dsh-mcp 1.11.0 → 1.11.1

package/CHANGELOG.en.md

@@ -7,6 +7,19 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Compatibility
+
+- **Supported DSH version**: **dsh `0.1.5-rc.1`** — developed and verified on `0.1.5-rc.1` (declared in `package.json` → `dsh.supported`). When the DSH and plugin versions do not match, the Settings page reports a diagnosis (check the `cordis.patch.yml` row → restart `dsh web` → hard-refresh → upgrade both sides).
+- **Release convention**: every version entry states `- **Supported DSH version**: dsh <version>`, mirrored in the GitHub Release notes.
+
+## [1.11.1] - 2026-09-13
+
+### Fixed
+
+- **OAuth is now an explicit switch instead of a header guess (no more repeated browser authorizations)**: the previous rule was "streamable-http without an `Authorization` header gets an OAuth provider", so servers that authenticate with static tokens or custom headers (`x-bbzai-mcp-token`, `X-Mcp-Token`, `Private-Token`) were treated as OAuth servers. When such a server answered 401 (a stale token, a gateway challenge), the SDK asked for authorization, the plugin opened the browser and started its loopback callback (`127.0.0.1:<port>/callback`) — a flow that could never satisfy those servers, so every reconnect or remount opened the browser again. A stored server now has an **`oauth: true`** switch (the form's "Use OAuth authorization" checkbox, off by default; taking over a declaration without an `Authorization` header ticks it, and it stays editable)
+- **Upgrade migration**: servers that already hold OAuth credentials (a token or a client registration) keep `oauth: true`, everything else is turned off — so servers that genuinely need OAuth keep working while the misdetected ones stop opening the browser
+- **Automatic-authorization circuit breaker**: the plugin opens the browser **at most once per server per process**; later automatic attempts return the authorization-link error instead (the 1.8.0 behaviour), and "Test connection" can still start an authorization on demand
+
 ## [1.11.0] - 2026-09-13
 
 ### Added

package/CHANGELOG.md

@@ -7,6 +7,19 @@
 格式基于 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 兼容性
+
+- **支持版本**：**dsh `0.1.5-rc.1`** —— 本插件在 `0.1.5-rc.1` 上开发与验证（`package.json` → `dsh.supported` 同步声明）。DSH 与插件版本不匹配时，设置页会给出排查诊断（核对 `cordis.patch.yml` 注册行 → 重启 `dsh web` → 硬刷新 → 同步升级）。
+- **发版约定**：每个版本条目都要声明 `- **支持版本**：dsh <版本>`，并在 GitHub Release notes 中同步。
+
+## [1.11.1] - 2026-09-13
+
+### 修复
+
+- **OAuth 改为显式开关，不再凭请求头猜测（停止反复弹出浏览器授权）**：此前规则是"streamable-http 且没有 `Authorization` 头 → 挂 OAuth provider"，于是用静态 token/自定义头（`x-bbzai-mcp-token`、`X-Mcp-Token`、`Private-Token`）认证的服务器也被当成 OAuth 服务器。这类服务器返回 401 时（token 失效、网关挑战等），SDK 会要求授权 → 插件打开浏览器并起回环回调（`127.0.0.1:<port>/callback`），而该流程永远无法让它们通过 → 每次重连/重挂载就再弹一次。现在服务器配置新增 **`oauth: true`** 开关（设置页勾选「使用 OAuth 授权」，默认关；接管声明时若该声明没有 `Authorization` 头则默认勾上，之后仍可修改）
+- **升级自动迁移**：已存在 OAuth 凭据（token 或 client 注册记录）的服务器会保留 `oauth: true`，其余一律关闭——因此**现有真正需要 OAuth 的服务器不受影响，误判的那批立刻停止弹窗**
+- **自动弹窗熔断**：同一服务器**每个进程最多自动打开一次**浏览器授权；之后的自动尝试不再弹窗，改为返回带授权链接的错误（沿用 1.8.0 的能力），手动点「测试连接」仍可随时发起授权
+
 ## [1.11.0] - 2026-09-13
 
 ### 新增

package/README.en.md

@@ -2,6 +2,8 @@
 
 [![dshfind](https://dshfind.com/api/badge/ArvinQi/dsh-mcp?lang=en)](https://dshfind.com/en/plugins/ArvinQi/dsh-mcp?ref=badge)
 
+> **Supported DSH version**: `dsh 0.1.5-rc.1` — developed and verified on `0.1.5-rc.1`, declared in `package.json` → `dsh.supported`. When the DSH and plugin versions do not match, the Settings page shows a diagnosis (check the registration row → restart `dsh web` → hard-refresh → upgrade both sides).
+
 ![Settings preview](static/snapshot.en.webp)
 
 ## Why dsh-mcp?
@@ -78,6 +80,7 @@ Since 1.11.0 those declarations appear in Settings → MCP, badged "cordis decla
 - **Imported into storages as mirrors**: at startup and on every refresh the declarations are imported into the storage domain (id `cordis:<rowId>`, with `origin/declaredIn/declaredRowId`), **import only** — a row created in the plugin is never overwritten; a mirror whose declaration disappeared is **removed automatically** (a mirror is only a copy of a declaration, so an ownerless one must not pile up); a declaration containing a `!!js` expression is skipped and flagged with the reason (its value only resolves inside the Loader). Mirrors are never mounted — the composition owns the mount.
 - **Take over / give back**: clicking "Take over" makes the plugin write an id-targeted `disabled: true` into its own **managed block** in `cordis.patch.yml` (a `.dsh-mcp.bak` backup is taken before the first write; atomic, idempotent, reversible, confined to that block). The declaration releases the `serverName` and the plugin mounts its own row instead — enabling **OAuth authorization, managed credentials, `${VAR}` header substitution and connection tests**. A hard mount failure rolls back automatically (the block is removed and the row returns to mirror state) and reports why; "Give back" hands the mount back to the declaration and deletes the managed row. A declaration without an explicit `id`, or one containing a `!!js` expression, cannot be taken over.
 - **OAuth / placeholder limit (`needsPlugin`)**: a declaration can carry neither an OAuth provider nor `${VAR}` / bare-name placeholder substitution — only the plugin does those. Such a declaration can therefore only work while the plugin owns the mount: the page reports it as **failed with the reason** (not "connecting"), "Give back" makes its tools disappear (the confirmation and the result warning both say so), and taking it over again restores them.
+- **OAuth is an explicit switch (since 1.11.1)**: an OAuth provider is attached only when the server sets `oauth: true` (the form's "Use OAuth authorization" checkbox, off by default). **Do not tick it for servers that authenticate with static tokens or custom headers** — otherwise a 401 is treated as an OAuth challenge and the plugin keeps opening the browser (with its `127.0.0.1:<port>/callback` loopback listener). The plugin also opens the browser **at most once per server per process**; later automatic attempts return the authorization-link error, and "Test connection" can still start one on demand. Upgrading migrates automatically from existing OAuth credentials, so servers that genuinely need OAuth are unaffected.
 - **Safe degradation when the hot reload does not commit**: if the native tools have not unregistered within 5 seconds of writing the disable block (that profile's patch hot reload did not commit — a sibling entry failing its re-apply rolls the whole generation back), the plugin **registers the takeover without mounting** (the managed row is marked `pendingTakeover`); the next dsh start mounts it, and "Give back" reports the same need for a restart. A mount is also always skipped when same-named `mcp__<server>__` tools already exist without a local mount, so the plugin never fights a still-mounted declaration for one name.
 - **Tool search covers them**: search/hot injection and per-tool switches work by `mcp__` prefix across the whole tool set, so declared tools need no extra configuration.
 
@@ -296,6 +299,9 @@ Check in order:
   reinstalling (link install).
 - Configuration changes (bundle additions/removals, new plugin rows) require restarting `dsh web` to enter
   the client roster.
+- **Every release must declare its supported DSH version**: add a
+  `- **Supported DSH version**: dsh <version>` line to the CHANGELOG entry and the GitHub Release notes, and
+  update `package.json` → `dsh.supported` plus the "Supported DSH version" note at the top of this README.
 
 ## Changelog
 

package/README.md

@@ -4,6 +4,8 @@
 
 [![dshfind](https://dshfind.com/api/badge/ArvinQi/dsh-mcp?lang=zh)](https://dshfind.com/zh/plugins/ArvinQi/dsh-mcp?ref=badge)
 
+> **支持版本**：`dsh 0.1.5-rc.1` —— 本插件在 `0.1.5-rc.1` 上开发与验证，`package.json` → `dsh.supported` 同步声明。DSH 与插件两侧版本不匹配时，设置页会给出排查诊断（检查注册行 → 重启 `dsh web` → 硬刷新 → 同步升级）。
+
 ![设置页预览](static/snapshot.webp)
 
 ## 为什么用 dsh-mcp？
@@ -76,6 +78,11 @@ DSH 原生支持在组合里直接声明 MCP 服务器：**一行一台**，`nam
   `${VAR}`/裸变量名占位符——这两件事只有插件会做。因此这类声明**只能由插件挂载**：页面会把它们标为
   **挂载失败并说明原因**（不是"连接中"），「释放」会让工具消失（确认框与结果告警都会提示），恢复只需
   重新「接管」。
+- **OAuth 是显式开关（1.11.1 起）**：服务器配置里的 `oauth: true`（设置页「使用 OAuth 授权」勾选，默认关）
+  才会挂 OAuth provider。**用静态 token 或自定义头认证的服务器不要勾**——否则它返回 401 时会被当成 OAuth
+  挑战，插件会反复打开浏览器授权（并起 `127.0.0.1:<port>/callback` 回环回调）。另外，同一服务器**每个进程
+  最多自动弹一次**浏览器，之后只返回带授权链接的错误；手动「测试连接」仍可随时发起授权。升级时会按已有
+  OAuth 凭据自动迁移，真正需要 OAuth 的服务器不受影响。
 - **热重载未提交时的安全降级**：写入停用块后若原生工具 5 秒内没有注销（该 profile 的 patch 热重载未提交，
   例如某个兄弟条目重建失败导致整代回滚），插件会**登记接管但暂不挂载**（管理行标记 `pendingTakeover`），
   重启 dsh 后由插件挂载；「释放」在同样情况下会提示需要重启。此外，挂载前若发现同名 `mcp__<server>__`
@@ -278,5 +285,7 @@ dsh plugin --profile web add link:<本仓库绝对路径>
 - 浏览器半部改 `src/client/*` 后重新 `node scripts/build.mjs`；host 半部改动无需重装
   （link 安装直接生效）。
 - 配置变更（bundles 增删、新插件行）需重启 `dsh web` 才进入 client roster。
+- **每次发版都必须声明支持的 DSH 版本**：在 CHANGELOG 对应条目与 GitHub Release notes 里加一行
+  `- **支持版本**：dsh <版本>`，并同步更新 `package.json` 的 `dsh.supported` 与 README 顶部的「支持版本」。
 
 [![dshfind](https://dshfind.com/api/card/ArvinQi/dsh-mcp?lang=zh)](https://dshfind.com/zh/plugins/ArvinQi/dsh-mcp?ref=badge)

package/lib/client.js

@@ -14577,6 +14577,7 @@ var _deepseek_ai_dsh_mcp_manager_mcpManager_list_result$schema = external_export
     })).readonly(),
     "toolCallTimeoutMs": external_exports.number().readonly(),
     "failOnStartupError": external_exports.boolean().readonly(),
+    "oauth": external_exports.boolean().readonly().optional(),
     "status": external_exports.object({
       "phase": external_exports.union([external_exports.literal("failed"), external_exports.literal("stopped"), external_exports.literal("mounting"), external_exports.literal("live")]).readonly(),
       "tools": external_exports.array(external_exports.string()).readonly(),
@@ -14622,7 +14623,8 @@ var _deepseek_ai_dsh_mcp_manager_mcpManager_test_parameter_0$schema = external_e
       "value": external_exports.string().readonly()
     })).readonly(),
     "toolCallTimeoutMs": external_exports.number().readonly(),
-    "failOnStartupError": external_exports.boolean().readonly()
+    "failOnStartupError": external_exports.boolean().readonly(),
+    "oauth": external_exports.boolean().readonly().optional()
   }).readonly(),
   "env": external_exports.array(external_exports.object({
     "name": external_exports.string().readonly(),
@@ -14659,7 +14661,8 @@ var _deepseek_ai_dsh_mcp_manager_mcpManager_upsert_parameter_0$schema = external
       "value": external_exports.string().readonly()
     })).readonly(),
     "toolCallTimeoutMs": external_exports.number().readonly(),
-    "failOnStartupError": external_exports.boolean().readonly()
+    "failOnStartupError": external_exports.boolean().readonly(),
+    "oauth": external_exports.boolean().readonly().optional()
   }).readonly(),
   "env": external_exports.array(external_exports.object({
     "name": external_exports.string().readonly(),
@@ -14690,6 +14693,7 @@ var _deepseek_ai_dsh_mcp_manager_mcpManager_upsert_result$schema = external_expo
     })).readonly(),
     "toolCallTimeoutMs": external_exports.number().readonly(),
     "failOnStartupError": external_exports.boolean().readonly(),
+    "oauth": external_exports.boolean().readonly().optional(),
     "status": external_exports.object({
       "phase": external_exports.union([external_exports.literal("failed"), external_exports.literal("stopped"), external_exports.literal("mounting"), external_exports.literal("live")]).readonly(),
       "tools": external_exports.array(external_exports.string()).readonly(),
@@ -14731,7 +14735,8 @@ var _deepseek_ai_dsh_mcp_manager_mcpManager_upsertJson_parameter_0$schema = exte
         "value": external_exports.string().readonly()
       })).readonly()]).readonly().optional(),
       "toolCallTimeoutMs": external_exports.number().readonly().optional(),
-      "failOnStartupError": external_exports.boolean().readonly().optional()
+      "failOnStartupError": external_exports.boolean().readonly().optional(),
+      "oauth": external_exports.boolean().readonly().optional()
     }).readonly(),
     "env": external_exports.array(external_exports.object({
       "name": external_exports.string().readonly(),
@@ -14767,6 +14772,7 @@ var _deepseek_ai_dsh_mcp_manager_mcpManager_upsertJson_result$schema = external_
     })).readonly(),
     "toolCallTimeoutMs": external_exports.number().readonly(),
     "failOnStartupError": external_exports.boolean().readonly(),
+    "oauth": external_exports.boolean().readonly().optional(),
     "status": external_exports.object({
       "phase": external_exports.union([external_exports.literal("failed"), external_exports.literal("stopped"), external_exports.literal("mounting"), external_exports.literal("live")]).readonly(),
       "tools": external_exports.array(external_exports.string()).readonly(),
@@ -14887,6 +14893,7 @@ var _deepseek_ai_dsh_mcp_manager_mcpManager_adopt_result$schema = external_expor
     })).readonly(),
     "toolCallTimeoutMs": external_exports.number().readonly(),
     "failOnStartupError": external_exports.boolean().readonly(),
+    "oauth": external_exports.boolean().readonly().optional(),
     "status": external_exports.object({
       "phase": external_exports.union([external_exports.literal("failed"), external_exports.literal("stopped"), external_exports.literal("mounting"), external_exports.literal("live")]).readonly(),
       "tools": external_exports.array(external_exports.string()).readonly(),
@@ -15225,7 +15232,10 @@ function emptyDraft() {
     toolCallTimeoutMs: String(DEFAULT_TOOL_CALL_TIMEOUT_MS),
     // Reject the mount by default when the startup connection fails, so a
     // broken server never registers stale tools.
-    failOnStartupError: true
+    failOnStartupError: true,
+    // OAuth is opt-in: guessing it from the headers opened the browser for
+    // servers that authenticate with static tokens.
+    oauth: false
   };
 }
 function draftFromServer(server) {
@@ -15240,6 +15250,7 @@ function draftFromServer(server) {
     url: server.url,
     headersText: server.headers.map((header) => `${header.name}: ${header.value}`).join("\n"),
     toolCallTimeoutMs: String(server.toolCallTimeoutMs),
+    oauth: server.oauth === true,
     failOnStartupError: server.failOnStartupError
   };
 }
@@ -15326,6 +15337,7 @@ function draftToSubmission(draft) {
       url: draft.url.trim(),
       headers: parseHeaders(draft.headersText),
       toolCallTimeoutMs: parseTimeout(draft.toolCallTimeoutMs),
+      oauth: draft.oauth,
       failOnStartupError: draft.failOnStartupError
     }
   };
@@ -15591,6 +15603,18 @@ function McpServerForm(props) {
         }
       )
     ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: ServerForm_default.checkRow, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        "input",
+        {
+          type: "checkbox",
+          checked: draft.oauth,
+          onChange: (event) => update({ oauth: event.currentTarget.checked })
+        }
+      ),
+      t("oauthAuth")
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: ServerForm_default.hint, children: t("oauthAuthHint") }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: ServerForm_default.checkRow, children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
         "input",
@@ -15663,6 +15687,7 @@ function serversToJsonText(servers) {
     }
     entry.toolCallTimeoutMs = server.toolCallTimeoutMs;
     entry.failOnStartupError = server.failOnStartupError;
+    if (server.oauth === true) entry.oauth = true;
     entry.env = server.env.map((row) => row.secret ? { name: row.name, secret: true, configured: row.configured } : { name: row.name, secret: false, ...row.value !== void 0 && row.value.length > 0 ? { value: row.value } : {} });
     document2[server.serverName] = entry;
   }
@@ -15730,6 +15755,7 @@ function parseServersJson(text) {
       url: typeof cfg.url === "string" ? cfg.url : "",
       headers: cfg.headers,
       toolCallTimeoutMs: typeof cfg.toolCallTimeoutMs === "number" ? cfg.toolCallTimeoutMs : 6e4,
+      oauth: cfg.oauth === true,
       failOnStartupError: cfg.failOnStartupError !== false
     };
     servers.push({ server, env });
@@ -16093,6 +16119,7 @@ function viewToDraft(server) {
     url: server.url,
     headersText: server.headers.map((header) => `${header.name}: ${header.value}`).join("\n"),
     toolCallTimeoutMs: String(server.toolCallTimeoutMs),
+    oauth: server.oauth === true,
     failOnStartupError: server.failOnStartupError
   };
 }
@@ -16515,6 +16542,8 @@ var zh = {
   removeEnvVar: "\u79FB\u9664\u8BE5\u53D8\u91CF",
   toolCallTimeoutMs: "\u5DE5\u5177\u8C03\u7528\u8D85\u65F6\uFF08\u6BEB\u79D2\uFF09",
   failOnStartupError: "\u542F\u52A8\u8FDE\u63A5\u5931\u8D25\u65F6\u62D2\u7EDD\u6302\u8F7D",
+  oauthAuth: "\u4F7F\u7528 OAuth \u6388\u6743\uFF08\u6D4F\u89C8\u5668\u6388\u6743 + token \u6258\u7BA1\uFF09",
+  oauthAuthHint: "\u4EC5\u5F53\u8BE5\u670D\u52A1\u5668\u786E\u5B9E\u4F7F\u7528 OAuth\uFF08MCP \u6388\u6743\u7801 + PKCE\uFF09\u65F6\u52FE\u9009\u3002\u7528\u9759\u6001 token \u6216\u81EA\u5B9A\u4E49\u8BF7\u6C42\u5934\u8BA4\u8BC1\u7684\u670D\u52A1\u5668\u8BF7\u52FF\u52FE\u9009\u2014\u2014\u5426\u5219\u670D\u52A1\u5668\u8FD4\u56DE 401 \u65F6\u4F1A\u88AB\u5F53\u6210 OAuth \u6311\u6218\uFF0C\u4ECE\u800C\u53CD\u590D\u5F39\u51FA\u6D4F\u89C8\u5668\u6388\u6743\u3002",
   statusMounting: "\u8FDE\u63A5\u4E2D",
   statusLive: "\u5DF2\u8FDE\u63A5",
   statusFailed: "\u6302\u8F7D\u5931\u8D25",
@@ -16638,6 +16667,8 @@ var en = {
   removeEnvVar: "Remove this variable",
   toolCallTimeoutMs: "Tool-call timeout (ms)",
   failOnStartupError: "Reject the mount when the startup connection fails",
+  oauthAuth: "Use OAuth authorization (browser authorization + token storage)",
+  oauthAuthHint: "Tick only when the server really uses OAuth (MCP authorization-code + PKCE). Servers that authenticate with static tokens or custom headers must leave this off \u2014 otherwise a 401 is treated as an OAuth challenge and the browser authorization opens again and again.",
   statusMounting: "Connecting",
   statusLive: "Connected",
   statusFailed: "Mount failed",

package/lib/index.js

@@ -2,7 +2,7 @@ import { randomBytes } from "node:crypto";
 import { Service } from "@deepseek-ai/cordis";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import * as mcpClient from "./mcp-client.js";
-import { createOAuthProvider } from "./oauth.js";
+import { createOAuthProvider, oauthCredentialRefs } from "./oauth.js";
 import { probeConnection } from "./probe.js";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { hostText } from "./host-locales.js";
@@ -56,6 +56,7 @@ const mcpServerRowSchema = z$1.object({
 	env: z$1.array(envEntrySchema).default([]),
 	toolCallTimeoutMs: positiveIntegerSchema,
 	failOnStartupError: z$1.boolean().default(false),
+	oauth: z$1.boolean().default(false),
 	origin: z$1.union([z$1.literal("plugin"), z$1.literal("cordis")]).default("plugin"),
 	declaredIn: z$1.string().optional(),
 	declaredRowId: z$1.string().optional(),
@@ -184,6 +185,9 @@ function toServerRow(id, server, env, previous) {
 		}),
 		toolCallTimeoutMs: server.toolCallTimeoutMs,
 		failOnStartupError: server.failOnStartupError,
+		// The OAuth switch is explicit: a caller that states nothing (the JSON
+		// editor omitting the field) keeps the previous choice.
+		oauth: server.oauth === true ? true : server.oauth === false ? false : previous?.oauth === true,
 		// Rows created here are the manager's own; mirrors imported from a
 		// Cordis patch layer are written by syncDeclared with origin "cordis".
 		origin: "plugin",
@@ -327,7 +331,7 @@ function placeholderName(value, envNames) {
 }
 /** Whether two server records carry the same content (mirror refresh guard). */
 function sameRecord(left, right) {
-	return left.serverName === right.serverName && left.transport === right.transport && left.enabled === right.enabled && left.command === right.command && left.cwd === right.cwd && left.url === right.url && left.toolCallTimeoutMs === right.toolCallTimeoutMs && left.failOnStartupError === right.failOnStartupError && left.declaredIn === right.declaredIn && left.declaredRowId === right.declaredRowId && left.stale === right.stale && JSON.stringify(left.args) === JSON.stringify(right.args) && JSON.stringify(left.headers) === JSON.stringify(right.headers) && JSON.stringify(left.env) === JSON.stringify(right.env);
+	return left.serverName === right.serverName && left.transport === right.transport && left.enabled === right.enabled && left.command === right.command && left.cwd === right.cwd && left.url === right.url && left.toolCallTimeoutMs === right.toolCallTimeoutMs && left.failOnStartupError === right.failOnStartupError && left.oauth === right.oauth && left.declaredIn === right.declaredIn && left.declaredRowId === right.declaredRowId && left.stale === right.stale && JSON.stringify(left.args) === JSON.stringify(right.args) && JSON.stringify(left.headers) === JSON.stringify(right.headers) && JSON.stringify(left.env) === JSON.stringify(right.env);
 }
 /**
 * The managed server id a credential reference belongs to, when the reference
@@ -561,6 +565,11 @@ let McpManagerService = (() => {
 		* disabled and re-enabled.
 		*/
 		everMounted = /* @__PURE__ */ new Set();
+		/**
+		* Server names whose one automatic browser authorization this process
+		* already consumed (see {@link claimAutoBrowser}).
+		*/
+		autoBrowserOpened = /* @__PURE__ */ new Set();
 		/** Per-id operation chain serializing reconcile, remove, and restart jobs. */
 		operationTails = /* @__PURE__ */ new Map();
 		/** Server ids whose secret writes are this manager's own; skip restart echoes. */
@@ -594,6 +603,7 @@ let McpManagerService = (() => {
 			}, "mcp-manager.domainClose");
 			this.table = domain.table("servers");
 			this.envTable = domain.table("global_env");
+			await this.migrateOAuthFlags();
 			await this.refreshDeclared(false);
 			this.reconcileDeclared();
 			this.installToolControl();
@@ -808,7 +818,11 @@ let McpManagerService = (() => {
 				...toMirrorRecord(entry),
 				origin: "plugin",
 				enabled: true,
-				stale: false
+				stale: false,
+				// A declaration with no `Authorization` header is the shape an
+				// OAuth-protected server has; default the switch on for the
+				// takeover (it stays visible and editable in the form).
+				oauth: entry.transport === "streamable-http" && !entry.headers.some((header) => header.name.toLowerCase() === "authorization")
 			});
 			if (!parsed.success) return this.adoptFailure("MCP_ADOPT_FAILED", parsed.error.issues[0]?.message ?? "invalid declaration");
 			const disable = writeManagedIds(entry.declaredIn, [...managedIds(entry.declaredIn), entry.rowId]);
@@ -1036,19 +1050,64 @@ let McpManagerService = (() => {
 			};
 		}
 		/**
-		* Whether one resolved client config needs an OAuth provider. Only
-		* streamable-http servers WITHOUT a static `Authorization` header do:
-		* a static bearer token means the server authenticates directly, and
-		* attaching an OAuth provider would make the SDK treat any 401 as an
-		* authorization-code challenge — opening the browser / blocking tool
-		* calls for servers that never intended OAuth. stdio never needs it.
-		* @param config - the resolved client config from {@link toClientConfig}.
+		* Whether one stored server asks for an OAuth provider. The switch is
+		* explicit (`oauth: true`, set in the settings form): a server that
+		* authenticates with static headers must never be guessed into OAuth,
+		* because a 401 from it is not a challenge and starting the
+		* authorization-code flow for it only opens the browser forever.
+		* stdio never needs the provider.
+		* @param row - the stored definition (or the submitted spec).
 		* @returns true when OAuth (authorization-code + PKCE) should be enabled.
 		*/
-		wantsOAuthProvider(config) {
-			if (config.transport !== "streamable-http") return false;
-			const names = Object.keys(config.headers ?? {});
-			return !names.some((name) => name.toLowerCase() === "authorization");
+		wantsOAuthProvider(row) {
+			return row?.transport === "streamable-http" && row.oauth === true;
+		}
+		/**
+		* Claim the one automatic browser authorization this process allows per
+		* server. Without it a server whose 401 can never be satisfied by the
+		* authorization-code flow (or whose token keeps being rejected) reopens
+		* the browser on every mount and reconnect; later attempts surface the
+		* authorization link instead, and `test` still opens the browser because
+		* the user asked for it.
+		* @param serverName - the server the provider belongs to.
+		* @returns true when this process may open the browser automatically.
+		*/
+		claimAutoBrowser(serverName) {
+			if (this.autoBrowserOpened.has(serverName)) return false;
+			this.autoBrowserOpened.add(serverName);
+			return true;
+		}
+		/**
+		* Give stored rows that completed an OAuth flow before the explicit
+		* switch existed their provider back (`oauth: true`). The switch replaced
+		* a header heuristic, so a row with stored OAuth credentials really does
+		* need authorization; rows without them stay off and stop opening the
+		* browser for a flow that can never succeed.
+		*/
+		async migrateOAuthFlags() {
+			const table = this.requireTable();
+			for (const [id, row] of table.entries()) {
+				if (row.oauth === true || row.origin === "cordis") continue;
+				let configured = false;
+				for (const ref of oauthCredentialRefs(row.serverName)) {
+					try {
+						if ((await this.ctx.credentials.describe(ref)).configured) {
+							configured = true;
+							break;
+						}
+					} catch {
+						/* an absent credential document is not an error */
+					}
+				}
+				if (!configured) continue;
+				const parsed = mcpServerRowSchema.safeParse({
+					...row,
+					oauth: true
+				});
+				if (!parsed.success) continue;
+				await table.put(id, parsed.data);
+				this.ctx.logger.info(`mcp-manager: "${row.serverName}" keeps OAuth (stored credentials) after the explicit switch`);
+			}
 		}
 		/**
 		* Mount one server's mcp-client instance without awaiting activation, so a
@@ -1071,15 +1130,17 @@ let McpManagerService = (() => {
 					const env = await this.resolveEnv(row);
 					const globalEnv = await this.resolveGlobalEnv();
 					const config = this.toClientConfig(row, env, globalEnv);
-					// OAuth servers (authorization-code flow) trigger browser
-					// auth on connect (unless allowBrowserOnMount is off, the
-					// default); static-credential servers get no provider so
-					// their 401s surface as authentication failures instead of
-					// an OAuth flow the server never asked for. Tokens are
-					// keyed by serverName so a test-connection authorization
-					// is reused by the mount.
-					const authProvider = this.wantsOAuthProvider(config)
-						? createOAuthProvider(row.serverName, this.ctx, { allowBrowser: this.allowBrowserOnMount, serverUrl: row.url })
+					// The OAuth switch is explicit per server (`oauth: true`), and
+					// automatic browser authorization happens at most once per
+					// server per process: later attempts surface the
+					// authorization link instead of opening the browser again.
+					// Tokens are keyed by serverName, so a test-connection
+					// authorization is reused by the mount.
+					const authProvider = this.wantsOAuthProvider(row)
+						? createOAuthProvider(row.serverName, this.ctx, {
+							allowBrowser: this.allowBrowserOnMount && this.claimAutoBrowser(row.serverName),
+							serverUrl: row.url
+						})
 						: void 0;
 					handle = this.ctx.plugin(MCP_CLIENT_PLUGIN, { ...config, ...authProvider === void 0 ? {} : { authProvider } });
 				} catch (error) {
@@ -1182,6 +1243,7 @@ let McpManagerService = (() => {
 				env,
 				toolCallTimeoutMs: row.toolCallTimeoutMs,
 				failOnStartupError: row.failOnStartupError,
+				...(mirror ? {} : { oauth: row.oauth === true }),
 				...(mirrorNeedsPlugin ? { needsPlugin: true } : {}),
 				status: {
 					// A mirror never mounts here: its phase follows the declaration
@@ -1393,7 +1455,8 @@ let McpManagerService = (() => {
 					url: typeof item.server.url === "string" ? item.server.url : "",
 					headers: normalizeHeaders(item.server.headers),
 					toolCallTimeoutMs: Number.isInteger(item.server.toolCallTimeoutMs) ? item.server.toolCallTimeoutMs : 60e3,
-					failOnStartupError: item.server.failOnStartupError !== false
+					failOnStartupError: item.server.failOnStartupError !== false,
+					oauth: item.server.oauth === void 0 ? void 0 : item.server.oauth === true
 				};
 				try {
 					validateServerInput(spec, env);
@@ -1595,12 +1658,13 @@ let McpManagerService = (() => {
 			// Test connection also supports OAuth: an OAuth-protected server
 			// opens the browser for authorization and the probe continues after
 			// tokens are stored (keyed by serverName, matching the mount path).
-			// Static-credential servers (configured Authorization header) skip
-			// the provider so a 401 probe reports the authentication failure
-			// instead of starting an OAuth flow the server never asked for.
+			// The user asked for this probe, so it may open the browser even
+			// when the mount-time circuit breaker already fired; servers without
+			// the explicit switch skip the provider so a 401 reports an
+			// authentication failure instead of starting a bogus flow.
 			const probe = await probeConnection(probeConfig, {
 				timeoutMs: this.probeTimeoutMs,
-				...(this.wantsOAuthProvider(probeConfig)
+				...(this.wantsOAuthProvider(request.server)
 					? { authProvider: createOAuthProvider(request.server.serverName, this.ctx, { serverUrl: request.server.url }) }
 					: {})
 			});

package/lib/oauth.js

@@ -77,6 +77,19 @@ function oauthClientRef(serverId) {
   return oauthRef(OAUTH_CLIENT_REF_PREFIX, serverId);
 }
 
+/**
+ * The credential references one server's OAuth flow writes (token + client).
+ * Recognising servers that demonstrably completed a flow is how stored rows
+ * migrate to the explicit OAuth switch: the switch replaced a header
+ * heuristic, and a server with stored OAuth credentials really does need
+ * authorization.
+ * @param serverId - the server name the flow is keyed by.
+ * @returns both credential reference names.
+ */
+export function oauthCredentialRefs(serverId) {
+  return [oauthTokenRef(serverId), oauthClientRef(serverId)];
+}
+
 /** Open the system browser to one URL, best effort. */
 function openBrowser(url) {
   const command =

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "description": "MCP 管理界面 + tool search：可视化配置/启停/刷新 MCP 服务器与工具勾选，按需检索（tool search）热注入；工具列表稳定命中缓存、不撑爆上下文。DeepSeek Harness plugin: MCP management UI + tool search — stable tool list, cache-friendly, no context bloat.",
   "type": "module",
   "main": "lib/index.js",
@@ -35,6 +35,7 @@
     "url": "https://github.com/ArvinQi/dsh-mcp/issues"
   },
   "dsh": {
+    "supported": "0.1.5-rc.1",
     "client": {
       "inject": [
         "@deepseek-ai/dsh-api-remotes",

package/src/client/McpSettingsSection.tsx

@@ -73,6 +73,7 @@ function viewToDraft(server: McpServerView): McpDraft {
     url: server.url,
     headersText: server.headers.map(header => `${header.name}: ${header.value}`).join('\n'),
     toolCallTimeoutMs: String(server.toolCallTimeoutMs),
+    oauth: server.oauth === true,
     failOnStartupError: server.failOnStartupError,
   }
 }

package/src/client/ServerForm.tsx

@@ -225,6 +225,16 @@ export function McpServerForm(props: McpServerFormProps): ReactNode {
         />
       </label>
 
+      <label className={css.checkRow}>
+        <input
+          type="checkbox"
+          checked={draft.oauth}
+          onChange={(event) => update({ oauth: event.currentTarget.checked })}
+        />
+        {t('oauthAuth')}
+      </label>
+      <p className={css.hint}>{t('oauthAuthHint')}</p>
+
       <label className={css.checkRow}>
         <input
           type="checkbox"

package/src/client/ServersJsonEditor.tsx

@@ -77,6 +77,7 @@ export function serversToJsonText(servers: readonly McpServerView[]): string {
     }
     entry.toolCallTimeoutMs = server.toolCallTimeoutMs
     entry.failOnStartupError = server.failOnStartupError
+    if (server.oauth === true) entry.oauth = true
     entry.env = server.env.map(row => row.secret
       ? { name: row.name, secret: true, configured: row.configured }
       : { name: row.name, secret: false, ...(row.value !== undefined && row.value.length > 0 ? { value: row.value } : {}) })
@@ -150,6 +151,7 @@ export function parseServersJson(text: string): { ok: true; servers: readonly Se
       url: typeof cfg.url === 'string' ? cfg.url : '',
       headers: cfg.headers,
       toolCallTimeoutMs: typeof cfg.toolCallTimeoutMs === 'number' ? cfg.toolCallTimeoutMs : 60000,
+      oauth: cfg.oauth === true,
       failOnStartupError: cfg.failOnStartupError !== false,
     }
     servers.push({ server, env })

package/src/client/locales.ts

@@ -39,6 +39,8 @@ export const zh = {
   removeEnvVar: '移除该变量',
   toolCallTimeoutMs: '工具调用超时（毫秒）',
   failOnStartupError: '启动连接失败时拒绝挂载',
+  oauthAuth: '使用 OAuth 授权（浏览器授权 + token 托管）',
+  oauthAuthHint: '仅当该服务器确实使用 OAuth（MCP 授权码 + PKCE）时勾选。用静态 token 或自定义请求头认证的服务器请勿勾选——否则服务器返回 401 时会被当成 OAuth 挑战，从而反复弹出浏览器授权。',
   statusMounting: '连接中',
   statusLive: '已连接',
   statusFailed: '挂载失败',
@@ -167,6 +169,8 @@ export const en = {
   removeEnvVar: 'Remove this variable',
   toolCallTimeoutMs: 'Tool-call timeout (ms)',
   failOnStartupError: 'Reject the mount when the startup connection fails',
+  oauthAuth: 'Use OAuth authorization (browser authorization + token storage)',
+  oauthAuthHint: 'Tick only when the server really uses OAuth (MCP authorization-code + PKCE). Servers that authenticate with static tokens or custom headers must leave this off — otherwise a 401 is treated as an OAuth challenge and the browser authorization opens again and again.',
   statusMounting: 'Connecting',
   statusLive: 'Connected',
   statusFailed: 'Mount failed',

package/src/client/mcp-store.ts

@@ -25,6 +25,8 @@ export interface McpDraft {
   readonly headersText: string
   /** Timeout as editor text; blank falls back to the default. */
   readonly toolCallTimeoutMs: string
+  /** Explicit OAuth switch: only then does the Host attach an OAuth provider. */
+  readonly oauth: boolean
   readonly failOnStartupError: boolean
 }
 
@@ -78,6 +80,9 @@ export function emptyDraft(): McpDraft {
     // Reject the mount by default when the startup connection fails, so a
     // broken server never registers stale tools.
     failOnStartupError: true,
+    // OAuth is opt-in: guessing it from the headers opened the browser for
+    // servers that authenticate with static tokens.
+    oauth: false,
   }
 }
 
@@ -94,6 +99,7 @@ export function draftFromServer(server: McpServerView): McpDraft {
     url: server.url,
     headersText: server.headers.map(header => `${header.name}: ${header.value}`).join('\n'),
     toolCallTimeoutMs: String(server.toolCallTimeoutMs),
+    oauth: server.oauth === true,
     failOnStartupError: server.failOnStartupError,
   }
 }
@@ -205,6 +211,7 @@ export function draftToSubmission(draft: McpDraft): McpSubmission {
       url: draft.url.trim(),
       headers: parseHeaders(draft.headersText),
       toolCallTimeoutMs: parseTimeout(draft.toolCallTimeoutMs),
+      oauth: draft.oauth,
       failOnStartupError: draft.failOnStartupError,
     },
   }

package/src/client/remote-contribution.js

@@ -36,6 +36,7 @@ const _deepseek_ai_dsh_mcp_manager_mcpManager_list_result$schema = z.object({
 })).readonly(),
   'toolCallTimeoutMs': z.number().readonly(),
   'failOnStartupError': z.boolean().readonly(),
+  'oauth': z.boolean().readonly().optional(),
   'status': z.object({
   'phase': z.union([z.literal("failed"), z.literal("stopped"), z.literal("mounting"), z.literal("live")]).readonly(),
   'tools': z.array(z.string()).readonly(),
@@ -82,6 +83,7 @@ const _deepseek_ai_dsh_mcp_manager_mcpManager_test_parameter_0$schema = z.object
 })).readonly(),
   'toolCallTimeoutMs': z.number().readonly(),
   'failOnStartupError': z.boolean().readonly(),
+  'oauth': z.boolean().readonly().optional(),
 }).readonly(),
   'env': z.array(z.object({
   'name': z.string().readonly(),
@@ -119,6 +121,7 @@ const _deepseek_ai_dsh_mcp_manager_mcpManager_upsert_parameter_0$schema = z.obje
 })).readonly(),
   'toolCallTimeoutMs': z.number().readonly(),
   'failOnStartupError': z.boolean().readonly(),
+  'oauth': z.boolean().readonly().optional(),
 }).readonly(),
   'env': z.array(z.object({
   'name': z.string().readonly(),
@@ -149,6 +152,7 @@ const _deepseek_ai_dsh_mcp_manager_mcpManager_upsert_result$schema = z.union([z.
 })).readonly(),
   'toolCallTimeoutMs': z.number().readonly(),
   'failOnStartupError': z.boolean().readonly(),
+  'oauth': z.boolean().readonly().optional(),
   'status': z.object({
   'phase': z.union([z.literal("failed"), z.literal("stopped"), z.literal("mounting"), z.literal("live")]).readonly(),
   'tools': z.array(z.string()).readonly(),
@@ -191,6 +195,7 @@ const _deepseek_ai_dsh_mcp_manager_mcpManager_upsertJson_parameter_0$schema = z.
 })).readonly()]).readonly().optional(),
   'toolCallTimeoutMs': z.number().readonly().optional(),
   'failOnStartupError': z.boolean().readonly().optional(),
+  'oauth': z.boolean().readonly().optional(),
 }).readonly(),
   'env': z.array(z.object({
   'name': z.string().readonly(),
@@ -226,6 +231,7 @@ const _deepseek_ai_dsh_mcp_manager_mcpManager_upsertJson_result$schema = z.union
 })).readonly(),
   'toolCallTimeoutMs': z.number().readonly(),
   'failOnStartupError': z.boolean().readonly(),
+  'oauth': z.boolean().readonly().optional(),
   'status': z.object({
   'phase': z.union([z.literal("failed"), z.literal("stopped"), z.literal("mounting"), z.literal("live")]).readonly(),
   'tools': z.array(z.string()).readonly(),
@@ -347,6 +353,7 @@ const _deepseek_ai_dsh_mcp_manager_mcpManager_adopt_result$schema = z.union([z.o
 })).readonly(),
   'toolCallTimeoutMs': z.number().readonly(),
   'failOnStartupError': z.boolean().readonly(),
+  'oauth': z.boolean().readonly().optional(),
   'status': z.object({
   'phase': z.union([z.literal("failed"), z.literal("stopped"), z.literal("mounting"), z.literal("live")]).readonly(),
   'tools': z.array(z.string()).readonly(),

package/src/client/types.ts

@@ -44,6 +44,8 @@ export interface McpServerInput {
   readonly url: string
   readonly headers: readonly McpHeaderEntry[]
   readonly toolCallTimeoutMs: number
+  /** Explicit OAuth switch: only then does the Host attach an OAuth provider. */
+  readonly oauth: boolean
   readonly failOnStartupError: boolean
 }
 
@@ -86,6 +88,8 @@ export interface McpServerView {
   readonly env: readonly McpEnvVarView[]
   readonly toolCallTimeoutMs: number
   readonly failOnStartupError: boolean
+  /** Explicit OAuth switch of a managed row (absent for declared rows). */
+  readonly oauth?: boolean
   readonly status: McpServerStatus
   /** `plugin` = stored and mounted here; `cordis` = declared in a patch layer. */
   readonly source?: McpServerSource