From 7d8203139f94078c18537496f38623890bc0a520 Mon Sep 17 00:00:00 2001
From: zerob13 <zerob13@gmail.com>
Date: Fri, 3 Jul 2026 12:46:47 +0800
Subject: [PATCH 1/5] feat(mcp): add OAuth authentication

Add OAuth support for streamable HTTP/SSE MCP servers with loopback callback handling, external browser login, callback URL fallback, and renderer auth status refreshes. Also switch Codex OAuth to external browser callback flow and fix related MCP panel close controls.
---
 .../features/mcp-oauth-authentication/plan.md | 402 ++++++++++++++++++
 .../features/mcp-oauth-authentication/spec.md | 165 +++++++
 .../mcp-oauth-authentication/tasks.md         |  30 ++
 .../issues/mcp-oauth-callback-refresh/plan.md |   7 +
 .../issues/mcp-oauth-callback-refresh/spec.md |  17 +
 .../mcp-oauth-callback-refresh/tasks.md       |   7 +
 docs/issues/mcp-save-toast-i18n/plan.md       |   8 +
 docs/issues/mcp-save-toast-i18n/spec.md       |  18 +
 docs/issues/mcp-save-toast-i18n/tasks.md      |   7 +
 docs/issues/sheet-close-no-drag/plan.md       |   5 +
 docs/issues/sheet-close-no-drag/spec.md       |  13 +
 docs/issues/sheet-close-no-drag/tasks.md      |   5 +
 src/main/presenter/mcpPresenter/index.ts      |  63 ++-
 src/main/presenter/mcpPresenter/mcpClient.ts  |  19 +-
 .../presenter/mcpPresenter/mcpOAuthManager.ts | 372 ++++++++++++++++
 .../mcpPresenter/mcpOAuthProvider.ts          |  99 +++++
 .../presenter/mcpPresenter/oauthConstants.ts  |  16 +
 .../mcpPresenter/oauthCredentialStore.ts      | 171 ++++++++
 .../presenter/mcpPresenter/serverManager.ts   |  12 +-
 src/main/presenter/oauthLoopbackCallback.ts   | 240 +++++++++++
 src/main/presenter/oauthPresenter.ts          |   6 +
 src/main/presenter/openaiCodexAuth/index.ts   | 223 ++++------
 src/main/routes/index.ts                      |  45 ++
 src/renderer/api/McpClient.ts                 |  43 ++
 src/renderer/api/OAuthClient.ts               |  11 +
 .../settings/components/OpenAICodexOAuth.vue  |  79 +++-
 .../mcp-config/components/McpServerCard.vue   |  51 ++-
 .../mcp-config/components/McpServers.vue      | 114 ++++-
 src/renderer/src/i18n/da-DK/settings.json     |  18 +-
 src/renderer/src/i18n/de-DE/settings.json     |  18 +-
 src/renderer/src/i18n/en-US/settings.json     |  18 +-
 src/renderer/src/i18n/es-ES/settings.json     |  18 +-
 src/renderer/src/i18n/fa-IR/settings.json     |  18 +-
 src/renderer/src/i18n/fr-FR/settings.json     |  18 +-
 src/renderer/src/i18n/he-IL/settings.json     |  18 +-
 src/renderer/src/i18n/id-ID/settings.json     |  18 +-
 src/renderer/src/i18n/it-IT/settings.json     |  18 +-
 src/renderer/src/i18n/ja-JP/settings.json     |  18 +-
 src/renderer/src/i18n/ko-KR/settings.json     |  18 +-
 src/renderer/src/i18n/ms-MY/settings.json     |  18 +-
 src/renderer/src/i18n/pl-PL/settings.json     |  18 +-
 src/renderer/src/i18n/pt-BR/settings.json     |  18 +-
 src/renderer/src/i18n/ru-RU/settings.json     |  18 +-
 src/renderer/src/i18n/tr-TR/settings.json     |  18 +-
 src/renderer/src/i18n/vi-VN/settings.json     |  18 +-
 src/renderer/src/i18n/zh-CN/settings.json     |  18 +-
 src/renderer/src/i18n/zh-HK/settings.json     |  18 +-
 src/renderer/src/i18n/zh-TW/settings.json     |  18 +-
 .../src/pages/plugins/McpPluginsPage.vue      |   2 +-
 src/renderer/src/stores/mcp.ts                | 111 +++++
 .../components/ui/sheet/SheetContent.vue      |   1 +
 src/shared/contracts/events.ts                |   2 +
 src/shared/contracts/events/mcp.events.ts     |  11 +
 src/shared/contracts/routes.ts                |  11 +
 src/shared/contracts/routes/mcp.routes.ts     |  50 +++
 src/shared/contracts/routes/oauth.routes.ts   |   8 +
 .../types/presenters/core.presenter.d.ts      |  25 ++
 .../mcpPresenter/mcpOAuthManager.test.ts      |  49 +++
 test/main/presenter/openaiCodexAuth.test.ts   |  40 +-
 test/renderer/components/McpServers.test.ts   |  39 +-
 .../components/SheetContentDrag.test.ts       |  12 +
 test/renderer/stores/mcpStore.test.ts         |  49 +++
 62 files changed, 2785 insertions(+), 233 deletions(-)
 create mode 100644 docs/features/mcp-oauth-authentication/plan.md
 create mode 100644 docs/features/mcp-oauth-authentication/spec.md
 create mode 100644 docs/features/mcp-oauth-authentication/tasks.md
 create mode 100644 docs/issues/mcp-oauth-callback-refresh/plan.md
 create mode 100644 docs/issues/mcp-oauth-callback-refresh/spec.md
 create mode 100644 docs/issues/mcp-oauth-callback-refresh/tasks.md
 create mode 100644 docs/issues/mcp-save-toast-i18n/plan.md
 create mode 100644 docs/issues/mcp-save-toast-i18n/spec.md
 create mode 100644 docs/issues/mcp-save-toast-i18n/tasks.md
 create mode 100644 docs/issues/sheet-close-no-drag/plan.md
 create mode 100644 docs/issues/sheet-close-no-drag/spec.md
 create mode 100644 docs/issues/sheet-close-no-drag/tasks.md
 create mode 100644 src/main/presenter/mcpPresenter/mcpOAuthManager.ts
 create mode 100644 src/main/presenter/mcpPresenter/mcpOAuthProvider.ts
 create mode 100644 src/main/presenter/mcpPresenter/oauthConstants.ts
 create mode 100644 src/main/presenter/mcpPresenter/oauthCredentialStore.ts
 create mode 100644 src/main/presenter/oauthLoopbackCallback.ts
 create mode 100644 test/main/presenter/mcpPresenter/mcpOAuthManager.test.ts
 create mode 100644 test/renderer/components/SheetContentDrag.test.ts

diff --git a/docs/features/mcp-oauth-authentication/plan.md b/docs/features/mcp-oauth-authentication/plan.md
new file mode 100644
index 000000000..05732a287
--- /dev/null
+++ b/docs/features/mcp-oauth-authentication/plan.md
@@ -0,0 +1,402 @@
+# MCP And Codex OAuth Loopback Authentication Plan
+
+## Design Stance
+
+Do not build a general OAuth platform. The useful shared piece is only loopback callback handling:
+local listener, state/path validation, completion HTML, timeout cleanup, and pasted callback URL
+parsing. MCP OAuth and OpenAI Codex OAuth keep separate presenters, routes, statuses, and token
+stores.
+
+## Research Summary
+
+- MCP requires clients to discover protected resource metadata from `WWW-Authenticate` 401
+  challenges, falling back to well-known metadata URLs.
+- MCP clients must send the OAuth `resource` parameter in both authorization and token requests.
+- OpenCode handles remote MCP OAuth by detecting 401, attempting DCR when supported, and storing
+  tokens for future requests.
+- Codex documents OAuth for Streamable HTTP MCP servers through `codex mcp login <server-name>`.
+- OpenAI Codex provider auth already has PKCE/state/token refresh/storage; only its browser
+  transport changes from embedded `BrowserWindow` redirect interception to external browser +
+  loopback callback.
+- Linear's current MCP endpoint supports the exact happy path: 401 challenge, protected resource
+  metadata, authorization server metadata, DCR endpoint, PKCE S256, and `read write` scopes.
+- The installed MCP SDK already exposes:
+  - `OAuthClientProvider`
+  - `auth(provider, { serverUrl, authorizationCode })`
+  - `UnauthorizedError`
+  - `StreamableHTTPClientTransport.finishAuth(code)`
+  - automatic token attachment/refresh when an auth provider is present.
+
+## Affected Modules
+
+- `src/main/presenter/oauthLoopbackCallback.ts` or equivalent small helper
+  - Own `node:http` loopback listener, callback-page HTML, timeout cleanup, and pasted URL parsing.
+  - Must not know about MCP tokens, OpenAI Codex tokens, providers, or server configs.
+- `src/main/presenter/mcpPresenter/`
+  - Add a small OAuth manager, credential store, and SDK provider.
+  - Wire auth status into `ServerManager` and `McpClient`.
+- `src/main/presenter/openaiCodexAuth/index.ts`
+  - Replace embedded `BrowserWindow` auth with `shell.openExternal` + loopback callback.
+  - Add fallback completion from pasted callback URL while a pending browser flow exists.
+- `src/shared/types/presenters/core.presenter.d.ts`
+  - Add auth status/result types and `IMCPPresenter` methods.
+- `src/shared/contracts/routes/mcp.routes.ts`
+  - Add typed routes for auth status/start/logout.
+- `src/shared/contracts/events/mcp.events.ts`
+  - Add typed auth-status changed event.
+- `src/shared/types/openai-codex.ts`
+  - Keep existing status shape unless a pending paste hint needs an extra non-secret flag.
+- `src/shared/contracts/routes/oauth.routes.ts`
+  - Add an OpenAI Codex route for pasted callback URL completion.
+- `src/renderer/api/McpClient.ts`
+  - Add client wrappers for the new routes/events.
+- `src/renderer/api/OAuthClient.ts`
+  - Add OpenAI Codex callback URL fallback wrapper.
+- `src/renderer/src/stores/mcp.ts`
+  - Merge auth status into server list.
+- `src/renderer/src/components/mcp-config/components/McpServerCard.vue`
+  - Render authenticate action and status.
+- `src/renderer/settings/components/OpenAICodexOAuth.vue`
+  - Keep the primary browser sign-in action.
+  - Show paste-callback-url fallback only while status is `pending-browser`.
+- `src/renderer/src/i18n/*/mcp.json` or `settings.json`
+  - Add user-facing strings.
+
+## Shared Loopback Callback Helper
+
+Add one small helper used by both MCP OAuth and OpenAI Codex OAuth.
+
+Responsibilities:
+
+- Bind `node:http` to `127.0.0.1` with a provider-specific preferred loopback port and fall
+  back to an OS-assigned port if the preferred port is busy.
+- Use a stable provider callback path and a random OAuth state per auth attempt.
+- Accept only `GET`.
+- Require exact host, path, and state.
+- Return parsed callback data to the caller.
+- Render the same English completion page copy:
+
+```text
+Authentication complete. You can return to DeepChat. If DeepChat does not update, copy the full URL from your browser and paste it into DeepChat.
+```
+
+- Expose a `resolvePastedCallbackUrl(rawUrl)` helper that applies the same URL/state/path checks to
+  a user-pasted callback URL for the currently pending flow.
+- Always close the listener on success, failure, cancel, timeout, and app shutdown.
+
+Non-responsibilities:
+
+- No token exchange.
+- No token persistence.
+- No OAuth discovery.
+- No provider-specific error details in the browser callback page.
+
+## MCP Main Process Flow
+
+### 1. Startup Detection
+
+Normal server start must not open a browser.
+
+```text
+ServerManager.startServer(name)
+  -> McpClient.connect()
+     -> no bearer header:
+        - if stored OAuth tokens exist, pass McpOAuthProvider to StreamableHTTP transport
+        - if no tokens exist, connect unauthenticated
+     -> auth challenge / UnauthorizedError
+        - McpOAuthManager.discover(name, baseUrl)
+        - store status: required
+        - publish mcp.server.auth.changed
+        - keep server stopped with normal last error
+```
+
+If `customHeaders.Authorization` exists, keep current bearer behavior and do not switch to OAuth
+unless the user removes that header in config.
+
+### 2. User Starts Auth
+
+```text
+Renderer Authenticate button
+  -> mcp.startServerAuth(serverName)
+  -> McpPresenter.startServerAuth(serverName)
+  -> McpOAuthManager.startAuth(serverName, serverConfig)
+     -> start node:http loopback server on 127.0.0.1 random available port
+     -> create MCP SDK OAuthClientProvider with redirect_uri from that port
+     -> call SDK auth(provider, { serverUrl })
+     -> provider.redirectToAuthorization(url) opens shell.openExternal(url)
+     -> wait for callback
+     -> validate method, host, path, state
+     -> call SDK auth(provider, { serverUrl, authorizationCode })
+     -> provider.saveTokens(tokens)
+     -> close callback server
+     -> update status: authenticated
+  -> restart MCP server through existing ServerManager path
+```
+
+Use `auth(...)` for the auth route instead of a throwaway MCP `Client.connect(...)`. It is smaller
+and lets the SDK own discovery, DCR, resource indicators, PKCE token exchange, and refresh-token
+shape.
+
+### 3. Runtime Requests
+
+When tokens exist, `McpClient.connect()` creates `McpOAuthProvider` and passes it to
+`StreamableHTTPClientTransport`. The provider implements:
+
+- `redirectUrl`
+- `clientMetadata`
+- `clientInformation()`
+- `saveClientInformation()`
+- `tokens()`
+- `saveTokens()`
+- `redirectToAuthorization()`
+- `saveCodeVerifier()`
+- `codeVerifier()`
+- `invalidateCredentials()`
+- optional `discoveryState()` / `saveDiscoveryState()`
+
+In non-interactive runtime connection, `redirectToAuthorization()` must not open a browser. It
+updates auth status to `required` and returns/throws in a way that lets the startup path fail
+cleanly.
+
+### 4. Pasted Callback URL Fallback
+
+```text
+Renderer paste callback URL
+  -> mcp.completeServerAuthFromCallbackUrl(serverName, callbackUrl)
+  -> McpOAuthManager validates against pending flow
+  -> calls SDK auth(provider, { serverUrl, authorizationCode })
+  -> stores tokens
+  -> restarts server
+```
+
+Only allow this while that server has a pending interactive auth attempt. Do not accept arbitrary
+historical URLs.
+
+## OpenAI Codex Main Process Flow
+
+Replace embedded browser navigation with loopback auth.
+
+```text
+OAuthPresenter.startOpenAICodexBrowserLogin()
+  -> OpenAICodexAuth.startBrowserLogin()
+     -> cancel existing pending flow
+     -> create state + PKCE
+     -> start shared loopback callback helper
+     -> build authorize URL with redirect_uri from helper
+     -> shell.openExternal(authorizeUrl)
+     -> status: pending-browser
+     -> wait for callback
+     -> validate method, host, path, state
+     -> exchange authorization code with existing token endpoint logic
+     -> save tokens in existing OpenAICodexCredentialStore
+     -> status: authenticated
+```
+
+Fallback:
+
+```text
+Renderer Paste callback URL
+  -> oauth.openaiCodex.completeBrowserLoginFromUrl({ callbackUrl })
+  -> OpenAICodexAuth.completeBrowserLoginFromCallbackUrl(callbackUrl)
+     -> shared helper validates URL against pending flow
+     -> existing exchangeAuthorizationCode(code, verifier)
+     -> save tokens
+     -> status: authenticated
+```
+
+Do not remove `pending-browser`; its meaning changes from "embedded window is open" to "external
+browser auth is pending".
+
+## Data Model
+
+Add a shared status type:
+
+```ts
+export type McpServerAuthState =
+  | 'none'
+  | 'required'
+  | 'authenticating'
+  | 'authenticated'
+  | 'error'
+
+export interface McpServerAuthStatus {
+  serverName: string
+  state: McpServerAuthState
+  resource?: string
+  scopes?: string[]
+  authorizationServer?: string
+  error?: string
+  updatedAt: number
+}
+```
+
+Token store is separate from `MCPServerConfig`:
+
+```text
+app.getPath('userData')/mcp-oauth/credentials.json
+```
+
+Envelope:
+
+```ts
+interface McpOAuthCredentialEnvelope {
+  version: 1
+  storage: 'safeStorage' | 'file'
+  entries: Record<string, StoredMcpOAuthCredentials>
+  updatedAt: number
+}
+```
+
+Credential key:
+
+```text
+sha256(serverName + "\n" + baseUrl + "\n" + resource)
+```
+
+This avoids token sharing across renamed or re-pointed MCP entries. Rename losing auth is acceptable
+for the first increment.
+
+## Routes And Events
+
+Add routes:
+
+```text
+mcp.getServerAuthStatus     { serverName } -> { status }
+mcp.startServerAuth         { serverName } -> { status }
+mcp.completeServerAuthFromCallbackUrl { serverName, callbackUrl } -> { status }
+mcp.logoutServerAuth        { serverName } -> { status }
+```
+
+Add event:
+
+```text
+mcp.server.auth.changed     { status, version }
+```
+
+Renderer never receives tokens or client secrets.
+
+Add OpenAI Codex route:
+
+```text
+oauth.openaiCodex.completeBrowserLoginFromUrl { callbackUrl } -> { status }
+```
+
+## Callback Server Rules
+
+- Bind only to `127.0.0.1`.
+- Let the OS choose a free port with `server.listen(0, '127.0.0.1')`.
+- Use one random callback path per auth attempt, e.g. `/mcp/oauth/callback/<nonce>`.
+- Accept only `GET`.
+- Require exact host and callback path.
+- Require exact `state`.
+- On success, write this HTML body text:
+
+```text
+Authentication complete. You can return to DeepChat. If DeepChat does not update, copy the full URL from your browser and paste it into DeepChat.
+```
+
+- On invalid callback input, write the same completion-page copy without sensitive details; detailed
+  failure state belongs in DeepChat UI.
+- Timeout and close server after 5 minutes.
+- If the listener never receives the callback, the browser may show a loopback connection error.
+  The user can copy the full `http://127.0.0.1:...` URL from the address bar and paste it into
+  DeepChat while the auth attempt is still pending.
+
+## UI Details
+
+Server card state comes from structured auth status, not string parsing of the last error.
+
+```text
+states:
+  required       -> show [Authenticate]
+  authenticating -> show disabled [Authenticating...]
+  authenticated -> show "Authenticated" secondary text
+  error          -> show [Authenticate] and error tooltip
+```
+
+OpenAI Codex settings:
+
+```text
+states:
+  signed-out       -> show [Sign in with browser]
+  pending-browser  -> show [Cancel] and [Paste callback URL]
+  authenticated    -> show account summary and [Logout]
+  error            -> show error and [Sign in with browser]
+```
+
+MCP card sketch:
+
+```text
++---------------------------------------------+
+| icon name                         status ... |
+| description                                 |
+| auth text                 [Authenticate]    |
+|                                      toggle |
++---------------------------------------------+
+| tools | prompts | resources                 |
++---------------------------------------------+
+```
+
+## Tests
+
+- `test/main/presenter/mcpOAuthManager.test.ts`
+  - parses Linear-shaped `WWW-Authenticate`
+  - saves required/authenticated/error status
+  - validates callback state/path/host
+  - does not leak tokens in status
+- `test/main/presenter/mcpOAuthCredentialStore.test.ts`
+  - saves/loads safeStorage envelope
+  - falls back to file envelope
+  - removes one server credential on logout
+- `test/main/presenter/mcpClient.test.ts`
+  - passes OAuth provider only when stored tokens exist or interactive auth is explicit
+  - preserves bearer header priority
+  - marks auth required on OAuth 401 without opening browser
+- `test/main/presenter/oauthLoopbackCallback.test.ts`
+  - binds only to loopback
+  - validates method/host/path/state
+  - renders the shared completion copy
+  - parses pasted callback URLs with the same validation
+- `test/main/presenter/openaiCodexAuth.test.ts`
+  - opens external browser instead of creating `BrowserWindow`
+  - completes auth from loopback callback
+  - completes auth from pasted callback URL
+  - rejects mismatched or expired pasted callback URL
+- `test/main/routes/contracts.test.ts`
+  - validates new route/event contracts
+- `test/renderer/stores/mcpStore.test.ts`
+  - merges auth status into server list
+- `test/renderer/components/McpServerCard.test.ts`
+  - shows authenticate button only for required/error states
+  - emits authenticate click
+- `test/renderer/components/OpenAICodexOAuth.test.ts`
+  - shows paste fallback only while pending
+  - calls the new callback URL completion route
+
+Manual smoke after implementation:
+
+```text
+1. Add linear HTTP MCP: https://mcp.linear.app/mcp
+2. Enable MCP and the server
+3. Confirm card shows Authenticate and no browser auto-opens
+4. Click Authenticate
+5. Complete Linear OAuth
+6. Confirm callback page text
+7. Confirm server starts and tools load
+8. Restart DeepChat and confirm token reuse/refresh
+9. Start OpenAI Codex sign-in and confirm the system browser opens
+10. Complete Google login and confirm DeepChat authenticates
+11. Repeat with the callback listener stopped/unreachable and confirm pasted callback URL fallback
+```
+
+## Risks
+
+- Some enterprise servers reject DCR. Do not solve before a concrete server requires it; add
+  pre-registered `clientId/clientSecret` config only then.
+- Some providers require a fixed redirect URI. Use random loopback first; add an advanced fixed port
+  only if a real provider needs it.
+- Existing SDK behavior may auto-redirect when an auth provider is passed. Keep runtime provider
+  non-interactive and make browser opening explicit in `startServerAuth`.
+- External browser auth can leave users on a browser error page if the loopback listener is not
+  reachable. The paste fallback is the recovery path; keep it pending-flow-only to avoid accepting
+  stale callback URLs.
diff --git a/docs/features/mcp-oauth-authentication/spec.md b/docs/features/mcp-oauth-authentication/spec.md
new file mode 100644
index 000000000..671a0a15b
--- /dev/null
+++ b/docs/features/mcp-oauth-authentication/spec.md
@@ -0,0 +1,165 @@
+# MCP And Codex OAuth Loopback Authentication
+
+## User Need
+
+DeepChat can add Streamable HTTP MCP servers today, but OAuth-protected servers fail during
+startup and only surface as connection errors. A user who adds a server such as
+`https://mcp.linear.app/mcp` needs a visible authentication action on the MCP server card, then a
+browser authorization flow, then a local callback page that says:
+
+`Authentication complete. You can return to DeepChat. If DeepChat does not update, copy the full URL from your browser and paste it into DeepChat.`
+
+OpenAI Codex sign-in currently uses an embedded Electron browser window. That breaks for providers
+such as Google login that reject or degrade embedded browser auth. Codex sign-in should use the same
+external-browser + loopback-callback pattern, with a fallback that lets the user paste the full
+callback URL back into DeepChat for parsing if the browser could not reach the local listener.
+
+## Current Evidence
+
+- DeepChat already creates `StreamableHTTPClientTransport` in
+  `src/main/presenter/mcpPresenter/mcpClient.ts`, but its current `SimpleOAuthProvider` only wraps
+  an existing `Authorization: Bearer ...` header.
+- DeepChat already has reusable local auth pieces:
+  - PKCE/state helpers in `src/main/presenter/openaiCodexAuth/pkce.ts`.
+  - Safe token persistence pattern in `src/main/presenter/openaiCodexAuth/credentialStore.ts`.
+  - Existing OpenAI Codex OAuth status/routes/events in `src/main/presenter/openaiCodexAuth/`,
+    `src/shared/contracts/routes/oauth.routes.ts`, and
+    `src/shared/contracts/events/oauth.events.ts`.
+  - Loopback callback validation and completion HTML pattern in
+    `src/main/presenter/remoteControlPresenter/index.ts`.
+- On 2026-07-03, `https://mcp.linear.app/mcp` returned `401` with
+  `WWW-Authenticate: Bearer ... resource_metadata="https://mcp.linear.app/.well-known/oauth-protected-resource/mcp"`.
+- Linear protected resource metadata returned:
+  - `resource: "https://mcp.linear.app/mcp"`
+  - `authorization_servers: ["https://mcp.linear.app"]`
+  - `scopes_supported: ["read", "write"]`
+- Linear authorization server metadata returned `authorization_endpoint`, `token_endpoint`,
+  `registration_endpoint`, `code_challenge_methods_supported: ["S256"]`, and
+  `client_id_metadata_document_supported: true`.
+
+## External References
+
+- MCP authorization spec:
+  https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization
+- OpenAI Codex MCP docs:
+  https://developers.openai.com/codex/mcp
+- Linear Codex MCP integration:
+  https://linear.app/integrations/codex-mcp
+- OpenCode MCP OAuth docs:
+  https://opencode.ai/docs/mcp-servers/
+- MCP TypeScript SDK OAuth client interfaces:
+  `node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.d.ts`
+- MCP TypeScript SDK Streamable HTTP auth behavior:
+  `node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.d.ts`
+
+## Goals
+
+- Detect OAuth-required Streamable HTTP MCP servers during normal startup without opening a browser.
+- Show a first-class authenticate button on the affected MCP card.
+- Start a loopback callback server only when the user clicks authenticate/sign in.
+- Open the provider authorization URL in the user's external browser.
+- Complete the authorization code + PKCE flow, persist tokens securely, and reconnect the server.
+- Reuse the installed MCP SDK OAuth flow instead of hand-rolling discovery, DCR, token exchange,
+  refresh, and resource-indicator behavior.
+- Move OpenAI Codex OAuth from embedded `BrowserWindow` auth to external browser loopback auth.
+- Add a paste-callback-url fallback for OpenAI Codex and MCP auth attempts while a matching pending
+  flow still exists.
+- Use one shared callback-page helper for completion HTML copy.
+
+## Non-Goals
+
+- No new OAuth framework for every provider in the app.
+- No cloud sync of MCP OAuth tokens.
+- No device-code flow.
+- No first increment for SSE OAuth unless it falls out naturally from the same provider with no
+  extra UI or storage surface.
+- No enterprise static OAuth client UI in the first increment. Add it only when a real supported
+  server needs pre-registered client credentials and DCR/client metadata is insufficient.
+- No shared token store across MCP and OpenAI Codex; only the loopback callback page/listener helper
+  is shared.
+
+## Acceptance Criteria
+
+- Adding and enabling `linear` with `type: "http"` and `baseUrl:
+  "https://mcp.linear.app/mcp"` does not auto-open a browser.
+- If startup receives an OAuth challenge, the server card shows an authenticate action and a clear
+  authentication-required state.
+- Clicking authenticate starts a localhost callback server, opens the authorization URL, and waits
+  for the callback.
+- The callback accepts only the expected loopback host, path, method, and state.
+- Successful callback returns an HTML page containing exactly:
+  `Authentication complete. You can return to DeepChat. If DeepChat does not update, copy the full URL from your browser and paste it into DeepChat.`
+- Tokens and dynamic client information are stored under app user data using `safeStorage` when
+  available, with a `0600` file fallback.
+- Access tokens, refresh tokens, auth codes, and client secrets never go to renderer state, logs,
+  config sync, or MCP server config.
+- After successful auth, the MCP server restarts or reconnects and its tools/prompts/resources load
+  through the existing MCP presenter path.
+- Expired access tokens are refreshed through the SDK/provider path when a refresh token exists.
+- Invalid/expired credentials clear token status and return the card to the authenticate state.
+- Existing bearer-token MCP configs keep working; `customHeaders.Authorization` remains higher
+  priority than OAuth auto-detection.
+- OpenAI Codex sign-in opens the system browser with `shell.openExternal` and no longer loads the
+  OAuth provider in an embedded `BrowserWindow`.
+- If the OpenAI Codex loopback listener is unreachable but the provider redirects to the callback
+  URL, the user can paste that full URL into DeepChat and DeepChat completes the pending auth flow
+  after validating state.
+- The pasted URL fallback rejects missing, expired, mismatched, or already-consumed auth states.
+
+## UX Shape
+
+Normal stopped/running cards stay unchanged. Only OAuth-required servers gain the auth action:
+
+```text
++--------------------------------------------------+
+| L  linear                         Error   ...    |
+|    https://mcp.linear.app/mcp                     |
+|    Authentication required        [Authenticate]  |
+|                                                  o|
++--------------------------------------------------+
+|   wrench 0       prompt 0       resource 0        |
++--------------------------------------------------+
+```
+
+After successful auth:
+
+```text
++--------------------------------------------------+
+| L  linear                         Running ...    |
+|    https://mcp.linear.app/mcp                     |
+|    Authenticated                                  |
+|                                                  o|
++--------------------------------------------------+
+|   wrench 12      prompt 0       resource 0        |
++--------------------------------------------------+
+```
+
+OpenAI Codex settings keeps one primary sign-in action and gains a fallback paste action only while
+an external browser auth flow is pending:
+
+```text
++--------------------------------------------------+
+| OpenAI Codex                                     |
+| Not connected                                    |
+| [Sign in with browser]                           |
++--------------------------------------------------+
+
++--------------------------------------------------+
+| OpenAI Codex                                     |
+| Waiting for browser authentication               |
+| [Cancel] [Paste callback URL]                    |
++--------------------------------------------------+
+```
+
+## Constraints
+
+- Keep new renderer-main capability on typed routes/events and `src/renderer/api/*Client`.
+- Keep user-facing strings in i18n.
+- Keep implementation inside the MCP presenter boundary unless a shared route/type is required.
+- Prefer `node:http`, Web Crypto/Node crypto, Electron `safeStorage`, and the installed MCP SDK.
+- Use loopback only: `127.0.0.1` or `localhost`, never `0.0.0.0`.
+- Use a short auth timeout and always close the callback server.
+- Keep OAuth callback pages in English:
+  - `Authentication complete. You can return to DeepChat. If DeepChat does not update, copy the full URL from your browser and paste it into DeepChat.`
+- In-app paste fallback UI still uses the normal renderer i18n path.
+- No clarification marker remains; implementation can start from this spec.
diff --git a/docs/features/mcp-oauth-authentication/tasks.md b/docs/features/mcp-oauth-authentication/tasks.md
new file mode 100644
index 000000000..818a746dc
--- /dev/null
+++ b/docs/features/mcp-oauth-authentication/tasks.md
@@ -0,0 +1,30 @@
+# MCP OAuth Authentication Tasks
+
+Status: implementation complete, manual external OAuth smoke pending.
+
+- [x] Inspect current DeepChat MCP and OAuth code paths.
+- [x] Verify Linear MCP current OAuth challenge and metadata shape.
+- [x] Review MCP spec, Codex docs, OpenCode docs, and installed MCP SDK auth APIs.
+- [x] Write SDD spec, plan, and implementation tasks.
+- [x] Add OpenAI Codex external-browser OAuth and shared callback page requirements.
+- [x] Add a shared loopback callback helper for listener lifecycle, completion HTML, and
+      pasted URL parsing.
+- [x] Add shared MCP OAuth status types, route contracts, and event contract.
+- [x] Add OpenAI Codex pasted callback URL route contract.
+- [x] Add `McpOAuthCredentialStore` using `safeStorage` with `0600` file fallback.
+- [x] Add `McpOAuthProvider` implementing the SDK `OAuthClientProvider`.
+- [x] Add `McpOAuthManager` for discovery, status, loopback callback, SDK auth, logout, and event publish.
+- [x] Wire `ServerManager`/`McpClient` so startup detects OAuth requirement without opening a browser.
+- [x] Wire `McpPresenter` routes: get status, start auth, complete from callback URL, logout auth.
+- [x] Move OpenAI Codex OAuth from embedded BrowserWindow to external browser + loopback callback.
+- [x] Add OpenAI Codex pasted callback URL fallback while auth is pending.
+- [x] Wire renderer `McpClient` API and Pinia MCP store auth-status merge.
+- [x] Wire renderer `OAuthClient` API for Codex callback URL completion.
+- [x] Add authenticate action and authenticated/error states to `McpServerCard`.
+- [x] Add pending Codex paste fallback UI to `OpenAICodexOAuth`.
+- [x] Add i18n strings for auth states and actions.
+- [x] Add focused main tests for Codex external-browser and pasted callback URL flow.
+- [ ] Manual smoke against `https://mcp.linear.app/mcp`.
+- [ ] Manual smoke OpenAI Codex sign-in with Google through external browser.
+- [x] Run `pnpm run format`, `pnpm run i18n`, and `pnpm run lint`.
+- [x] Run typecheck and focused Codex auth tests.
diff --git a/docs/issues/mcp-oauth-callback-refresh/plan.md b/docs/issues/mcp-oauth-callback-refresh/plan.md
new file mode 100644
index 000000000..75bbc61f3
--- /dev/null
+++ b/docs/issues/mcp-oauth-callback-refresh/plan.md
@@ -0,0 +1,7 @@
+# Plan
+
+- Make stored OAuth tokens take precedence over stale MCP auth errors.
+- Make callback URL completion idempotent when credentials already exist.
+- Refresh the selected auth status when DeepChat regains focus during the callback dialog.
+- Add focused tests for the manager and renderer store/component behavior.
+- Run format, i18n, lint, typecheck, and focused tests.
diff --git a/docs/issues/mcp-oauth-callback-refresh/spec.md b/docs/issues/mcp-oauth-callback-refresh/spec.md
new file mode 100644
index 000000000..8bcf9de88
--- /dev/null
+++ b/docs/issues/mcp-oauth-callback-refresh/spec.md
@@ -0,0 +1,17 @@
+# MCP OAuth Callback Refresh
+
+## User Need
+
+After an MCP OAuth provider redirects back to the local callback page, DeepChat should update the MCP
+card automatically. If the callback was already consumed by the local listener, pasting the same URL
+must not overwrite an authenticated state with a stale "not pending" error.
+
+## Acceptance Criteria
+
+- Returning to DeepChat after browser authentication refreshes the selected MCP server auth status.
+- Pasting an already-consumed callback URL returns the authenticated status when credentials were
+  saved.
+- Starting auth for an already-authenticated server refreshes the card instead of reopening the
+  browser.
+- Servers without saved credentials still report a non-authenticated state when no auth flow is
+  pending.
diff --git a/docs/issues/mcp-oauth-callback-refresh/tasks.md b/docs/issues/mcp-oauth-callback-refresh/tasks.md
new file mode 100644
index 000000000..c87fdd5af
--- /dev/null
+++ b/docs/issues/mcp-oauth-callback-refresh/tasks.md
@@ -0,0 +1,7 @@
+# Tasks
+
+- [x] Fix MCP OAuth status precedence in the main process.
+- [x] Make completed callback URL paste idempotent.
+- [x] Refresh auth status when returning to the renderer callback dialog.
+- [x] Add focused tests.
+- [x] Run validation.
diff --git a/docs/issues/mcp-save-toast-i18n/plan.md b/docs/issues/mcp-save-toast-i18n/plan.md
new file mode 100644
index 000000000..74007e1e0
--- /dev/null
+++ b/docs/issues/mcp-save-toast-i18n/plan.md
@@ -0,0 +1,8 @@
+# Plan
+
+- Remove the accidental agent scope from `McpPluginsPage.vue`.
+- Add the missing `mcp.saveSuccess` and `mcp.saveFailed` keys to locale `settings.json` files.
+- Treat OAuth-required startup as a handled MCP toggle result when the auth status becomes
+  `required` or `authenticating`.
+- Cover the OAuth-required toggle path in the existing MCP store tests.
+- Run formatting, i18n, lint, typecheck, and focused MCP store tests.
diff --git a/docs/issues/mcp-save-toast-i18n/spec.md b/docs/issues/mcp-save-toast-i18n/spec.md
new file mode 100644
index 000000000..a70f591e7
--- /dev/null
+++ b/docs/issues/mcp-save-toast-i18n/spec.md
@@ -0,0 +1,18 @@
+# MCP Server Toggle Feedback
+
+## User Need
+
+The MCP settings page in the plugins surface must start or stop MCP servers when the user clicks a
+server switch. It must not save the current agent MCP policy and show a save toast.
+
+When a Streamable HTTP MCP server requires OAuth, enabling the server should put the card into the
+authentication-required state without showing a generic operation-failed toast.
+
+## Acceptance Criteria
+
+- The `plugins-mcp` page uses the global MCP toggle path.
+- Clicking a server switch no longer triggers `handleToggleAgentServer`.
+- The previous i18n key leak remains fixed if the agent-scoped path is used elsewhere.
+- Enabling an OAuth-required MCP server does not show the generic operation failed toast.
+- OAuth-required startup keeps the server enabled so authentication can restart it after completion.
+- Non-auth startup failures still roll back the enabled state and report failure.
diff --git a/docs/issues/mcp-save-toast-i18n/tasks.md b/docs/issues/mcp-save-toast-i18n/tasks.md
new file mode 100644
index 000000000..616b62e72
--- /dev/null
+++ b/docs/issues/mcp-save-toast-i18n/tasks.md
@@ -0,0 +1,7 @@
+# Tasks
+
+- [x] Remove accidental agent scope from the plugins MCP page.
+- [x] Add missing MCP toast keys.
+- [x] Suppress the generic failure result for OAuth-required startup.
+- [x] Add MCP store coverage for OAuth-required toggle startup.
+- [x] Run format, i18n, lint, typecheck, and focused MCP store tests.
diff --git a/docs/issues/sheet-close-no-drag/plan.md b/docs/issues/sheet-close-no-drag/plan.md
new file mode 100644
index 000000000..3fb505b43
--- /dev/null
+++ b/docs/issues/sheet-close-no-drag/plan.md
@@ -0,0 +1,5 @@
+# Plan
+
+- Add explicit Electron `no-drag` styling to the shared sheet close button.
+- Add a focused regression check that the sheet close button keeps the `no-drag` app region.
+- Run format, i18n, lint, typecheck, and the focused test.
diff --git a/docs/issues/sheet-close-no-drag/spec.md b/docs/issues/sheet-close-no-drag/spec.md
new file mode 100644
index 000000000..d6772f560
--- /dev/null
+++ b/docs/issues/sheet-close-no-drag/spec.md
@@ -0,0 +1,13 @@
+# Sheet Close Button Drag Region
+
+## User Need
+
+Sheet close buttons must remain clickable inside draggable Electron windows. The MCP server detail
+sheet and nested MCP tool sheet both use the shared sheet close button, so fixing the shared button
+should restore both close actions.
+
+## Acceptance Criteria
+
+- The shared sheet close button opts out of Electron window dragging.
+- MCP detail and tool sheet close buttons remain in the same visual position.
+- The fix does not change sheet open/close state ownership.
diff --git a/docs/issues/sheet-close-no-drag/tasks.md b/docs/issues/sheet-close-no-drag/tasks.md
new file mode 100644
index 000000000..42782dffa
--- /dev/null
+++ b/docs/issues/sheet-close-no-drag/tasks.md
@@ -0,0 +1,5 @@
+# Tasks
+
+- [x] Patch the shared sheet close button.
+- [x] Add focused regression coverage.
+- [x] Run validation.
diff --git a/src/main/presenter/mcpPresenter/index.ts b/src/main/presenter/mcpPresenter/index.ts
index 079be681b..c8796a2a2 100644
--- a/src/main/presenter/mcpPresenter/index.ts
+++ b/src/main/presenter/mcpPresenter/index.ts
@@ -12,11 +12,13 @@ import {
   Resource,
   PromptListEntry,
   McpSamplingRequestPayload,
-  McpSamplingDecision
+  McpSamplingDecision,
+  McpServerAuthStatus
 } from '@shared/presenter'
 import { ServerManager } from './serverManager'
 import { ToolManager } from './toolManager'
 import { McpRouterManager } from './mcprouterManager'
+import { McpOAuthManager } from './mcpOAuthManager'
 import { eventBus } from '@/eventbus'
 import { MCP_EVENTS } from '@/events'
 import { getErrorMessageLabels } from '@shared/i18n'
@@ -58,6 +60,7 @@ const normalizeToolAccessContext = (
 export class McpPresenter implements IMCPPresenter {
   private serverManager: ServerManager
   private toolManager: ToolManager
+  private mcpOAuthManager: McpOAuthManager
   private configPresenter: IConfigPresenter
   private isInitialized: boolean = false
   // McpRouter
@@ -94,7 +97,10 @@ export class McpPresenter implements IMCPPresenter {
 
     this.configPresenter = configPresenter || presenter.configPresenter
     this.cacheImage = cacheImage
-    this.serverManager = new ServerManager(this.configPresenter)
+    this.mcpOAuthManager = new McpOAuthManager(undefined, (serverName) =>
+      this.restartServerAfterAuthentication(serverName)
+    )
+    this.serverManager = new ServerManager(this.configPresenter, this.mcpOAuthManager)
     this.toolManager = new ToolManager(this.configPresenter, this.serverManager)
     // init mcprouter manager
     try {
@@ -141,7 +147,10 @@ export class McpPresenter implements IMCPPresenter {
       // If no configPresenter is provided, get it from presenter
       if (!this.configPresenter.getLanguage) {
         // Recreate managers
-        this.serverManager = new ServerManager(this.configPresenter)
+        this.mcpOAuthManager = new McpOAuthManager(undefined, (serverName) =>
+          this.restartServerAfterAuthentication(serverName)
+        )
+        this.serverManager = new ServerManager(this.configPresenter, this.mcpOAuthManager)
         this.toolManager = new ToolManager(this.configPresenter, this.serverManager)
       }
 
@@ -239,6 +248,21 @@ export class McpPresenter implements IMCPPresenter {
     }
   }
 
+  private async restartServerAfterAuthentication(serverName: string): Promise<void> {
+    const servers = await this.configPresenter.getMcpServers()
+    const serverConfig = servers[serverName]
+    if (!serverConfig?.enabled) {
+      return
+    }
+
+    try {
+      await this.serverManager.startServer(serverName)
+      this.emitServerStarted(serverName)
+    } catch (error) {
+      console.error(`[MCP] Failed to restart authenticated server ${serverName}:`, error)
+    }
+  }
+
   // =============== McpRouter marketplace APIs ===============
   async listMcpRouterServers(
     page: number,
@@ -499,6 +523,8 @@ export class McpPresenter implements IMCPPresenter {
     if (await this.isServerRunning(serverName)) {
       await this.stopServer(serverName)
     }
+    const servers = await this.configPresenter.getMcpServers()
+    this.mcpOAuthManager.logout(serverName, servers[serverName])
     await this.configPresenter.removeMcpServer(serverName)
   }
 
@@ -520,6 +546,37 @@ export class McpPresenter implements IMCPPresenter {
     return this.serverManager.getServerLastError(serverName)
   }
 
+  async getMcpServerAuthStatus(serverName: string): Promise<McpServerAuthStatus> {
+    const servers = await this.configPresenter.getMcpServers()
+    return this.mcpOAuthManager.getStatus(serverName, servers[serverName])
+  }
+
+  async startMcpServerAuth(serverName: string): Promise<McpServerAuthStatus> {
+    const servers = await this.configPresenter.getMcpServers()
+    const serverConfig = servers[serverName]
+    if (!serverConfig) {
+      throw new Error(`MCP server ${serverName} not found`)
+    }
+    return this.mcpOAuthManager.startAuth(serverName, serverConfig)
+  }
+
+  async completeMcpServerAuthFromCallbackUrl(
+    serverName: string,
+    callbackUrl: string
+  ): Promise<McpServerAuthStatus> {
+    const servers = await this.configPresenter.getMcpServers()
+    const serverConfig = servers[serverName]
+    if (!serverConfig) {
+      throw new Error(`MCP server ${serverName} not found`)
+    }
+    return this.mcpOAuthManager.completeAuthFromCallbackUrl(serverName, serverConfig, callbackUrl)
+  }
+
+  async logoutMcpServerAuth(serverName: string): Promise<McpServerAuthStatus> {
+    const servers = await this.configPresenter.getMcpServers()
+    return this.mcpOAuthManager.logout(serverName, servers[serverName])
+  }
+
   async getAllToolDefinitions(
     enabledMcpTools?: string[] | McpToolAccessContext
   ): Promise<MCPToolDefinition[]> {
diff --git a/src/main/presenter/mcpPresenter/mcpClient.ts b/src/main/presenter/mcpPresenter/mcpClient.ts
index 205937265..21a2bbf90 100644
--- a/src/main/presenter/mcpPresenter/mcpClient.ts
+++ b/src/main/presenter/mcpPresenter/mcpClient.ts
@@ -27,6 +27,7 @@ import { getInMemoryServer } from './inMemoryServers/builder'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
 import { RuntimeHelper } from '@/lib/runtimeHelper'
 import { terminateProcessTree } from '@/lib/agentRuntime/processTree'
+import type { McpOAuthManager } from './mcpOAuthManager'
 import {
   PromptListEntry,
   ToolCallResult,
@@ -36,7 +37,8 @@ import {
   Resource,
   ChatMessage,
   McpSamplingRequestPayload,
-  McpSamplingDecision
+  McpSamplingDecision,
+  MCPServerConfig
 } from '@shared/presenter'
 
 const ALLOWED_SAMPLING_IMAGE_MIME_TYPES = new Set([
@@ -132,6 +134,7 @@ export class McpClient {
   private connectionTimeout: NodeJS.Timeout | null = null
   private npmRegistry: string | null = null
   private uvRegistry: string | null = null
+  private mcpOAuthManager?: McpOAuthManager
   private readonly runtimeHelper = RuntimeHelper.getInstance()
 
   // Session management
@@ -147,12 +150,14 @@ export class McpClient {
     serverName: string,
     serverConfig: Record<string, unknown>,
     npmRegistry: string | null = null,
-    uvRegistry: string | null = null
+    uvRegistry: string | null = null,
+    mcpOAuthManager?: McpOAuthManager
   ) {
     this.serverName = serverName
     this.serverConfig = serverConfig
     this.npmRegistry = npmRegistry
     this.uvRegistry = uvRegistry
+    this.mcpOAuthManager = mcpOAuthManager
     this.runtimeHelper.initializeRuntimes()
   }
 
@@ -227,6 +232,12 @@ export class McpClient {
         authProvider = new SimpleOAuthProvider(customHeaders.Authorization)
         delete customHeaders.Authorization // Remove from headers as it will be handled by AuthProvider
       }
+      const runtimeOAuthProvider =
+        authProvider ??
+        this.mcpOAuthManager?.createRuntimeProvider(
+          this.serverName,
+          this.serverConfig as Partial<MCPServerConfig>
+        )
 
       if (this.serverConfig.type === 'inmemory') {
         const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair()
@@ -420,7 +431,7 @@ export class McpClient {
         this.transport = new SSEClientTransport(new URL(this.serverConfig.baseUrl as string), {
           requestInit: { headers: customHeaders },
           // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          authProvider: (authProvider ?? undefined) as any
+          authProvider: (runtimeOAuthProvider ?? undefined) as any
         })
       } else if (this.serverConfig.baseUrl && this.serverConfig.type === 'http') {
         this.transport = new StreamableHTTPClientTransport(
@@ -428,7 +439,7 @@ export class McpClient {
           {
             requestInit: { headers: customHeaders },
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            authProvider: (authProvider ?? undefined) as any
+            authProvider: (runtimeOAuthProvider ?? undefined) as any
           }
         )
       } else {
diff --git a/src/main/presenter/mcpPresenter/mcpOAuthManager.ts b/src/main/presenter/mcpPresenter/mcpOAuthManager.ts
new file mode 100644
index 000000000..ebf842b36
--- /dev/null
+++ b/src/main/presenter/mcpPresenter/mcpOAuthManager.ts
@@ -0,0 +1,372 @@
+import crypto from 'crypto'
+import logger from '@shared/logger'
+import { auth, UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js'
+import type { MCPServerConfig, McpServerAuthStatus } from '@shared/presenter'
+import { publishDeepchatEvent } from '@/routes/publishDeepchatEvent'
+import {
+  resolveOAuthLoopbackCallbackUrl,
+  startOAuthLoopbackCallbackSession,
+  type OAuthLoopbackCallbackSession
+} from '../oauthLoopbackCallback'
+import {
+  MCP_OAUTH_CALLBACK_TIMEOUT_MS,
+  MCP_OAUTH_REDIRECT_PATH,
+  MCP_OAUTH_REDIRECT_PORT
+} from './oauthConstants'
+import { McpOAuthCredentialStore } from './oauthCredentialStore'
+import { DeepChatMcpOAuthProvider } from './mcpOAuthProvider'
+
+type PendingMcpOAuthFlow = {
+  serverName: string
+  serverUrl: string
+  credentialKey: string
+  state: string
+  provider: DeepChatMcpOAuthProvider
+  callbackSession: OAuthLoopbackCallbackSession
+  flowPromise?: Promise<void>
+}
+
+const OAUTH_AUTH_ERROR_PATTERNS = [
+  '401',
+  'unauthorized',
+  'auth required',
+  'authentication required',
+  'authorization required',
+  'invalid_token',
+  'no auth provider'
+]
+
+function createState(): string {
+  return crypto.randomBytes(16).toString('base64url')
+}
+
+function sanitizeError(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error)
+  return message
+    .replace(/access_token["\s:=]+[^"'\s,}]+/gi, 'access_token:[redacted]')
+    .replace(/refresh_token["\s:=]+[^"'\s,}]+/gi, 'refresh_token:[redacted]')
+    .replace(/Bearer\s+[A-Za-z0-9._~+/-]+/g, 'Bearer [redacted]')
+}
+
+function hasBearerHeader(config?: Partial<MCPServerConfig> | null): boolean {
+  const authorization = config?.customHeaders?.Authorization || config?.customHeaders?.authorization
+  return (
+    typeof authorization === 'string' && authorization.trim().toLowerCase().startsWith('bearer ')
+  )
+}
+
+function isRemoteOAuthCapable(config?: Partial<MCPServerConfig> | null): boolean {
+  return Boolean(
+    config?.baseUrl && (config.type === 'http' || config.type === 'sse') && !hasBearerHeader(config)
+  )
+}
+
+function isOAuthError(error: unknown): boolean {
+  if (error instanceof UnauthorizedError) {
+    return true
+  }
+
+  const status = (error as { code?: unknown; status?: unknown; httpStatus?: unknown } | undefined)
+    ?.code
+  if (status === 401) {
+    return true
+  }
+
+  const message = (error instanceof Error ? error.message : String(error)).toLowerCase()
+  return OAUTH_AUTH_ERROR_PATTERNS.some((pattern) => message.includes(pattern))
+}
+
+export class McpOAuthManager {
+  private readonly store: McpOAuthCredentialStore
+  private readonly statuses = new Map<string, McpServerAuthStatus>()
+  private readonly pendingFlows = new Map<string, PendingMcpOAuthFlow>()
+
+  constructor(
+    store = new McpOAuthCredentialStore(),
+    private readonly onAuthenticated?: (serverName: string) => void | Promise<void>
+  ) {
+    this.store = store
+  }
+
+  getStatus(serverName: string, config?: Partial<MCPServerConfig> | null): McpServerAuthStatus {
+    if (!isRemoteOAuthCapable(config)) {
+      return {
+        serverName,
+        state: hasBearerHeader(config) ? 'authenticated' : 'unsupported',
+        authenticated: hasBearerHeader(config),
+        storage: this.store.getStorageState()
+      }
+    }
+
+    const pending = this.pendingFlows.get(serverName)
+    if (pending) {
+      return {
+        serverName,
+        state: 'authenticating',
+        authenticated: false,
+        storage: this.store.getStorageState()
+      }
+    }
+
+    const entry = this.store.load(
+      this.getCredentialKey(serverName, config as Partial<MCPServerConfig>)
+    )
+    if (entry?.tokens?.access_token) {
+      return {
+        serverName,
+        state: 'authenticated',
+        authenticated: true,
+        updatedAt: entry.updatedAt,
+        storage: this.store.getStorageState()
+      }
+    }
+
+    const existing = this.statuses.get(serverName)
+    if (existing?.state === 'required' || existing?.state === 'error') {
+      return existing
+    }
+
+    return {
+      serverName,
+      state: 'none',
+      authenticated: false,
+      storage: this.store.getStorageState()
+    }
+  }
+
+  createRuntimeProvider(
+    serverName: string,
+    config: Partial<MCPServerConfig>
+  ): DeepChatMcpOAuthProvider | undefined {
+    if (!isRemoteOAuthCapable(config)) {
+      return undefined
+    }
+
+    const credentialKey = this.getCredentialKey(serverName, config)
+    if (!this.store.load(credentialKey)?.tokens?.access_token) {
+      return undefined
+    }
+
+    return new DeepChatMcpOAuthProvider({
+      store: this.store,
+      credentialKey,
+      redirectUrl: this.getDefaultRedirectUri(),
+      interactive: false
+    })
+  }
+
+  handleConnectionError(
+    serverName: string,
+    config: Partial<MCPServerConfig>,
+    error: unknown
+  ): boolean {
+    if (!isRemoteOAuthCapable(config) || !isOAuthError(error)) {
+      return false
+    }
+
+    this.setStatus({
+      serverName,
+      state: 'required',
+      authenticated: false,
+      error: sanitizeError(error),
+      storage: this.store.getStorageState()
+    })
+    return true
+  }
+
+  async startAuth(
+    serverName: string,
+    config: Partial<MCPServerConfig>
+  ): Promise<McpServerAuthStatus> {
+    if (!isRemoteOAuthCapable(config) || !config.baseUrl) {
+      throw new Error('MCP server does not support OAuth authentication')
+    }
+
+    this.cancelPendingFlow(serverName)
+
+    const state = createState()
+    const callbackSession = await startOAuthLoopbackCallbackSession({
+      expectedState: state,
+      path: MCP_OAUTH_REDIRECT_PATH,
+      preferredPort: MCP_OAUTH_REDIRECT_PORT,
+      redirectHost: 'localhost',
+      timeoutMs: MCP_OAUTH_CALLBACK_TIMEOUT_MS,
+      invalidCallbackMessage: 'Invalid MCP OAuth callback'
+    })
+    const credentialKey = this.getCredentialKey(serverName, config)
+    const provider = new DeepChatMcpOAuthProvider({
+      store: this.store,
+      credentialKey,
+      redirectUrl: callbackSession.redirectUri,
+      state,
+      interactive: true
+    })
+    const flow: PendingMcpOAuthFlow = {
+      serverName,
+      serverUrl: config.baseUrl,
+      credentialKey,
+      state,
+      provider,
+      callbackSession
+    }
+
+    this.pendingFlows.set(serverName, flow)
+    this.setStatus({
+      serverName,
+      state: 'authenticating',
+      authenticated: false,
+      storage: this.store.getStorageState()
+    })
+
+    try {
+      const result = await auth(provider, { serverUrl: config.baseUrl })
+      if (result === 'AUTHORIZED') {
+        this.finishAuthenticatedFlow(flow)
+        return this.getStatus(serverName, config)
+      }
+
+      flow.flowPromise = callbackSession
+        .waitForCallback()
+        .then((callback) => this.finishAuthFlow(flow, callback.code))
+        .catch((error) => this.failAuthFlow(flow, error))
+
+      return this.getStatus(serverName, config)
+    } catch (error) {
+      this.failAuthFlow(flow, error)
+      return this.getStatus(serverName, config)
+    }
+  }
+
+  async completeAuthFromCallbackUrl(
+    serverName: string,
+    config: Partial<MCPServerConfig>,
+    callbackUrl: string
+  ): Promise<McpServerAuthStatus> {
+    const flow = this.pendingFlows.get(serverName)
+    if (!flow) {
+      const status = this.getStatus(serverName, config)
+      if (status.authenticated) {
+        return status
+      }
+
+      this.setStatus({
+        serverName,
+        state: 'error',
+        authenticated: false,
+        error: 'MCP OAuth authentication is not pending',
+        storage: this.store.getStorageState()
+      })
+      return this.getStatus(serverName, config)
+    }
+
+    const resolution = flow.callbackSession.resolveCallbackUrl(callbackUrl)
+    if (resolution.kind === 'not-found') {
+      this.setStatus({
+        serverName,
+        state: 'error',
+        authenticated: false,
+        error: 'MCP OAuth callback URL is invalid',
+        storage: this.store.getStorageState()
+      })
+      return this.getStatus(serverName, config)
+    }
+
+    await flow.flowPromise
+    return this.getStatus(serverName, config)
+  }
+
+  logout(serverName: string, config?: Partial<MCPServerConfig> | null): McpServerAuthStatus {
+    this.cancelPendingFlow(serverName)
+    if (config) {
+      this.store.clearEntry(this.getCredentialKey(serverName, config))
+    }
+    this.setStatus({
+      serverName,
+      state: 'none',
+      authenticated: false,
+      storage: this.store.getStorageState()
+    })
+    return this.getStatus(serverName, config)
+  }
+
+  private async finishAuthFlow(flow: PendingMcpOAuthFlow, code: string): Promise<void> {
+    try {
+      await auth(flow.provider, {
+        serverUrl: flow.serverUrl,
+        authorizationCode: code
+      })
+      this.finishAuthenticatedFlow(flow)
+    } catch (error) {
+      this.failAuthFlow(flow, error)
+    }
+  }
+
+  private finishAuthenticatedFlow(flow: PendingMcpOAuthFlow): void {
+    this.pendingFlows.delete(flow.serverName)
+    flow.callbackSession.close()
+    const entry = this.store.load(flow.credentialKey)
+    this.setStatus({
+      serverName: flow.serverName,
+      state: 'authenticated',
+      authenticated: true,
+      updatedAt: entry?.updatedAt || Date.now(),
+      storage: this.store.getStorageState()
+    })
+
+    void Promise.resolve(this.onAuthenticated?.(flow.serverName)).catch((error) => {
+      logger.warn(
+        '[MCP OAuth] Failed to restart server after authentication:',
+        sanitizeError(error)
+      )
+    })
+  }
+
+  private failAuthFlow(flow: PendingMcpOAuthFlow, error: unknown): void {
+    if (this.pendingFlows.get(flow.serverName) !== flow) {
+      return
+    }
+
+    this.pendingFlows.delete(flow.serverName)
+    flow.callbackSession.close()
+    this.setStatus({
+      serverName: flow.serverName,
+      state: 'error',
+      authenticated: false,
+      error: sanitizeError(error),
+      storage: this.store.getStorageState()
+    })
+  }
+
+  private cancelPendingFlow(serverName: string): void {
+    const pending = this.pendingFlows.get(serverName)
+    if (!pending) {
+      return
+    }
+
+    pending.callbackSession.close()
+    this.pendingFlows.delete(serverName)
+  }
+
+  private setStatus(status: McpServerAuthStatus): void {
+    this.statuses.set(status.serverName, status)
+    publishDeepchatEvent('mcp.server.auth.changed', {
+      serverName: status.serverName,
+      status,
+      version: Date.now()
+    })
+  }
+
+  private getCredentialKey(serverName: string, config: Partial<MCPServerConfig>): string {
+    const baseUrl = config.baseUrl || ''
+    return crypto
+      .createHash('sha256')
+      .update(`${serverName}\n${config.type || ''}\n${baseUrl}`)
+      .digest('hex')
+  }
+
+  private getDefaultRedirectUri(): string {
+    return `http://localhost:${MCP_OAUTH_REDIRECT_PORT}${MCP_OAUTH_REDIRECT_PATH}`
+  }
+}
+
+export { isRemoteOAuthCapable, resolveOAuthLoopbackCallbackUrl }
diff --git a/src/main/presenter/mcpPresenter/mcpOAuthProvider.ts b/src/main/presenter/mcpPresenter/mcpOAuthProvider.ts
new file mode 100644
index 000000000..4a0ed56f3
--- /dev/null
+++ b/src/main/presenter/mcpPresenter/mcpOAuthProvider.ts
@@ -0,0 +1,99 @@
+import { shell } from 'electron'
+import type {
+  OAuthClientProvider,
+  OAuthDiscoveryState
+} from '@modelcontextprotocol/sdk/client/auth.js'
+import type {
+  OAuthClientInformationMixed,
+  OAuthClientMetadata,
+  OAuthTokens
+} from '@modelcontextprotocol/sdk/shared/auth.js'
+import type { McpOAuthCredentialStore } from './oauthCredentialStore'
+
+export type DeepChatMcpOAuthProviderOptions = {
+  store: McpOAuthCredentialStore
+  credentialKey: string
+  redirectUrl: string
+  state?: string
+  interactive?: boolean
+}
+
+export class DeepChatMcpOAuthProvider implements OAuthClientProvider {
+  private readonly store: McpOAuthCredentialStore
+  private readonly credentialKey: string
+  private readonly expectedState?: string
+  private readonly interactive: boolean
+
+  constructor(private readonly options: DeepChatMcpOAuthProviderOptions) {
+    this.store = options.store
+    this.credentialKey = options.credentialKey
+    this.expectedState = options.state
+    this.interactive = Boolean(options.interactive)
+  }
+
+  get redirectUrl(): string {
+    return this.options.redirectUrl
+  }
+
+  get clientMetadata(): OAuthClientMetadata {
+    return {
+      client_name: 'DeepChat',
+      redirect_uris: [this.options.redirectUrl],
+      grant_types: ['authorization_code', 'refresh_token'],
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none'
+    }
+  }
+
+  state(): string {
+    return this.expectedState || ''
+  }
+
+  clientInformation(): OAuthClientInformationMixed | undefined {
+    return this.store.load(this.credentialKey)?.clientInformation
+  }
+
+  saveClientInformation(clientInformation: OAuthClientInformationMixed): void {
+    this.store.saveEntry(this.credentialKey, { clientInformation })
+  }
+
+  tokens(): OAuthTokens | undefined {
+    return this.store.load(this.credentialKey)?.tokens
+  }
+
+  saveTokens(tokens: OAuthTokens): void {
+    this.store.saveEntry(this.credentialKey, { tokens })
+  }
+
+  async redirectToAuthorization(authorizationUrl: URL): Promise<void> {
+    if (!this.interactive) {
+      throw new Error('MCP OAuth authentication is required')
+    }
+
+    await shell.openExternal(authorizationUrl.toString())
+  }
+
+  saveCodeVerifier(codeVerifier: string): void {
+    this.store.saveEntry(this.credentialKey, { codeVerifier })
+  }
+
+  codeVerifier(): string {
+    const codeVerifier = this.store.load(this.credentialKey)?.codeVerifier
+    if (!codeVerifier) {
+      throw new Error('MCP OAuth code verifier is unavailable')
+    }
+    return codeVerifier
+  }
+
+  invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): void {
+    this.store.clearEntryScope(this.credentialKey, scope)
+  }
+
+  saveDiscoveryState(state: OAuthDiscoveryState): void {
+    this.store.saveEntry(this.credentialKey, { discoveryState: state })
+  }
+
+  discoveryState(): OAuthDiscoveryState | undefined {
+    return this.store.load(this.credentialKey)?.discoveryState
+  }
+}
diff --git a/src/main/presenter/mcpPresenter/oauthConstants.ts b/src/main/presenter/mcpPresenter/oauthConstants.ts
new file mode 100644
index 000000000..c91aa4176
--- /dev/null
+++ b/src/main/presenter/mcpPresenter/oauthConstants.ts
@@ -0,0 +1,16 @@
+function getPortEnv(name: string, fallback: number): number {
+  const value = Number(process.env[name])
+  return Number.isInteger(value) && value >= 1 && value <= 65535 ? value : fallback
+}
+
+function getNumberEnv(name: string, fallback: number): number {
+  const value = Number(process.env[name])
+  return Number.isFinite(value) && value > 0 ? value : fallback
+}
+
+export const MCP_OAUTH_REDIRECT_PORT = getPortEnv('DEEPCHAT_MCP_OAUTH_REDIRECT_PORT', 1456)
+export const MCP_OAUTH_REDIRECT_PATH = '/mcp/oauth/callback'
+export const MCP_OAUTH_CALLBACK_TIMEOUT_MS = getNumberEnv(
+  'DEEPCHAT_MCP_OAUTH_CALLBACK_TIMEOUT_MS',
+  10 * 60 * 1000
+)
diff --git a/src/main/presenter/mcpPresenter/oauthCredentialStore.ts b/src/main/presenter/mcpPresenter/oauthCredentialStore.ts
new file mode 100644
index 000000000..f73016428
--- /dev/null
+++ b/src/main/presenter/mcpPresenter/oauthCredentialStore.ts
@@ -0,0 +1,171 @@
+import * as fs from 'fs'
+import * as path from 'path'
+import { app, safeStorage } from 'electron'
+import type { OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js'
+import type {
+  OAuthClientInformationMixed,
+  OAuthTokens
+} from '@modelcontextprotocol/sdk/shared/auth.js'
+
+export type McpOAuthCredentialStorage = 'safeStorage' | 'file' | 'none'
+
+export type McpOAuthCredentialEntry = {
+  tokens?: OAuthTokens
+  clientInformation?: OAuthClientInformationMixed
+  codeVerifier?: string
+  discoveryState?: OAuthDiscoveryState
+  updatedAt: number
+}
+
+type McpOAuthCredentialData = Record<string, McpOAuthCredentialEntry>
+
+type StoredCredentialEnvelope =
+  | {
+      version: 1
+      storage: 'safeStorage'
+      wrapped: string
+      updatedAt: number
+    }
+  | {
+      version: 1
+      storage: 'file'
+      entries: McpOAuthCredentialData
+      updatedAt: number
+    }
+
+export class McpOAuthCredentialStore {
+  private readonly filePath: string
+
+  constructor(filePath?: string) {
+    this.filePath = filePath || path.join(app.getPath('userData'), 'mcp-oauth', 'credentials.json')
+  }
+
+  getStorageState(): McpOAuthCredentialStorage {
+    try {
+      return safeStorage.isEncryptionAvailable() ? 'safeStorage' : 'file'
+    } catch {
+      return 'file'
+    }
+  }
+
+  load(key: string): McpOAuthCredentialEntry | null {
+    return this.loadAll()[key] || null
+  }
+
+  saveEntry(key: string, entry: Partial<McpOAuthCredentialEntry>): McpOAuthCredentialEntry {
+    const entries = this.loadAll()
+    const next = {
+      ...(entries[key] || { updatedAt: Date.now() }),
+      ...entry,
+      updatedAt: Date.now()
+    }
+    entries[key] = next
+    this.saveAll(entries)
+    return next
+  }
+
+  clearEntry(key: string): void {
+    const entries = this.loadAll()
+    if (!entries[key]) {
+      return
+    }
+    delete entries[key]
+    this.saveAll(entries)
+  }
+
+  clearEntryScope(
+    key: string,
+    scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'
+  ): void {
+    if (scope === 'all') {
+      this.clearEntry(key)
+      return
+    }
+
+    const current = this.load(key)
+    if (!current) {
+      return
+    }
+
+    const next: McpOAuthCredentialEntry = { ...current, updatedAt: Date.now() }
+    if (scope === 'client') {
+      delete next.clientInformation
+    } else if (scope === 'tokens') {
+      delete next.tokens
+    } else if (scope === 'verifier') {
+      delete next.codeVerifier
+    } else if (scope === 'discovery') {
+      delete next.discoveryState
+    }
+
+    this.saveEntry(key, next)
+  }
+
+  private loadAll(): McpOAuthCredentialData {
+    try {
+      if (!fs.existsSync(this.filePath)) {
+        return {}
+      }
+
+      const envelope = JSON.parse(fs.readFileSync(this.filePath, 'utf-8')) as
+        | StoredCredentialEnvelope
+        | undefined
+      if (!envelope || envelope.version !== 1) {
+        return {}
+      }
+
+      if (envelope.storage === 'file') {
+        return this.normalizeEntries(envelope.entries)
+      }
+
+      const raw = safeStorage.decryptString(Buffer.from(envelope.wrapped, 'base64'))
+      return this.normalizeEntries(JSON.parse(raw) as McpOAuthCredentialData)
+    } catch {
+      return {}
+    }
+  }
+
+  private saveAll(entries: McpOAuthCredentialData): void {
+    fs.mkdirSync(path.dirname(this.filePath), { recursive: true, mode: 0o700 })
+    const normalized = this.normalizeEntries(entries)
+    const now = Date.now()
+    const envelope: StoredCredentialEnvelope =
+      this.getStorageState() === 'safeStorage'
+        ? {
+            version: 1,
+            storage: 'safeStorage',
+            wrapped: safeStorage.encryptString(JSON.stringify(normalized)).toString('base64'),
+            updatedAt: now
+          }
+        : {
+            version: 1,
+            storage: 'file',
+            entries: normalized,
+            updatedAt: now
+          }
+
+    fs.writeFileSync(this.filePath, JSON.stringify(envelope, null, 2), {
+      encoding: 'utf-8',
+      mode: 0o600
+    })
+  }
+
+  private normalizeEntries(entries: McpOAuthCredentialData | undefined): McpOAuthCredentialData {
+    if (!entries || typeof entries !== 'object') {
+      return {}
+    }
+
+    return Object.fromEntries(
+      Object.entries(entries).map(([key, entry]) => [
+        key,
+        {
+          tokens: entry.tokens,
+          clientInformation: entry.clientInformation,
+          codeVerifier: entry.codeVerifier,
+          discoveryState: entry.discoveryState,
+          updatedAt: Number.isFinite(entry.updatedAt) ? entry.updatedAt : Date.now()
+        }
+      ])
+    )
+  }
+}
diff --git a/src/main/presenter/mcpPresenter/serverManager.ts b/src/main/presenter/mcpPresenter/serverManager.ts
index 17886b5d3..d4e893eaf 100644
--- a/src/main/presenter/mcpPresenter/serverManager.ts
+++ b/src/main/presenter/mcpPresenter/serverManager.ts
@@ -7,6 +7,7 @@ import { eventBus } from '@/eventbus'
 import { MCP_EVENTS } from '@/events'
 import { getErrorMessageLabels } from '@shared/i18n'
 import { publishDeepchatEvent } from '@/routes/publishDeepchatEvent'
+import type { McpOAuthManager } from './mcpOAuthManager'
 
 const NPM_REGISTRY_LIST = [
   'https://registry.npmmirror.com/',
@@ -20,9 +21,11 @@ export class ServerManager {
   private configPresenter: IConfigPresenter
   private npmRegistry: string | null = null
   private uvRegistry: string | null = null
+  private mcpOAuthManager?: McpOAuthManager
 
-  constructor(configPresenter: IConfigPresenter) {
+  constructor(configPresenter: IConfigPresenter, mcpOAuthManager?: McpOAuthManager) {
     this.configPresenter = configPresenter
+    this.mcpOAuthManager = mcpOAuthManager
     this.loadRegistryFromCache()
   }
 
@@ -242,7 +245,8 @@ export class ServerManager {
         name,
         serverConfig as unknown as Record<string, unknown>,
         npmRegistry,
-        this.uvRegistry
+        this.uvRegistry,
+        this.mcpOAuthManager
       )
       this.clients.set(name, client)
 
@@ -255,8 +259,10 @@ export class ServerManager {
       // Remove client reference
       this.clients.delete(name)
       this.setServerLastError(name, error)
+      const authHandled =
+        this.mcpOAuthManager?.handleConnectionError(name, serverConfig, error) ?? false
 
-      if (!this.isPluginOwnedServerConfig(serverConfig)) {
+      if (!authHandled && !this.isPluginOwnedServerConfig(serverConfig)) {
         // Send global error notification only for normal MCP servers.
         this.sendMcpConnectionError(name, error)
       }
diff --git a/src/main/presenter/oauthLoopbackCallback.ts b/src/main/presenter/oauthLoopbackCallback.ts
new file mode 100644
index 000000000..02c142c9e
--- /dev/null
+++ b/src/main/presenter/oauthLoopbackCallback.ts
@@ -0,0 +1,240 @@
+import * as http from 'http'
+import { URL } from 'url'
+
+export const OAUTH_CALLBACK_COMPLETE_TEXT =
+  'Authentication complete. You can return to DeepChat. If DeepChat does not update, copy the full URL from your browser and paste it into DeepChat.'
+
+export type OAuthLoopbackCallbackResolution =
+  | { kind: 'not-found' }
+  | { kind: 'success'; code: string; state: string; url: string }
+  | { kind: 'failure'; error: Error; url: string }
+
+export type OAuthLoopbackCallbackSessionOptions = {
+  expectedState: string
+  path: string
+  preferredPort?: number
+  timeoutMs?: number
+  listenHost?: string
+  redirectHost?: string
+  invalidCallbackMessage?: string
+}
+
+type ListenOptions = {
+  server: http.Server
+  port: number
+  host: string
+}
+
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000
+
+function writeCallbackPage(response: http.ServerResponse): void {
+  response.writeHead(200, {
+    'Content-Type': 'text/html; charset=utf-8',
+    'Cache-Control': 'no-store'
+  })
+  response.end(`<!doctype html>
+<html>
+<head><meta charset="utf-8"><title>Authentication complete</title></head>
+<body style="font-family: system-ui, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif; line-height: 1.5; margin: 48px;">
+  <h1>Authentication complete</h1>
+  <p>${OAUTH_CALLBACK_COMPLETE_TEXT}</p>
+</body>
+</html>`)
+}
+
+function listen({ server, port, host }: ListenOptions): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const onError = (error: Error) => {
+      server.off('listening', onListening)
+      reject(error)
+    }
+    const onListening = () => {
+      server.off('error', onError)
+      const address = server.address()
+      resolve(typeof address === 'object' && address ? address.port : port)
+    }
+
+    server.once('error', onError)
+    server.once('listening', onListening)
+    server.listen(port, host)
+  })
+}
+
+export function resolveOAuthLoopbackCallbackUrl(
+  rawUrl: string | undefined,
+  expectedState: string,
+  redirectUri: string,
+  invalidCallbackMessage = 'Invalid OAuth callback'
+): OAuthLoopbackCallbackResolution {
+  const redirect = new URL(redirectUri)
+  const url = new URL(rawUrl || '/', redirect)
+  if (
+    url.protocol !== redirect.protocol ||
+    url.hostname !== redirect.hostname ||
+    url.port !== redirect.port ||
+    url.pathname !== redirect.pathname
+  ) {
+    return { kind: 'not-found' }
+  }
+
+  const error = url.searchParams.get('error')
+  const errorDescription = url.searchParams.get('error_description')
+  if (error) {
+    return {
+      kind: 'failure',
+      error: new Error(errorDescription ? `${error}: ${errorDescription}` : error),
+      url: url.toString()
+    }
+  }
+
+  const code = url.searchParams.get('code')
+  const state = url.searchParams.get('state')
+  if (!code || state !== expectedState) {
+    return {
+      kind: 'failure',
+      error: new Error(invalidCallbackMessage),
+      url: url.toString()
+    }
+  }
+
+  return {
+    kind: 'success',
+    code,
+    state,
+    url: url.toString()
+  }
+}
+
+export class OAuthLoopbackCallbackSession {
+  readonly redirectUri: string
+
+  private readonly server: http.Server
+  private readonly expectedState: string
+  private readonly timeout: NodeJS.Timeout
+  private readonly invalidCallbackMessage: string
+  private settled = false
+  private resolveResult!: (
+    result: Extract<OAuthLoopbackCallbackResolution, { kind: 'success' }>
+  ) => void
+  private rejectResult!: (error: Error) => void
+  private readonly callbackPromise: Promise<
+    Extract<OAuthLoopbackCallbackResolution, { kind: 'success' }>
+  >
+
+  constructor(
+    server: http.Server,
+    redirectUri: string,
+    expectedState: string,
+    timeoutMs: number,
+    invalidCallbackMessage: string
+  ) {
+    this.server = server
+    this.redirectUri = redirectUri
+    this.expectedState = expectedState
+    this.invalidCallbackMessage = invalidCallbackMessage
+    this.callbackPromise = new Promise((resolve, reject) => {
+      this.resolveResult = resolve
+      this.rejectResult = reject
+    })
+    this.timeout = setTimeout(() => {
+      this.rejectOnce(new Error('OAuth callback timed out'))
+    }, timeoutMs)
+  }
+
+  waitForCallback(): Promise<Extract<OAuthLoopbackCallbackResolution, { kind: 'success' }>> {
+    return this.callbackPromise
+  }
+
+  resolveCallbackUrl(rawUrl: string | undefined): OAuthLoopbackCallbackResolution {
+    const resolution = resolveOAuthLoopbackCallbackUrl(
+      rawUrl,
+      this.expectedState,
+      this.redirectUri,
+      this.invalidCallbackMessage
+    )
+
+    if (resolution.kind === 'success') {
+      this.resolveOnce(resolution)
+    } else if (resolution.kind === 'failure') {
+      this.rejectOnce(resolution.error)
+    }
+
+    return resolution
+  }
+
+  close(): void {
+    clearTimeout(this.timeout)
+    try {
+      this.server.close()
+    } catch {}
+  }
+
+  private resolveOnce(result: Extract<OAuthLoopbackCallbackResolution, { kind: 'success' }>): void {
+    if (this.settled) {
+      return
+    }
+    this.settled = true
+    this.close()
+    this.resolveResult(result)
+  }
+
+  private rejectOnce(error: Error): void {
+    if (this.settled) {
+      return
+    }
+    this.settled = true
+    this.close()
+    this.rejectResult(error)
+  }
+}
+
+export async function startOAuthLoopbackCallbackSession(
+  options: OAuthLoopbackCallbackSessionOptions
+): Promise<OAuthLoopbackCallbackSession> {
+  const listenHost = options.listenHost || '127.0.0.1'
+  const redirectHost = options.redirectHost || 'localhost'
+  const path = options.path.startsWith('/') ? options.path : `/${options.path}`
+  let session: OAuthLoopbackCallbackSession | null = null
+  const server = http.createServer((request, response) => {
+    const url = new URL(request.url || '/', `http://${request.headers.host || redirectHost}`)
+    if (request.method !== 'GET') {
+      response.writeHead(405, { 'Content-Type': 'text/plain; charset=utf-8' })
+      response.end('Method not allowed')
+      return
+    }
+
+    if (url.pathname !== path) {
+      response.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' })
+      response.end('Not found')
+      return
+    }
+
+    writeCallbackPage(response)
+    session?.resolveCallbackUrl(url.toString())
+  })
+
+  let port: number
+  try {
+    port = await listen({
+      server,
+      port: options.preferredPort || 0,
+      host: listenHost
+    })
+  } catch (error) {
+    if (!options.preferredPort || (error as NodeJS.ErrnoException).code !== 'EADDRINUSE') {
+      throw error
+    }
+    port = await listen({ server, port: 0, host: listenHost })
+  }
+
+  const redirectUri = `http://${redirectHost}:${port}${path}`
+  session = new OAuthLoopbackCallbackSession(
+    server,
+    redirectUri,
+    options.expectedState,
+    options.timeoutMs || DEFAULT_TIMEOUT_MS,
+    options.invalidCallbackMessage || 'Invalid OAuth callback'
+  )
+
+  return session
+}
diff --git a/src/main/presenter/oauthPresenter.ts b/src/main/presenter/oauthPresenter.ts
index 16c42c1bb..df8858442 100644
--- a/src/main/presenter/oauthPresenter.ts
+++ b/src/main/presenter/oauthPresenter.ts
@@ -95,6 +95,12 @@ export class OAuthPresenter {
     return getGlobalOpenAICodexAuth().startBrowserLogin()
   }
 
+  async completeOpenAICodexBrowserLoginFromUrl(
+    callbackUrl: string
+  ): Promise<OpenAICodexAuthStatus> {
+    return getGlobalOpenAICodexAuth().completeBrowserLoginFromCallbackUrl(callbackUrl)
+  }
+
   async cancelOpenAICodexLogin(): Promise<OpenAICodexAuthStatus> {
     return getGlobalOpenAICodexAuth().cancelLogin()
   }
diff --git a/src/main/presenter/openaiCodexAuth/index.ts b/src/main/presenter/openaiCodexAuth/index.ts
index 4a74c7c16..e0e97104f 100644
--- a/src/main/presenter/openaiCodexAuth/index.ts
+++ b/src/main/presenter/openaiCodexAuth/index.ts
@@ -1,11 +1,17 @@
 import logger from '@shared/logger'
-import { BrowserWindow } from 'electron'
+import { shell } from 'electron'
 import { URL } from 'url'
 import { publishDeepchatEvent } from '@/routes/publishDeepchatEvent'
+import {
+  resolveOAuthLoopbackCallbackUrl,
+  startOAuthLoopbackCallbackSession,
+  type OAuthLoopbackCallbackSession
+} from '../oauthLoopbackCallback'
 import {
   OPENAI_CODEX_ACCESS_TOKEN_ENV,
   OPENAI_CODEX_AUTH_REQUEST_TIMEOUT_MS,
   OPENAI_CODEX_AUTHORIZE_URL,
+  OPENAI_CODEX_BROWSER_TIMEOUT_MS,
   OPENAI_CODEX_CLIENT_ID,
   OPENAI_CODEX_REDIRECT_PATH,
   OPENAI_CODEX_REDIRECT_PORT,
@@ -28,6 +34,8 @@ export type OpenAICodexBackendAuth = {
 type PendingBrowserFlow = {
   state: string
   codeVerifier: string
+  redirectUri: string
+  callbackSession: OAuthLoopbackCallbackSession
   cancelled: boolean
   flowPromise?: Promise<void>
 }
@@ -106,43 +114,37 @@ export type OpenAICodexCallbackResolution =
 
 export function resolveOpenAICodexCallbackUrl(
   rawUrl: string | undefined,
-  expectedState: string
+  expectedState: string,
+  redirectUri = OPENAI_CODEX_REDIRECT_URI
 ): OpenAICodexCallbackResolution {
-  const url = new URL(rawUrl || '/', `http://localhost:${OPENAI_CODEX_REDIRECT_PORT}`)
-  if (url.pathname !== OPENAI_CODEX_REDIRECT_PATH) {
+  const callback = resolveOAuthLoopbackCallbackUrl(
+    rawUrl,
+    expectedState,
+    redirectUri,
+    'Invalid OpenAI Codex OAuth callback'
+  )
+  if (callback.kind === 'not-found') {
     return { kind: 'not-found' }
   }
 
-  const error = url.searchParams.get('error')
-  const code = url.searchParams.get('code')
-  const state = url.searchParams.get('state')
-  if (error) {
-    return {
-      kind: 'failure',
-      error: new Error(error),
-      message: 'Authorization failed. You can close this window.'
-    }
-  }
-
-  if (!code || state !== expectedState) {
+  if (callback.kind === 'failure') {
     return {
       kind: 'failure',
-      error: new Error('Invalid OpenAI Codex OAuth callback'),
-      message: 'Authorization state is invalid. You can close this window.'
+      error: callback.error,
+      message: 'Authentication complete. You can return to DeepChat.'
     }
   }
 
   return {
     kind: 'success',
-    code,
-    message: 'Authorization complete. You can close this window.'
+    code: callback.code,
+    message: 'Authentication complete. You can return to DeepChat.'
   }
 }
 
 export class OpenAICodexAuth {
   private readonly store: OpenAICodexCredentialStore
   private pendingBrowserFlow: PendingBrowserFlow | null = null
-  private authWindow: BrowserWindow | null = null
   private refreshPromise: Promise<OpenAICodexTokenSet> | null = null
   private lastError: string | null = null
 
@@ -185,44 +187,76 @@ export class OpenAICodexAuth {
 
     const state = createOpenAICodexState()
     const pkce = createOpenAICodexPkcePair()
-
-    const authUrl = new URL(OPENAI_CODEX_AUTHORIZE_URL)
-    authUrl.searchParams.set('client_id', OPENAI_CODEX_CLIENT_ID)
-    authUrl.searchParams.set('response_type', 'code')
-    authUrl.searchParams.set('redirect_uri', OPENAI_CODEX_REDIRECT_URI)
-    authUrl.searchParams.set('scope', OPENAI_CODEX_SCOPE)
-    authUrl.searchParams.set('state', state)
-    authUrl.searchParams.set('code_challenge', pkce.codeChallenge)
-    authUrl.searchParams.set('code_challenge_method', 'S256')
-    authUrl.searchParams.set('codex_cli_simplified_flow', 'true')
-    authUrl.searchParams.set('id_token_add_organizations', 'true')
+    let callbackSession: OAuthLoopbackCallbackSession | null = null
 
     try {
+      const configuredRedirect = new URL(OPENAI_CODEX_REDIRECT_URI)
+      callbackSession = await startOAuthLoopbackCallbackSession({
+        expectedState: state,
+        path: configuredRedirect.pathname || OPENAI_CODEX_REDIRECT_PATH,
+        preferredPort: Number(configuredRedirect.port) || OPENAI_CODEX_REDIRECT_PORT,
+        redirectHost: configuredRedirect.hostname || 'localhost',
+        timeoutMs: OPENAI_CODEX_BROWSER_TIMEOUT_MS,
+        invalidCallbackMessage: 'Invalid OpenAI Codex OAuth callback'
+      })
+      const authUrl = new URL(OPENAI_CODEX_AUTHORIZE_URL)
+      authUrl.searchParams.set('client_id', OPENAI_CODEX_CLIENT_ID)
+      authUrl.searchParams.set('response_type', 'code')
+      authUrl.searchParams.set('redirect_uri', callbackSession.redirectUri)
+      authUrl.searchParams.set('scope', OPENAI_CODEX_SCOPE)
+      authUrl.searchParams.set('state', state)
+      authUrl.searchParams.set('code_challenge', pkce.codeChallenge)
+      authUrl.searchParams.set('code_challenge_method', 'S256')
+      authUrl.searchParams.set('codex_cli_simplified_flow', 'true')
+      authUrl.searchParams.set('id_token_add_organizations', 'true')
+
       const flow: PendingBrowserFlow = {
         state,
         codeVerifier: pkce.codeVerifier,
+        redirectUri: callbackSession.redirectUri,
+        callbackSession,
         cancelled: false
       }
       this.pendingBrowserFlow = flow
-      const authWindowPromise = this.openAuthWindow(authUrl.toString(), state)
-      flow.flowPromise = this.completeBrowserLogin(flow, authWindowPromise)
+      flow.flowPromise = this.completeBrowserLogin(flow, callbackSession.waitForCallback())
+      await shell.openExternal(authUrl.toString())
       this.publishStatusChanged()
       return this.getStatus()
     } catch (error) {
       this.lastError = sanitizeError(error)
       this.pendingBrowserFlow = null
-      this.stopAuthWindow()
+      callbackSession?.close()
+      this.publishStatusChanged()
+      return this.getStatus()
+    }
+  }
+
+  async completeBrowserLoginFromCallbackUrl(callbackUrl: string): Promise<OpenAICodexAuthStatus> {
+    this.assertEnabled()
+    const flow = this.pendingBrowserFlow
+    if (!flow || flow.cancelled) {
+      this.lastError = 'OpenAI Codex browser login is not pending'
+      this.publishStatusChanged()
+      return this.getStatus()
+    }
+
+    const resolution = flow.callbackSession.resolveCallbackUrl(callbackUrl)
+    if (resolution.kind === 'not-found') {
+      this.lastError = 'OpenAI Codex callback URL is invalid'
       this.publishStatusChanged()
       return this.getStatus()
     }
+
+    await flow.flowPromise
+    return this.getStatus()
   }
 
   cancelLogin(): OpenAICodexAuthStatus {
     if (this.pendingBrowserFlow) {
       this.pendingBrowserFlow.cancelled = true
+      this.pendingBrowserFlow.callbackSession.close()
       this.pendingBrowserFlow = null
     }
-    this.stopAuthWindow()
     this.publishStatusChanged()
     return this.getStatus()
   }
@@ -319,111 +353,17 @@ export class OpenAICodexAuth {
     }
   }
 
-  private openAuthWindow(authUrl: string, expectedState: string): Promise<string> {
-    this.stopAuthWindow()
-
-    return new Promise<string>((resolve, reject) => {
-      const authWindow = new BrowserWindow({
-        width: 520,
-        height: 720,
-        show: false,
-        autoHideMenuBar: true,
-        title: 'OpenAI Codex Authorization',
-        minimizable: true,
-        maximizable: false,
-        fullscreenable: false,
-        webPreferences: {
-          nodeIntegration: false,
-          contextIsolation: true,
-          webSecurity: true
-        }
-      })
-      this.authWindow = authWindow
-      let settled = false
-
-      const rejectWindow = (error: Error) => {
-        if (settled) {
-          return
-        }
-        settled = true
-        if (this.authWindow === authWindow) {
-          this.authWindow = null
-        }
-        reject(error)
-      }
-
-      const resolveWindow = (code: string) => {
-        if (settled) {
-          return
-        }
-        settled = true
-        resolve(code)
-      }
-
-      const handleNavigation = (url: string): boolean => {
-        const callback = resolveOpenAICodexCallbackUrl(url, expectedState)
-        if (callback.kind === 'not-found') {
-          return false
-        }
-
-        if (callback.kind === 'failure') {
-          rejectWindow(callback.error)
-          return true
-        }
-
-        resolveWindow(callback.code)
-        return true
-      }
-
-      authWindow.on('closed', () => {
-        rejectWindow(new Error('OpenAI Codex browser login window was closed'))
-      })
-
-      authWindow.webContents.on('will-redirect', (event, url) => {
-        if (handleNavigation(url)) {
-          event.preventDefault()
-        }
-      })
-
-      authWindow.webContents.on('will-navigate', (event, url) => {
-        if (handleNavigation(url)) {
-          event.preventDefault()
-        }
-      })
-
-      authWindow.webContents.on('did-navigate', (_event, url) => {
-        handleNavigation(url)
-      })
-
-      authWindow.webContents.setWindowOpenHandler(({ url }) => {
-        if (handleNavigation(url)) {
-          return { action: 'deny' }
-        }
-        void Promise.resolve(authWindow.loadURL(url)).catch((error) => {
-          rejectWindow(error instanceof Error ? error : new Error(String(error)))
-        })
-        return { action: 'deny' }
-      })
-
-      void Promise.resolve(authWindow.loadURL(authUrl)).catch((error) => {
-        rejectWindow(error instanceof Error ? error : new Error(String(error)))
-      })
-      authWindow.show()
-      authWindow.focus()
-    })
-  }
-
   private async completeBrowserLogin(
     flow: PendingBrowserFlow,
-    codePromise: Promise<string>
+    callbackPromise: Promise<{ code: string }>
   ): Promise<void> {
     try {
-      const code = await codePromise
+      const { code } = await callbackPromise
       if (flow.cancelled || this.pendingBrowserFlow !== flow) {
         return
       }
 
-      const tokens = await this.exchangeAuthorizationCode(code, flow.codeVerifier)
+      const tokens = await this.exchangeAuthorizationCode(code, flow.codeVerifier, flow.redirectUri)
       if (flow.cancelled || this.pendingBrowserFlow !== flow) {
         return
       }
@@ -431,7 +371,7 @@ export class OpenAICodexAuth {
       this.store.save(tokens)
       this.lastError = null
       this.pendingBrowserFlow = null
-      this.stopAuthWindow()
+      flow.callbackSession.close()
       this.publishStatusChanged()
     } catch (error) {
       if (flow.cancelled || this.pendingBrowserFlow !== flow) {
@@ -440,28 +380,21 @@ export class OpenAICodexAuth {
 
       this.lastError = sanitizeError(error)
       this.pendingBrowserFlow = null
-      this.stopAuthWindow()
+      flow.callbackSession.close()
       this.publishStatusChanged()
     }
   }
 
-  private stopAuthWindow(): void {
-    const authWindow = this.authWindow
-    this.authWindow = null
-    if (authWindow && !authWindow.isDestroyed()) {
-      authWindow.close()
-    }
-  }
-
   private async exchangeAuthorizationCode(
     code: string,
-    codeVerifier: string
+    codeVerifier: string,
+    redirectUri: string
   ): Promise<OpenAICodexTokenSet> {
     const payload = await this.postForm(OPENAI_CODEX_TOKEN_URL, {
       grant_type: 'authorization_code',
       client_id: OPENAI_CODEX_CLIENT_ID,
       code,
-      redirect_uri: OPENAI_CODEX_REDIRECT_URI,
+      redirect_uri: redirectUri,
       code_verifier: codeVerifier
     })
 
diff --git a/src/main/routes/index.ts b/src/main/routes/index.ts
index a93b27c9f..9edb7a10c 100644
--- a/src/main/routes/index.ts
+++ b/src/main/routes/index.ts
@@ -124,15 +124,18 @@ import {
   mcpCallToolRoute,
   mcpCancelSamplingRequestRoute,
   mcpClearNpmRegistryCacheRoute,
+  mcpCompleteServerAuthFromCallbackUrlRoute,
   mcpGetClientsRoute,
   mcpGetEnabledRoute,
   mcpGetNpmRegistryStatusRoute,
   mcpGetPromptRoute,
+  mcpGetServerAuthStatusRoute,
   mcpGetServersRoute,
   mcpIsServerRunningRoute,
   mcpListPromptsRoute,
   mcpListResourcesRoute,
   mcpListToolDefinitionsRoute,
+  mcpLogoutServerAuthRoute,
   mcpReadResourceRoute,
   mcpRefreshNpmRegistryRoute,
   mcpRemoveServerRoute,
@@ -146,6 +149,7 @@ import {
   mcpSetCustomNpmRegistryRoute,
   mcpSetEnabledRoute,
   mcpSetServerEnabledRoute,
+  mcpStartServerAuthRoute,
   mcpStartServerRoute,
   mcpStopServerRoute,
   mcpSubmitSamplingDecisionRoute,
@@ -162,6 +166,7 @@ import {
   oauthGithubCopilotStartDeviceFlowLoginRoute,
   oauthGithubCopilotStartLoginRoute,
   oauthOpenAICodexCancelLoginRoute,
+  oauthOpenAICodexCompleteBrowserLoginFromUrlRoute,
   oauthOpenAICodexGetStatusRoute,
   oauthOpenAICodexLogoutRoute,
   oauthOpenAICodexStartBrowserLoginRoute,
@@ -2553,6 +2558,15 @@ export async function dispatchDeepchatRoute(
       })
     }
 
+    case oauthOpenAICodexCompleteBrowserLoginFromUrlRoute.name: {
+      const input = oauthOpenAICodexCompleteBrowserLoginFromUrlRoute.input.parse(rawInput)
+      return oauthOpenAICodexCompleteBrowserLoginFromUrlRoute.output.parse({
+        status: await runtime.oauthPresenter.completeOpenAICodexBrowserLoginFromUrl(
+          input.callbackUrl
+        )
+      })
+    }
+
     case oauthOpenAICodexCancelLoginRoute.name: {
       oauthOpenAICodexCancelLoginRoute.input.parse(rawInput)
       return oauthOpenAICodexCancelLoginRoute.output.parse({
@@ -3599,6 +3613,37 @@ export async function dispatchDeepchatRoute(
       return mcpStopServerRoute.output.parse({ stopped: true })
     }
 
+    case mcpGetServerAuthStatusRoute.name: {
+      const input = mcpGetServerAuthStatusRoute.input.parse(rawInput)
+      return mcpGetServerAuthStatusRoute.output.parse({
+        status: await runtime.mcpPresenter.getMcpServerAuthStatus(input.serverName)
+      })
+    }
+
+    case mcpStartServerAuthRoute.name: {
+      const input = mcpStartServerAuthRoute.input.parse(rawInput)
+      return mcpStartServerAuthRoute.output.parse({
+        status: await runtime.mcpPresenter.startMcpServerAuth(input.serverName)
+      })
+    }
+
+    case mcpCompleteServerAuthFromCallbackUrlRoute.name: {
+      const input = mcpCompleteServerAuthFromCallbackUrlRoute.input.parse(rawInput)
+      return mcpCompleteServerAuthFromCallbackUrlRoute.output.parse({
+        status: await runtime.mcpPresenter.completeMcpServerAuthFromCallbackUrl(
+          input.serverName,
+          input.callbackUrl
+        )
+      })
+    }
+
+    case mcpLogoutServerAuthRoute.name: {
+      const input = mcpLogoutServerAuthRoute.input.parse(rawInput)
+      return mcpLogoutServerAuthRoute.output.parse({
+        status: await runtime.mcpPresenter.logoutMcpServerAuth(input.serverName)
+      })
+    }
+
     case mcpGetPromptRoute.name: {
       const input = mcpGetPromptRoute.input.parse(rawInput)
       const result = await runtime.mcpPresenter.getPrompt(input.prompt, input.args)
diff --git a/src/renderer/api/McpClient.ts b/src/renderer/api/McpClient.ts
index 7e0d194da..b7ff08218 100644
--- a/src/renderer/api/McpClient.ts
+++ b/src/renderer/api/McpClient.ts
@@ -4,6 +4,7 @@ import {
   mcpSamplingCancelledEvent,
   mcpSamplingDecisionEvent,
   mcpSamplingRequestEvent,
+  mcpServerAuthChangedEvent,
   mcpServerStartedEvent,
   mcpServerStatusChangedEvent,
   mcpServerStoppedEvent,
@@ -14,15 +15,18 @@ import {
   mcpCallToolRoute,
   mcpCancelSamplingRequestRoute,
   mcpClearNpmRegistryCacheRoute,
+  mcpCompleteServerAuthFromCallbackUrlRoute,
   mcpGetClientsRoute,
   mcpGetEnabledRoute,
   mcpGetNpmRegistryStatusRoute,
   mcpGetPromptRoute,
+  mcpGetServerAuthStatusRoute,
   mcpGetServersRoute,
   mcpIsServerRunningRoute,
   mcpListPromptsRoute,
   mcpListResourcesRoute,
   mcpListToolDefinitionsRoute,
+  mcpLogoutServerAuthRoute,
   mcpReadResourceRoute,
   mcpRefreshNpmRegistryRoute,
   mcpRemoveServerRoute,
@@ -36,6 +40,7 @@ import {
   mcpSetCustomNpmRegistryRoute,
   mcpSetEnabledRoute,
   mcpSetServerEnabledRoute,
+  mcpStartServerAuthRoute,
   mcpStartServerRoute,
   mcpStopServerRoute,
   mcpSubmitSamplingDecisionRoute,
@@ -126,6 +131,29 @@ export function createMcpClient(bridge: DeepchatBridge = getDeepchatBridge()) {
     await bridge.invoke(mcpStopServerRoute.name, { serverName })
   }
 
+  async function getServerAuthStatus(serverName: string) {
+    const result = await bridge.invoke(mcpGetServerAuthStatusRoute.name, { serverName })
+    return result.status
+  }
+
+  async function startServerAuth(serverName: string) {
+    const result = await bridge.invoke(mcpStartServerAuthRoute.name, { serverName })
+    return result.status
+  }
+
+  async function completeServerAuthFromCallbackUrl(serverName: string, callbackUrl: string) {
+    const result = await bridge.invoke(mcpCompleteServerAuthFromCallbackUrlRoute.name, {
+      serverName,
+      callbackUrl
+    })
+    return result.status
+  }
+
+  async function logoutServerAuth(serverName: string) {
+    const result = await bridge.invoke(mcpLogoutServerAuthRoute.name, { serverName })
+    return result.status
+  }
+
   async function getPrompt(prompt: PromptListEntry, args?: Record<string, unknown>) {
     const result = await bridge.invoke(mcpGetPromptRoute.name, { prompt, args })
     return result.result
@@ -217,6 +245,16 @@ export function createMcpClient(bridge: DeepchatBridge = getDeepchatBridge()) {
     return bridge.on(mcpServerStatusChangedEvent.name, listener)
   }
 
+  function onServerAuthChanged(
+    listener: (payload: {
+      serverName: string
+      status: Awaited<ReturnType<typeof getServerAuthStatus>>
+      version: number
+    }) => void
+  ) {
+    return bridge.on(mcpServerAuthChangedEvent.name, listener)
+  }
+
   function onToolCallResult(
     listener: (payload: {
       functionName?: string
@@ -261,6 +299,10 @@ export function createMcpClient(bridge: DeepchatBridge = getDeepchatBridge()) {
     isServerRunning,
     startServer,
     stopServer,
+    getServerAuthStatus,
+    startServerAuth,
+    completeServerAuthFromCallbackUrl,
+    logoutServerAuth,
     getPrompt,
     readResource,
     submitSamplingDecision,
@@ -280,6 +322,7 @@ export function createMcpClient(bridge: DeepchatBridge = getDeepchatBridge()) {
     onServerStopped,
     onConfigChanged,
     onServerStatusChanged,
+    onServerAuthChanged,
     onToolCallResult,
     onSamplingRequest,
     onSamplingDecision,
diff --git a/src/renderer/api/OAuthClient.ts b/src/renderer/api/OAuthClient.ts
index 4c763f6a1..ade997063 100644
--- a/src/renderer/api/OAuthClient.ts
+++ b/src/renderer/api/OAuthClient.ts
@@ -2,6 +2,7 @@ import type { DeepchatBridge } from '@shared/contracts/bridge'
 import { oauthOpenAICodexStatusChangedEvent } from '@shared/contracts/events'
 import {
   oauthOpenAICodexCancelLoginRoute,
+  oauthOpenAICodexCompleteBrowserLoginFromUrlRoute,
   oauthOpenAICodexGetStatusRoute,
   oauthOpenAICodexLogoutRoute,
   oauthOpenAICodexStartBrowserLoginRoute,
@@ -34,6 +35,15 @@ export function createOAuthClient(bridge: DeepchatBridge = getDeepchatBridge())
     return result.status
   }
 
+  async function completeOpenAICodexBrowserLoginFromUrl(
+    callbackUrl: string
+  ): Promise<OpenAICodexAuthStatus> {
+    const result = await bridge.invoke(oauthOpenAICodexCompleteBrowserLoginFromUrlRoute.name, {
+      callbackUrl
+    })
+    return result.status
+  }
+
   async function cancelOpenAICodexLogin(): Promise<OpenAICodexAuthStatus> {
     const result = await bridge.invoke(oauthOpenAICodexCancelLoginRoute.name, {})
     return result.status
@@ -57,6 +67,7 @@ export function createOAuthClient(bridge: DeepchatBridge = getDeepchatBridge())
     startGitHubCopilotDeviceFlowLogin,
     getOpenAICodexStatus,
     startOpenAICodexBrowserLogin,
+    completeOpenAICodexBrowserLoginFromUrl,
     cancelOpenAICodexLogin,
     logoutOpenAICodex,
     onOpenAICodexStatusChanged
diff --git a/src/renderer/settings/components/OpenAICodexOAuth.vue b/src/renderer/settings/components/OpenAICodexOAuth.vue
index e0dbc1c14..7487a40b4 100644
--- a/src/renderer/settings/components/OpenAICodexOAuth.vue
+++ b/src/renderer/settings/components/OpenAICodexOAuth.vue
@@ -61,6 +61,18 @@
         {{ browserButtonText }}
       </Button>
 
+      <Button
+        v-if="isPending"
+        data-testid="codex-paste-callback-button"
+        variant="outline"
+        size="sm"
+        class="text-xs"
+        @click="isCallbackDialogOpen = true"
+      >
+        <Icon icon="lucide:clipboard-paste" class="h-4 w-4" />
+        {{ t('settings.provider.openaiCodexPasteCallback') }}
+      </Button>
+
       <Button
         v-if="isPending"
         data-testid="codex-cancel-login-button"
@@ -89,6 +101,43 @@
     <div class="text-xs leading-5 text-muted-foreground">
       {{ t('settings.provider.openaiCodexLoginTip') }}
     </div>
+
+    <Dialog v-model:open="isCallbackDialogOpen">
+      <DialogContent class="w-[90vw] max-w-[460px]">
+        <DialogHeader>
+          <DialogTitle class="text-base">
+            {{ t('settings.provider.openaiCodexCallbackTitle') }}
+          </DialogTitle>
+          <DialogDescription class="text-sm">
+            {{ t('settings.provider.openaiCodexCallbackDescription') }}
+          </DialogDescription>
+        </DialogHeader>
+        <div class="mt-2 flex flex-col gap-3">
+          <Input
+            v-model="callbackUrl"
+            :placeholder="t('settings.provider.openaiCodexCallbackPlaceholder')"
+            @keydown.enter.prevent="completeBrowserLoginFromUrl"
+          />
+          <div class="flex justify-end gap-2">
+            <Button variant="outline" size="sm" @click="isCallbackDialogOpen = false">
+              {{ t('common.cancel') }}
+            </Button>
+            <Button
+              size="sm"
+              :disabled="!callbackUrl.trim() || busyAction === 'callback'"
+              @click="completeBrowserLoginFromUrl"
+            >
+              <Icon
+                v-if="busyAction === 'callback'"
+                icon="lucide:loader-2"
+                class="h-4 w-4 animate-spin"
+              />
+              {{ t('settings.provider.openaiCodexCompleteAuthentication') }}
+            </Button>
+          </div>
+        </div>
+      </DialogContent>
+    </Dialog>
   </div>
 </template>
 
@@ -97,6 +146,14 @@ import { computed, onMounted, onUnmounted, ref, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { Label } from '@shadcn/components/ui/label'
 import { Button } from '@shadcn/components/ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle
+} from '@shadcn/components/ui/dialog'
+import { Input } from '@shadcn/components/ui/input'
 import { Icon } from '@iconify/vue'
 import { createOAuthClient } from '@api/OAuthClient'
 import { useModelCheckStore } from '@/stores/modelCheck'
@@ -123,7 +180,9 @@ const signedOutStatus: OpenAICodexAuthStatus = {
 const oauthClient = createOAuthClient()
 const modelCheckStore = useModelCheckStore()
 const status = ref<OpenAICodexAuthStatus>(signedOutStatus)
-const busyAction = ref<'browser' | 'cancel' | 'logout' | null>(null)
+const busyAction = ref<'browser' | 'callback' | 'cancel' | 'logout' | null>(null)
+const isCallbackDialogOpen = ref(false)
+const callbackUrl = ref('')
 let pollTimer: number | null = null
 let unsubscribeStatus: (() => void) | null = null
 
@@ -202,7 +261,7 @@ const refreshStatus = async () => {
 }
 
 const runAuthAction = async (
-  action: 'browser' | 'cancel' | 'logout',
+  action: 'browser' | 'callback' | 'cancel' | 'logout',
   runner: () => Promise<OpenAICodexAuthStatus>
 ) => {
   busyAction.value = action
@@ -225,6 +284,22 @@ const runAuthAction = async (
 const startBrowserLogin = () =>
   runAuthAction('browser', () => oauthClient.startOpenAICodexBrowserLogin())
 
+const completeBrowserLoginFromUrl = () => {
+  const url = callbackUrl.value.trim()
+  if (!url) {
+    return
+  }
+
+  runAuthAction('callback', async () => {
+    const nextStatus = await oauthClient.completeOpenAICodexBrowserLoginFromUrl(url)
+    if (nextStatus.authenticated) {
+      isCallbackDialogOpen.value = false
+      callbackUrl.value = ''
+    }
+    return nextStatus
+  })
+}
+
 const cancelLogin = () => runAuthAction('cancel', () => oauthClient.cancelOpenAICodexLogin())
 
 const logout = () => runAuthAction('logout', () => oauthClient.logoutOpenAICodex())
diff --git a/src/renderer/src/components/mcp-config/components/McpServerCard.vue b/src/renderer/src/components/mcp-config/components/McpServerCard.vue
index a39cc5270..3d44605ed 100644
--- a/src/renderer/src/components/mcp-config/components/McpServerCard.vue
+++ b/src/renderer/src/components/mcp-config/components/McpServerCard.vue
@@ -18,6 +18,7 @@ import {
 import { useI18n } from 'vue-i18n'
 import { computed, ref, nextTick, onMounted, watch } from 'vue'
 import { Separator } from '@shadcn/components/ui/separator'
+import type { McpServerAuthStatus } from '@shared/presenter'
 
 interface ServerInfo {
   name: string
@@ -30,6 +31,7 @@ interface ServerInfo {
   type?: string
   baseUrl?: string
   errorMessage?: string
+  authStatus?: McpServerAuthStatus
   source?: string
   sourceId?: string
 }
@@ -54,6 +56,7 @@ interface Emits {
   (e: 'viewTools'): void
   (e: 'viewPrompts'): void
   (e: 'viewResources'): void
+  (e: 'authenticate'): void
 }
 
 const props = defineProps<Props>()
@@ -75,11 +78,20 @@ const getLocalizedServerDesc = (serverName: string, fallbackDesc: string) => {
 // 计算服务器状态
 const serverStatus = computed(() => {
   if (props.isLoading) return 'loading'
+  if (props.server.authStatus?.state === 'authenticating') return 'loading'
+  if (props.server.authStatus?.state === 'required') return 'auth-required'
+  if (props.server.authStatus?.state === 'error') return 'auth-error'
   if (props.server.errorMessage) return 'error'
   if (props.server.isRunning) return 'running'
   return 'stopped'
 })
 
+const showAuthenticateButton = computed(() =>
+  ['required', 'error', 'authenticating'].includes(props.server.authStatus?.state || '')
+)
+
+const isAuthenticating = computed(() => props.server.authStatus?.state === 'authenticating')
+
 // 计算状态样式
 const statusConfig = computed(() => {
   switch (serverStatus.value) {
@@ -95,6 +107,18 @@ const statusConfig = computed(() => {
         text: t('settings.mcp.starting'),
         color: 'text-blue-600 dark:text-blue-400'
       }
+    case 'auth-required':
+      return {
+        dot: 'bg-yellow-500',
+        text: t('settings.mcp.authRequired'),
+        color: 'text-yellow-600 dark:text-yellow-400'
+      }
+    case 'auth-error':
+      return {
+        dot: 'bg-red-500',
+        text: t('settings.mcp.authRequired'),
+        color: 'text-red-600 dark:text-red-400'
+      }
     case 'error':
       return {
         dot: 'bg-red-500',
@@ -224,10 +248,35 @@ watch(watchDescription, () => {
               </TooltipContent>
             </Tooltip>
           </TooltipProvider>
+
+          <TooltipProvider v-if="server.authStatus?.error">
+            <Tooltip>
+              <TooltipTrigger>
+                <Icon icon="lucide:key-round" class="w-3 h-3 text-yellow-500" />
+              </TooltipTrigger>
+              <TooltipContent>
+                <p class="text-xs max-w-xs">{{ server.authStatus.error }}</p>
+              </TooltipContent>
+            </Tooltip>
+          </TooltipProvider>
         </div>
 
         <!-- 开关 -->
-        <div class="shrink-0" @click.stop @keydown.stop>
+        <div class="flex shrink-0 items-center gap-2" @click.stop @keydown.stop>
+          <Button
+            v-if="showAuthenticateButton"
+            variant="outline"
+            size="sm"
+            class="h-6 px-2 text-[11px]"
+            :disabled="disabled || isAuthenticating"
+            @click.stop="$emit('authenticate')"
+          >
+            <Icon
+              :icon="isAuthenticating ? 'lucide:loader-2' : 'lucide:key-round'"
+              :class="['h-3 w-3', { 'animate-spin': isAuthenticating }]"
+            />
+            {{ t('settings.mcp.authenticate') }}
+          </Button>
           <Switch
             :model-value="server.enabled"
             :disabled="disabled || isLoading"
diff --git a/src/renderer/src/components/mcp-config/components/McpServers.vue b/src/renderer/src/components/mcp-config/components/McpServers.vue
index 28bbd4f45..45866ff8a 100644
--- a/src/renderer/src/components/mcp-config/components/McpServers.vue
+++ b/src/renderer/src/components/mcp-config/components/McpServers.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref, computed, watch } from 'vue'
+import { ref, computed, watch, onMounted, onUnmounted } from 'vue'
 import { Icon } from '@iconify/vue'
 import { Button } from '@shadcn/components/ui/button'
 import { ScrollArea } from '@shadcn/components/ui/scroll-area'
@@ -55,6 +55,7 @@ const emit = defineEmits<{
 const isAddServerDialogOpen = ref(false)
 const isEditServerDialogOpen = ref(false)
 const isRemoveConfirmDialogOpen = ref(false)
+const isAuthCallbackDialogOpen = ref(false)
 const isToolPanelOpen = ref(false)
 const isPromptPanelOpen = ref(false)
 const isResourceViewerOpen = ref(false)
@@ -63,6 +64,9 @@ const selectedServerForTools = ref<string>('')
 const selectedServerForPrompts = ref<string>('')
 const selectedServerForResources = ref<string>('')
 const selectedDetailServerName = ref('')
+const selectedServerForAuth = ref('')
+const authCallbackUrl = ref('')
+const isSubmittingAuthCallback = ref(false)
 const searchQuery = ref('')
 const activeFilter = ref<'all' | 'running' | 'stopped'>('all')
 const MCP_FILTERS = ['all', 'running', 'stopped'] as const
@@ -138,6 +142,32 @@ const openAddServerDialog = () => {
   isAddServerDialogOpen.value = true
 }
 
+const closeAuthCallbackDialog = () => {
+  isAuthCallbackDialogOpen.value = false
+  selectedServerForAuth.value = ''
+  authCallbackUrl.value = ''
+}
+
+const refreshSelectedServerAuthStatus = async () => {
+  const serverName = selectedServerForAuth.value
+  if (!isAuthCallbackDialogOpen.value || !serverName) {
+    return
+  }
+
+  const status = await mcpStore.updateServerAuthStatus(serverName, true)
+  if (status?.authenticated) {
+    closeAuthCallbackDialog()
+  }
+}
+
+onMounted(() => {
+  window.addEventListener('focus', refreshSelectedServerAuthStatus)
+})
+
+onUnmounted(() => {
+  window.removeEventListener('focus', refreshSelectedServerAuthStatus)
+})
+
 const handleEditServer = async (serverName: string, serverConfig: Partial<MCPServerConfig>) => {
   const success = await mcpStore.updateServer(serverName, serverConfig)
   if (success) {
@@ -196,6 +226,52 @@ const handleToggleServer = async (serverName: string) => {
   }
 }
 
+const handleAuthenticateServer = async (serverName: string) => {
+  const status = await mcpStore.startServerAuth(serverName)
+  if (!status) {
+    toast({
+      title: t('settings.mcp.authFailed'),
+      description: t('common.error.requestFailed'),
+      variant: 'destructive'
+    })
+    return
+  }
+
+  if (status.authenticated) {
+    closeAuthCallbackDialog()
+    return
+  }
+
+  selectedServerForAuth.value = serverName
+  authCallbackUrl.value = ''
+  isAuthCallbackDialogOpen.value = true
+}
+
+const submitAuthCallbackUrl = async () => {
+  const serverName = selectedServerForAuth.value
+  const callbackUrl = authCallbackUrl.value.trim()
+  if (!serverName || !callbackUrl) {
+    return
+  }
+
+  isSubmittingAuthCallback.value = true
+  try {
+    const status = await mcpStore.completeServerAuthFromCallbackUrl(serverName, callbackUrl)
+    if (status?.authenticated) {
+      closeAuthCallbackDialog()
+      return
+    }
+
+    toast({
+      title: t('settings.mcp.authFailed'),
+      description: status?.error || t('common.error.requestFailed'),
+      variant: 'destructive'
+    })
+  } finally {
+    isSubmittingAuthCallback.value = false
+  }
+}
+
 const openEditServerDialog = (serverName: string) => {
   const specialServers = {
     difyKnowledge: 'dify',
@@ -328,6 +404,7 @@ defineExpose({
             @view-tools="handleViewTools(server.name)"
             @view-prompts="handleViewPrompts(server.name)"
             @view-resources="handleViewResources(server.name)"
+            @authenticate="handleAuthenticateServer(server.name)"
           />
         </div>
 
@@ -522,6 +599,41 @@ defineExpose({
       </DialogContent>
     </Dialog>
 
+    <Dialog v-model:open="isAuthCallbackDialogOpen">
+      <DialogContent class="w-[90vw] max-w-[460px]">
+        <DialogHeader>
+          <DialogTitle class="text-base">{{ t('settings.mcp.authCallbackTitle') }}</DialogTitle>
+          <DialogDescription class="text-sm">
+            {{ t('settings.mcp.authCallbackDescription') }}
+          </DialogDescription>
+        </DialogHeader>
+        <div class="mt-2 flex flex-col gap-3">
+          <Input
+            v-model="authCallbackUrl"
+            :placeholder="t('settings.mcp.authCallbackPlaceholder')"
+            @keydown.enter.prevent="submitAuthCallbackUrl"
+          />
+          <div class="flex justify-end gap-2">
+            <Button variant="outline" size="sm" @click="closeAuthCallbackDialog">
+              {{ t('common.cancel') }}
+            </Button>
+            <Button
+              size="sm"
+              :disabled="!authCallbackUrl.trim() || isSubmittingAuthCallback"
+              @click="submitAuthCallbackUrl"
+            >
+              <Icon
+                v-if="isSubmittingAuthCallback"
+                icon="lucide:loader-2"
+                class="size-4 animate-spin"
+              />
+              {{ t('settings.mcp.completeAuthentication') }}
+            </Button>
+          </div>
+        </div>
+      </DialogContent>
+    </Dialog>
+
     <!-- Tool panel -->
     <McpToolPanel v-model:open="isToolPanelOpen" :server-name="selectedServerForTools" />
 
diff --git a/src/renderer/src/i18n/da-DK/settings.json b/src/renderer/src/i18n/da-DK/settings.json
index 58b4546fd..47c52665f 100644
--- a/src/renderer/src/i18n/da-DK/settings.json
+++ b/src/renderer/src/i18n/da-DK/settings.json
@@ -1063,7 +1063,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Indstillinger for vidensbase",
@@ -1381,7 +1386,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "scheduledTasks": {
     "title": "Planlagte opgaver",
diff --git a/src/renderer/src/i18n/de-DE/settings.json b/src/renderer/src/i18n/de-DE/settings.json
index 6c99c5594..641f1e470 100644
--- a/src/renderer/src/i18n/de-DE/settings.json
+++ b/src/renderer/src/i18n/de-DE/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Wissensdatenbank-Einstellungen",
@@ -1705,7 +1710,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "about": {
     "title": "Über uns",
diff --git a/src/renderer/src/i18n/en-US/settings.json b/src/renderer/src/i18n/en-US/settings.json
index 89e9286d7..b8522d0eb 100644
--- a/src/renderer/src/i18n/en-US/settings.json
+++ b/src/renderer/src/i18n/en-US/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Knowledge Base Settings",
@@ -1705,7 +1710,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "scheduledTasks": {
     "title": "Scheduled Tasks",
diff --git a/src/renderer/src/i18n/es-ES/settings.json b/src/renderer/src/i18n/es-ES/settings.json
index dc4c09b89..8edbde5a2 100644
--- a/src/renderer/src/i18n/es-ES/settings.json
+++ b/src/renderer/src/i18n/es-ES/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Modelos",
         "advanced": "Avanzado"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Configuración de la base de conocimientos",
@@ -1705,7 +1710,16 @@
         "builtIn": "Incorporado",
         "custom": "personalizado"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "about": {
     "title": "Sobre nosotros",
diff --git a/src/renderer/src/i18n/fa-IR/settings.json b/src/renderer/src/i18n/fa-IR/settings.json
index 30323c42f..dd2844921 100644
--- a/src/renderer/src/i18n/fa-IR/settings.json
+++ b/src/renderer/src/i18n/fa-IR/settings.json
@@ -1130,7 +1130,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "تنظیمات پایگاه دانش",
@@ -1448,7 +1453,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "scheduledTasks": {
     "title": "کارهای زمان‌بندی‌شده",
diff --git a/src/renderer/src/i18n/fr-FR/settings.json b/src/renderer/src/i18n/fr-FR/settings.json
index 591fe4f8f..ab7725c6c 100644
--- a/src/renderer/src/i18n/fr-FR/settings.json
+++ b/src/renderer/src/i18n/fr-FR/settings.json
@@ -1130,7 +1130,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Paramètres de la base de connaissances",
@@ -1448,7 +1453,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "scheduledTasks": {
     "title": "Tâches planifiées",
diff --git a/src/renderer/src/i18n/he-IL/settings.json b/src/renderer/src/i18n/he-IL/settings.json
index 47a0a08b8..be51b8b85 100644
--- a/src/renderer/src/i18n/he-IL/settings.json
+++ b/src/renderer/src/i18n/he-IL/settings.json
@@ -1130,7 +1130,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "הגדרות בסיס ידע",
@@ -1448,7 +1453,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "scheduledTasks": {
     "title": "משימות מתוזמנות",
diff --git a/src/renderer/src/i18n/id-ID/settings.json b/src/renderer/src/i18n/id-ID/settings.json
index bce667fc9..7cf0a4bb1 100644
--- a/src/renderer/src/i18n/id-ID/settings.json
+++ b/src/renderer/src/i18n/id-ID/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Model",
         "advanced": "Lanjutan"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Pengaturan basis pengetahuan",
@@ -1705,7 +1710,16 @@
         "builtIn": "Bawaan",
         "custom": "Adat"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "about": {
     "title": "Tentang kami",
diff --git a/src/renderer/src/i18n/it-IT/settings.json b/src/renderer/src/i18n/it-IT/settings.json
index d46572fc2..bce74a737 100644
--- a/src/renderer/src/i18n/it-IT/settings.json
+++ b/src/renderer/src/i18n/it-IT/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Impostazioni base di conoscenza",
@@ -1705,7 +1710,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "about": {
     "title": "Chi siamo",
diff --git a/src/renderer/src/i18n/ja-JP/settings.json b/src/renderer/src/i18n/ja-JP/settings.json
index bd17f6d5b..9463febce 100644
--- a/src/renderer/src/i18n/ja-JP/settings.json
+++ b/src/renderer/src/i18n/ja-JP/settings.json
@@ -1130,7 +1130,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "ナレッジベース設定",
@@ -1448,7 +1453,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "scheduledTasks": {
     "title": "スケジュールタスク",
diff --git a/src/renderer/src/i18n/ko-KR/settings.json b/src/renderer/src/i18n/ko-KR/settings.json
index 75897ec0d..a7b3af4d5 100644
--- a/src/renderer/src/i18n/ko-KR/settings.json
+++ b/src/renderer/src/i18n/ko-KR/settings.json
@@ -1130,7 +1130,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "지식 베이스 설정",
@@ -1448,7 +1453,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "scheduledTasks": {
     "title": "예약된 작업",
diff --git a/src/renderer/src/i18n/ms-MY/settings.json b/src/renderer/src/i18n/ms-MY/settings.json
index 417d37d88..daaef4025 100644
--- a/src/renderer/src/i18n/ms-MY/settings.json
+++ b/src/renderer/src/i18n/ms-MY/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Tetapan asas pengetahuan",
@@ -1705,7 +1710,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "about": {
     "title": "tentang Kami",
diff --git a/src/renderer/src/i18n/pl-PL/settings.json b/src/renderer/src/i18n/pl-PL/settings.json
index a55d1448b..278385cde 100644
--- a/src/renderer/src/i18n/pl-PL/settings.json
+++ b/src/renderer/src/i18n/pl-PL/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Modele",
         "advanced": "Zaawansowane"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Ustawienia bazy wiedzy",
@@ -1705,7 +1710,16 @@
         "builtIn": "Wbudowany",
         "custom": "Niestandardowe"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "about": {
     "title": "O nas",
diff --git a/src/renderer/src/i18n/pt-BR/settings.json b/src/renderer/src/i18n/pt-BR/settings.json
index 0881af031..573fafd88 100644
--- a/src/renderer/src/i18n/pt-BR/settings.json
+++ b/src/renderer/src/i18n/pt-BR/settings.json
@@ -1130,7 +1130,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Configurações da Base de Conhecimento",
@@ -1448,7 +1453,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "scheduledTasks": {
     "title": "Tarefas agendadas",
diff --git a/src/renderer/src/i18n/ru-RU/settings.json b/src/renderer/src/i18n/ru-RU/settings.json
index faa4e4c3a..30deeffc9 100644
--- a/src/renderer/src/i18n/ru-RU/settings.json
+++ b/src/renderer/src/i18n/ru-RU/settings.json
@@ -1130,7 +1130,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Настройки базы знаний",
@@ -1448,7 +1453,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "scheduledTasks": {
     "title": "Запланированные задачи",
diff --git a/src/renderer/src/i18n/tr-TR/settings.json b/src/renderer/src/i18n/tr-TR/settings.json
index 898c21448..c7a1943e1 100644
--- a/src/renderer/src/i18n/tr-TR/settings.json
+++ b/src/renderer/src/i18n/tr-TR/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Modeller",
         "advanced": "Gelişmiş"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Bilgi Bankası Ayarları",
@@ -1705,7 +1710,16 @@
         "builtIn": "Yerleşik",
         "custom": "Gelenek"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "about": {
     "title": "Hakkımızda",
diff --git a/src/renderer/src/i18n/vi-VN/settings.json b/src/renderer/src/i18n/vi-VN/settings.json
index 8744c6329..0fb2888a1 100644
--- a/src/renderer/src/i18n/vi-VN/settings.json
+++ b/src/renderer/src/i18n/vi-VN/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Người mẫu",
         "advanced": "Nâng cao"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "Paste callback URL",
+    "openaiCodexCallbackTitle": "Complete authentication",
+    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
+    "openaiCodexCompleteAuthentication": "Complete authentication"
   },
   "knowledgeBase": {
     "title": "Cài đặt cơ sở kiến thức",
@@ -1705,7 +1710,16 @@
         "builtIn": "Tích hợp sẵn",
         "custom": "tùy chỉnh"
       }
-    }
+    },
+    "authRequired": "Authentication required",
+    "authenticate": "Authenticate",
+    "authFailed": "Authentication failed",
+    "authCallbackTitle": "Complete authentication",
+    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
+    "authCallbackPlaceholder": "Paste the full callback URL",
+    "completeAuthentication": "Complete authentication",
+    "saveSuccess": "Configuration saved",
+    "saveFailed": "Failed to save configuration"
   },
   "about": {
     "title": "Về chúng tôi",
diff --git a/src/renderer/src/i18n/zh-CN/settings.json b/src/renderer/src/i18n/zh-CN/settings.json
index b9091cc5b..8da85a281 100644
--- a/src/renderer/src/i18n/zh-CN/settings.json
+++ b/src/renderer/src/i18n/zh-CN/settings.json
@@ -1387,7 +1387,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "粘贴回调 URL",
+    "openaiCodexCallbackTitle": "完成认证",
+    "openaiCodexCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
+    "openaiCodexCallbackPlaceholder": "粘贴完整回调 URL",
+    "openaiCodexCompleteAuthentication": "完成认证"
   },
   "knowledgeBase": {
     "title": "知识库设置",
@@ -1705,7 +1710,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "需要认证",
+    "authenticate": "认证",
+    "authFailed": "认证失败",
+    "authCallbackTitle": "完成认证",
+    "authCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
+    "authCallbackPlaceholder": "粘贴完整回调 URL",
+    "completeAuthentication": "完成认证",
+    "saveSuccess": "已保存配置",
+    "saveFailed": "保存失败"
   },
   "scheduledTasks": {
     "title": "定时任务",
diff --git a/src/renderer/src/i18n/zh-HK/settings.json b/src/renderer/src/i18n/zh-HK/settings.json
index 6d324773d..6c8042634 100644
--- a/src/renderer/src/i18n/zh-HK/settings.json
+++ b/src/renderer/src/i18n/zh-HK/settings.json
@@ -1130,7 +1130,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "粘贴回调 URL",
+    "openaiCodexCallbackTitle": "完成认证",
+    "openaiCodexCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
+    "openaiCodexCallbackPlaceholder": "粘贴完整回调 URL",
+    "openaiCodexCompleteAuthentication": "完成认证"
   },
   "knowledgeBase": {
     "fastgptTitle": "FastGPT知識庫",
@@ -1448,7 +1453,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "需要认证",
+    "authenticate": "认证",
+    "authFailed": "认证失败",
+    "authCallbackTitle": "完成认证",
+    "authCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
+    "authCallbackPlaceholder": "粘贴完整回调 URL",
+    "completeAuthentication": "完成认证",
+    "saveSuccess": "已保存配置",
+    "saveFailed": "保存失败"
   },
   "scheduledTasks": {
     "title": "定時任務",
diff --git a/src/renderer/src/i18n/zh-TW/settings.json b/src/renderer/src/i18n/zh-TW/settings.json
index a1882fef6..5e1fffa92 100644
--- a/src/renderer/src/i18n/zh-TW/settings.json
+++ b/src/renderer/src/i18n/zh-TW/settings.json
@@ -1130,7 +1130,12 @@
         "models": "Models",
         "advanced": "Advanced"
       }
-    }
+    },
+    "openaiCodexPasteCallback": "粘贴回调 URL",
+    "openaiCodexCallbackTitle": "完成认证",
+    "openaiCodexCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
+    "openaiCodexCallbackPlaceholder": "粘贴完整回调 URL",
+    "openaiCodexCompleteAuthentication": "完成认证"
   },
   "knowledgeBase": {
     "title": "知識庫設置",
@@ -1448,7 +1453,16 @@
         "builtIn": "Built-in",
         "custom": "Custom"
       }
-    }
+    },
+    "authRequired": "需要认证",
+    "authenticate": "认证",
+    "authFailed": "认证失败",
+    "authCallbackTitle": "完成认证",
+    "authCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
+    "authCallbackPlaceholder": "粘贴完整回调 URL",
+    "completeAuthentication": "完成认证",
+    "saveSuccess": "已保存配置",
+    "saveFailed": "保存失败"
   },
   "scheduledTasks": {
     "title": "定時任務",
diff --git a/src/renderer/src/pages/plugins/McpPluginsPage.vue b/src/renderer/src/pages/plugins/McpPluginsPage.vue
index 04bd94714..59c4b5aff 100644
--- a/src/renderer/src/pages/plugins/McpPluginsPage.vue
+++ b/src/renderer/src/pages/plugins/McpPluginsPage.vue
@@ -1,5 +1,5 @@
 <template>
-  <McpSettings scope="agent" />
+  <McpSettings />
 </template>
 
 <script setup lang="ts">
diff --git a/src/renderer/src/stores/mcp.ts b/src/renderer/src/stores/mcp.ts
index bb5767d5d..3411ab333 100644
--- a/src/renderer/src/stores/mcp.ts
+++ b/src/renderer/src/stores/mcp.ts
@@ -11,6 +11,7 @@ import type {
   MCPConfig,
   MCPServerConfig,
   MCPToolDefinition,
+  McpServerAuthStatus,
   PromptListEntry,
   Resource,
   ResourceListEntry,
@@ -42,6 +43,7 @@ export const useMcpStore = defineStore('mcp', () => {
 
   // 服务器状态
   const serverStatuses = ref<Record<string, boolean>>({})
+  const serverAuthStatuses = ref<Record<string, McpServerAuthStatus>>({})
   const serverLoadingStates = ref<Record<string, boolean>>({})
   const configLoading = ref(false)
 
@@ -265,6 +267,40 @@ export const useMcpStore = defineStore('mcp', () => {
     return error instanceof Error ? error.message : String(error)
   })
 
+  const refreshAfterAuthenticated = async (serverName: string) => {
+    await Promise.all([
+      updateServerStatus(serverName),
+      loadTools({ force: true }),
+      loadClients({ force: true })
+    ])
+  }
+
+  const updateServerAuthStatus = async (
+    serverName: string,
+    refreshAuthenticated = false
+  ): Promise<McpServerAuthStatus | null> => {
+    try {
+      const status = await mcpClient.getServerAuthStatus(serverName)
+      serverAuthStatuses.value[serverName] = status
+      if (refreshAuthenticated && status.authenticated) {
+        await refreshAfterAuthenticated(serverName)
+      }
+      return status
+    } catch (error) {
+      console.warn('Failed to load MCP server auth status:', serverName, error)
+      return null
+    }
+  }
+
+  const isAuthWaitingStatus = (status?: McpServerAuthStatus) =>
+    status?.state === 'required' || status?.state === 'authenticating'
+
+  const loadAllServerAuthStatuses = async () => {
+    await Promise.all(
+      Object.keys(config.value.mcpServers).map((serverName) => updateServerAuthStatus(serverName))
+    )
+  }
+
   const syncConfigFromQuery = (data?: ConfigQueryResult | null) => {
     if (!data) {
       return
@@ -299,6 +335,7 @@ export const useMcpStore = defineStore('mcp', () => {
       mcpEnabled: data.mcpEnabled,
       ready: true
     }
+    void loadAllServerAuthStatuses()
 
     // If mcpEnabled state changed, trigger query refreshes
     if (previousReady && mcpEnabledChanged) {
@@ -397,6 +434,7 @@ export const useMcpStore = defineStore('mcp', () => {
       name,
       ...serverConfig,
       isRunning: serverStatuses.value[name] || false,
+      authStatus: serverAuthStatuses.value[name],
       isLoading: serverLoadingStates.value[name] || false
     }))
 
@@ -697,6 +735,14 @@ export const useMcpStore = defineStore('mcp', () => {
       await updateServerStatus(serverName)
       return true
     } catch (error) {
+      if (nextEnabled) {
+        await updateServerAuthStatus(serverName)
+        if (isAuthWaitingStatus(serverAuthStatuses.value[serverName])) {
+          serverStatuses.value[serverName] = false
+          return true
+        }
+      }
+
       config.value.mcpServers = {
         ...config.value.mcpServers,
         [serverName]: previousConfig
@@ -713,6 +759,57 @@ export const useMcpStore = defineStore('mcp', () => {
     }
   }
 
+  const startServerAuth = async (serverName: string): Promise<McpServerAuthStatus | null> => {
+    if (serverLoadingStates.value[serverName]) {
+      return serverAuthStatuses.value[serverName] ?? null
+    }
+
+    serverLoadingStates.value[serverName] = true
+    try {
+      const status = await mcpClient.startServerAuth(serverName)
+      serverAuthStatuses.value[serverName] = status
+      if (status.authenticated) {
+        await refreshAfterAuthenticated(serverName)
+      }
+      return status
+    } catch (error) {
+      console.error('Failed to start MCP server authentication:', serverName, error)
+      await updateServerAuthStatus(serverName)
+      return null
+    } finally {
+      serverLoadingStates.value[serverName] = false
+    }
+  }
+
+  const completeServerAuthFromCallbackUrl = async (
+    serverName: string,
+    callbackUrl: string
+  ): Promise<McpServerAuthStatus | null> => {
+    try {
+      const status = await mcpClient.completeServerAuthFromCallbackUrl(serverName, callbackUrl)
+      serverAuthStatuses.value[serverName] = status
+      if (status.authenticated) {
+        await refreshAfterAuthenticated(serverName)
+      }
+      return status
+    } catch (error) {
+      console.error('Failed to complete MCP server authentication:', serverName, error)
+      await updateServerAuthStatus(serverName)
+      return null
+    }
+  }
+
+  const logoutServerAuth = async (serverName: string): Promise<McpServerAuthStatus | null> => {
+    try {
+      const status = await mcpClient.logoutServerAuth(serverName)
+      serverAuthStatuses.value[serverName] = status
+      return status
+    } catch (error) {
+      console.error('Failed to clear MCP server authentication:', serverName, error)
+      return null
+    }
+  }
+
   const loadClients = async (options?: QueryExecuteOptions) => {
     try {
       const state = await runQuery(clientsQuery, options)
@@ -955,6 +1052,15 @@ export const useMcpStore = defineStore('mcp', () => {
       serverStatuses.value[serverName] = isRunning
     })
 
+    mcpClient.onServerAuthChanged(({ serverName, status }) => {
+      serverAuthStatuses.value[serverName] = status
+      if (status.authenticated) {
+        void refreshAfterAuthenticated(serverName).catch((error) => {
+          console.error('Failed to refresh MCP after authentication:', error)
+        })
+      }
+    })
+
     mcpClient.onToolCallResult((result) => {
       console.log(`MCP tool call result:`, result.functionName)
       if (result && result.functionName) {
@@ -1038,6 +1144,7 @@ export const useMcpStore = defineStore('mcp', () => {
     // 状态
     config,
     serverStatuses,
+    serverAuthStatuses,
     serverLoadingStates,
     configLoading,
     tools,
@@ -1075,6 +1182,10 @@ export const useMcpStore = defineStore('mcp', () => {
     updateServer,
     removeServer,
     toggleServer,
+    updateServerAuthStatus,
+    startServerAuth,
+    completeServerAuthFromCallbackUrl,
+    logoutServerAuth,
     setMcpEnabled,
 
     // 工具和资源方法
diff --git a/src/shadcn/components/ui/sheet/SheetContent.vue b/src/shadcn/components/ui/sheet/SheetContent.vue
index eb2f346d5..b042e6e62 100644
--- a/src/shadcn/components/ui/sheet/SheetContent.vue
+++ b/src/shadcn/components/ui/sheet/SheetContent.vue
@@ -54,6 +54,7 @@ const forwarded = useForwardPropsEmits(delegatedProps, emits)
 
       <DialogClose
         class="window-no-drag-region ring-offset-background focus:ring-ring data-[state=open]:bg-secondary absolute top-4 right-4 rounded-xs opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none"
+        style="-webkit-app-region: no-drag"
       >
         <X class="size-4" />
         <span class="sr-only">Close</span>
diff --git a/src/shared/contracts/events.ts b/src/shared/contracts/events.ts
index 54a0a146e..9866678fc 100644
--- a/src/shared/contracts/events.ts
+++ b/src/shared/contracts/events.ts
@@ -52,6 +52,7 @@ import {
   mcpSamplingCancelledEvent,
   mcpSamplingDecisionEvent,
   mcpSamplingRequestEvent,
+  mcpServerAuthChangedEvent,
   mcpServerStartedEvent,
   mcpServerStatusChangedEvent,
   mcpServerStoppedEvent,
@@ -230,6 +231,7 @@ export const DEEPCHAT_EVENT_CATALOG = {
   [mcpServerStoppedEvent.name]: mcpServerStoppedEvent,
   [mcpConfigChangedEvent.name]: mcpConfigChangedEvent,
   [mcpServerStatusChangedEvent.name]: mcpServerStatusChangedEvent,
+  [mcpServerAuthChangedEvent.name]: mcpServerAuthChangedEvent,
   [mcpToolCallResultEvent.name]: mcpToolCallResultEvent,
   [mcpSamplingRequestEvent.name]: mcpSamplingRequestEvent,
   [mcpSamplingDecisionEvent.name]: mcpSamplingDecisionEvent,
diff --git a/src/shared/contracts/events/mcp.events.ts b/src/shared/contracts/events/mcp.events.ts
index 403bc2655..2b16dd330 100644
--- a/src/shared/contracts/events/mcp.events.ts
+++ b/src/shared/contracts/events/mcp.events.ts
@@ -1,6 +1,7 @@
 import { z } from 'zod'
 import type {
   MCPServerConfig,
+  McpServerAuthStatus,
   McpSamplingDecision,
   McpSamplingRequestPayload
 } from '@shared/presenter'
@@ -9,6 +10,7 @@ import { defineEventContract } from '../common'
 const McpSamplingRequestSchema = z.custom<McpSamplingRequestPayload>()
 const McpSamplingDecisionSchema = z.custom<McpSamplingDecision>()
 const MCPServerConfigSchema = z.custom<MCPServerConfig>()
+const McpServerAuthStatusSchema = z.custom<McpServerAuthStatus>()
 
 export const mcpServerStartedEvent = defineEventContract({
   name: 'mcp.server.started',
@@ -44,6 +46,15 @@ export const mcpServerStatusChangedEvent = defineEventContract({
   })
 })
 
+export const mcpServerAuthChangedEvent = defineEventContract({
+  name: 'mcp.server.auth.changed',
+  payload: z.object({
+    serverName: z.string(),
+    status: McpServerAuthStatusSchema,
+    version: z.number().int()
+  })
+})
+
 export const mcpToolCallResultEvent = defineEventContract({
   name: 'mcp.toolCall.result',
   payload: z.object({
diff --git a/src/shared/contracts/routes.ts b/src/shared/contracts/routes.ts
index 1927e98f1..1f39d6f1e 100644
--- a/src/shared/contracts/routes.ts
+++ b/src/shared/contracts/routes.ts
@@ -168,15 +168,18 @@ import {
   mcpCallToolRoute,
   mcpCancelSamplingRequestRoute,
   mcpClearNpmRegistryCacheRoute,
+  mcpCompleteServerAuthFromCallbackUrlRoute,
   mcpGetClientsRoute,
   mcpGetEnabledRoute,
   mcpGetNpmRegistryStatusRoute,
   mcpGetPromptRoute,
+  mcpGetServerAuthStatusRoute,
   mcpGetServersRoute,
   mcpIsServerRunningRoute,
   mcpListPromptsRoute,
   mcpListResourcesRoute,
   mcpListToolDefinitionsRoute,
+  mcpLogoutServerAuthRoute,
   mcpReadResourceRoute,
   mcpRefreshNpmRegistryRoute,
   mcpRemoveServerRoute,
@@ -190,6 +193,7 @@ import {
   mcpSetCustomNpmRegistryRoute,
   mcpSetEnabledRoute,
   mcpSetServerEnabledRoute,
+  mcpStartServerAuthRoute,
   mcpStartServerRoute,
   mcpStopServerRoute,
   mcpSubmitSamplingDecisionRoute,
@@ -229,6 +233,7 @@ import {
   oauthGithubCopilotStartDeviceFlowLoginRoute,
   oauthGithubCopilotStartLoginRoute,
   oauthOpenAICodexCancelLoginRoute,
+  oauthOpenAICodexCompleteBrowserLoginFromUrlRoute,
   oauthOpenAICodexGetStatusRoute,
   oauthOpenAICodexLogoutRoute,
   oauthOpenAICodexStartBrowserLoginRoute
@@ -570,6 +575,8 @@ const DEEPCHAT_ROUTE_CATALOG_PART_1 = {
   [oauthGithubCopilotStartDeviceFlowLoginRoute.name]: oauthGithubCopilotStartDeviceFlowLoginRoute,
   [oauthOpenAICodexGetStatusRoute.name]: oauthOpenAICodexGetStatusRoute,
   [oauthOpenAICodexStartBrowserLoginRoute.name]: oauthOpenAICodexStartBrowserLoginRoute,
+  [oauthOpenAICodexCompleteBrowserLoginFromUrlRoute.name]:
+    oauthOpenAICodexCompleteBrowserLoginFromUrlRoute,
   [oauthOpenAICodexCancelLoginRoute.name]: oauthOpenAICodexCancelLoginRoute,
   [oauthOpenAICodexLogoutRoute.name]: oauthOpenAICodexLogoutRoute,
   [remoteControlListChannelsRoute.name]: remoteControlListChannelsRoute,
@@ -926,6 +933,10 @@ const DEEPCHAT_ROUTE_CATALOG_PART_5 = {
   [mcpIsServerRunningRoute.name]: mcpIsServerRunningRoute,
   [mcpStartServerRoute.name]: mcpStartServerRoute,
   [mcpStopServerRoute.name]: mcpStopServerRoute,
+  [mcpGetServerAuthStatusRoute.name]: mcpGetServerAuthStatusRoute,
+  [mcpStartServerAuthRoute.name]: mcpStartServerAuthRoute,
+  [mcpCompleteServerAuthFromCallbackUrlRoute.name]: mcpCompleteServerAuthFromCallbackUrlRoute,
+  [mcpLogoutServerAuthRoute.name]: mcpLogoutServerAuthRoute,
   [mcpGetPromptRoute.name]: mcpGetPromptRoute,
   [mcpReadResourceRoute.name]: mcpReadResourceRoute,
   [mcpSubmitSamplingDecisionRoute.name]: mcpSubmitSamplingDecisionRoute,
diff --git a/src/shared/contracts/routes/mcp.routes.ts b/src/shared/contracts/routes/mcp.routes.ts
index 31446fa1d..8e4a836db 100644
--- a/src/shared/contracts/routes/mcp.routes.ts
+++ b/src/shared/contracts/routes/mcp.routes.ts
@@ -5,6 +5,7 @@ import type {
   MCPToolDefinition,
   MCPToolResponse,
   McpClient,
+  McpServerAuthStatus,
   McpSamplingDecision,
   PromptListEntry,
   Resource,
@@ -21,6 +22,14 @@ const ResourceSchema = z.custom<Resource>()
 const MCPToolCallSchema = z.custom<MCPToolCall>()
 const MCPToolResponseSchema = z.custom<MCPToolResponse>()
 const McpSamplingDecisionSchema = z.custom<McpSamplingDecision>()
+export const McpServerAuthStatusSchema: z.ZodType<McpServerAuthStatus> = z.object({
+  serverName: z.string(),
+  state: z.enum(['unsupported', 'none', 'required', 'authenticating', 'authenticated', 'error']),
+  authenticated: z.boolean(),
+  error: z.string().optional(),
+  updatedAt: z.number().optional(),
+  storage: z.enum(['safeStorage', 'file', 'none']).optional()
+})
 const NpmRegistryStatusSchema = z.custom<{
   currentRegistry: string | null
   isFromCache: boolean
@@ -186,6 +195,47 @@ export const mcpStopServerRoute = defineRouteContract({
   })
 })
 
+export const mcpGetServerAuthStatusRoute = defineRouteContract({
+  name: 'mcp.getServerAuthStatus',
+  input: z.object({
+    serverName: z.string()
+  }),
+  output: z.object({
+    status: McpServerAuthStatusSchema
+  })
+})
+
+export const mcpStartServerAuthRoute = defineRouteContract({
+  name: 'mcp.startServerAuth',
+  input: z.object({
+    serverName: z.string()
+  }),
+  output: z.object({
+    status: McpServerAuthStatusSchema
+  })
+})
+
+export const mcpCompleteServerAuthFromCallbackUrlRoute = defineRouteContract({
+  name: 'mcp.completeServerAuthFromCallbackUrl',
+  input: z.object({
+    serverName: z.string(),
+    callbackUrl: z.string()
+  }),
+  output: z.object({
+    status: McpServerAuthStatusSchema
+  })
+})
+
+export const mcpLogoutServerAuthRoute = defineRouteContract({
+  name: 'mcp.logoutServerAuth',
+  input: z.object({
+    serverName: z.string()
+  }),
+  output: z.object({
+    status: McpServerAuthStatusSchema
+  })
+})
+
 export const mcpGetPromptRoute = defineRouteContract({
   name: 'mcp.getPrompt',
   input: z.object({
diff --git a/src/shared/contracts/routes/oauth.routes.ts b/src/shared/contracts/routes/oauth.routes.ts
index bf9519d11..aca4e3caf 100644
--- a/src/shared/contracts/routes/oauth.routes.ts
+++ b/src/shared/contracts/routes/oauth.routes.ts
@@ -53,6 +53,14 @@ export const oauthOpenAICodexStartBrowserLoginRoute = defineRouteContract({
   output: OpenAICodexStatusResultSchema
 })
 
+export const oauthOpenAICodexCompleteBrowserLoginFromUrlRoute = defineRouteContract({
+  name: 'oauth.openaiCodex.completeBrowserLoginFromUrl',
+  input: z.object({
+    callbackUrl: z.string()
+  }),
+  output: OpenAICodexStatusResultSchema
+})
+
 export const oauthOpenAICodexCancelLoginRoute = defineRouteContract({
   name: 'oauth.openaiCodex.cancelLogin',
   input: z.object({}),
diff --git a/src/shared/types/presenters/core.presenter.d.ts b/src/shared/types/presenters/core.presenter.d.ts
index 2184ff66e..e52f74873 100644
--- a/src/shared/types/presenters/core.presenter.d.ts
+++ b/src/shared/types/presenters/core.presenter.d.ts
@@ -412,6 +412,7 @@ export interface IOAuthPresenter {
   startGitHubCopilotDeviceFlowLogin(providerId: string): Promise<boolean>
   getOpenAICodexStatus(): Promise<OpenAICodexAuthStatus>
   startOpenAICodexBrowserLogin(): Promise<OpenAICodexAuthStatus>
+  completeOpenAICodexBrowserLoginFromUrl(callbackUrl: string): Promise<OpenAICodexAuthStatus>
   cancelOpenAICodexLogin(): Promise<OpenAICodexAuthStatus>
   logoutOpenAICodex(): Promise<OpenAICodexAuthStatus>
 }
@@ -1638,6 +1639,23 @@ export interface MCPConfig {
   ready: boolean
 }
 
+export type McpServerAuthState =
+  | 'unsupported'
+  | 'none'
+  | 'required'
+  | 'authenticating'
+  | 'authenticated'
+  | 'error'
+
+export interface McpServerAuthStatus {
+  serverName: string
+  state: McpServerAuthState
+  authenticated: boolean
+  error?: string
+  updatedAt?: number
+  storage?: 'safeStorage' | 'file' | 'none'
+}
+
 export interface MCPToolDefinition {
   type: string
   source?: 'mcp' | 'agent'
@@ -1772,6 +1790,13 @@ export interface IMCPPresenter {
   startServer(serverName: string): Promise<void>
   stopServer(serverName: string): Promise<void>
   getServerLastError?(serverName: string): string | undefined
+  getMcpServerAuthStatus(serverName: string): Promise<McpServerAuthStatus>
+  startMcpServerAuth(serverName: string): Promise<McpServerAuthStatus>
+  completeMcpServerAuthFromCallbackUrl(
+    serverName: string,
+    callbackUrl: string
+  ): Promise<McpServerAuthStatus>
+  logoutMcpServerAuth(serverName: string): Promise<McpServerAuthStatus>
   getAllToolDefinitions(
     enabledMcpTools?:
       | string[]
diff --git a/test/main/presenter/mcpPresenter/mcpOAuthManager.test.ts b/test/main/presenter/mcpPresenter/mcpOAuthManager.test.ts
new file mode 100644
index 000000000..5605e1c82
--- /dev/null
+++ b/test/main/presenter/mcpPresenter/mcpOAuthManager.test.ts
@@ -0,0 +1,49 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const publishDeepchatEventMock = vi.hoisted(() => vi.fn())
+
+vi.mock('@/routes/publishDeepchatEvent', () => ({
+  publishDeepchatEvent: publishDeepchatEventMock
+}))
+
+import { McpOAuthManager } from '../../../../src/main/presenter/mcpPresenter/mcpOAuthManager'
+import type { McpOAuthCredentialStore } from '../../../../src/main/presenter/mcpPresenter/oauthCredentialStore'
+
+const createStore = (entry: unknown): McpOAuthCredentialStore =>
+  ({
+    getStorageState: vi.fn(() => 'file'),
+    load: vi.fn(() => entry),
+    saveEntry: vi.fn(),
+    clearEntry: vi.fn(),
+    clearEntryScope: vi.fn()
+  }) as unknown as McpOAuthCredentialStore
+
+describe('McpOAuthManager', () => {
+  it('keeps authenticated credentials ahead of stale non-pending errors', async () => {
+    const manager = new McpOAuthManager(
+      createStore({
+        tokens: {
+          access_token: 'access-token'
+        },
+        updatedAt: 123
+      })
+    )
+    const config = {
+      type: 'http',
+      baseUrl: 'https://mcp.linear.app/mcp'
+    }
+
+    manager.handleConnectionError('linear', config, new Error('401 unauthorized'))
+
+    const status = await manager.completeAuthFromCallbackUrl(
+      'linear',
+      config,
+      'http://localhost:3333/callback?code=used&state=used'
+    )
+
+    expect(status.state).toBe('authenticated')
+    expect(status.authenticated).toBe(true)
+    expect(status.error).toBeUndefined()
+    expect(publishDeepchatEventMock).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/test/main/presenter/openaiCodexAuth.test.ts b/test/main/presenter/openaiCodexAuth.test.ts
index 4bc8e4ea0..e36a1b4df 100644
--- a/test/main/presenter/openaiCodexAuth.test.ts
+++ b/test/main/presenter/openaiCodexAuth.test.ts
@@ -1,6 +1,6 @@
 import * as fs from 'fs'
 import * as path from 'path'
-import { BrowserWindow, shell } from 'electron'
+import { shell } from 'electron'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { OpenAICodexAuth } from '../../../src/main/presenter/openaiCodexAuth'
 import { OpenAICodexCredentialStore } from '../../../src/main/presenter/openaiCodexAuth/credentialStore'
@@ -26,7 +26,6 @@ describe('OpenAI Codex auth', () => {
     vi.mocked(fs.rmSync).mockImplementation((file) => {
       files.delete(String(file))
     })
-    vi.mocked(BrowserWindow).mockClear()
     vi.mocked(shell.openExternal).mockClear()
     delete process.env.DEEPCHAT_OPENAI_CODEX_DISABLED
   })
@@ -153,7 +152,7 @@ describe('OpenAI Codex auth', () => {
     expect(store.load()?.refreshToken).toBe('new-refresh-token')
   })
 
-  it('opens browser login in an internal authorization window', async () => {
+  it('opens browser login externally and completes from a pasted callback URL', async () => {
     const store = new OpenAICodexCredentialStore(path.join(tempDir, 'browser.json'))
     const fetchMock = vi.fn().mockResolvedValue(
       new Response(
@@ -176,39 +175,22 @@ describe('OpenAI Codex auth', () => {
     const auth = new OpenAICodexAuth(store)
 
     const status = await auth.startBrowserLogin()
-    const authWindow = vi.mocked(BrowserWindow).mock.results[0]?.value
+    const authUrl = new URL(vi.mocked(shell.openExternal).mock.calls[0][0])
+    const redirectUri = authUrl.searchParams.get('redirect_uri')!
+    const state = authUrl.searchParams.get('state')!
 
     expect(status.state).toBe('pending-browser')
     expect(store.load()).toBeNull()
-    expect(BrowserWindow).toHaveBeenCalledWith(
-      expect.objectContaining({
-        title: 'OpenAI Codex Authorization',
-        width: 520,
-        height: 720
-      })
-    )
-    expect(authWindow.loadURL).toHaveBeenCalledWith(
+    expect(shell.openExternal).toHaveBeenCalledWith(
       expect.stringContaining('https://auth.openai.com/oauth/authorize')
     )
-    expect(authWindow.show).toHaveBeenCalledTimes(1)
-    expect(authWindow.focus).toHaveBeenCalledTimes(1)
-    expect(shell.openExternal).not.toHaveBeenCalled()
-
-    const navigateHandler = authWindow.webContents.on.mock.calls.find(
-      ([eventName]: [string]) => eventName === 'will-navigate'
-    )?.[1]
-    const preventDefault = vi.fn()
-    navigateHandler(
-      {
-        preventDefault
-      },
-      'http://localhost:1455/auth/callback?code=browser-code&state=' +
-        encodeURIComponent(new URL(authWindow.loadURL.mock.calls[0][0]).searchParams.get('state')!)
-    )
+
+    const callbackUrl = new URL(redirectUri)
+    callbackUrl.searchParams.set('code', 'browser-code')
+    callbackUrl.searchParams.set('state', state)
+    await auth.completeBrowserLoginFromCallbackUrl(callbackUrl.toString())
 
     await vi.waitFor(() => expect(store.load()?.accessToken).toBe('browser-token'))
-    expect(preventDefault).toHaveBeenCalledTimes(1)
-    expect(authWindow.close).toHaveBeenCalledTimes(1)
     expect(auth.getStatus().state).toBe('authenticated')
   })
 
diff --git a/test/renderer/components/McpServers.test.ts b/test/renderer/components/McpServers.test.ts
index 4035656d1..49b8f3097 100644
--- a/test/renderer/components/McpServers.test.ts
+++ b/test/renderer/components/McpServers.test.ts
@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { defineComponent, reactive } from 'vue'
-import { mount } from '@vue/test-utils'
+import { flushPromises, mount } from '@vue/test-utils'
 
 const passthrough = (name: string) =>
   defineComponent({
@@ -22,9 +22,13 @@ const serverCardStub = defineComponent({
       required: true
     }
   },
-  emits: ['toggle'],
-  template:
-    '<button data-testid="server-card" @click="$emit(\'toggle\')">{{ server.name }}:{{ server.enabled }}</button>'
+  emits: ['toggle', 'authenticate'],
+  template: `
+    <div>
+      <button data-testid="server-card" @click="$emit('toggle')">{{ server.name }}:{{ server.enabled }}</button>
+      <button data-testid="authenticate-server" @click="$emit('authenticate')">auth</button>
+    </div>
+  `
 })
 
 type SetupOptions = {
@@ -101,6 +105,13 @@ const setup = async (options: SetupOptions = {}) => {
     updateServer: vi.fn().mockResolvedValue(true),
     removeServer: vi.fn().mockResolvedValue(true),
     toggleServer: vi.fn().mockResolvedValue(true),
+    startServerAuth: vi.fn().mockResolvedValue({
+      serverName: 'running-server',
+      state: 'authenticating',
+      authenticated: false
+    }),
+    completeServerAuthFromCallbackUrl: vi.fn(),
+    updateServerAuthStatus: vi.fn().mockResolvedValue(null),
     loadTools: vi.fn().mockResolvedValue(undefined),
     loadPrompts: vi.fn().mockResolvedValue(undefined),
     loadResources: vi.fn().mockResolvedValue(undefined)
@@ -287,4 +298,24 @@ describe('McpServers', () => {
     expect(wrapper.text()).toContain('settings.mcp.noServersFound')
     expect(wrapper.findAll('[data-testid="server-card"]')).toHaveLength(0)
   })
+
+  it('refreshes auth status when returning to the callback dialog', async () => {
+    const { wrapper, mcpStore } = await setup({ withServers: true })
+    mcpStore.updateServerAuthStatus.mockResolvedValueOnce({
+      serverName: 'running-server',
+      state: 'authenticated',
+      authenticated: true
+    })
+
+    await wrapper.find('[data-testid="authenticate-server"]').trigger('click')
+    await flushPromises()
+    window.dispatchEvent(new Event('focus'))
+    await flushPromises()
+    window.dispatchEvent(new Event('focus'))
+    await flushPromises()
+
+    expect(mcpStore.startServerAuth).toHaveBeenCalledWith('running-server')
+    expect(mcpStore.updateServerAuthStatus).toHaveBeenCalledTimes(1)
+    expect(mcpStore.updateServerAuthStatus).toHaveBeenCalledWith('running-server', true)
+  })
 })
diff --git a/test/renderer/components/SheetContentDrag.test.ts b/test/renderer/components/SheetContentDrag.test.ts
new file mode 100644
index 000000000..65d473066
--- /dev/null
+++ b/test/renderer/components/SheetContentDrag.test.ts
@@ -0,0 +1,12 @@
+import { readFile } from 'fs/promises'
+import { describe, expect, it } from 'vitest'
+
+describe('SheetContent drag region', () => {
+  it('keeps the close button outside the Electron drag region', async () => {
+    const source = await readFile('src/shadcn/components/ui/sheet/SheetContent.vue', 'utf-8')
+    const closeButton = source.match(/<DialogClose[\s\S]*?>/)?.[0] ?? ''
+
+    expect(closeButton).toContain('window-no-drag-region')
+    expect(closeButton).toContain('-webkit-app-region: no-drag')
+  })
+})
diff --git a/test/renderer/stores/mcpStore.test.ts b/test/renderer/stores/mcpStore.test.ts
index b014e2e03..b94938553 100644
--- a/test/renderer/stores/mcpStore.test.ts
+++ b/test/renderer/stores/mcpStore.test.ts
@@ -9,6 +9,11 @@ const mcpClientMock = vi.hoisted(() => ({
   startServer: vi.fn().mockResolvedValue(undefined),
   stopServer: vi.fn().mockResolvedValue(undefined),
   isServerRunning: vi.fn().mockResolvedValue(false),
+  getServerAuthStatus: vi.fn().mockResolvedValue({
+    serverName: 'demo',
+    state: 'none',
+    authenticated: false
+  }),
   getAllToolDefinitions: vi.fn().mockResolvedValue([]),
   getMcpClients: vi.fn().mockResolvedValue([]),
   getAllResources: vi.fn().mockResolvedValue([])
@@ -84,6 +89,12 @@ describe('useMcpStore toggleServer rollback', () => {
     setMcpServerEnabledMutate.mockReset()
     mcpClientMock.startServer.mockClear()
     mcpClientMock.stopServer.mockClear()
+    mcpClientMock.getServerAuthStatus.mockReset()
+    mcpClientMock.getServerAuthStatus.mockResolvedValue({
+      serverName: 'demo',
+      state: 'none',
+      authenticated: false
+    })
   })
 
   it('restores local state and persisted config when runtime sync fails', async () => {
@@ -121,6 +132,44 @@ describe('useMcpStore toggleServer rollback', () => {
     expect(mcpClientMock.stopServer).not.toHaveBeenCalled()
   })
 
+  it('keeps enabled state when startup requires OAuth authentication', async () => {
+    const store = await setupStore()
+
+    store.config = {
+      mcpServers: {
+        demo: {
+          command: 'demo-command',
+          args: [],
+          env: {},
+          descriptions: 'Demo server',
+          icons: 'D',
+          autoApprove: [],
+          disable: false,
+          type: 'stdio',
+          enabled: false
+        }
+      },
+      mcpEnabled: true,
+      ready: true
+    }
+
+    setMcpServerEnabledMutate.mockRejectedValueOnce(new Error('authorization required'))
+    mcpClientMock.getServerAuthStatus.mockResolvedValueOnce({
+      serverName: 'demo',
+      state: 'required',
+      authenticated: false
+    })
+
+    const result = await store.toggleServer('demo')
+
+    expect(result).toBe(true)
+    expect(store.config.mcpServers.demo.enabled).toBe(true)
+    expect(store.serverAuthStatuses.demo?.state).toBe('required')
+    expect(store.serverStatuses.demo).toBe(false)
+    expect(setMcpServerEnabledMutate).toHaveBeenCalledTimes(1)
+    expect(setMcpServerEnabledMutate).toHaveBeenCalledWith(['demo', true])
+  })
+
   it('hides enabled servers when MCP is globally disabled', async () => {
     const store = await setupStore()
 

From 852a11daf7f3a905563e01c6eea5cacf404ac4f7 Mon Sep 17 00:00:00 2001
From: zerob13 <zerob13@gmail.com>
Date: Fri, 3 Jul 2026 13:08:10 +0800
Subject: [PATCH 2/5] docs(mcp): plan permission system removal

---
 .../remove-mcp-permission-system/plan.md      | 88 +++++++++++++++++++
 .../remove-mcp-permission-system/spec.md      | 69 +++++++++++++++
 .../remove-mcp-permission-system/tasks.md     | 12 +++
 3 files changed, 169 insertions(+)
 create mode 100644 docs/architecture/remove-mcp-permission-system/plan.md
 create mode 100644 docs/architecture/remove-mcp-permission-system/spec.md
 create mode 100644 docs/architecture/remove-mcp-permission-system/tasks.md

diff --git a/docs/architecture/remove-mcp-permission-system/plan.md b/docs/architecture/remove-mcp-permission-system/plan.md
new file mode 100644
index 000000000..48ff59af9
--- /dev/null
+++ b/docs/architecture/remove-mcp-permission-system/plan.md
@@ -0,0 +1,88 @@
+# Plan
+
+## Current Owners
+
+- MCP runtime permission checks: `src/main/presenter/mcpPresenter/toolManager.ts`
+- MCP server config defaults and normalization: `src/main/presenter/configPresenter/mcpConfHelper.ts`
+- Deep link and marketplace MCP import defaults: `src/main/presenter/deeplinkPresenter/index.ts`,
+  `src/main/presenter/mcpPresenter/mcprouterManager.ts`,
+  `src/main/presenter/llmProviderPresenter/modelScopeMcp.ts`
+- Plugin MCP manifest mapping: `src/main/presenter/pluginPresenter/index.ts`
+- MCP server form UI: `src/renderer/src/components/mcp-config/McpServerForm.vue`
+- Public MCP config type: `src/shared/types/presenters/core.presenter.d.ts`
+- Existing tests: MCP form, config import, tool manager, plugin presenter, deeplink presenter, sync import.
+
+## Target Behavior
+
+MCP should execute tools when the agent/session layer has allowed the tool call to proceed. MCP
+should still return normal tool errors for transport/server/tool failures, but it should not create
+permission request blocks.
+
+```text
+Before
+agent/session permission -> MCP autoApprove/session cache/plugin policy -> MCP tool call
+
+After
+agent/session permission -> MCP tool call
+```
+
+Agent-scoped MCP server/plugin selection stays outside this removal:
+
+```text
+agent selected servers/plugins -> tool list filtering -> agent/session permission -> MCP tool call
+```
+
+## Implementation Steps
+
+1. Runtime removal
+   - Remove `checkToolPermission`, `determinePermissionType`, MCP session permission cache, and
+     `updateServerPermissions` from `ToolManager`.
+   - Remove MCP-generated `requiresPermission` / `permissionRequest` responses.
+   - Preserve server/tool availability checks and normal error handling.
+
+2. Config migration and normalization
+   - Strip `autoApprove` from persisted MCP server configs when reading or migrating settings.
+   - Ensure built-in MCP defaults no longer include `autoApprove`.
+   - Ensure imported/synced/deeplink/marketplace/plugin MCP configs drop `autoApprove`.
+   - Treat unknown legacy `autoApprove` values as ignored until the field is fully removed from
+     shared types.
+
+3. UI removal
+   - Remove auto-approve controls and state from `McpServerForm.vue`.
+   - Remove `settings.mcp.serverForm.autoApprove*` and `mcp.server.autoApprove*` i18n keys after no
+     code references them.
+   - Update tests that currently assert editable auto-approve controls.
+
+4. Type cleanup
+   - Remove `autoApprove` from `MCPServerConfig` after all producers are updated.
+   - If needed, introduce a private legacy input type for import/migration code only.
+   - Keep route contracts structurally compatible by parsing legacy payloads and normalizing them
+     before persistence.
+
+5. Test strategy
+   - Tool manager: MCP tool calls no longer produce permission requests from `autoApprove`.
+   - Config presenter: persisted legacy `autoApprove` is stripped on read/write migration.
+   - MCP form: no auto-approve controls render or submit.
+   - Import/deeplink/plugin/marketplace sync: incoming `autoApprove` is ignored.
+   - Agent/session permission tests stay in the agent runtime suites, not MCP suites.
+
+## Migration Notes
+
+Prefer normalizing at the config boundary so old configs cannot leak back into renderer state:
+
+```text
+read stored mcpServers
+  -> normalize server config
+  -> delete autoApprove
+  -> persist normalized config when settings are next saved or during explicit migration
+```
+
+This keeps runtime code simple and prevents UI/API clients from seeing obsolete permission data.
+
+## Risks
+
+- Some tests or fixtures assume `autoApprove: []` is required. Those should be updated to omit the
+  field.
+- Plugin manifests may still carry `autoApprove`; import code should ignore it instead of rejecting
+  older manifests.
+- Removing MCP permission requests must not remove agent/session permission prompts.
diff --git a/docs/architecture/remove-mcp-permission-system/spec.md b/docs/architecture/remove-mcp-permission-system/spec.md
new file mode 100644
index 000000000..063f7048e
--- /dev/null
+++ b/docs/architecture/remove-mcp-permission-system/spec.md
@@ -0,0 +1,69 @@
+# Remove MCP Permission System
+
+## User Need
+
+DeepChat should have one permission owner for tool execution: the agent/session permission system.
+MCP should provide transports, tool discovery, tool execution, authentication, and server selection,
+but it should not maintain a second permission layer.
+
+Today MCP stores and checks per-server `autoApprove` permissions. That creates duplicated policy:
+
+- agent/session permission mode decides whether a tool action needs review;
+- MCP `autoApprove` can independently bypass or request permission;
+- historical MCP permission settings survive upgrades and keep affecting behavior.
+
+## Goal
+
+Remove MCP-specific permission handling so MCP does no extra approval, denial, or auto-approval
+processing. After upgrade, historical MCP permission settings are cleared or ignored.
+
+## Acceptance Criteria
+
+- MCP tool execution no longer checks `MCPServerConfig.autoApprove`.
+- MCP no longer persists new per-server approval settings.
+- Existing persisted MCP permission settings are removed during migration or normalized away on read.
+- MCP add/edit/import/sync paths do not reintroduce `autoApprove`.
+- MCP UI no longer displays per-server auto-approve controls.
+- MCP permission request/session-cache code paths are removed from the MCP presenter.
+- Agent/session permission mode remains the only tool-execution permission gate.
+- MCP OAuth authentication remains separate and unchanged; authentication is not a permission gate.
+- Agent-scoped MCP server/plugin selection remains unchanged; selection is not a permission system.
+
+## Non-Goals
+
+- Do not remove agent/session permission modes such as `default`, `full_access`, or `auto_approve`.
+- Do not change ACP `session/request_permission` handling.
+- Do not change plugin installation trust or plugin ownership metadata.
+- Do not change MCP OAuth credential storage or authentication prompts.
+- Do not change server enablement, agent server selection, or plugin server selection.
+
+## Compatibility
+
+Historical config may contain:
+
+```json
+{
+  "mcpServers": {
+    "linear": {
+      "autoApprove": ["all"]
+    }
+  }
+}
+```
+
+After migration/read normalization, DeepChat should behave as if the field does not exist:
+
+```json
+{
+  "mcpServers": {
+    "linear": {}
+  }
+}
+```
+
+The implementation may keep a temporary optional type field only as a read-compatibility shim, but
+runtime logic must not use it.
+
+## Open Questions
+
+None.
diff --git a/docs/architecture/remove-mcp-permission-system/tasks.md b/docs/architecture/remove-mcp-permission-system/tasks.md
new file mode 100644
index 000000000..1b226c770
--- /dev/null
+++ b/docs/architecture/remove-mcp-permission-system/tasks.md
@@ -0,0 +1,12 @@
+# Tasks
+
+- [ ] Remove MCP runtime permission checks from `ToolManager`.
+- [ ] Remove MCP session permission cache/update paths.
+- [ ] Strip `autoApprove` from built-in/default MCP configs.
+- [ ] Normalize persisted MCP server configs to remove historical `autoApprove`.
+- [ ] Drop `autoApprove` from deeplink, marketplace, ModelScope, sync import, and plugin MCP mapping.
+- [ ] Remove MCP server form auto-approve controls and related local state.
+- [ ] Remove unused MCP auto-approve i18n keys after code references are gone.
+- [ ] Remove `autoApprove` from shared MCP config types or confine it to legacy input normalization.
+- [ ] Update tests and fixtures that still include `autoApprove`.
+- [ ] Validate with format, i18n, lint, typecheck, and focused MCP/tool permission tests.

From 03aa6f72fd47ad18bd59eab819fd98d1d56ebb43 Mon Sep 17 00:00:00 2001
From: zerob13 <zerob13@gmail.com>
Date: Fri, 3 Jul 2026 13:30:43 +0800
Subject: [PATCH 3/5] fix(mcp): include tools in sessions

---
 .../mcp-tools-missing-from-session/plan.md    | 33 ++++++++++++++++
 .../mcp-tools-missing-from-session/spec.md    | 38 +++++++++++++++++++
 .../mcp-tools-missing-from-session/tasks.md   |  8 ++++
 .../presenter/agentRuntimePresenter/index.ts  |  8 +---
 .../agentRuntimePresenter.test.ts             | 37 ++++++++++++++++++
 .../components/PluginPageWrappers.test.ts     |  4 +-
 6 files changed, 120 insertions(+), 8 deletions(-)
 create mode 100644 docs/issues/mcp-tools-missing-from-session/plan.md
 create mode 100644 docs/issues/mcp-tools-missing-from-session/spec.md
 create mode 100644 docs/issues/mcp-tools-missing-from-session/tasks.md

diff --git a/docs/issues/mcp-tools-missing-from-session/plan.md b/docs/issues/mcp-tools-missing-from-session/plan.md
new file mode 100644
index 000000000..4ef3e9c42
--- /dev/null
+++ b/docs/issues/mcp-tools-missing-from-session/plan.md
@@ -0,0 +1,33 @@
+# Plan
+
+## Diagnosis
+
+The provider request is assembled from `AgentRuntimePresenter.loadToolDefinitionsForSession()`.
+That path calls `ToolPresenter.getAllToolDefinitions()` with agent extension policy. Historical
+`enabledMcpServerIds` can be an empty allowlist, which filters out all MCP tools even though the MCP
+store and chat popover can still show a running server and tool count.
+
+Separately, `ToolManager` clears its MCP definition cache on `MCP_EVENTS.CLIENT_LIST_UPDATED`, but
+`AgentRuntimePresenter` does not currently treat the same event as a session tool-profile change.
+
+## Implementation
+
+1. Stop passing `enabledMcpServerIds` from agent policy into session tool discovery and tool-call
+   routing.
+2. Remove `enabledMcpServerIds` from the session tool-profile fingerprint so historical MCP policy
+   no longer affects cache keys.
+3. Register `MCP_EVENTS.CLIENT_LIST_UPDATED` with `handleToolRegistryChanged`.
+4. Keep plugin and skill policy behavior unchanged.
+
+## Test Strategy
+
+- Add a main presenter test that verifies MCP client-list updates invalidate the cached session tool
+  profile.
+- Add a main presenter test that verifies historical `enabledMcpServerIds: []` is ignored for
+  session tool discovery.
+- Update any renderer wrapper test that still expects the old MCP agent-scope route.
+
+## Risks
+
+- Old tests may still encode agent-scoped MCP selection. Update only the expectations affected by
+  the already-changed MCP plugins page.
diff --git a/docs/issues/mcp-tools-missing-from-session/spec.md b/docs/issues/mcp-tools-missing-from-session/spec.md
new file mode 100644
index 000000000..d3d4492ab
--- /dev/null
+++ b/docs/issues/mcp-tools-missing-from-session/spec.md
@@ -0,0 +1,38 @@
+# MCP Tools Missing From Session
+
+## User Need
+
+When an MCP server is enabled and exposes tools, DeepChat sessions should include those MCP tool
+schemas in the provider request. The chat advanced configuration may show the running MCP server and
+tool count, but the actual request trace can still omit MCP tools.
+
+## Goal
+
+Ensure session tool resolution in the main process cannot be blocked by stale or historical
+agent-scoped MCP server allowlists, and refresh cached session tool profiles when the MCP client list
+changes.
+
+## Acceptance Criteria
+
+- A running MCP server's tools are available to DeepChat agent sessions by default.
+- Historical `enabledMcpServerIds: []` or stale agent MCP policy does not filter MCP tools out of
+  session requests.
+- MCP client list updates invalidate cached session tool profiles.
+- Existing agent tool enable/disable behavior remains unchanged.
+- MCP OAuth authentication remains unchanged.
+
+## Constraints
+
+- Keep the fix in the main session/tool resolution path.
+- Do not introduce a new permission model or new renderer state.
+- Preserve MCP global enablement and server running-state checks.
+
+## Non-Goals
+
+- Do not remove the MCP OAuth flow.
+- Do not change agent built-in tool toggles.
+- Do not complete the broader MCP `autoApprove` permission-system removal in this issue.
+
+## Open Questions
+
+None.
diff --git a/docs/issues/mcp-tools-missing-from-session/tasks.md b/docs/issues/mcp-tools-missing-from-session/tasks.md
new file mode 100644
index 000000000..a3b9bd3da
--- /dev/null
+++ b/docs/issues/mcp-tools-missing-from-session/tasks.md
@@ -0,0 +1,8 @@
+# Tasks
+
+- [x] Diagnose request tool assembly and MCP filtering path.
+- [x] Document the issue contract and implementation plan.
+- [x] Stop session tool resolution from applying historical MCP server allowlists.
+- [x] Invalidate session tool profiles on MCP client-list updates.
+- [x] Add focused tests for cache invalidation and historical MCP policy.
+- [x] Run focused tests and project validation commands.
diff --git a/src/main/presenter/agentRuntimePresenter/index.ts b/src/main/presenter/agentRuntimePresenter/index.ts
index cca971162..1f291ec70 100644
--- a/src/main/presenter/agentRuntimePresenter/index.ts
+++ b/src/main/presenter/agentRuntimePresenter/index.ts
@@ -206,7 +206,6 @@ type ResumeBudgetToolCall = {
 type AgentExtensionPolicy = {
   enabledPluginIds?: string[] | null
   enabledSkillNames?: string[] | null
-  enabledMcpServerIds?: string[] | null
 }
 
 type PackageJsonManifest = {
@@ -731,6 +730,7 @@ export class AgentRuntimePresenter implements IAgentImplementation {
     eventBus.on(MCP_EVENTS.SERVER_STARTED, this.handleToolRegistryChanged)
     eventBus.on(MCP_EVENTS.SERVER_STOPPED, this.handleToolRegistryChanged)
     eventBus.on(MCP_EVENTS.SERVER_STATUS_CHANGED, this.handleToolRegistryChanged)
+    eventBus.on(MCP_EVENTS.CLIENT_LIST_UPDATED, this.handleToolRegistryChanged)
     eventBus.on(MCP_EVENTS.INITIALIZED, this.handleToolRegistryChanged)
   }
 
@@ -6399,7 +6399,6 @@ export class AgentRuntimePresenter implements IAgentImplementation {
       const extensionPolicy = await this.resolveAgentExtensionPolicy(sessionId)
       const result = await this.toolPresenter.callTool(request, {
         agentId: this.getSessionAgentId(sessionId) ?? 'deepchat',
-        enabledMcpServerIds: extensionPolicy.enabledMcpServerIds ?? undefined,
         enabledPluginIds: extensionPolicy.enabledPluginIds ?? undefined,
         onProgress: (update) => {
           if (
@@ -6553,7 +6552,6 @@ export class AgentRuntimePresenter implements IAgentImplementation {
 
       const tools = await this.toolPresenter.getAllToolDefinitions({
         agentId,
-        enabledMcpServerIds: policy.enabledMcpServerIds ?? undefined,
         enabledPluginIds: policy.enabledPluginIds ?? undefined,
         disabledAgentTools: this.getDisabledAgentTools(sessionId),
         chatMode: 'agent',
@@ -6605,7 +6603,6 @@ export class AgentRuntimePresenter implements IAgentImplementation {
         disabledAgentTools: [...disabledAgentTools].sort((left, right) =>
           left.localeCompare(right)
         ),
-        enabledMcpServerIds: this.normalizeNullablePolicyList(policy.enabledMcpServerIds),
         enabledPluginIds: this.normalizeNullablePolicyList(policy.enabledPluginIds),
         enabledSkillNames: this.normalizeNullablePolicyList(policy.enabledSkillNames),
         skillsEnabled,
@@ -6644,8 +6641,7 @@ export class AgentRuntimePresenter implements IAgentImplementation {
       const config = await this.configPresenter.resolveDeepChatAgentConfig(agentId)
       return {
         enabledPluginIds: config.enabledPluginIds,
-        enabledSkillNames: config.enabledSkillNames,
-        enabledMcpServerIds: config.enabledMcpServerIds
+        enabledSkillNames: config.enabledSkillNames
       }
     } catch (error) {
       console.warn(
diff --git a/test/main/presenter/agentRuntimePresenter/agentRuntimePresenter.test.ts b/test/main/presenter/agentRuntimePresenter/agentRuntimePresenter.test.ts
index ce4063842..a364f215d 100644
--- a/test/main/presenter/agentRuntimePresenter/agentRuntimePresenter.test.ts
+++ b/test/main/presenter/agentRuntimePresenter/agentRuntimePresenter.test.ts
@@ -49,6 +49,7 @@ vi.mock('@/events', () => ({
     SERVER_STOPPED: 'mcp:server-stopped',
     CONFIG_CHANGED: 'mcp:config-changed',
     SERVER_STATUS_CHANGED: 'mcp:server-status-changed',
+    CLIENT_LIST_UPDATED: 'mcp:client-list-updated',
     INITIALIZED: 'mcp:initialized'
   }
 }))
@@ -104,6 +105,7 @@ vi.mock('@/presenter/agentRuntimePresenter/process', () => ({
 
 import { processStream } from '@/presenter/agentRuntimePresenter/process'
 import { presenter } from '@/presenter'
+import { eventBus } from '@/eventbus'
 import { publishDeepchatEvent } from '@/routes/publishDeepchatEvent'
 import {
   buildRuntimeCapabilitiesPrompt,
@@ -120,6 +122,14 @@ function expectPublished(eventName: string, payload: Record<string, unknown>): v
   expect(publishDeepchatEvent).toHaveBeenCalledWith(eventName, expect.objectContaining(payload))
 }
 
+function getEventHandler(eventName: string): () => void {
+  const handler = (eventBus.on as ReturnType<typeof vi.fn>).mock.calls.find(
+    ([name]) => name === eventName
+  )?.[1]
+  expect(handler).toEqual(expect.any(Function))
+  return handler as () => void
+}
+
 function deferred<T>() {
   let resolve: (value: T) => void = () => {
     throw new Error('Deferred promise resolved before initialization')
@@ -2399,6 +2409,33 @@ describe('AgentRuntimePresenter', () => {
       expect(firstCallArgs.messages[0].content).toBe(secondCallArgs.messages[0].content)
     })
 
+    it('invalidates cached tools when the MCP client list changes', async () => {
+      await agent.initSession('s1', { providerId: 'openai', modelId: 'gpt-4' })
+      await agent.processMessage('s1', 'Before MCP update')
+
+      expect(toolPresenter.getAllToolDefinitions).toHaveBeenCalledTimes(1)
+
+      getEventHandler('mcp:client-list-updated')()
+      await agent.processMessage('s1', 'After MCP update')
+
+      expect(toolPresenter.getAllToolDefinitions).toHaveBeenCalledTimes(2)
+    })
+
+    it('ignores historical agent MCP server allowlists for session tool discovery', async () => {
+      configPresenter.resolveDeepChatAgentConfig.mockResolvedValue({
+        enabledMcpServerIds: [],
+        enabledPluginIds: ['plugin-a'],
+        enabledSkillNames: ['skill-a']
+      })
+
+      await agent.initSession('s1', { providerId: 'openai', modelId: 'gpt-4' })
+      await agent.processMessage('s1', 'Hello')
+
+      const toolContext = toolPresenter.getAllToolDefinitions.mock.calls[0][0]
+      expect(toolContext).not.toHaveProperty('enabledMcpServerIds')
+      expect(toolContext.enabledPluginIds).toEqual(['plugin-a'])
+    })
+
     it('invalidates cached prompt after system prompt update', async () => {
       vi.useFakeTimers()
       vi.setSystemTime(new Date('2026-03-05T08:00:00.000Z'))
diff --git a/test/renderer/components/PluginPageWrappers.test.ts b/test/renderer/components/PluginPageWrappers.test.ts
index 120167294..986e352fe 100644
--- a/test/renderer/components/PluginPageWrappers.test.ts
+++ b/test/renderer/components/PluginPageWrappers.test.ts
@@ -9,8 +9,8 @@ describe('plugins page wrappers', () => {
     expect(skillsSource).not.toContain('AgentExtensionPolicyPanel')
   })
 
-  it('renders the original MCP settings view in agent scope', () => {
-    expect(mcpSource).toContain('<McpSettings scope="agent" />')
+  it('renders the original MCP settings view in global scope', () => {
+    expect(mcpSource).toContain('<McpSettings />')
     expect(mcpSource).toContain('settings/components/McpSettings.vue')
     expect(mcpSource).not.toContain('AgentExtensionPolicyPanel')
   })

From e398368f90cee242c7b1b19d08ec47e07ceb1dc6 Mon Sep 17 00:00:00 2001
From: zerob13 <zerob13@gmail.com>
Date: Fri, 3 Jul 2026 13:34:31 +0800
Subject: [PATCH 4/5] fix(mcp): sort enabled servers first

---
 docs/issues/mcp-enabled-server-sort/plan.md  | 16 +++++++
 docs/issues/mcp-enabled-server-sort/spec.md  | 30 +++++++++++++
 docs/issues/mcp-enabled-server-sort/tasks.md |  6 +++
 src/renderer/src/stores/mcp.ts               | 14 ++----
 test/renderer/stores/mcpStore.test.ts        | 46 ++++++++++++++++++++
 5 files changed, 102 insertions(+), 10 deletions(-)
 create mode 100644 docs/issues/mcp-enabled-server-sort/plan.md
 create mode 100644 docs/issues/mcp-enabled-server-sort/spec.md
 create mode 100644 docs/issues/mcp-enabled-server-sort/tasks.md

diff --git a/docs/issues/mcp-enabled-server-sort/plan.md b/docs/issues/mcp-enabled-server-sort/plan.md
new file mode 100644
index 000000000..647443844
--- /dev/null
+++ b/docs/issues/mcp-enabled-server-sort/plan.md
@@ -0,0 +1,16 @@
+# Plan
+
+## Implementation
+
+Update `allServerList` in `src/renderer/src/stores/mcp.ts` to rank servers by:
+
+1. enabled built-in/deepchat
+2. enabled custom
+3. disabled built-in/deepchat
+4. disabled custom
+
+Keep JavaScript's stable sort preserving original config order inside the same rank.
+
+## Test Strategy
+
+Add a store test proving an enabled custom server sorts before disabled built-in/custom servers.
diff --git a/docs/issues/mcp-enabled-server-sort/spec.md b/docs/issues/mcp-enabled-server-sort/spec.md
new file mode 100644
index 000000000..fcef47557
--- /dev/null
+++ b/docs/issues/mcp-enabled-server-sort/spec.md
@@ -0,0 +1,30 @@
+# MCP Enabled Server Sort
+
+## User Need
+
+Enabled MCP servers should appear first in the MCP Center so active servers are easy to find.
+
+## Goal
+
+Sort MCP server cards with enabled servers before disabled servers while preserving the existing
+built-in-first preference inside each enabled/disabled group.
+
+## Acceptance Criteria
+
+- Enabled MCP servers render before disabled MCP servers.
+- Built-in/deepchat servers remain ahead of custom servers within the same enabled state.
+- Existing plugin-owned server filtering remains unchanged.
+
+## Constraints
+
+- Keep the change in the MCP store list ordering.
+- Do not add new UI state or controls.
+
+## Non-Goals
+
+- Do not change server enable/disable behavior.
+- Do not change MCP authentication, tool discovery, or permissions.
+
+## Open Questions
+
+None.
diff --git a/docs/issues/mcp-enabled-server-sort/tasks.md b/docs/issues/mcp-enabled-server-sort/tasks.md
new file mode 100644
index 000000000..6962b6430
--- /dev/null
+++ b/docs/issues/mcp-enabled-server-sort/tasks.md
@@ -0,0 +1,6 @@
+# Tasks
+
+- [x] Locate MCP server list owner.
+- [x] Update MCP server sort rank.
+- [x] Add focused store test.
+- [x] Run focused test and required validation commands.
diff --git a/src/renderer/src/stores/mcp.ts b/src/renderer/src/stores/mcp.ts
index 3411ab333..06e495440 100644
--- a/src/renderer/src/stores/mcp.ts
+++ b/src/renderer/src/stores/mcp.ts
@@ -438,20 +438,14 @@ export const useMcpStore = defineStore('mcp', () => {
       isLoading: serverLoadingStates.value[name] || false
     }))
 
-    // 按照特定顺序排序：
-    // 1. 启用的inmemory服务
-    // 2. 其他启用的服务
-    // 3. 未启用的inmemory服务
-    // 4. 其他服务
+    // Sort enabled servers first, then keep built-in servers ahead within each state.
     return servers.sort((a, b) => {
       const aIsInmemory = a.type === 'inmemory' || a.source === 'deepchat'
       const bIsInmemory = b.type === 'inmemory' || b.source === 'deepchat'
+      const aRank = (a.enabled ? 0 : 2) + (aIsInmemory ? 0 : 1)
+      const bRank = (b.enabled ? 0 : 2) + (bIsInmemory ? 0 : 1)
 
-      // inmemory 都优先
-      if (aIsInmemory && !bIsInmemory) return -1
-      if (!aIsInmemory && bIsInmemory) return 1
-
-      return 0 // 保持原有顺序
+      return aRank - bRank
     })
   })
   const serverList = computed(() =>
diff --git a/test/renderer/stores/mcpStore.test.ts b/test/renderer/stores/mcpStore.test.ts
index b94938553..9347b0ebe 100644
--- a/test/renderer/stores/mcpStore.test.ts
+++ b/test/renderer/stores/mcpStore.test.ts
@@ -260,4 +260,50 @@ describe('useMcpStore toggleServer rollback', () => {
     expect(store.enabledServerCount).toBe(1)
     expect(store.config.mcpServers['cua-driver']).toBeDefined()
   })
+
+  it('sorts enabled servers before disabled servers', async () => {
+    const store = await setupStore()
+
+    store.config = {
+      mcpServers: {
+        memory: {
+          command: 'memory-command',
+          args: [],
+          env: {},
+          descriptions: 'Memory',
+          icons: 'M',
+          autoApprove: [],
+          disable: false,
+          type: 'inmemory',
+          enabled: false
+        },
+        tavily: {
+          command: 'tavily-command',
+          args: [],
+          env: {},
+          descriptions: 'Tavily',
+          icons: 'T',
+          autoApprove: [],
+          disable: false,
+          type: 'stdio',
+          enabled: false
+        },
+        linear: {
+          command: 'https://mcp.linear.app/mcp',
+          args: [],
+          env: {},
+          descriptions: 'Linear',
+          icons: 'L',
+          autoApprove: [],
+          disable: false,
+          type: 'sse',
+          enabled: true
+        }
+      },
+      mcpEnabled: true,
+      ready: true
+    }
+
+    expect(store.serverList.map((server) => server.name)).toEqual(['linear', 'memory', 'tavily'])
+  })
 })

From 8cdadd245585af4e54ae2af2cbaeee2a0bb03983 Mon Sep 17 00:00:00 2001
From: zerob13 <zerob13@gmail.com>
Date: Fri, 3 Jul 2026 14:10:45 +0800
Subject: [PATCH 5/5] fix(mcp): address oauth review notes

---
 docs/issues/pr-1870-review-fixes/plan.md      | 20 ++++++
 docs/issues/pr-1870-review-fixes/spec.md      | 34 ++++++++++
 docs/issues/pr-1870-review-fixes/tasks.md     |  9 +++
 .../presenter/mcpPresenter/mcpOAuthManager.ts | 29 +++++++--
 .../mcpPresenter/mcpOAuthProvider.ts          |  3 +
 .../mcpPresenter/oauthCredentialStore.ts      |  6 +-
 .../settings/components/OpenAICodexOAuth.vue  |  4 ++
 .../mcp-config/components/McpServerCard.vue   |  2 +-
 .../mcp-config/components/McpServers.vue      |  4 ++
 src/renderer/src/i18n/da-DK/settings.json     | 28 ++++----
 src/renderer/src/i18n/de-DE/settings.json     | 28 ++++----
 src/renderer/src/i18n/es-ES/settings.json     | 28 ++++----
 src/renderer/src/i18n/fa-IR/settings.json     | 28 ++++----
 src/renderer/src/i18n/fr-FR/settings.json     | 28 ++++----
 src/renderer/src/i18n/he-IL/settings.json     | 28 ++++----
 src/renderer/src/i18n/id-ID/settings.json     | 28 ++++----
 src/renderer/src/i18n/it-IT/settings.json     | 28 ++++----
 src/renderer/src/i18n/ja-JP/settings.json     | 28 ++++----
 src/renderer/src/i18n/ko-KR/settings.json     | 28 ++++----
 src/renderer/src/i18n/ms-MY/settings.json     | 28 ++++----
 src/renderer/src/i18n/pl-PL/settings.json     | 28 ++++----
 src/renderer/src/i18n/pt-BR/settings.json     | 28 ++++----
 src/renderer/src/i18n/ru-RU/settings.json     | 28 ++++----
 src/renderer/src/i18n/tr-TR/settings.json     | 28 ++++----
 src/renderer/src/i18n/vi-VN/settings.json     | 28 ++++----
 src/renderer/src/i18n/zh-HK/settings.json     | 28 ++++----
 src/renderer/src/i18n/zh-TW/settings.json     | 28 ++++----
 .../components/ui/sheet/SheetContent.vue      | 15 +++--
 src/shared/contracts/events/mcp.events.ts     |  3 +-
 src/shared/contracts/routes/mcp.routes.ts     |  2 +-
 src/shared/contracts/routes/oauth.routes.ts   |  2 +-
 .../mcpPresenter/mcpOAuthManager.test.ts      | 65 ++++++++++++++++++-
 .../mcpPresenter/oauthCredentialStore.test.ts | 42 ++++++++++++
 .../renderer/components/McpServerCard.test.ts | 21 +++++-
 test/renderer/components/McpServers.test.ts   | 27 ++++++--
 .../components/OpenAICodexOAuth.test.ts       | 60 +++++++++++++++++
 .../components/SheetContentDrag.test.ts       | 44 +++++++++++--
 37 files changed, 611 insertions(+), 285 deletions(-)
 create mode 100644 docs/issues/pr-1870-review-fixes/plan.md
 create mode 100644 docs/issues/pr-1870-review-fixes/spec.md
 create mode 100644 docs/issues/pr-1870-review-fixes/tasks.md
 create mode 100644 test/main/presenter/mcpPresenter/oauthCredentialStore.test.ts

diff --git a/docs/issues/pr-1870-review-fixes/plan.md b/docs/issues/pr-1870-review-fixes/plan.md
new file mode 100644
index 000000000..29991a1d7
--- /dev/null
+++ b/docs/issues/pr-1870-review-fixes/plan.md
@@ -0,0 +1,20 @@
+# Plan
+
+## Implementation
+
+1. Patch the smallest root locations:
+   - `mcpOAuthManager.ts` for OAuth error shape checks and stale-flow guard.
+   - `mcpOAuthProvider.ts` for authorization URL scheme validation.
+   - `oauthCredentialStore.ts` for scoped deletion persistence.
+   - renderer OAuth callback handlers for in-flight guards.
+   - `McpServerCard.vue` for the auth-error label.
+   - shared contracts for stricter callback/status validation.
+2. Replace the source-text sheet test with a mounted DOM assertion.
+3. Update the new OpenAI Codex/MCP auth strings in affected locale JSON files.
+
+## Test Strategy
+
+- Extend MCP OAuth manager tests for HTTP status classification.
+- Add a credential store scoped-clear test.
+- Update the SheetContent drag test to mount the component.
+- Run focused tests for MCP OAuth/store/renderer components plus format, i18n, lint, and typecheck.
diff --git a/docs/issues/pr-1870-review-fixes/spec.md b/docs/issues/pr-1870-review-fixes/spec.md
new file mode 100644
index 000000000..81f00efd9
--- /dev/null
+++ b/docs/issues/pr-1870-review-fixes/spec.md
@@ -0,0 +1,34 @@
+# PR 1870 Review Fixes
+
+## User Need
+
+PR review comments on MCP and Codex OAuth should be verified against the current code and fixed
+where they point to real bugs or user-visible polish issues.
+
+## Goal
+
+Address valid review feedback for OAuth error classification, stale OAuth flow handling, callback
+submission guards, URL validation, credential clearing, status labels, rendered drag-region tests,
+and newly added locale strings.
+
+## Acceptance Criteria
+
+- MCP OAuth classifies HTTP 401 errors from common error shapes.
+- Superseded MCP OAuth flows cannot complete and overwrite the active flow.
+- Invalid pasted MCP callback URLs return the error status created by the failure path.
+- MCP OAuth authorization opens only `http:` or `https:` URLs.
+- Scoped MCP OAuth credential clearing actually removes the targeted scope.
+- OpenAI Codex and MCP callback submissions cannot double-submit while already in flight.
+- MCP auth error cards show the failure label, not the required-auth label.
+- The Sheet no-drag regression test checks rendered DOM.
+- Newly added auth strings are localized in the affected locale files.
+
+## Non-Goals
+
+- Do not redesign OAuth.
+- Do not add a new permission model.
+- Do not translate unrelated legacy strings.
+
+## Open Questions
+
+None.
diff --git a/docs/issues/pr-1870-review-fixes/tasks.md b/docs/issues/pr-1870-review-fixes/tasks.md
new file mode 100644
index 000000000..e054c082b
--- /dev/null
+++ b/docs/issues/pr-1870-review-fixes/tasks.md
@@ -0,0 +1,9 @@
+# Tasks
+
+- [x] Fetch and verify PR review comments.
+- [x] Patch OAuth manager/provider/store issues.
+- [x] Patch renderer duplicate-submit and status-label issues.
+- [x] Tighten route/event schemas.
+- [x] Replace sheet source-text test with DOM assertion.
+- [x] Localize new auth strings in affected locales.
+- [x] Run focused tests and required validation commands.
diff --git a/src/main/presenter/mcpPresenter/mcpOAuthManager.ts b/src/main/presenter/mcpPresenter/mcpOAuthManager.ts
index ebf842b36..24afc75f9 100644
--- a/src/main/presenter/mcpPresenter/mcpOAuthManager.ts
+++ b/src/main/presenter/mcpPresenter/mcpOAuthManager.ts
@@ -66,9 +66,21 @@ function isOAuthError(error: unknown): boolean {
     return true
   }
 
-  const status = (error as { code?: unknown; status?: unknown; httpStatus?: unknown } | undefined)
-    ?.code
-  if (status === 401) {
+  const errorLike = error as
+    | {
+        code?: unknown
+        status?: unknown
+        httpStatus?: unknown
+        response?: { status?: unknown }
+      }
+    | undefined
+  const statuses = [
+    errorLike?.code,
+    errorLike?.status,
+    errorLike?.httpStatus,
+    errorLike?.response?.status
+  ]
+  if (statuses.some((status) => status === 401 || status === '401')) {
     return true
   }
 
@@ -261,14 +273,15 @@ export class McpOAuthManager {
 
     const resolution = flow.callbackSession.resolveCallbackUrl(callbackUrl)
     if (resolution.kind === 'not-found') {
-      this.setStatus({
+      const status: McpServerAuthStatus = {
         serverName,
         state: 'error',
         authenticated: false,
         error: 'MCP OAuth callback URL is invalid',
         storage: this.store.getStorageState()
-      })
-      return this.getStatus(serverName, config)
+      }
+      this.setStatus(status)
+      return status
     }
 
     await flow.flowPromise
@@ -302,6 +315,10 @@ export class McpOAuthManager {
   }
 
   private finishAuthenticatedFlow(flow: PendingMcpOAuthFlow): void {
+    if (this.pendingFlows.get(flow.serverName) !== flow) {
+      return
+    }
+
     this.pendingFlows.delete(flow.serverName)
     flow.callbackSession.close()
     const entry = this.store.load(flow.credentialKey)
diff --git a/src/main/presenter/mcpPresenter/mcpOAuthProvider.ts b/src/main/presenter/mcpPresenter/mcpOAuthProvider.ts
index 4a0ed56f3..5a67b32a1 100644
--- a/src/main/presenter/mcpPresenter/mcpOAuthProvider.ts
+++ b/src/main/presenter/mcpPresenter/mcpOAuthProvider.ts
@@ -69,6 +69,9 @@ export class DeepChatMcpOAuthProvider implements OAuthClientProvider {
     if (!this.interactive) {
       throw new Error('MCP OAuth authentication is required')
     }
+    if (authorizationUrl.protocol !== 'http:' && authorizationUrl.protocol !== 'https:') {
+      throw new Error('MCP OAuth authorization URL must use http or https')
+    }
 
     await shell.openExternal(authorizationUrl.toString())
   }
diff --git a/src/main/presenter/mcpPresenter/oauthCredentialStore.ts b/src/main/presenter/mcpPresenter/oauthCredentialStore.ts
index f73016428..263c5516f 100644
--- a/src/main/presenter/mcpPresenter/oauthCredentialStore.ts
+++ b/src/main/presenter/mcpPresenter/oauthCredentialStore.ts
@@ -82,7 +82,8 @@ export class McpOAuthCredentialStore {
       return
     }
 
-    const current = this.load(key)
+    const entries = this.loadAll()
+    const current = entries[key]
     if (!current) {
       return
     }
@@ -98,7 +99,8 @@ export class McpOAuthCredentialStore {
       delete next.discoveryState
     }
 
-    this.saveEntry(key, next)
+    entries[key] = next
+    this.saveAll(entries)
   }
 
   private loadAll(): McpOAuthCredentialData {
diff --git a/src/renderer/settings/components/OpenAICodexOAuth.vue b/src/renderer/settings/components/OpenAICodexOAuth.vue
index 7487a40b4..ad6743cd4 100644
--- a/src/renderer/settings/components/OpenAICodexOAuth.vue
+++ b/src/renderer/settings/components/OpenAICodexOAuth.vue
@@ -285,6 +285,10 @@ const startBrowserLogin = () =>
   runAuthAction('browser', () => oauthClient.startOpenAICodexBrowserLogin())
 
 const completeBrowserLoginFromUrl = () => {
+  if (busyAction.value === 'callback') {
+    return
+  }
+
   const url = callbackUrl.value.trim()
   if (!url) {
     return
diff --git a/src/renderer/src/components/mcp-config/components/McpServerCard.vue b/src/renderer/src/components/mcp-config/components/McpServerCard.vue
index 3d44605ed..d5745b450 100644
--- a/src/renderer/src/components/mcp-config/components/McpServerCard.vue
+++ b/src/renderer/src/components/mcp-config/components/McpServerCard.vue
@@ -116,7 +116,7 @@ const statusConfig = computed(() => {
     case 'auth-error':
       return {
         dot: 'bg-red-500',
-        text: t('settings.mcp.authRequired'),
+        text: t('settings.mcp.authFailed'),
         color: 'text-red-600 dark:text-red-400'
       }
     case 'error':
diff --git a/src/renderer/src/components/mcp-config/components/McpServers.vue b/src/renderer/src/components/mcp-config/components/McpServers.vue
index 45866ff8a..8b9753ea4 100644
--- a/src/renderer/src/components/mcp-config/components/McpServers.vue
+++ b/src/renderer/src/components/mcp-config/components/McpServers.vue
@@ -248,6 +248,10 @@ const handleAuthenticateServer = async (serverName: string) => {
 }
 
 const submitAuthCallbackUrl = async () => {
+  if (isSubmittingAuthCallback.value) {
+    return
+  }
+
   const serverName = selectedServerForAuth.value
   const callbackUrl = authCallbackUrl.value.trim()
   if (!serverName || !callbackUrl) {
diff --git a/src/renderer/src/i18n/da-DK/settings.json b/src/renderer/src/i18n/da-DK/settings.json
index 47c52665f..ce593ee04 100644
--- a/src/renderer/src/i18n/da-DK/settings.json
+++ b/src/renderer/src/i18n/da-DK/settings.json
@@ -1064,11 +1064,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Indsæt callback-URL",
+    "openaiCodexCallbackTitle": "Fuldfør godkendelse",
+    "openaiCodexCallbackDescription": "Når browseren er færdig, skal du vende tilbage til DeepChat. Hvis DeepChat ikke opdateres, skal du indsætte den fulde callback-URL her.",
+    "openaiCodexCallbackPlaceholder": "Indsæt den fulde callback-URL",
+    "openaiCodexCompleteAuthentication": "Fuldfør godkendelse"
   },
   "knowledgeBase": {
     "title": "Indstillinger for vidensbase",
@@ -1387,15 +1387,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Godkendelse påkrævet",
+    "authenticate": "Godkend",
+    "authFailed": "Godkendelse mislykkedes",
+    "authCallbackTitle": "Fuldfør godkendelse",
+    "authCallbackDescription": "Når browseren er færdig, skal du vende tilbage til DeepChat. Hvis DeepChat ikke opdateres, skal du indsætte den fulde callback-URL her.",
+    "authCallbackPlaceholder": "Indsæt den fulde callback-URL",
+    "completeAuthentication": "Fuldfør godkendelse",
+    "saveSuccess": "Konfiguration gemt",
+    "saveFailed": "Kunne ikke gemme konfiguration"
   },
   "scheduledTasks": {
     "title": "Planlagte opgaver",
diff --git a/src/renderer/src/i18n/de-DE/settings.json b/src/renderer/src/i18n/de-DE/settings.json
index 641f1e470..559e0d91f 100644
--- a/src/renderer/src/i18n/de-DE/settings.json
+++ b/src/renderer/src/i18n/de-DE/settings.json
@@ -1388,11 +1388,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Callback-URL einfügen",
+    "openaiCodexCallbackTitle": "Authentifizierung abschließen",
+    "openaiCodexCallbackDescription": "Kehre nach Abschluss im Browser zu DeepChat zurück. Wenn DeepChat nicht aktualisiert wird, füge hier die vollständige Callback-URL ein.",
+    "openaiCodexCallbackPlaceholder": "Vollständige Callback-URL einfügen",
+    "openaiCodexCompleteAuthentication": "Authentifizierung abschließen"
   },
   "knowledgeBase": {
     "title": "Wissensdatenbank-Einstellungen",
@@ -1711,15 +1711,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Authentifizierung erforderlich",
+    "authenticate": "Authentifizieren",
+    "authFailed": "Authentifizierung fehlgeschlagen",
+    "authCallbackTitle": "Authentifizierung abschließen",
+    "authCallbackDescription": "Kehre nach Abschluss im Browser zu DeepChat zurück. Wenn DeepChat nicht aktualisiert wird, füge hier die vollständige Callback-URL ein.",
+    "authCallbackPlaceholder": "Vollständige Callback-URL einfügen",
+    "completeAuthentication": "Authentifizierung abschließen",
+    "saveSuccess": "Konfiguration gespeichert",
+    "saveFailed": "Konfiguration konnte nicht gespeichert werden"
   },
   "about": {
     "title": "Über uns",
diff --git a/src/renderer/src/i18n/es-ES/settings.json b/src/renderer/src/i18n/es-ES/settings.json
index 8edbde5a2..d1fccddbc 100644
--- a/src/renderer/src/i18n/es-ES/settings.json
+++ b/src/renderer/src/i18n/es-ES/settings.json
@@ -1388,11 +1388,11 @@
         "advanced": "Avanzado"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Pegar URL de callback",
+    "openaiCodexCallbackTitle": "Completar autenticación",
+    "openaiCodexCallbackDescription": "Cuando termine el navegador, vuelve a DeepChat. Si DeepChat no se actualiza, pega aquí la URL completa de callback.",
+    "openaiCodexCallbackPlaceholder": "Pega la URL completa de callback",
+    "openaiCodexCompleteAuthentication": "Completar autenticación"
   },
   "knowledgeBase": {
     "title": "Configuración de la base de conocimientos",
@@ -1711,15 +1711,15 @@
         "custom": "personalizado"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Autenticación requerida",
+    "authenticate": "Autenticar",
+    "authFailed": "Error de autenticación",
+    "authCallbackTitle": "Completar autenticación",
+    "authCallbackDescription": "Cuando termine el navegador, vuelve a DeepChat. Si DeepChat no se actualiza, pega aquí la URL completa de callback.",
+    "authCallbackPlaceholder": "Pega la URL completa de callback",
+    "completeAuthentication": "Completar autenticación",
+    "saveSuccess": "Configuración guardada",
+    "saveFailed": "No se pudo guardar la configuración"
   },
   "about": {
     "title": "Sobre nosotros",
diff --git a/src/renderer/src/i18n/fa-IR/settings.json b/src/renderer/src/i18n/fa-IR/settings.json
index dd2844921..8231dbdff 100644
--- a/src/renderer/src/i18n/fa-IR/settings.json
+++ b/src/renderer/src/i18n/fa-IR/settings.json
@@ -1131,11 +1131,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "چسباندن URL بازگشت",
+    "openaiCodexCallbackTitle": "تکمیل احراز هویت",
+    "openaiCodexCallbackDescription": "پس از پایان کار مرورگر، به DeepChat برگردید. اگر DeepChat به‌روزرسانی نشد، URL کامل بازگشت را اینجا بچسبانید.",
+    "openaiCodexCallbackPlaceholder": "URL کامل بازگشت را بچسبانید",
+    "openaiCodexCompleteAuthentication": "تکمیل احراز هویت"
   },
   "knowledgeBase": {
     "title": "تنظیمات پایگاه دانش",
@@ -1454,15 +1454,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "احراز هویت لازم است",
+    "authenticate": "احراز هویت",
+    "authFailed": "احراز هویت ناموفق بود",
+    "authCallbackTitle": "تکمیل احراز هویت",
+    "authCallbackDescription": "پس از پایان کار مرورگر، به DeepChat برگردید. اگر DeepChat به‌روزرسانی نشد، URL کامل بازگشت را اینجا بچسبانید.",
+    "authCallbackPlaceholder": "URL کامل بازگشت را بچسبانید",
+    "completeAuthentication": "تکمیل احراز هویت",
+    "saveSuccess": "پیکربندی ذخیره شد",
+    "saveFailed": "ذخیره پیکربندی ناموفق بود"
   },
   "scheduledTasks": {
     "title": "کارهای زمان‌بندی‌شده",
diff --git a/src/renderer/src/i18n/fr-FR/settings.json b/src/renderer/src/i18n/fr-FR/settings.json
index ab7725c6c..df2ecd469 100644
--- a/src/renderer/src/i18n/fr-FR/settings.json
+++ b/src/renderer/src/i18n/fr-FR/settings.json
@@ -1131,11 +1131,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Coller l'URL de rappel",
+    "openaiCodexCallbackTitle": "Terminer l'authentification",
+    "openaiCodexCallbackDescription": "Lorsque le navigateur a terminé, revenez à DeepChat. Si DeepChat ne se met pas à jour, collez ici l'URL de rappel complète.",
+    "openaiCodexCallbackPlaceholder": "Coller l'URL de rappel complète",
+    "openaiCodexCompleteAuthentication": "Terminer l'authentification"
   },
   "knowledgeBase": {
     "title": "Paramètres de la base de connaissances",
@@ -1454,15 +1454,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Authentification requise",
+    "authenticate": "Authentifier",
+    "authFailed": "Échec de l'authentification",
+    "authCallbackTitle": "Terminer l'authentification",
+    "authCallbackDescription": "Lorsque le navigateur a terminé, revenez à DeepChat. Si DeepChat ne se met pas à jour, collez ici l'URL de rappel complète.",
+    "authCallbackPlaceholder": "Coller l'URL de rappel complète",
+    "completeAuthentication": "Terminer l'authentification",
+    "saveSuccess": "Configuration enregistrée",
+    "saveFailed": "Impossible d'enregistrer la configuration"
   },
   "scheduledTasks": {
     "title": "Tâches planifiées",
diff --git a/src/renderer/src/i18n/he-IL/settings.json b/src/renderer/src/i18n/he-IL/settings.json
index be51b8b85..136b2a8a1 100644
--- a/src/renderer/src/i18n/he-IL/settings.json
+++ b/src/renderer/src/i18n/he-IL/settings.json
@@ -1131,11 +1131,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "הדבק כתובת URL לחזרה",
+    "openaiCodexCallbackTitle": "השלמת האימות",
+    "openaiCodexCallbackDescription": "לאחר שהדפדפן מסיים, חזור אל DeepChat. אם DeepChat לא מתעדכן, הדבק כאן את כתובת ה-URL המלאה לחזרה.",
+    "openaiCodexCallbackPlaceholder": "הדבק את כתובת ה-URL המלאה לחזרה",
+    "openaiCodexCompleteAuthentication": "השלמת האימות"
   },
   "knowledgeBase": {
     "title": "הגדרות בסיס ידע",
@@ -1454,15 +1454,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "נדרש אימות",
+    "authenticate": "אמת",
+    "authFailed": "האימות נכשל",
+    "authCallbackTitle": "השלמת האימות",
+    "authCallbackDescription": "לאחר שהדפדפן מסיים, חזור אל DeepChat. אם DeepChat לא מתעדכן, הדבק כאן את כתובת ה-URL המלאה לחזרה.",
+    "authCallbackPlaceholder": "הדבק את כתובת ה-URL המלאה לחזרה",
+    "completeAuthentication": "השלמת האימות",
+    "saveSuccess": "התצורה נשמרה",
+    "saveFailed": "שמירת התצורה נכשלה"
   },
   "scheduledTasks": {
     "title": "משימות מתוזמנות",
diff --git a/src/renderer/src/i18n/id-ID/settings.json b/src/renderer/src/i18n/id-ID/settings.json
index 7cf0a4bb1..240684600 100644
--- a/src/renderer/src/i18n/id-ID/settings.json
+++ b/src/renderer/src/i18n/id-ID/settings.json
@@ -1388,11 +1388,11 @@
         "advanced": "Lanjutan"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Tempel URL callback",
+    "openaiCodexCallbackTitle": "Selesaikan autentikasi",
+    "openaiCodexCallbackDescription": "Setelah browser selesai, kembali ke DeepChat. Jika DeepChat tidak diperbarui, tempel URL callback lengkap di sini.",
+    "openaiCodexCallbackPlaceholder": "Tempel URL callback lengkap",
+    "openaiCodexCompleteAuthentication": "Selesaikan autentikasi"
   },
   "knowledgeBase": {
     "title": "Pengaturan basis pengetahuan",
@@ -1711,15 +1711,15 @@
         "custom": "Adat"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Autentikasi diperlukan",
+    "authenticate": "Autentikasi",
+    "authFailed": "Autentikasi gagal",
+    "authCallbackTitle": "Selesaikan autentikasi",
+    "authCallbackDescription": "Setelah browser selesai, kembali ke DeepChat. Jika DeepChat tidak diperbarui, tempel URL callback lengkap di sini.",
+    "authCallbackPlaceholder": "Tempel URL callback lengkap",
+    "completeAuthentication": "Selesaikan autentikasi",
+    "saveSuccess": "Konfigurasi disimpan",
+    "saveFailed": "Gagal menyimpan konfigurasi"
   },
   "about": {
     "title": "Tentang kami",
diff --git a/src/renderer/src/i18n/it-IT/settings.json b/src/renderer/src/i18n/it-IT/settings.json
index bce74a737..8d65c291f 100644
--- a/src/renderer/src/i18n/it-IT/settings.json
+++ b/src/renderer/src/i18n/it-IT/settings.json
@@ -1388,11 +1388,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Incolla URL di callback",
+    "openaiCodexCallbackTitle": "Completa autenticazione",
+    "openaiCodexCallbackDescription": "Dopo il completamento nel browser, torna a DeepChat. Se DeepChat non si aggiorna, incolla qui l'URL di callback completo.",
+    "openaiCodexCallbackPlaceholder": "Incolla l'URL di callback completo",
+    "openaiCodexCompleteAuthentication": "Completa autenticazione"
   },
   "knowledgeBase": {
     "title": "Impostazioni base di conoscenza",
@@ -1711,15 +1711,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Autenticazione richiesta",
+    "authenticate": "Autentica",
+    "authFailed": "Autenticazione non riuscita",
+    "authCallbackTitle": "Completa autenticazione",
+    "authCallbackDescription": "Dopo il completamento nel browser, torna a DeepChat. Se DeepChat non si aggiorna, incolla qui l'URL di callback completo.",
+    "authCallbackPlaceholder": "Incolla l'URL di callback completo",
+    "completeAuthentication": "Completa autenticazione",
+    "saveSuccess": "Configurazione salvata",
+    "saveFailed": "Impossibile salvare la configurazione"
   },
   "about": {
     "title": "Chi siamo",
diff --git a/src/renderer/src/i18n/ja-JP/settings.json b/src/renderer/src/i18n/ja-JP/settings.json
index 9463febce..a86448dcf 100644
--- a/src/renderer/src/i18n/ja-JP/settings.json
+++ b/src/renderer/src/i18n/ja-JP/settings.json
@@ -1131,11 +1131,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "コールバックURLを貼り付け",
+    "openaiCodexCallbackTitle": "認証を完了",
+    "openaiCodexCallbackDescription": "ブラウザーで完了したら DeepChat に戻ってください。DeepChat が更新されない場合は、完全なコールバックURLをここに貼り付けてください。",
+    "openaiCodexCallbackPlaceholder": "完全なコールバックURLを貼り付け",
+    "openaiCodexCompleteAuthentication": "認証を完了"
   },
   "knowledgeBase": {
     "title": "ナレッジベース設定",
@@ -1454,15 +1454,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "認証が必要です",
+    "authenticate": "認証",
+    "authFailed": "認証に失敗しました",
+    "authCallbackTitle": "認証を完了",
+    "authCallbackDescription": "ブラウザーで完了したら DeepChat に戻ってください。DeepChat が更新されない場合は、完全なコールバックURLをここに貼り付けてください。",
+    "authCallbackPlaceholder": "完全なコールバックURLを貼り付け",
+    "completeAuthentication": "認証を完了",
+    "saveSuccess": "設定を保存しました",
+    "saveFailed": "設定の保存に失敗しました"
   },
   "scheduledTasks": {
     "title": "スケジュールタスク",
diff --git a/src/renderer/src/i18n/ko-KR/settings.json b/src/renderer/src/i18n/ko-KR/settings.json
index a7b3af4d5..54c3d1fc7 100644
--- a/src/renderer/src/i18n/ko-KR/settings.json
+++ b/src/renderer/src/i18n/ko-KR/settings.json
@@ -1131,11 +1131,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "콜백 URL 붙여넣기",
+    "openaiCodexCallbackTitle": "인증 완료",
+    "openaiCodexCallbackDescription": "브라우저에서 완료되면 DeepChat으로 돌아오세요. DeepChat이 업데이트되지 않으면 전체 콜백 URL을 여기에 붙여넣으세요.",
+    "openaiCodexCallbackPlaceholder": "전체 콜백 URL 붙여넣기",
+    "openaiCodexCompleteAuthentication": "인증 완료"
   },
   "knowledgeBase": {
     "title": "지식 베이스 설정",
@@ -1454,15 +1454,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "인증 필요",
+    "authenticate": "인증",
+    "authFailed": "인증 실패",
+    "authCallbackTitle": "인증 완료",
+    "authCallbackDescription": "브라우저에서 완료되면 DeepChat으로 돌아오세요. DeepChat이 업데이트되지 않으면 전체 콜백 URL을 여기에 붙여넣으세요.",
+    "authCallbackPlaceholder": "전체 콜백 URL 붙여넣기",
+    "completeAuthentication": "인증 완료",
+    "saveSuccess": "설정이 저장되었습니다",
+    "saveFailed": "설정 저장 실패"
   },
   "scheduledTasks": {
     "title": "예약된 작업",
diff --git a/src/renderer/src/i18n/ms-MY/settings.json b/src/renderer/src/i18n/ms-MY/settings.json
index daaef4025..5f33cfaba 100644
--- a/src/renderer/src/i18n/ms-MY/settings.json
+++ b/src/renderer/src/i18n/ms-MY/settings.json
@@ -1388,11 +1388,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Tampal URL panggil balik",
+    "openaiCodexCallbackTitle": "Lengkapkan pengesahan",
+    "openaiCodexCallbackDescription": "Selepas pelayar selesai, kembali ke DeepChat. Jika DeepChat tidak dikemas kini, tampal URL panggil balik penuh di sini.",
+    "openaiCodexCallbackPlaceholder": "Tampal URL panggil balik penuh",
+    "openaiCodexCompleteAuthentication": "Lengkapkan pengesahan"
   },
   "knowledgeBase": {
     "title": "Tetapan asas pengetahuan",
@@ -1711,15 +1711,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Pengesahan diperlukan",
+    "authenticate": "Sahkan",
+    "authFailed": "Pengesahan gagal",
+    "authCallbackTitle": "Lengkapkan pengesahan",
+    "authCallbackDescription": "Selepas pelayar selesai, kembali ke DeepChat. Jika DeepChat tidak dikemas kini, tampal URL panggil balik penuh di sini.",
+    "authCallbackPlaceholder": "Tampal URL panggil balik penuh",
+    "completeAuthentication": "Lengkapkan pengesahan",
+    "saveSuccess": "Konfigurasi disimpan",
+    "saveFailed": "Gagal menyimpan konfigurasi"
   },
   "about": {
     "title": "tentang Kami",
diff --git a/src/renderer/src/i18n/pl-PL/settings.json b/src/renderer/src/i18n/pl-PL/settings.json
index 278385cde..98e4ff0fc 100644
--- a/src/renderer/src/i18n/pl-PL/settings.json
+++ b/src/renderer/src/i18n/pl-PL/settings.json
@@ -1388,11 +1388,11 @@
         "advanced": "Zaawansowane"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Wklej adres URL wywołania zwrotnego",
+    "openaiCodexCallbackTitle": "Zakończ uwierzytelnianie",
+    "openaiCodexCallbackDescription": "Po zakończeniu w przeglądarce wróć do DeepChat. Jeśli DeepChat się nie zaktualizuje, wklej tutaj pełny adres URL wywołania zwrotnego.",
+    "openaiCodexCallbackPlaceholder": "Wklej pełny adres URL wywołania zwrotnego",
+    "openaiCodexCompleteAuthentication": "Zakończ uwierzytelnianie"
   },
   "knowledgeBase": {
     "title": "Ustawienia bazy wiedzy",
@@ -1711,15 +1711,15 @@
         "custom": "Niestandardowe"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Wymagane uwierzytelnienie",
+    "authenticate": "Uwierzytelnij",
+    "authFailed": "Uwierzytelnianie nie powiodło się",
+    "authCallbackTitle": "Zakończ uwierzytelnianie",
+    "authCallbackDescription": "Po zakończeniu w przeglądarce wróć do DeepChat. Jeśli DeepChat się nie zaktualizuje, wklej tutaj pełny adres URL wywołania zwrotnego.",
+    "authCallbackPlaceholder": "Wklej pełny adres URL wywołania zwrotnego",
+    "completeAuthentication": "Zakończ uwierzytelnianie",
+    "saveSuccess": "Konfiguracja zapisana",
+    "saveFailed": "Nie udało się zapisać konfiguracji"
   },
   "about": {
     "title": "O nas",
diff --git a/src/renderer/src/i18n/pt-BR/settings.json b/src/renderer/src/i18n/pt-BR/settings.json
index 573fafd88..66a65e77f 100644
--- a/src/renderer/src/i18n/pt-BR/settings.json
+++ b/src/renderer/src/i18n/pt-BR/settings.json
@@ -1131,11 +1131,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Colar URL de callback",
+    "openaiCodexCallbackTitle": "Concluir autenticação",
+    "openaiCodexCallbackDescription": "Depois que o navegador terminar, volte ao DeepChat. Se o DeepChat não atualizar, cole aqui a URL de callback completa.",
+    "openaiCodexCallbackPlaceholder": "Cole a URL de callback completa",
+    "openaiCodexCompleteAuthentication": "Concluir autenticação"
   },
   "knowledgeBase": {
     "title": "Configurações da Base de Conhecimento",
@@ -1454,15 +1454,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Autenticação necessária",
+    "authenticate": "Autenticar",
+    "authFailed": "Falha na autenticação",
+    "authCallbackTitle": "Concluir autenticação",
+    "authCallbackDescription": "Depois que o navegador terminar, volte ao DeepChat. Se o DeepChat não atualizar, cole aqui a URL de callback completa.",
+    "authCallbackPlaceholder": "Cole a URL de callback completa",
+    "completeAuthentication": "Concluir autenticação",
+    "saveSuccess": "Configuração salva",
+    "saveFailed": "Falha ao salvar configuração"
   },
   "scheduledTasks": {
     "title": "Tarefas agendadas",
diff --git a/src/renderer/src/i18n/ru-RU/settings.json b/src/renderer/src/i18n/ru-RU/settings.json
index 30deeffc9..d44b58ac1 100644
--- a/src/renderer/src/i18n/ru-RU/settings.json
+++ b/src/renderer/src/i18n/ru-RU/settings.json
@@ -1131,11 +1131,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Вставить URL обратного вызова",
+    "openaiCodexCallbackTitle": "Завершить аутентификацию",
+    "openaiCodexCallbackDescription": "Когда браузер завершит процесс, вернитесь в DeepChat. Если DeepChat не обновится, вставьте здесь полный URL обратного вызова.",
+    "openaiCodexCallbackPlaceholder": "Вставьте полный URL обратного вызова",
+    "openaiCodexCompleteAuthentication": "Завершить аутентификацию"
   },
   "knowledgeBase": {
     "title": "Настройки базы знаний",
@@ -1454,15 +1454,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Требуется аутентификация",
+    "authenticate": "Аутентифицировать",
+    "authFailed": "Ошибка аутентификации",
+    "authCallbackTitle": "Завершить аутентификацию",
+    "authCallbackDescription": "Когда браузер завершит процесс, вернитесь в DeepChat. Если DeepChat не обновится, вставьте здесь полный URL обратного вызова.",
+    "authCallbackPlaceholder": "Вставьте полный URL обратного вызова",
+    "completeAuthentication": "Завершить аутентификацию",
+    "saveSuccess": "Конфигурация сохранена",
+    "saveFailed": "Не удалось сохранить конфигурацию"
   },
   "scheduledTasks": {
     "title": "Запланированные задачи",
diff --git a/src/renderer/src/i18n/tr-TR/settings.json b/src/renderer/src/i18n/tr-TR/settings.json
index c7a1943e1..878313649 100644
--- a/src/renderer/src/i18n/tr-TR/settings.json
+++ b/src/renderer/src/i18n/tr-TR/settings.json
@@ -1388,11 +1388,11 @@
         "advanced": "Gelişmiş"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Geri çağırma URL'sini yapıştır",
+    "openaiCodexCallbackTitle": "Kimlik doğrulamayı tamamla",
+    "openaiCodexCallbackDescription": "Tarayıcı işlemi tamamladıktan sonra DeepChat'e dönün. DeepChat güncellenmezse tam geri çağırma URL'sini buraya yapıştırın.",
+    "openaiCodexCallbackPlaceholder": "Tam geri çağırma URL'sini yapıştır",
+    "openaiCodexCompleteAuthentication": "Kimlik doğrulamayı tamamla"
   },
   "knowledgeBase": {
     "title": "Bilgi Bankası Ayarları",
@@ -1711,15 +1711,15 @@
         "custom": "Gelenek"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Kimlik doğrulama gerekli",
+    "authenticate": "Kimlik doğrula",
+    "authFailed": "Kimlik doğrulama başarısız",
+    "authCallbackTitle": "Kimlik doğrulamayı tamamla",
+    "authCallbackDescription": "Tarayıcı işlemi tamamladıktan sonra DeepChat'e dönün. DeepChat güncellenmezse tam geri çağırma URL'sini buraya yapıştırın.",
+    "authCallbackPlaceholder": "Tam geri çağırma URL'sini yapıştır",
+    "completeAuthentication": "Kimlik doğrulamayı tamamla",
+    "saveSuccess": "Yapılandırma kaydedildi",
+    "saveFailed": "Yapılandırma kaydedilemedi"
   },
   "about": {
     "title": "Hakkımızda",
diff --git a/src/renderer/src/i18n/vi-VN/settings.json b/src/renderer/src/i18n/vi-VN/settings.json
index 0fb2888a1..6a70a775a 100644
--- a/src/renderer/src/i18n/vi-VN/settings.json
+++ b/src/renderer/src/i18n/vi-VN/settings.json
@@ -1388,11 +1388,11 @@
         "advanced": "Nâng cao"
       }
     },
-    "openaiCodexPasteCallback": "Paste callback URL",
-    "openaiCodexCallbackTitle": "Complete authentication",
-    "openaiCodexCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "openaiCodexCallbackPlaceholder": "Paste the full callback URL",
-    "openaiCodexCompleteAuthentication": "Complete authentication"
+    "openaiCodexPasteCallback": "Dán URL callback",
+    "openaiCodexCallbackTitle": "Hoàn tất xác thực",
+    "openaiCodexCallbackDescription": "Sau khi trình duyệt hoàn tất, hãy quay lại DeepChat. Nếu DeepChat không cập nhật, hãy dán URL callback đầy đủ vào đây.",
+    "openaiCodexCallbackPlaceholder": "Dán URL callback đầy đủ",
+    "openaiCodexCompleteAuthentication": "Hoàn tất xác thực"
   },
   "knowledgeBase": {
     "title": "Cài đặt cơ sở kiến thức",
@@ -1711,15 +1711,15 @@
         "custom": "tùy chỉnh"
       }
     },
-    "authRequired": "Authentication required",
-    "authenticate": "Authenticate",
-    "authFailed": "Authentication failed",
-    "authCallbackTitle": "Complete authentication",
-    "authCallbackDescription": "After the browser finishes, return to DeepChat. If DeepChat does not update, paste the full callback URL here.",
-    "authCallbackPlaceholder": "Paste the full callback URL",
-    "completeAuthentication": "Complete authentication",
-    "saveSuccess": "Configuration saved",
-    "saveFailed": "Failed to save configuration"
+    "authRequired": "Cần xác thực",
+    "authenticate": "Xác thực",
+    "authFailed": "Xác thực thất bại",
+    "authCallbackTitle": "Hoàn tất xác thực",
+    "authCallbackDescription": "Sau khi trình duyệt hoàn tất, hãy quay lại DeepChat. Nếu DeepChat không cập nhật, hãy dán URL callback đầy đủ vào đây.",
+    "authCallbackPlaceholder": "Dán URL callback đầy đủ",
+    "completeAuthentication": "Hoàn tất xác thực",
+    "saveSuccess": "Đã lưu cấu hình",
+    "saveFailed": "Lưu cấu hình thất bại"
   },
   "about": {
     "title": "Về chúng tôi",
diff --git a/src/renderer/src/i18n/zh-HK/settings.json b/src/renderer/src/i18n/zh-HK/settings.json
index 6c8042634..752c88ed9 100644
--- a/src/renderer/src/i18n/zh-HK/settings.json
+++ b/src/renderer/src/i18n/zh-HK/settings.json
@@ -1131,11 +1131,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "粘贴回调 URL",
-    "openaiCodexCallbackTitle": "完成认证",
-    "openaiCodexCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
-    "openaiCodexCallbackPlaceholder": "粘贴完整回调 URL",
-    "openaiCodexCompleteAuthentication": "完成认证"
+    "openaiCodexPasteCallback": "貼上回調 URL",
+    "openaiCodexCallbackTitle": "完成認證",
+    "openaiCodexCallbackDescription": "瀏覽器完成後返回 DeepChat。如果 DeepChat 沒有更新，請在此貼上完整回調 URL。",
+    "openaiCodexCallbackPlaceholder": "貼上完整回調 URL",
+    "openaiCodexCompleteAuthentication": "完成認證"
   },
   "knowledgeBase": {
     "fastgptTitle": "FastGPT知識庫",
@@ -1454,15 +1454,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "需要认证",
-    "authenticate": "认证",
-    "authFailed": "认证失败",
-    "authCallbackTitle": "完成认证",
-    "authCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
-    "authCallbackPlaceholder": "粘贴完整回调 URL",
-    "completeAuthentication": "完成认证",
-    "saveSuccess": "已保存配置",
-    "saveFailed": "保存失败"
+    "authRequired": "需要認證",
+    "authenticate": "認證",
+    "authFailed": "認證失敗",
+    "authCallbackTitle": "完成認證",
+    "authCallbackDescription": "瀏覽器完成後返回 DeepChat。如果 DeepChat 沒有更新，請在此貼上完整回調 URL。",
+    "authCallbackPlaceholder": "貼上完整回調 URL",
+    "completeAuthentication": "完成認證",
+    "saveSuccess": "已儲存配置",
+    "saveFailed": "儲存失敗"
   },
   "scheduledTasks": {
     "title": "定時任務",
diff --git a/src/renderer/src/i18n/zh-TW/settings.json b/src/renderer/src/i18n/zh-TW/settings.json
index 5e1fffa92..4905f8c5a 100644
--- a/src/renderer/src/i18n/zh-TW/settings.json
+++ b/src/renderer/src/i18n/zh-TW/settings.json
@@ -1131,11 +1131,11 @@
         "advanced": "Advanced"
       }
     },
-    "openaiCodexPasteCallback": "粘贴回调 URL",
-    "openaiCodexCallbackTitle": "完成认证",
-    "openaiCodexCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
-    "openaiCodexCallbackPlaceholder": "粘贴完整回调 URL",
-    "openaiCodexCompleteAuthentication": "完成认证"
+    "openaiCodexPasteCallback": "貼上回呼 URL",
+    "openaiCodexCallbackTitle": "完成驗證",
+    "openaiCodexCallbackDescription": "瀏覽器完成後返回 DeepChat。如果 DeepChat 沒有更新，請在此貼上完整回呼 URL。",
+    "openaiCodexCallbackPlaceholder": "貼上完整回呼 URL",
+    "openaiCodexCompleteAuthentication": "完成驗證"
   },
   "knowledgeBase": {
     "title": "知識庫設置",
@@ -1454,15 +1454,15 @@
         "custom": "Custom"
       }
     },
-    "authRequired": "需要认证",
-    "authenticate": "认证",
-    "authFailed": "认证失败",
-    "authCallbackTitle": "完成认证",
-    "authCallbackDescription": "浏览器完成后回到 DeepChat。如果 DeepChat 没有更新，请把完整回调 URL 粘贴到这里。",
-    "authCallbackPlaceholder": "粘贴完整回调 URL",
-    "completeAuthentication": "完成认证",
-    "saveSuccess": "已保存配置",
-    "saveFailed": "保存失败"
+    "authRequired": "需要驗證",
+    "authenticate": "驗證",
+    "authFailed": "驗證失敗",
+    "authCallbackTitle": "完成驗證",
+    "authCallbackDescription": "瀏覽器完成後返回 DeepChat。如果 DeepChat 沒有更新，請在此貼上完整回呼 URL。",
+    "authCallbackPlaceholder": "貼上完整回呼 URL",
+    "completeAuthentication": "完成驗證",
+    "saveSuccess": "已儲存設定",
+    "saveFailed": "儲存失敗"
   },
   "scheduledTasks": {
     "title": "定時任務",
diff --git a/src/shadcn/components/ui/sheet/SheetContent.vue b/src/shadcn/components/ui/sheet/SheetContent.vue
index b042e6e62..ecd2a50be 100644
--- a/src/shadcn/components/ui/sheet/SheetContent.vue
+++ b/src/shadcn/components/ui/sheet/SheetContent.vue
@@ -52,12 +52,15 @@ const forwarded = useForwardPropsEmits(delegatedProps, emits)
     >
       <slot />
 
-      <DialogClose
-        class="window-no-drag-region ring-offset-background focus:ring-ring data-[state=open]:bg-secondary absolute top-4 right-4 rounded-xs opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none"
-        style="-webkit-app-region: no-drag"
-      >
-        <X class="size-4" />
-        <span class="sr-only">Close</span>
+      <DialogClose as-child>
+        <button
+          type="button"
+          class="window-no-drag-region ring-offset-background focus:ring-ring data-[state=open]:bg-secondary absolute top-4 right-4 rounded-xs opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none"
+          style="-webkit-app-region: no-drag"
+        >
+          <X class="size-4" />
+          <span class="sr-only">Close</span>
+        </button>
       </DialogClose>
     </DialogContent>
   </DialogPortal>
diff --git a/src/shared/contracts/events/mcp.events.ts b/src/shared/contracts/events/mcp.events.ts
index 2b16dd330..ad0b3559f 100644
--- a/src/shared/contracts/events/mcp.events.ts
+++ b/src/shared/contracts/events/mcp.events.ts
@@ -1,16 +1,15 @@
 import { z } from 'zod'
 import type {
   MCPServerConfig,
-  McpServerAuthStatus,
   McpSamplingDecision,
   McpSamplingRequestPayload
 } from '@shared/presenter'
 import { defineEventContract } from '../common'
+import { McpServerAuthStatusSchema } from '../routes/mcp.routes'
 
 const McpSamplingRequestSchema = z.custom<McpSamplingRequestPayload>()
 const McpSamplingDecisionSchema = z.custom<McpSamplingDecision>()
 const MCPServerConfigSchema = z.custom<MCPServerConfig>()
-const McpServerAuthStatusSchema = z.custom<McpServerAuthStatus>()
 
 export const mcpServerStartedEvent = defineEventContract({
   name: 'mcp.server.started',
diff --git a/src/shared/contracts/routes/mcp.routes.ts b/src/shared/contracts/routes/mcp.routes.ts
index 8e4a836db..e3739fd9a 100644
--- a/src/shared/contracts/routes/mcp.routes.ts
+++ b/src/shared/contracts/routes/mcp.routes.ts
@@ -219,7 +219,7 @@ export const mcpCompleteServerAuthFromCallbackUrlRoute = defineRouteContract({
   name: 'mcp.completeServerAuthFromCallbackUrl',
   input: z.object({
     serverName: z.string(),
-    callbackUrl: z.string()
+    callbackUrl: z.url()
   }),
   output: z.object({
     status: McpServerAuthStatusSchema
diff --git a/src/shared/contracts/routes/oauth.routes.ts b/src/shared/contracts/routes/oauth.routes.ts
index aca4e3caf..d8babdb6f 100644
--- a/src/shared/contracts/routes/oauth.routes.ts
+++ b/src/shared/contracts/routes/oauth.routes.ts
@@ -56,7 +56,7 @@ export const oauthOpenAICodexStartBrowserLoginRoute = defineRouteContract({
 export const oauthOpenAICodexCompleteBrowserLoginFromUrlRoute = defineRouteContract({
   name: 'oauth.openaiCodex.completeBrowserLoginFromUrl',
   input: z.object({
-    callbackUrl: z.string()
+    callbackUrl: z.url()
   }),
   output: OpenAICodexStatusResultSchema
 })
diff --git a/test/main/presenter/mcpPresenter/mcpOAuthManager.test.ts b/test/main/presenter/mcpPresenter/mcpOAuthManager.test.ts
index 5605e1c82..d3b29585d 100644
--- a/test/main/presenter/mcpPresenter/mcpOAuthManager.test.ts
+++ b/test/main/presenter/mcpPresenter/mcpOAuthManager.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const publishDeepchatEventMock = vi.hoisted(() => vi.fn())
 
@@ -19,6 +19,10 @@ const createStore = (entry: unknown): McpOAuthCredentialStore =>
   }) as unknown as McpOAuthCredentialStore
 
 describe('McpOAuthManager', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
   it('keeps authenticated credentials ahead of stale non-pending errors', async () => {
     const manager = new McpOAuthManager(
       createStore({
@@ -46,4 +50,63 @@ describe('McpOAuthManager', () => {
     expect(status.error).toBeUndefined()
     expect(publishDeepchatEventMock).toHaveBeenCalledTimes(1)
   })
+
+  it('classifies HTTP status shaped OAuth failures', () => {
+    const config = {
+      type: 'http',
+      baseUrl: 'https://mcp.linear.app/mcp'
+    } as const
+    const errors = [{ status: 401 }, { httpStatus: 401 }, { response: { status: '401' } }]
+
+    for (const error of errors) {
+      const manager = new McpOAuthManager(createStore(null))
+
+      expect(manager.handleConnectionError('linear', config, error)).toBe(true)
+      expect(manager.getStatus('linear', config).state).toBe('required')
+    }
+  })
+
+  it('ignores stale authenticated flows after a newer auth attempt starts', () => {
+    const closeStaleSession = vi.fn()
+    const closeActiveSession = vi.fn()
+    const onAuthenticated = vi.fn()
+    const manager = new McpOAuthManager(
+      createStore({
+        tokens: {
+          access_token: 'access-token'
+        },
+        updatedAt: 123
+      }),
+      onAuthenticated
+    )
+    const staleFlow = {
+      serverName: 'linear',
+      serverUrl: 'https://mcp.linear.app/mcp',
+      credentialKey: 'linear-key',
+      state: 'old',
+      provider: {},
+      callbackSession: {
+        close: closeStaleSession
+      }
+    }
+    const activeFlow = {
+      ...staleFlow,
+      state: 'new',
+      callbackSession: {
+        close: closeActiveSession
+      }
+    }
+    const managerInternals = manager as unknown as {
+      pendingFlows: Map<string, unknown>
+      finishAuthenticatedFlow: (flow: unknown) => void
+    }
+
+    managerInternals.pendingFlows.set('linear', activeFlow)
+    managerInternals.finishAuthenticatedFlow(staleFlow)
+
+    expect(closeStaleSession).not.toHaveBeenCalled()
+    expect(closeActiveSession).not.toHaveBeenCalled()
+    expect(onAuthenticated).not.toHaveBeenCalled()
+    expect(publishDeepchatEventMock).not.toHaveBeenCalled()
+  })
 })
diff --git a/test/main/presenter/mcpPresenter/oauthCredentialStore.test.ts b/test/main/presenter/mcpPresenter/oauthCredentialStore.test.ts
new file mode 100644
index 000000000..210adea2a
--- /dev/null
+++ b/test/main/presenter/mcpPresenter/oauthCredentialStore.test.ts
@@ -0,0 +1,42 @@
+import * as fs from 'fs'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { McpOAuthCredentialStore } from '../../../../src/main/presenter/mcpPresenter/oauthCredentialStore'
+
+describe('McpOAuthCredentialStore', () => {
+  let savedContent = ''
+
+  beforeEach(() => {
+    savedContent = ''
+    vi.mocked(fs.existsSync).mockImplementation(() => Boolean(savedContent))
+    vi.mocked(fs.readFileSync).mockImplementation(() => savedContent)
+    vi.mocked(fs.writeFileSync).mockImplementation((_, data) => {
+      savedContent = String(data)
+    })
+    vi.mocked(fs.mkdirSync).mockImplementation(() => undefined as unknown as string)
+  })
+
+  it('removes only the requested credential scope', () => {
+    const store = new McpOAuthCredentialStore('/tmp/deepchat-mcp-oauth/credentials.json')
+
+    store.saveEntry('linear', {
+      tokens: {
+        access_token: 'access-token'
+      },
+      clientInformation: {
+        client_id: 'client-id'
+      },
+      codeVerifier: 'verifier',
+      discoveryState: {
+        authorizationServerUrl: 'https://mcp.linear.app'
+      }
+    })
+
+    store.clearEntryScope('linear', 'tokens')
+
+    const entry = store.load('linear')
+    expect(entry?.tokens).toBeUndefined()
+    expect(entry?.clientInformation?.client_id).toBe('client-id')
+    expect(entry?.codeVerifier).toBe('verifier')
+    expect(entry?.discoveryState?.authorizationServerUrl).toBe('https://mcp.linear.app')
+  })
+})
diff --git a/test/renderer/components/McpServerCard.test.ts b/test/renderer/components/McpServerCard.test.ts
index 878de82ad..c8e48bd84 100644
--- a/test/renderer/components/McpServerCard.test.ts
+++ b/test/renderer/components/McpServerCard.test.ts
@@ -46,10 +46,13 @@ const server = {
   isRunning: false
 }
 
-const mountCard = (onClick = vi.fn()) => {
+const mountCard = (onClick = vi.fn(), serverOverrides: Record<string, unknown> = {}) => {
   const wrapper = mount(McpServerCard, {
     props: {
-      server,
+      server: {
+        ...server,
+        ...serverOverrides
+      },
       toolsCount: 1,
       promptsCount: 1,
       resourcesCount: 1
@@ -110,4 +113,18 @@ describe('McpServerCard', () => {
     expect(wrapper.emitted('viewResources')).toHaveLength(1)
     expect(onClick).not.toHaveBeenCalled()
   })
+
+  it('labels OAuth error status as authentication failed', () => {
+    const { wrapper } = mountCard(vi.fn(), {
+      authStatus: {
+        serverName: 'demo',
+        state: 'error',
+        authenticated: false,
+        error: 'callback failed'
+      }
+    })
+
+    expect(wrapper.text()).toContain('settings.mcp.authFailed')
+    expect(wrapper.text()).not.toContain('settings.mcp.authRequired')
+  })
 })
diff --git a/test/renderer/components/McpServers.test.ts b/test/renderer/components/McpServers.test.ts
index 49b8f3097..1127612f2 100644
--- a/test/renderer/components/McpServers.test.ts
+++ b/test/renderer/components/McpServers.test.ts
@@ -146,11 +146,11 @@ const setup = async (options: SetupOptions = {}) => {
         ScrollArea: passthrough('ScrollArea'),
         Dialog: passthrough('Dialog'),
         DialogTrigger: passthrough('DialogTrigger'),
-        DialogContent: defineComponent({ name: 'DialogContent', template: '<div />' }),
-        DialogHeader: defineComponent({ name: 'DialogHeader', template: '<div />' }),
-        DialogTitle: defineComponent({ name: 'DialogTitle', template: '<div />' }),
-        DialogDescription: defineComponent({ name: 'DialogDescription', template: '<div />' }),
-        DialogFooter: defineComponent({ name: 'DialogFooter', template: '<div />' }),
+        DialogContent: passthrough('DialogContent'),
+        DialogHeader: passthrough('DialogHeader'),
+        DialogTitle: passthrough('DialogTitle'),
+        DialogDescription: passthrough('DialogDescription'),
+        DialogFooter: passthrough('DialogFooter'),
         McpServerCard: serverCardStub,
         McpServerForm: true,
         McpToolPanel: true,
@@ -318,4 +318,21 @@ describe('McpServers', () => {
     expect(mcpStore.updateServerAuthStatus).toHaveBeenCalledTimes(1)
     expect(mcpStore.updateServerAuthStatus).toHaveBeenCalledWith('running-server', true)
   })
+
+  it('ignores duplicate callback URL submissions while one is pending', async () => {
+    const { wrapper, mcpStore } = await setup({ withServers: true })
+    mcpStore.completeServerAuthFromCallbackUrl.mockImplementation(() => new Promise(() => {}))
+
+    await wrapper.find('[data-testid="authenticate-server"]').trigger('click')
+    await flushPromises()
+
+    const authCallbackInput = wrapper.findAll('input').at(-1)
+    expect(authCallbackInput).toBeTruthy()
+
+    await authCallbackInput!.setValue('http://localhost:3333/callback?code=code&state=state')
+    await authCallbackInput!.trigger('keydown.enter')
+    await authCallbackInput!.trigger('keydown.enter')
+
+    expect(mcpStore.completeServerAuthFromCallbackUrl).toHaveBeenCalledTimes(1)
+  })
 })
diff --git a/test/renderer/components/OpenAICodexOAuth.test.ts b/test/renderer/components/OpenAICodexOAuth.test.ts
index fae315f74..df45f075b 100644
--- a/test/renderer/components/OpenAICodexOAuth.test.ts
+++ b/test/renderer/components/OpenAICodexOAuth.test.ts
@@ -22,6 +22,34 @@ const iconStub = defineComponent({
   template: '<i />'
 })
 
+const passthrough = (name: string) =>
+  defineComponent({
+    name,
+    inheritAttrs: false,
+    template: '<div v-bind="$attrs"><slot /></div>'
+  })
+
+const inputStub = defineComponent({
+  name: 'Input',
+  props: {
+    modelValue: {
+      type: String,
+      default: ''
+    }
+  },
+  emits: ['update:modelValue'],
+  setup(_, { emit }) {
+    const onInput = (event: Event) => {
+      emit('update:modelValue', (event.target as HTMLInputElement).value)
+    }
+
+    return {
+      onInput
+    }
+  },
+  template: '<input :value="modelValue" @input="onInput" />'
+})
+
 const signedOutStatus: OpenAICodexAuthStatus = {
   state: 'signed-out',
   authenticated: false,
@@ -36,6 +64,12 @@ const authenticatedStatus: OpenAICodexAuthStatus = {
   accountLabel: 'user@example.com'
 }
 
+const pendingBrowserStatus: OpenAICodexAuthStatus = {
+  state: 'pending-browser',
+  authenticated: false,
+  storage: 'safeStorage'
+}
+
 const createProvider = (overrides?: Partial<LLM_PROVIDER>): LLM_PROVIDER => ({
   id: 'openai-codex',
   name: 'OpenAI Codex',
@@ -54,6 +88,7 @@ describe('OpenAICodexOAuth', () => {
     const oauthClient = {
       getOpenAICodexStatus: vi.fn().mockResolvedValue(initialStatus),
       startOpenAICodexBrowserLogin: vi.fn().mockResolvedValue(authenticatedStatus),
+      completeOpenAICodexBrowserLoginFromUrl: vi.fn().mockResolvedValue(authenticatedStatus),
       cancelOpenAICodexLogin: vi.fn().mockResolvedValue(signedOutStatus),
       logoutOpenAICodex: vi.fn().mockResolvedValue(signedOutStatus),
       onOpenAICodexStatusChanged: vi.fn(() => vi.fn())
@@ -79,6 +114,16 @@ describe('OpenAICodexOAuth', () => {
     vi.doMock('@shadcn/components/ui/label', () => ({
       Label: labelStub
     }))
+    vi.doMock('@shadcn/components/ui/dialog', () => ({
+      Dialog: passthrough('Dialog'),
+      DialogContent: passthrough('DialogContent'),
+      DialogDescription: passthrough('DialogDescription'),
+      DialogHeader: passthrough('DialogHeader'),
+      DialogTitle: passthrough('DialogTitle')
+    }))
+    vi.doMock('@shadcn/components/ui/input', () => ({
+      Input: inputStub
+    }))
     vi.doMock('@iconify/vue', () => ({
       Icon: iconStub
     }))
@@ -127,4 +172,19 @@ describe('OpenAICodexOAuth', () => {
     expect(oauthClient.logoutOpenAICodex).toHaveBeenCalledTimes(1)
     expect(wrapper.text()).toContain('settings.provider.openaiCodexNotConnected')
   })
+
+  it('ignores duplicate callback URL submissions while one is pending', async () => {
+    const { wrapper, oauthClient } = await setup(pendingBrowserStatus)
+    oauthClient.completeOpenAICodexBrowserLoginFromUrl.mockImplementation(
+      () => new Promise(() => {})
+    )
+
+    await wrapper
+      .find('input')
+      .setValue('http://localhost:1455/auth/callback?code=code&state=state')
+    await wrapper.find('input').trigger('keydown.enter')
+    await wrapper.find('input').trigger('keydown.enter')
+
+    expect(oauthClient.completeOpenAICodexBrowserLoginFromUrl).toHaveBeenCalledTimes(1)
+  })
 })
diff --git a/test/renderer/components/SheetContentDrag.test.ts b/test/renderer/components/SheetContentDrag.test.ts
index 65d473066..f2b4024e9 100644
--- a/test/renderer/components/SheetContentDrag.test.ts
+++ b/test/renderer/components/SheetContentDrag.test.ts
@@ -1,12 +1,44 @@
-import { readFile } from 'fs/promises'
-import { describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it } from 'vitest'
+import { defineComponent } from 'vue'
+import { flushPromises, mount } from '@vue/test-utils'
+import { Sheet, SheetContent, SheetDescription, SheetTitle } from '@shadcn/components/ui/sheet'
 
 describe('SheetContent drag region', () => {
+  afterEach(() => {
+    document.body.innerHTML = ''
+  })
+
   it('keeps the close button outside the Electron drag region', async () => {
-    const source = await readFile('src/shadcn/components/ui/sheet/SheetContent.vue', 'utf-8')
-    const closeButton = source.match(/<DialogClose[\s\S]*?>/)?.[0] ?? ''
+    const TestHost = defineComponent({
+      components: {
+        Sheet,
+        SheetContent,
+        SheetDescription,
+        SheetTitle
+      },
+      template: `
+        <Sheet :open="true">
+          <SheetContent>
+            <SheetTitle>Test sheet</SheetTitle>
+            <SheetDescription>Test description</SheetDescription>
+            <div>Body</div>
+          </SheetContent>
+        </Sheet>
+      `
+    })
+
+    const wrapper = mount(TestHost, {
+      attachTo: document.body
+    })
+    await flushPromises()
+
+    const closeButton = document.body.querySelector(
+      'button.window-no-drag-region'
+    ) as HTMLButtonElement | null
+
+    expect(closeButton).not.toBeNull()
+    expect(closeButton?.type).toBe('button')
 
-    expect(closeButton).toContain('window-no-drag-region')
-    expect(closeButton).toContain('-webkit-app-region: no-drag')
+    wrapper.unmount()
   })
 })