MCP connector OAuth: loopback callback connection refused — no listener code found in @deepseek-ai/dsh 0.1.1-rc.2

[RAFOLIE]

Environment

• @deepseek-ai/dsh: 0.1.1-rc.2 (installed globally via npm, dsh web)
• Client: third-party desktop shell (dsh-desktop) that embeds http://127.0.0.1:3080/ and routes OAuth authorize pages to the system browser
• OS: Windows 11 x64

Problem

Configuring an MCP connector that uses OAuth authorization fails at the final step. After approving access at the provider, the browser is redirected to the loopback callback URL (http://127.0.0.1:<port>/callback) and shows ERR_CONNECTION_REFUSED — nothing is listening on that port at that moment.

Steps

1. In the harness web UI, start OAuth authorization for an MCP connector (a local loopback listener is expected to catch the redirect).
2. The authorize page opens in the system browser; approve access.
3. The provider redirects the browser to http://127.0.0.1:<port>/callback → connection refused.

Evidence from controlled experiments (same machine, same account)

Experiments by @chaoyang2009918, originally reported in RAFOLIE/dsh-desktop-windowos#7:

1. Opening http://127.0.0.1:3080/ directly in the system browser and clicking the same links works as expected → the web UI itself behaves correctly.
2. Routing the authorize page to the system browser works → the browser-side part of the flow is healthy.
3. The refusal happens only at the loopback redirect — i.e. no process is bound to the redirect port when the callback arrives.

Additional finding

Inspecting the globally installed @deepseek-ai/dsh@0.1.1-rc.2 package locally: there is no oauth / redirect_uri / loopback / 127.0.0.1 related code anywhere in lib/. So either the OAuth loopback listener lives in the separately-served web bundle, or it is not shipped in 0.1.1-rc.2 at all. If it is missing, "connection refused" is the expected outcome and connector OAuth cannot complete on this version.

Questions

1. Where should the MCP OAuth loopback listener live in 0.1.1-rc.2 — backend process, web bundle, or is it planned for the 0.1.2 line?
2. Is there a listener timeout that would explain a refused callback when login takes a while?
3. The 0.1.2-alpha.1 changelog lists provider login configuration work ("插件支持在模型设置页添加提供方登录配置") — is the MCP OAuth callback covered by that effort?

Happy to provide more logs or repro details.