dsh-mcp 1.1.0 → 1.3.0

package/CHANGELOG.en.md

@@ -7,6 +7,36 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.3.0] - 2026-08-16
+
+### Added
+
+- **Windows working-directory support**: stdio servers now accept drive-letter absolute paths for `cwd` (e.g. `C:\Users\...`, `C:/...`), consistent with POSIX `/` and UNC `\\` paths (PR #2, thanks @coding-chong)
+
+### Fixed
+
+- Form operations now surface the real error: save / delete / test-connection failures show `code: message` (e.g. `MCP_SERVER_NAME_CONFLICT: serverName "x" is already used...`) instead of a generic message, making failures diagnosable
+- Refresh is decoupled from save/delete: a `refresh()` failure no longer misreports the save/delete outcome — the editor stays open and shows the refresh failure reason (`refresh()` keeps its try/catch and returns a result)
+- Removed the now-unused `failureLocaleKey` dead code (error display shows `code: message` directly)
+
+## [1.2.0] - 2026-08-16
+
+### Added
+
+- **OAuth authentication**: `streamable-http` servers using MCP OAuth (authorization-code + PKCE) trigger browser authorization on connect; tokens are persisted (credentials document) and refreshed automatically by the SDK (auto-renewed while active within 24h) (`lib/oauth.js`)
+
+### Fixed
+
+- OAuth token credential-ref names collided with hyphens in server ids and failed credential validation (ref names only allow `[A-Za-z_][A-Za-z0-9_]*`): refs now use a sanitized server id plus a stable short hash, avoiding illegal characters and naming collisions
+- The interactive OAuth probe budget was raised from 90 seconds to 5 minutes: the first authorization requires browser login/approval, and slower-than-90s flows caused the probe to time out and report a false failure (the authorization had actually succeeded and tokens were saved); now the test result appears automatically once authorization completes
+- Disabled servers no longer render two "Disabled" badges (the phase badge plus a redundant caption)
+- The settings page primary buttons (Add/Save) and the "Connecting" badge used theme tokens that do not exist in the web shell, breaking their text color: switched to the shell's real theme tokens (`--dsw-alias-button-primary-fill` / `--dsw-alias-label-primary-foreground` / `--dsw-alias-brand-primary`)
+
+### Improved
+
+- While testing a streamable-http server, a hint explains that a browser authorization page may open and the result refreshes automatically after it is completed
+- After saving a server, the list refreshes itself on a delay so "Connecting" settles to "Connected" once the mount is live
+
 ## [1.1.0] - 2026-08-15
 
 ### Added

package/CHANGELOG.md

@@ -7,6 +7,36 @@
 格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## [1.3.0] - 2026-08-16
+
+### 新增
+
+- **Windows 工作目录支持**：stdio 服务器的 cwd 接受 Windows 盘符绝对路径（如 `C:\Users\...`、`C:/...`），与 POSIX `/`、UNC `\\` 路径一致（PR #2，感谢 @coding-chong）
+
+### 修复
+
+- 表单操作失败时展示真实错误信息：保存 / 删除 / 测试连接失败不再只显示笼统文案，直接展示 `code: message`（如 `MCP_SERVER_NAME_CONFLICT: serverName "x" is already used...`），便于定位问题
+- 刷新与保存/删除解耦：`refresh()` 失败不再误报保存结果，停留编辑页并显示刷新失败原因（`refresh()` 保留 try/catch 并返回结果）
+- 清理死代码：移除已无引用的 `failureLocaleKey`（错误展示改为直接显示 `code: message`）
+
+## [1.2.0] - 2026-08-16
+
+### 新增
+
+- **OAuth 认证支持**：`streamable-http` 服务器支持 MCP OAuth（授权码 + PKCE），连接时自动打开浏览器授权；token 持久化（凭据文档）并由 SDK 自动刷新（24 小时内活跃自动续期）（`lib/oauth.js`）
+
+### 修复
+
+- OAuth token 凭据引用名与服务器名中的连字符冲突导致 `resolve` 校验失败（凭据引用名仅允许 `[A-Za-z_][A-Za-z0-9_]*`）：引用名改为清洗后的服务器名 + 稳定哈希，避免非法字符与命名碰撞
+- OAuth 交互授权探测预算从 90 秒提升到 5 分钟：首次授权需在浏览器完成登录/同意，慢于 90 秒会导致探测提前超时并误报连接失败（授权其实已成功、token 已保存），现授权完成后测试结果会自动展示
+- 禁用状态的服务器不再重复展示两个「未启用」徽标（badge 与补充文案叠加）
+- 设置页 primary 按钮（添加/保存）与「连接中」徽标使用了不存在的主题 token，导致文字颜色异常：改用 web shell 真实主题 token（`--dsw-alias-button-primary-fill` / `--dsw-alias-label-primary-foreground` / `--dsw-alias-brand-primary`）
+
+### 优化
+
+- 测试连接（streamable-http）期间提示浏览器授权：若弹出授权页，完成授权后返回，结果自动刷新
+- 保存服务器后自动延迟刷新列表状态，挂载完成后「连接中」自动变为「已连接」
+
 ## [1.1.0] - 2026-08-15
 
 ### 新增

package/README.en.md

@@ -1,4 +1,4 @@
-# dsh-mcp — MCP server management plugin for DeepSeek Harness (standalone)
+# dsh-mcp — MCP management UI + tool search: stable tool list, cache hits, no context bloat
 
 [![dshfind](https://dshfind.com/api/badge/ArvinQi/dsh-mcp?lang=en)](https://dshfind.com/en/plugins/ArvinQi/dsh-mcp?ref=badge)
 
@@ -18,6 +18,7 @@
 - **Fine-grained tool control**: expand each server to see its tools, all checked by default; uncheck to load only what you need
 - **Two injection modes**: `search` (on-demand, token-saving) and `full` (inject everything)
 - **Zero npm dependencies**: plugs into DeepSeek Harness internals, install and go
+- **OAuth authentication**: for `streamable-http` servers using MCP OAuth (authorization-code + PKCE), the browser opens automatically for authorization on connect; tokens are persisted and refreshed automatically by the SDK (auto-renewed while active within 24h)
 - **Three install paths**: npm / GitHub git source / local link; bilingual UI and docs
 
 Migrated and merged from uncommitted MCP work in the `deepseek-harness` repository:
@@ -40,6 +41,10 @@ Migrated and merged from uncommitted MCP work in the `deepseek-harness` reposito
 - **Tool control**:
   - Injection mode: `search` (on-demand, default — the model hot-injects tools via `mcp_tool_search`) and `full` (inject every enabled tool each request).
   - Expandable per-server tool list, all checked by default; unchecking a tool keeps it out of injection. Changes take effect immediately.
+- **OAuth authentication** (host, `lib/oauth.js`): on a 401 + OAuth challenge from a `streamable-http`
+  server, runs the authorization-code + PKCE flow automatically — opens the browser, receives the
+  callback on a loopback server, persists tokens, and refreshes them on demand; test connection and
+  mounts share the same token.
 - **Remote self-mount**: the client half mounts the `mcpManager` Remote namespace itself via `ctx.remote.$mount()` in `apply()`,
   so no in-box package modification is required.
 - Zero npm runtime dependencies (`@deepseek-ai/*` resolve from the DSH profiles module fallback).
@@ -52,6 +57,7 @@ dsh-mcp/
 ├── lib/
 │   ├── index.js          host half (McpManagerService, built from mcp-manager)
 │   ├── mcp-client.js     vendored MCP client (from @deepseek-ai/dsh-mcp-client, with tool-list stability extension)
+│   ├── oauth.js          MCP OAuth client provider (authorization-code + PKCE, loopback callback, token persistence)
 │   ├── probe.js          vendored connection probe (from mcp-client/src/probe.ts)
 │   ├── transport.js      vendored transport factory (from mcp-client/src/transport.ts)
 │   └── client.js         browser half (esbuild bundle, ModuleLoader wire format)
@@ -124,6 +130,18 @@ Then **restart `dsh web`** (client roster changes require a restart); afterwards
    (`streamable-http` → URL / `stdio` → command), headers, tool-call timeout, etc.
 3. Click **Test connection** to verify connectivity and the tool list, then **Save**.
 
+**OAuth servers** (`streamable-http` using MCP OAuth, e.g. OAuth-protected gateway services):
+
+- Just fill in the URL and test the connection; when the server responds with a 401 + OAuth challenge,
+  the plugin **opens the browser automatically** for authorization.
+- Log in / approve in the browser and return to DSH; the test result refreshes automatically
+  ("connection succeeded + tool count").
+- Tokens are persisted in the credentials document (scoped by `serverName`) and refreshed automatically
+  by the MCP SDK (auto-renewed while active within 24h); after authorizing once, mounts and later
+  test connections reuse the same token — no repeated authorization.
+- The first authorization needs browser interaction, so the test/connect wait budget is relaxed to
+  5 minutes; non-OAuth servers are unaffected and fail fast.
+
 **Day-to-day management**:
 
 - **Enable / disable**: row button; disabling a server unregisters all of its tools immediately.

package/README.md

@@ -1,4 +1,4 @@
-# dsh-mcp — MCP 服务器管理插件（独立版）
+# dsh-mcp — MCP 管理界面 + tool search：稳定工具列表、命中缓存、不撑爆上下文
 
 **[English](README.en.md) | 简体中文**
 
@@ -20,6 +20,7 @@
 - **工具级精细控制**：每个服务器展开工具列表，默认全选，可取消勾选只加载需要的部分
 - **双注入模式**：`search`（按需检索，省 token）与 `full`（全量注入）
 - **零 npm 依赖**：直接对接 DeepSeek Harness 内部能力，安装即用
+- **OAuth 认证支持**：`streamable-http` 服务器若走 MCP OAuth（授权码 + PKCE），连接时自动打开浏览器授权；token 持久化、由 SDK 自动刷新（24 小时内活跃自动续期）
 - **三种安装方式**：npm / GitHub git 源 / 本地 link；中英文界面与文档
 
 ## 功能
@@ -28,6 +29,9 @@
   `@deepseek-ai/dsh-mcp-client` 实例、环境变量注入（明文入定义、secret 走 credentials）、
   连接探测（test）。
 - **Web 设置管理页**（client）：Settings → MCP，列表/编辑/删除/测试服务器。
+- **OAuth 认证**（host，`lib/oauth.js`）：`streamable-http` 服务器遇 401 + OAuth 挑战时自动走
+  授权码 + PKCE 流程，打开浏览器授权、回环回调收码、token 持久化并按需自动刷新；
+  测试连接与挂载共用同一份 token。
 - **Remote 自挂载**：client 半部在 `apply()` 里自行 `ctx.remote.$mount()` 挂载 `mcpManager`
   命名空间（原实现依赖 api-remotes 的 in-box 修改，独立版不再需要任何 in-box 包改动）。
 
@@ -39,6 +43,7 @@ dsh-mcp/
 ├── lib/
 │   ├── index.js          host 半部（McpManagerService，源自 mcp-manager 构建产物）
 │   ├── mcp-client.js     vendored MCP 客户端（源自 @deepseek-ai/dsh-mcp-client，含工具列表稳定扩展）
+│   ├── oauth.js          MCP OAuth 客户端提供者（授权码 + PKCE、回环回调、token 持久化）
 │   ├── probe.js          vendored 连接探测（源自 mcp-client/src/probe.ts）
 │   ├── transport.js      vendored 传输工厂（源自 mcp-client/src/transport.ts）
 │   └── client.js         浏览器半部（esbuild 打包，ModuleLoader wire format）
@@ -112,6 +117,14 @@ dsh plugin --profile web add link:<本仓库绝对路径>
    （`streamable-http` 填 URL / `stdio` 填命令）、请求头、工具调用超时等
 3. 点「测试连接」确认连通性与工具列表，点「保存」
 
+**OAuth 服务器**（`streamable-http` 走 MCP OAuth，如受 OAuth 保护的网关服务）：
+
+- 只需正常填写 URL 并测试连接；服务器返回 401 + OAuth 挑战时，插件**自动打开浏览器**完成授权
+- 在浏览器中登录/同意后返回 DSH，测试结果自动刷新（「连接成功 + 工具数」）
+- token 持久化在凭据文档（按 `serverName` 隔离），由 MCP SDK 自动刷新（24 小时内活跃自动续期）；
+  授权一次后，挂载连接与后续测试连接复用同一份 token，无需重复授权
+- 首次授权需浏览器交互，测试/连接等待时间放宽至 5 分钟；非 OAuth 服务器不受影响，连接失败即时返回
+
 **日常管理**：
 
 - **启用 / 禁用**：列表行按钮，禁用后该服务器所有工具即时注销，不再注入

package/lib/client.js

@@ -14905,7 +14905,9 @@ function emptyDraft() {
     headersText: "",
     env: [],
     toolCallTimeoutMs: String(DEFAULT_TOOL_CALL_TIMEOUT_MS),
-    failOnStartupError: false
+    // Reject the mount by default when the startup connection fails, so a
+    // broken server never registers stale tools.
+    failOnStartupError: true
   };
 }
 function draftFromServer(server) {
@@ -15024,7 +15026,7 @@ function createMcpManagerStore() {
       const style = document.createElement("style");
       style.setAttribute("data-plugin", "dsh-mcp");
       style.setAttribute("data-file", "ServerForm.module.css");
-      style.textContent = ".form {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n  width: 100%;\n  max-width: 760px;\n  color: var(--dsw-alias-label-primary);\n}\n\n.titleRow {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n}\n\n.title {\n  margin: 0;\n  font-size: 15px;\n  line-height: 22px;\n  font-weight: 600;\n}\n\n.titleActions {\n  display: flex;\n  gap: 8px;\n}\n\nbutton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  line-height: 20px;\n  cursor: pointer;\n}\n\nbutton:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\nbutton:focus-visible {\n  outline: 2px solid var(--dsw-alias-state-business-primary);\n  outline-offset: 1px;\n}\n\nbutton:disabled {\n  cursor: not-allowed;\n  opacity: 0.55;\n}\n\n.primary {\n  border-color: var(--dsw-alias-state-business-primary);\n  background: var(--dsw-alias-state-business-primary);\n  color: var(--dsw-alias-label-on-accent);\n}\n\n.primary:hover {\n  background: var(--dsw-alias-state-business-primary-hover);\n}\n\n.danger {\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.error {\n  margin: 0;\n  color: var(--dsw-alias-state-error-primary);\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.field {\n  display: flex;\n  flex-direction: column;\n  gap: 5px;\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.field input,\n.field select,\n.field textarea {\n  width: 100%;\n  box-sizing: border-box;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  padding: 6px 10px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  resize: vertical;\n}\n\n.field input::placeholder,\n.field textarea::placeholder {\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.field input:focus-visible,\n.field select:focus-visible,\n.field textarea:focus-visible {\n  border-color: var(--dsw-alias-state-business-primary);\n  box-shadow: 0 0 0 2px color-mix(in srgb, var(--dsw-alias-state-business-primary) 18%, transparent);\n}\n\n.envBlock {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 10px 12px 12px;\n  margin: 0;\n}\n\n.envBlock legend {\n  padding: 0 4px;\n  font-size: 13px;\n  line-height: 20px;\n  font-weight: 600;\n}\n\n.hint,\n.muted {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.envRow {\n  display: grid;\n  grid-template-columns: minmax(0, 1.2fr) minmax(0, 1.6fr) auto auto;\n  align-items: center;\n  gap: 8px;\n}\n\n.envRow input {\n  box-sizing: border-box;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 8px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n}\n\n.secretToggle {\n  display: inline-flex;\n  align-items: center;\n  gap: 4px;\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  line-height: 18px;\n  white-space: nowrap;\n  cursor: pointer;\n}\n\n.checkRow {\n  display: inline-flex;\n  align-items: center;\n  gap: 8px;\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-secondary);\n  cursor: pointer;\n}\n\n.testResult {\n  margin: 0;\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.testOk {\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.testFail {\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.actions {\n  display: flex;\n  justify-content: flex-end;\n  gap: 8px;\n}\n";
+      style.textContent = ".form {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n  width: 100%;\n  max-width: 760px;\n  color: var(--dsw-alias-label-primary);\n}\n\n.titleRow {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n}\n\n.title {\n  margin: 0;\n  font-size: 15px;\n  line-height: 22px;\n  font-weight: 600;\n}\n\n.titleActions {\n  display: flex;\n  gap: 8px;\n}\n\nbutton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  line-height: 20px;\n  cursor: pointer;\n}\n\nbutton:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\nbutton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\nbutton:disabled {\n  cursor: not-allowed;\n  opacity: 0.55;\n}\n\n.primary {\n  border-color: var(--dsw-alias-button-primary-fill);\n  background: var(--dsw-alias-button-primary-fill);\n  color: var(--dsw-alias-label-primary-foreground);\n}\n\n.primary:hover {\n  background: var(--dsw-alias-button-primary-hover);\n}\n\n.danger {\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.error {\n  margin: 0;\n  color: var(--dsw-alias-state-error-primary);\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.field {\n  display: flex;\n  flex-direction: column;\n  gap: 5px;\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.field input,\n.field select,\n.field textarea {\n  width: 100%;\n  box-sizing: border-box;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 8px;\n  padding: 6px 10px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  resize: vertical;\n}\n\n.field input::placeholder,\n.field textarea::placeholder {\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.field input:focus-visible,\n.field select:focus-visible,\n.field textarea:focus-visible {\n  border-color: var(--dsw-alias-brand-primary);\n  box-shadow: 0 0 0 2px color-mix(in srgb, var(--dsw-alias-brand-primary) 18%, transparent);\n}\n\n.envBlock {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 10px 12px 12px;\n  margin: 0;\n}\n\n.envBlock legend {\n  padding: 0 4px;\n  font-size: 13px;\n  line-height: 20px;\n  font-weight: 600;\n}\n\n.hint,\n.muted {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.envRow {\n  display: grid;\n  grid-template-columns: minmax(0, 1.2fr) minmax(0, 1.6fr) auto auto;\n  align-items: center;\n  gap: 8px;\n}\n\n.envRow input {\n  box-sizing: border-box;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 8px;\n  outline: none;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n}\n\n.secretToggle {\n  display: inline-flex;\n  align-items: center;\n  gap: 4px;\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  line-height: 18px;\n  white-space: nowrap;\n  cursor: pointer;\n}\n\n.checkRow {\n  display: inline-flex;\n  align-items: center;\n  gap: 8px;\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-secondary);\n  cursor: pointer;\n}\n\n.testResult {\n  margin: 0;\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.testOk {\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.testFail {\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.actions {\n  display: flex;\n  justify-content: flex-end;\n  gap: 8px;\n}\n";
       document.head.appendChild(style);
     }
   }
@@ -15034,7 +15036,7 @@ var ServerForm_default = { "form": "form", "titleRow": "titleRow", "title": "tit
 // src/client/ServerForm.tsx
 var import_jsx_runtime = require("react/jsx-runtime");
 function McpServerForm(props) {
-  const { draft, busy, testRunning, test, t, actions, injected } = props;
+  const { draft, busy, testRunning, test, t, actions, injected, onSaved } = props;
   const [saveError, setSaveError] = (0, import_react.useState)(null);
   const update = (patch) => {
     setSaveError(null);
@@ -15049,13 +15051,16 @@ function McpServerForm(props) {
   const addEnvRow = () => {
     update({ env: [...draft.env, createEnvRowDraft()] });
   };
+  const errorText = (error51) => error51 instanceof Error ? error51.message : String(error51);
   const runTest = async () => {
     setSaveError(null);
     actions.setTestRunning(true);
     try {
       actions.setTest(await injected.test(draft));
-    } catch {
+    } catch (error51) {
+      console.error("[dsh-mcp] test failed:", error51);
       actions.setTest(null);
+      setSaveError(errorText(error51));
     } finally {
       actions.setTestRunning(false);
     }
@@ -15066,13 +15071,15 @@ function McpServerForm(props) {
     try {
       const failure = await injected.save(draft);
       if (failure !== null) {
-        setSaveError(failure.message);
+        setSaveError(`${failure.code}: ${failure.message}`);
         return;
       }
-      await refresh();
+      if (!await refresh()) return;
       actions.cancelEdit();
-    } catch {
-      setSaveError(t("failureTitle"));
+      onSaved?.();
+    } catch (error51) {
+      console.error("[dsh-mcp] save failed:", error51);
+      setSaveError(errorText(error51));
     } finally {
       actions.setBusy(null);
     }
@@ -15084,13 +15091,14 @@ function McpServerForm(props) {
     try {
       const failure = await injected.remove(draft.id);
       if (failure !== null) {
-        setSaveError(failure.message);
+        setSaveError(`${failure.code}: ${failure.message}`);
         return;
       }
-      await refresh();
+      if (!await refresh()) return;
       actions.cancelEdit();
-    } catch {
-      setSaveError(t("failureTitle"));
+    } catch (error51) {
+      console.error("[dsh-mcp] remove failed:", error51);
+      setSaveError(errorText(error51));
     } finally {
       actions.setBusy(null);
     }
@@ -15098,7 +15106,11 @@ function McpServerForm(props) {
   const refresh = async () => {
     try {
       actions.setServers(await injected.list());
-    } catch {
+      return true;
+    } catch (error51) {
+      console.error("[dsh-mcp] refresh failed:", error51);
+      setSaveError(errorText(error51));
+      return false;
     }
   };
   const stdio = draft.transport === "stdio";
@@ -15285,6 +15297,7 @@ function McpServerForm(props) {
       t("enabled")
     ] }),
     test !== null ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: `${ServerForm_default.testResult} ${probe !== void 0 && probe.ok ? ServerForm_default.testOk : ServerForm_default.testFail}`, role: "status", children: probe !== void 0 && probe.ok ? `${t("testOk")} (${probe.tools.length} ${t("toolCount")}, ${test.elapsedMs}ms)` : probe !== void 0 && !probe.ok ? `${t("testFail")}: ${probe.message}` : t("testUnknown") }) : null,
+    testRunning && draft.transport === "streamable-http" ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: ServerForm_default.muted, role: "status", children: t("testBrowserHint") }) : null,
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: ServerForm_default.actions, children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", disabled: testRunning || busy !== null, onClick: () => void runTest(), children: testRunning ? t("testRunning") : t("test") }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "submit", className: ServerForm_default.primary, disabled: busy !== null || testRunning, children: busy === "save" ? t("saving") : t("save") }),
@@ -15301,7 +15314,7 @@ function McpServerForm(props) {
       const style = document.createElement("style");
       style.setAttribute("data-plugin", "dsh-mcp");
       style.setAttribute("data-file", "McpSettingsSection.module.css");
-      style.textContent = ".section {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n  width: 100%;\n  max-width: 760px;\n  color: var(--dsw-alias-label-primary);\n}\n\n.header {\n  display: flex;\n  align-items: center;\n  justify-content: flex-end;\n}\n\n.status,\n.failure p {\n  margin: 0;\n}\n\n.status,\n.failure {\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.failure {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  color: var(--dsw-alias-state-error-primary);\n}\n\nbutton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  line-height: 20px;\n  cursor: pointer;\n}\n\nbutton:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\nbutton:focus-visible {\n  outline: 2px solid var(--dsw-alias-state-business-primary);\n  outline-offset: 1px;\n}\n\nbutton:disabled {\n  cursor: not-allowed;\n  opacity: 0.55;\n}\n\n.primary {\n  border-color: var(--dsw-alias-state-business-primary);\n  background: var(--dsw-alias-state-business-primary);\n  color: var(--dsw-alias-label-on-accent);\n}\n\n.primary:hover {\n  background: var(--dsw-alias-state-business-primary-hover);\n}\n\n.list {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin: 0;\n  padding: 0;\n  list-style: none;\n}\n\n.row {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 10px 14px;\n  background: var(--dsw-alias-bg-layer-3);\n}\n\n.rowMain {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n  min-width: 0;\n}\n\n.rowTitle {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  min-width: 0;\n}\n\n.serverName {\n  overflow: hidden;\n  font-size: 14px;\n  line-height: 20px;\n  font-weight: 600;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n\n.badge {\n  display: inline-flex;\n  align-items: center;\n  min-height: 18px;\n  border-radius: 5px;\n  padding: 1px 6px;\n  font-size: 11px;\n  line-height: 16px;\n  white-space: nowrap;\n}\n\n.badge.mounting {\n  background: color-mix(in srgb, var(--dsw-alias-state-business-primary) 12%, transparent);\n  color: var(--dsw-alias-state-business-primary);\n}\n\n.badge.live {\n  background: color-mix(in srgb, var(--dsw-alias-state-success-primary) 12%, transparent);\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.badge.failed {\n  background: color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent);\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.badge.stopped {\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.muted {\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.rowMeta {\n  display: flex;\n  gap: 14px;\n  color: var(--dsw-alias-label-tertiary);\n  font-size: 12px;\n  line-height: 18px;\n  font-variant-numeric: tabular-nums;\n}\n\n.rowActions {\n  flex: none;\n}\n\n.card {\n  display: flex;\n  flex-direction: column;\n  gap: 0;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-3);\n}\n\n.card > .row {\n  border: 0;\n  border-radius: 0;\n  background: transparent;\n}\n\n.modeRow {\n  display: flex;\n  align-items: center;\n  gap: 18px;\n  flex-wrap: wrap;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 8px 14px;\n  background: var(--dsw-alias-bg-layer-3);\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.modeLabel {\n  font-weight: 600;\n}\n\n.modeOption {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  cursor: pointer;\n}\n\n.modeHint {\n  margin: 0;\n  color: var(--dsw-alias-label-tertiary);\n  font-size: 12px;\n  line-height: 18px;\n}\n\n.toolPanel {\n  border-top: 1px solid var(--dsw-alias-border-l2);\n  padding: 10px 14px;\n}\n\n.toolGrid {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(230px, 1fr));\n  gap: 4px 14px;\n  max-height: 320px;\n  overflow-y: auto;\n}\n\n.toolRow {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  min-width: 0;\n  padding: 2px 0;\n  font-size: 12px;\n  line-height: 18px;\n  cursor: pointer;\n}\n\n.toolName {\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n";
+      style.textContent = ".section {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n  width: 100%;\n  max-width: 760px;\n  color: var(--dsw-alias-label-primary);\n}\n\n.header {\n  display: flex;\n  align-items: center;\n  justify-content: flex-end;\n}\n\n.status,\n.failure p {\n  margin: 0;\n}\n\n.status,\n.failure {\n  font-size: 13px;\n  line-height: 20px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.failure {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  color: var(--dsw-alias-state-error-primary);\n}\n\nbutton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  padding: 5px 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font: inherit;\n  font-size: 13px;\n  line-height: 20px;\n  cursor: pointer;\n}\n\nbutton:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\nbutton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\nbutton:disabled {\n  cursor: not-allowed;\n  opacity: 0.55;\n}\n\n.primary {\n  border-color: var(--dsw-alias-button-primary-fill);\n  background: var(--dsw-alias-button-primary-fill);\n  color: var(--dsw-alias-label-primary-foreground);\n}\n\n.primary:hover {\n  background: var(--dsw-alias-button-primary-hover);\n}\n\n.list {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin: 0;\n  padding: 0;\n  list-style: none;\n}\n\n.row {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 10px 14px;\n  background: var(--dsw-alias-bg-layer-3);\n}\n\n.rowMain {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n  min-width: 0;\n}\n\n.rowTitle {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  min-width: 0;\n}\n\n.serverName {\n  overflow: hidden;\n  font-size: 14px;\n  line-height: 20px;\n  font-weight: 600;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n\n.badge {\n  display: inline-flex;\n  align-items: center;\n  min-height: 18px;\n  border-radius: 5px;\n  padding: 1px 6px;\n  font-size: 11px;\n  line-height: 16px;\n  white-space: nowrap;\n}\n\n.badge.mounting {\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 12%, transparent);\n  color: var(--dsw-alias-brand-primary);\n}\n\n.badge.live {\n  background: color-mix(in srgb, var(--dsw-alias-state-success-primary) 12%, transparent);\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.badge.failed {\n  background: color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent);\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.badge.stopped {\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.muted {\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.rowMeta {\n  display: flex;\n  gap: 14px;\n  color: var(--dsw-alias-label-tertiary);\n  font-size: 12px;\n  line-height: 18px;\n  font-variant-numeric: tabular-nums;\n}\n\n.rowActions {\n  flex: none;\n}\n\n.card {\n  display: flex;\n  flex-direction: column;\n  gap: 0;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-3);\n}\n\n.card > .row {\n  border: 0;\n  border-radius: 0;\n  background: transparent;\n}\n\n.modeRow {\n  display: flex;\n  align-items: center;\n  gap: 18px;\n  flex-wrap: wrap;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 10px;\n  padding: 8px 14px;\n  background: var(--dsw-alias-bg-layer-3);\n  font-size: 13px;\n  line-height: 20px;\n}\n\n.modeLabel {\n  font-weight: 600;\n}\n\n.modeOption {\n  display: inline-flex;\n  align-items: center;\n  gap: 6px;\n  cursor: pointer;\n}\n\n.modeHint {\n  margin: 0;\n  color: var(--dsw-alias-label-tertiary);\n  font-size: 12px;\n  line-height: 18px;\n}\n\n.toolPanel {\n  border-top: 1px solid var(--dsw-alias-border-l2);\n  padding: 10px 14px;\n}\n\n.toolGrid {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(230px, 1fr));\n  gap: 4px 14px;\n  max-height: 320px;\n  overflow-y: auto;\n}\n\n.toolRow {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  min-width: 0;\n  padding: 2px 0;\n  font-size: 12px;\n  line-height: 18px;\n  cursor: pointer;\n}\n\n.toolName {\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n";
       document.head.appendChild(style);
     }
   }
@@ -15517,7 +15530,12 @@ function McpSettingsSection(props) {
         test: state.test,
         t,
         actions,
-        injected: { save, remove, test, list }
+        injected: { save, remove, test, list },
+        onSaved: () => {
+          const serverName = state.draft.serverName;
+          timersRef.current.push(window.setTimeout(() => refreshServer(serverName), 2e3));
+          timersRef.current.push(window.setTimeout(() => refreshServer(serverName), 6e3));
+        }
       }
     );
   }
@@ -15561,7 +15579,7 @@ function McpSettingsSection(props) {
             /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: McpSettingsSection_default.rowTitle, children: [
               /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: McpSettingsSection_default.serverName, children: server.serverName }),
               /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: `${McpSettingsSection_default.badge} ${McpSettingsSection_default[server.status.phase]}`, children: t(phaseKey(server.status.phase)) }),
-              !server.enabled ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: McpSettingsSection_default.muted, children: t("statusStopped") }) : null
+              !server.enabled && server.status.phase !== "stopped" ? /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { className: McpSettingsSection_default.muted, children: t("statusStopped") }) : null
             ] }),
             /* @__PURE__ */ (0, import_jsx_runtime2.jsxs)("div", { className: McpSettingsSection_default.rowMeta, children: [
               /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { children: server.transport }),
@@ -15643,6 +15661,7 @@ var zh = {
   edit: "\u7F16\u8F91",
   test: "\u6D4B\u8BD5\u8FDE\u63A5",
   testRunning: "\u6B63\u5728\u6D4B\u8BD5\u2026",
+  testBrowserHint: "\u6B63\u5728\u6D4B\u8BD5\u2026\u82E5\u5F39\u51FA\u6D4F\u89C8\u5668\u6388\u6743\u9875\uFF0C\u8BF7\u5B8C\u6210\u6388\u6743\u540E\u8FD4\u56DE\uFF0C\u7ED3\u679C\u4F1A\u81EA\u52A8\u5237\u65B0\u3002",
   testOk: "\u8FDE\u63A5\u6210\u529F",
   testFail: "\u8FDE\u63A5\u5931\u8D25",
   testUnknown: "\u672A\u77E5\u7ED3\u679C",
@@ -15715,6 +15734,7 @@ var en = {
   edit: "Edit",
   test: "Test connection",
   testRunning: "Testing\u2026",
+  testBrowserHint: "Testing\u2026 if a browser authorization page opens, complete it and return; the result refreshes automatically.",
   testOk: "Connection succeeded",
   testFail: "Connection failed",
   testUnknown: "Unknown result",

package/lib/index.js

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import { Service } from "@deepseek-ai/cordis";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import * as mcpClient from "./mcp-client.js";
+import { createOAuthProvider } from "./oauth.js";
 import { probeConnection } from "./probe.js";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import z from "@deepseek-ai/schemastery";
@@ -66,19 +67,7 @@ const mcpServersDomainSpec = defineDomain({
 				message: "streamable-http requires an absolute http(s) URL"
 			});
 		}
-		const headerNames = /* @__PURE__ */ new Set();
-		row.headers.forEach((header, index) => {
-			if (headerNames.has(header.name)) ctx.addIssue({
-				code: "custom",
-				path: [
-					"headers",
-					index,
-					"name"
-				],
-				message: `duplicate header '${header.name}'`
-			});
-			headerNames.add(header.name);
-		});
+		// Same-name custom headers are allowed (matches other MCP clients).
 		const envNames = /* @__PURE__ */ new Set();
 		row.env.forEach((entry, index) => {
 			if (envNames.has(entry.name)) ctx.addIssue({
@@ -116,7 +105,7 @@ function validateServerInput(server, env) {
 	if (!serverNameSchema.safeParse(server.serverName).success) throw new McpServerValidationError("serverName must match [A-Za-z0-9_-]{1,32}");
 	if (server.transport === "stdio") {
 		if (server.command.trim().length === 0) throw new McpServerValidationError("stdio transport requires a command");
-		if (server.cwd.length > 0 && !/^[/\\]/.test(server.cwd)) throw new McpServerValidationError("cwd must be an absolute path or empty");
+		if (server.cwd.length > 0 && !/^(?:[A-Za-z]:[\\/]|[/\\])/.test(server.cwd)) throw new McpServerValidationError("cwd must be an absolute path or empty");
 	} else try {
 		const parsed = new URL(server.url);
 		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error("non-http protocol");
@@ -124,11 +113,10 @@ function validateServerInput(server, env) {
 		throw new McpServerValidationError("streamable-http requires an absolute http(s) URL");
 	}
 	if (!Number.isInteger(server.toolCallTimeoutMs) || server.toolCallTimeoutMs <= 0) throw new McpServerValidationError("toolCallTimeoutMs must be a positive integer");
-	const headerNames = /* @__PURE__ */ new Set();
+	// Custom headers pass through unvalidated (same-name headers are allowed,
+	// matching other MCP clients); only a blank name is rejected.
 	for (const header of server.headers) {
 		if (header.name.trim().length === 0) throw new McpServerValidationError("header names must not be blank");
-		if (headerNames.has(header.name)) throw new McpServerValidationError(`duplicate header '${header.name}'`);
-		headerNames.add(header.name);
 	}
 	const envNames = /* @__PURE__ */ new Set();
 	for (const entry of env) {
@@ -477,7 +465,13 @@ let McpManagerService = (() => {
 				let handle;
 				try {
 					const env = await this.resolveEnv(row);
-					handle = this.ctx.plugin(MCP_CLIENT_PLUGIN, this.toClientConfig(row, env));
+					// Every server gets an OAuth provider: servers that require
+					// OAuth (authorization-code flow) trigger browser auth on
+					// connect; servers that do not are unaffected. Tokens are
+					// keyed by serverName so a test-connection authorization is
+					// reused by the mount.
+					const authProvider = createOAuthProvider(row.serverName, this.ctx);
+					handle = this.ctx.plugin(MCP_CLIENT_PLUGIN, { ...this.toClientConfig(row, env), authProvider });
 				} catch (error) {
 					entry.phase = "failed";
 					entry.error = errorText(error);
@@ -691,7 +685,13 @@ let McpManagerService = (() => {
 				}
 			} else if (entry.value !== void 0) env[entry.name] = entry.value;
 			const startedAt = Date.now();
-			const probe = await probeConnection(this.toClientConfig(request.server, env), { timeoutMs: this.probeTimeoutMs });
+			// Test connection also supports OAuth: an OAuth-protected server
+			// opens the browser for authorization and the probe continues after
+			// tokens are stored (keyed by serverName, matching the mount path).
+			const probe = await probeConnection(this.toClientConfig(request.server, env), {
+				timeoutMs: this.probeTimeoutMs,
+				authProvider: createOAuthProvider(request.server.serverName, this.ctx)
+			});
 			const elapsedMs = Date.now() - startedAt;
 			return {
 				ok: true,

package/lib/mcp-client.js

@@ -42,7 +42,10 @@ function createTransport(config) {
 			env: buildChildEnv(config.env),
 			cwd: config.cwd
 		});
-		case "streamable-http": return new StreamableHTTPClientTransport(new URL(config.url), { requestInit: { headers: config.headers } });
+		case "streamable-http": return new StreamableHTTPClientTransport(new URL(config.url), {
+			requestInit: { headers: config.headers },
+			...(config.authProvider === void 0 ? {} : { authProvider: config.authProvider })
+		});
 	}
 }
 //#endregion
@@ -476,7 +479,10 @@ function startConnection(ctx, config, policy) {
 		const generation = new Client({
 			name: "dsh-mcp-client",
 			version: "0.0.1"
-		}, { capabilities: {} });
+		}, {
+			capabilities: {},
+			...(opts.authProvider === void 0 ? {} : { authProvider: opts.authProvider })
+		});
 		const closed = Promise.withResolvers();
 		let attemptSettled = false;
 		let closeObserved = false;

package/lib/oauth.js

@@ -0,0 +1,155 @@
+/**
+ * OAuth 2.0 (authorization-code + PKCE) client provider for MCP servers,
+ * implemented for the dsh-mcp host half.
+ *
+ * The MCP SDK drives the flow (metadata discovery, dynamic client registration,
+ * PKCE, token refresh) and only asks this provider to: persist tokens, and
+ * redirect the user agent to the authorization URL. This provider opens the
+ * system browser, hosts a loopback callback server, exchanges the returned
+ * code for tokens via the SDK, and stores them in the credentials document
+ * (per server id), so reconnects reuse the tokens and the SDK refreshes them
+ * transparently.
+ */
+
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import {
+  discoverAuthorizationServerMetadata,
+  exchangeAuthorization,
+} from "@modelcontextprotocol/sdk/client/auth.js";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+
+/** Credential reference namespace prefix for per-server OAuth tokens. */
+const OAUTH_REF_PREFIX = "DSH_MCP_OAUTH_";
+
+/** Short stable hash so sanitized server ids cannot collide. */
+function shortHash(value) {
+  let hash = 0;
+  for (let i = 0; i < value.length; i += 1) {
+    hash = (hash * 31 + value.charCodeAt(i)) >>> 0;
+  }
+  return hash.toString(36);
+}
+
+/**
+ * One server's OAuth token credential reference.
+ *
+ * Credential ref names must match /^[A-Za-z_][A-Za-z0-9_]*$/, but managed
+ * server ids may contain hyphens, slashes, spaces, etc.; sanitize the id and
+ * append a short stable hash of the original so distinct ids cannot collide
+ * (e.g. "a-b" and "a_b").
+ */
+function oauthTokenRef(serverId) {
+  const safe = serverId.replace(/[^A-Za-z0-9_]/g, "_");
+  return credentialRef(`${OAUTH_REF_PREFIX}${safe}_${shortHash(serverId)}`);
+}
+
+/** Open the system browser to one URL, best effort. */
+function openBrowser(url) {
+  const command =
+    process.platform === "darwin" ? "open"
+    : process.platform === "win32" ? "start"
+    : "xdg-open";
+  const child = spawn(command, [url], { detached: true, stdio: "ignore" });
+  child.on("error", () => {});
+  child.unref();
+}
+
+/**
+ * Build one OAuthClientProvider for a managed server.
+ * @param serverId - Managed server id; keys the stored token.
+ * @param ctx - Host context carrying the credentials service.
+ * @returns an MCP SDK `OAuthClientProvider` implementation.
+ */
+export function createOAuthProvider(serverId, ctx) {
+  let codeVerifierValue = null;
+  let savedClientInfo = null;
+  const port = 3100 + Math.floor(Math.random() * 20000);
+  const redirectUrl = `http://127.0.0.1:${port}/callback`;
+  const log = ctx?.logger ?? console;
+  const tag = `mcp-oauth(${serverId})`;
+
+  return {
+    get redirectUrl() {
+      return redirectUrl;
+    },
+    clientMetadata: {
+      client_name: "dsh-mcp",
+      redirect_uris: [redirectUrl],
+    },
+    async clientInformation() {
+      return savedClientInfo;
+    },
+    async saveClientInformation(info) {
+      savedClientInfo = info;
+    },
+    async tokens() {
+      const hit = await ctx.credentials.resolve(oauthTokenRef(serverId));
+      if (hit === undefined) return undefined;
+      try {
+        return JSON.parse(hit.value);
+      } catch {
+        return undefined;
+      }
+    },
+    async saveTokens(tokens) {
+      await ctx.credentials.set(oauthTokenRef(serverId), JSON.stringify(tokens));
+    },
+    async clearTokens() {
+      await ctx.credentials.unset(oauthTokenRef(serverId));
+    },
+    async saveCodeVerifier(codeVerifier) {
+      codeVerifierValue = codeVerifier;
+    },
+    async codeVerifier() {
+      return codeVerifierValue;
+    },
+    async redirectToAuthorization(authorizationUrl) {
+      let resolveResult;
+      const resultPromise = new Promise((resolve) => {
+        resolveResult = resolve;
+      });
+      const server = createServer((req, res) => {
+        const url = new URL(req.url, redirectUrl);
+        const code = url.searchParams.get("code");
+        const error = url.searchParams.get("error");
+        res.setHeader("content-type", "text/html; charset=utf-8");
+        if (error) {
+          res.end(`授权失败：${error}，可关闭此页面并返回 DSH。`);
+          log.error(`${tag}: callback rejected: ${error}`);
+          resolveResult({ error });
+          return;
+        }
+        res.end("授权成功，可关闭此页面并返回 DSH。");
+        log.info(`${tag}: authorization callback received (code)`);
+        resolveResult({ code });
+      });
+      await new Promise((resolve) => server.listen(port, "127.0.0.1", resolve));
+      log.info(`${tag}: opening browser for authorization: ${authorizationUrl}`);
+      openBrowser(authorizationUrl.toString());
+      try {
+        const result = await resultPromise;
+        if (result.error) throw new Error(`OAuth 授权失败：${result.error}`);
+        const authServerUrl = new URL(authorizationUrl.origin);
+        log.info(`${tag}: discovering authorization server metadata at ${authServerUrl}`);
+        const metadata = await discoverAuthorizationServerMetadata(authServerUrl);
+        log.info(`${tag}: exchanging authorization code for tokens`);
+        const tokens = await exchangeAuthorization(authServerUrl, {
+          metadata,
+          clientInformation: savedClientInfo,
+          authorizationCode: result.code,
+          codeVerifier: codeVerifierValue,
+          redirectUri: redirectUrl,
+        });
+        await this.saveTokens(tokens);
+        log.info(`${tag}: tokens saved`);
+      } catch (error) {
+        log.error(`${tag}: OAuth exchange failed: ${error instanceof Error ? error.message : String(error)}`);
+        throw error;
+      } finally {
+        server.close();
+        log.info(`${tag}: callback server closed`);
+      }
+    },
+  };
+}

package/lib/probe.js

@@ -29,16 +29,33 @@ async function probeConnection(config, options = {}) {
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
     throw new Error(`probeConnection: timeoutMs must be a positive finite number, received ${String(timeoutMs)}`);
   }
+  // OAuth authorization is interactive (browser login), so a probe with an
+  // auth provider gets a generous budget; plain servers connect or fail
+  // immediately and never wait out the budget. 5 minutes covers slow SSO
+  // login + approval screens; an exhausted budget reports a failure view and
+  // the loopback callback keeps running, so a late authorization still stores
+  // the tokens and the next probe succeeds.
+  const OAUTH_PROBE_BUDGET_MS = 5 * 60e3;
+  const budgetMs = options.authProvider === void 0 ? timeoutMs : Math.max(timeoutMs, OAUTH_PROBE_BUDGET_MS);
   const client = new Client(
     { name: "dsh-mcp-client", version: "0.0.1" },
-    { capabilities: {} }
+    {
+      capabilities: {},
+      ...(options.authProvider === void 0 ? {} : { authProvider: options.authProvider })
+    }
   );
   const timeout = new Promise((_, reject) => {
-    const timer = setTimeout(() => reject(new Error(`connection probe timed out after ${timeoutMs}ms`)), timeoutMs);
+    const timer = setTimeout(() => reject(new Error(`connection probe timed out after ${budgetMs}ms`)), budgetMs);
     timer.unref();
   });
   try {
-    return await Promise.race([runProbe(client, config), timeout]);
+    // The SDK performs OAuth in the transport layer, so the authProvider must
+    // reach the transport config (not only the Client options).
+    const transportConfig = {
+      ...config,
+      ...(options.authProvider === void 0 ? {} : { authProvider: options.authProvider })
+    };
+    return await Promise.race([runProbe(client, transportConfig), timeout]);
   } catch (error) {
     return { ok: false, message: probeErrorMessage(error) };
   } finally {

package/lib/transport.js

@@ -16,7 +16,10 @@ function createTransport(config) {
     case "streamable-http":
       return new StreamableHTTPClientTransport(
         new URL(config.url),
-        { requestInit: { headers: config.headers } }
+        {
+          requestInit: { headers: config.headers },
+          ...(config.authProvider === void 0 ? {} : { authProvider: config.authProvider })
+        }
       );
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-mcp",
-  "version": "1.1.0",
-  "description": "MCP 服务器管理插件：可视化界面管理 MCP 服务器与工具（配置/启停/刷新/测试、工具级勾选），支持按需检索（tool search）热注入，省 token。DeepSeek Harness plugin: visual MCP server & tool management with on-demand tool search injection.",
+  "version": "1.3.0",
+  "description": "MCP 管理界面 + tool search：可视化配置/启停/刷新 MCP 服务器与工具勾选，按需检索（tool search）热注入；工具列表稳定命中缓存、不撑爆上下文。DeepSeek Harness plugin: MCP management UI + tool search — stable tool list, cache-friendly, no context bloat.",
   "type": "module",
   "main": "lib/index.js",
   "exports": {

package/src/client/McpSettingsSection.module.css

@@ -49,7 +49,7 @@ button:hover {
 }
 
 button:focus-visible {
-  outline: 2px solid var(--dsw-alias-state-business-primary);
+  outline: 2px solid var(--dsw-alias-brand-primary);
   outline-offset: 1px;
 }
 
@@ -59,13 +59,13 @@ button:disabled {
 }
 
 .primary {
-  border-color: var(--dsw-alias-state-business-primary);
-  background: var(--dsw-alias-state-business-primary);
-  color: var(--dsw-alias-label-on-accent);
+  border-color: var(--dsw-alias-button-primary-fill);
+  background: var(--dsw-alias-button-primary-fill);
+  color: var(--dsw-alias-label-primary-foreground);
 }
 
 .primary:hover {
-  background: var(--dsw-alias-state-business-primary-hover);
+  background: var(--dsw-alias-button-primary-hover);
 }
 
 .list {
@@ -123,8 +123,8 @@ button:disabled {
 }
 
 .badge.mounting {
-  background: color-mix(in srgb, var(--dsw-alias-state-business-primary) 12%, transparent);
-  color: var(--dsw-alias-state-business-primary);
+  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 12%, transparent);
+  color: var(--dsw-alias-brand-primary);
 }
 
 .badge.live {

package/src/client/McpSettingsSection.tsx

@@ -248,6 +248,14 @@ export function McpSettingsSection(props: McpSettingsSectionProps): ReactNode {
         t={t}
         actions={actions}
         injected={{ save, remove, test, list }}
+        onSaved={() => {
+          // Mounting is asynchronous: refresh again after the connection
+          // settles so the badge and tool count reflect the live state without
+          // a manual refresh (mirrors the enable-toggle path).
+          const serverName = state.draft.serverName
+          timersRef.current.push(window.setTimeout(() => refreshServer(serverName), 2000))
+          timersRef.current.push(window.setTimeout(() => refreshServer(serverName), 6000))
+        }}
       />
     )
   }
@@ -298,7 +306,7 @@ export function McpSettingsSection(props: McpSettingsSectionProps): ReactNode {
                     <div className={css.rowTitle}>
                       <span className={css.serverName}>{server.serverName}</span>
                       <span className={`${css.badge} ${css[server.status.phase]}`}>{t(phaseKey(server.status.phase))}</span>
-                      {!server.enabled ? <span className={css.muted}>{t('statusStopped')}</span> : null}
+                      {!server.enabled && server.status.phase !== 'stopped' ? <span className={css.muted}>{t('statusStopped')}</span> : null}
                     </div>
                     <div className={css.rowMeta}>
                       <span>{server.transport}</span>

package/src/client/ServerForm.module.css

@@ -43,7 +43,7 @@ button:hover {
 }
 
 button:focus-visible {
-  outline: 2px solid var(--dsw-alias-state-business-primary);
+  outline: 2px solid var(--dsw-alias-brand-primary);
   outline-offset: 1px;
 }
 
@@ -53,13 +53,13 @@ button:disabled {
 }
 
 .primary {
-  border-color: var(--dsw-alias-state-business-primary);
-  background: var(--dsw-alias-state-business-primary);
-  color: var(--dsw-alias-label-on-accent);
+  border-color: var(--dsw-alias-button-primary-fill);
+  background: var(--dsw-alias-button-primary-fill);
+  color: var(--dsw-alias-label-primary-foreground);
 }
 
 .primary:hover {
-  background: var(--dsw-alias-state-business-primary-hover);
+  background: var(--dsw-alias-button-primary-hover);
 }
 
 .danger {
@@ -106,8 +106,8 @@ button:disabled {
 .field input:focus-visible,
 .field select:focus-visible,
 .field textarea:focus-visible {
-  border-color: var(--dsw-alias-state-business-primary);
-  box-shadow: 0 0 0 2px color-mix(in srgb, var(--dsw-alias-state-business-primary) 18%, transparent);
+  border-color: var(--dsw-alias-brand-primary);
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--dsw-alias-brand-primary) 18%, transparent);
 }
 
 .envBlock {

package/src/client/ServerForm.tsx

@@ -1,5 +1,5 @@
 import { useState, type ReactNode } from 'react'
-import type { McpServerId, McpServerView } from './types.ts'
+import type { McpManagerFailure, McpServerId, McpServerView } from './types.ts'
 import type {
   McpDraft, McpEnvRowDraft, McpTestOutcome,
 } from './mcp-store.ts'
@@ -9,8 +9,8 @@ import css from './ServerForm.module.css'
 
 /** The Remote verbs the editor needs; structurally the section's inject face. */
 export interface McpServerFormRemote {
-  save: (draft: McpDraft) => Promise<{ message: string } | null>
-  remove: (id: McpServerId) => Promise<{ message: string } | null>
+  save: (draft: McpDraft) => Promise<McpManagerFailure | null>
+  remove: (id: McpServerId) => Promise<McpManagerFailure | null>
   test: (draft: McpDraft) => Promise<McpTestOutcome>
   list: () => Promise<readonly McpServerView[]>
 }
@@ -34,11 +34,13 @@ export interface McpServerFormProps {
   t: (key: McpSettingsLocaleKey) => string
   actions: McpServerFormActions
   injected: McpServerFormRemote
+  /** Called after a successful save, before the editor closes. */
+  onSaved?: () => void
 }
 
 /** Render the editor for one server draft. */
 export function McpServerForm(props: McpServerFormProps): ReactNode {
-  const { draft, busy, testRunning, test, t, actions, injected } = props
+  const { draft, busy, testRunning, test, t, actions, injected, onSaved } = props
   const [saveError, setSaveError] = useState<string | null>(null)
 
   const update = (patch: Partial<McpDraft>): void => {
@@ -58,13 +60,18 @@ export function McpServerForm(props: McpServerFormProps): ReactNode {
     update({ env: [...draft.env, createEnvRowDraft()] })
   }
 
+  const errorText = (error: unknown): string =>
+    error instanceof Error ? error.message : String(error)
+
   const runTest = async (): Promise<void> => {
     setSaveError(null)
     actions.setTestRunning(true)
     try {
       actions.setTest(await injected.test(draft))
-    } catch {
+    } catch (error) {
+      console.error('[dsh-mcp] test failed:', error)
       actions.setTest(null)
+      setSaveError(errorText(error))
     } finally {
       actions.setTestRunning(false)
     }
@@ -76,13 +83,15 @@ export function McpServerForm(props: McpServerFormProps): ReactNode {
     try {
       const failure = await injected.save(draft)
       if (failure !== null) {
-        setSaveError(failure.message)
+        setSaveError(`${failure.code}: ${failure.message}`)
         return
       }
-      await refresh()
+      if (!await refresh()) return
       actions.cancelEdit()
-    } catch {
-      setSaveError(t('failureTitle'))
+      onSaved?.()
+    } catch (error) {
+      console.error('[dsh-mcp] save failed:', error)
+      setSaveError(errorText(error))
     } finally {
       actions.setBusy(null)
     }
@@ -95,24 +104,27 @@ export function McpServerForm(props: McpServerFormProps): ReactNode {
     try {
       const failure = await injected.remove(draft.id)
       if (failure !== null) {
-        setSaveError(failure.message)
+        setSaveError(`${failure.code}: ${failure.message}`)
         return
       }
-      await refresh()
+      if (!await refresh()) return
       actions.cancelEdit()
-    } catch {
-      setSaveError(t('failureTitle'))
+    } catch (error) {
+      console.error('[dsh-mcp] remove failed:', error)
+      setSaveError(errorText(error))
     } finally {
       actions.setBusy(null)
     }
   }
 
-  const refresh = async (): Promise<void> => {
+  const refresh = async (): Promise<boolean> => {
     try {
       actions.setServers(await injected.list())
-    } catch {
-      // The save/remove outcome is the actionable one; a failed refresh is
-      // re-run on the next page visit.
+      return true
+    } catch (error) {
+      console.error('[dsh-mcp] refresh failed:', error)
+      setSaveError(errorText(error))
+      return false
     }
   }
 
@@ -287,6 +299,10 @@ export function McpServerForm(props: McpServerFormProps): ReactNode {
         </p>
       ) : null}
 
+      {testRunning && draft.transport === 'streamable-http' ? (
+        <p className={css.muted} role="status">{t('testBrowserHint')}</p>
+      ) : null}
+
       <div className={css.actions}>
         <button type="button" disabled={testRunning || busy !== null} onClick={() => void runTest()}>
           {testRunning ? t('testRunning') : t('test')}

package/src/client/locales.ts

@@ -43,6 +43,7 @@ export const zh = {
   edit: '编辑',
   test: '测试连接',
   testRunning: '正在测试…',
+  testBrowserHint: '正在测试…若弹出浏览器授权页，请完成授权后返回，结果会自动刷新。',
   testOk: '连接成功',
   testFail: '连接失败',
   testUnknown: '未知结果',
@@ -120,6 +121,7 @@ export const en = {
   edit: 'Edit',
   test: 'Test connection',
   testRunning: 'Testing…',
+  testBrowserHint: 'Testing… if a browser authorization page opens, complete it and return; the result refreshes automatically.',
   testOk: 'Connection succeeded',
   testFail: 'Connection failed',
   testUnknown: 'Unknown result',

package/src/client/mcp-store.ts

@@ -102,7 +102,9 @@ export function emptyDraft(): McpDraft {
     headersText: '',
     env: [],
     toolCallTimeoutMs: String(DEFAULT_TOOL_CALL_TIMEOUT_MS),
-    failOnStartupError: false,
+    // Reject the mount by default when the startup connection fails, so a
+    // broken server never registers stale tools.
+    failOnStartupError: true,
   }
 }
 
@@ -186,17 +188,6 @@ export function draftToSubmission(draft: McpDraft): McpSubmission {
   }
 }
 
-/** Map a Remote failure code to a locale key for user-facing copy. */
-export function failureLocaleKey(code: string): string {
-  switch (code) {
-    case 'MCP_SERVER_NAME_CONFLICT': return 'serverNameConflict'
-    case 'MCP_SERVER_NOT_FOUND': return 'notFound'
-    case 'MCP_INVALID_SPEC': return 'invalidSpec'
-    case 'MCP_MOUNT_FAILED': return 'mountFailed'
-    default: return 'failureTitle'
-  }
-}
-
 /**
  * Declares the MCP management page state and write surface.
  * @returns the store handle.