mcp: re-mint expired managed proxy tokens on demand instead of failing or misrouting to OAuth

[Legoben]

Problem

Managed (backend-proxied) MCP servers authenticate with a short-lived proxy session token minted once per run via createManagedMcpClientConfig. Six of the mutation's eight response fields were dead code; nothing retained the managed uid. When the token expired (external sessions: 3h), every tool call failed for the rest of the run — the explicit v1 deferral in specs/managed-mcp-cli-resolution/TECH.md. Worse, an expired token at spawn time routed into the interactive OAuth flow with a misleading "Please authenticate this server in the Warp desktop app" message.

Changes

• Resolution now records each managed installation's uid (ResolvedMcpSpecs.managed_uids).
• Managed ephemerals spawn via spawn_managed_ephemeral_server carrying an InstallationRefresher: a closure that re-mints the client config (bounded retry — it sits on the tool-call latency path), re-parses it, and rebuilds the installation preserving the installation UUID (random for local runs, keys all manager state) and template UUID (keys the log file), then re-applies secrets.
• reconnect_server invokes the refresher before respawning a managed server, so the end-to-end reactive path is: mid-run 401 proxy_token_expired → classified recoverable (prev PR) → retry via reconnect → re-mint → respawn with the fresh header → tool call succeeds, nothing surfaced to the user. Overlap-safe: proxy sessions are stateless JWTs server-side; the old token stays valid until its expiry.
• Startup-401 misroute fix: the preflight now captures WWW-Authenticate, and a proxy re-mint reason returns a typed AuthRequired { reason: Some(..) } instead of entering the OAuth flow (no credential deletion either, per the guard in the classification PR).

Flag-gated by McpSelfHeal. Not covered (by design): third-party harnesses receive rendered JSON config and own their MCP connections; and an initial spawn hitting AuthRequired does not auto-re-mint — resolution happens seconds before spawn, so a token expired at that point indicates clock skew rather than age.

Tests

MockManagedMcpClient tests: refresher preserves identities and swaps only the Authorization value (asserted via rendered config), errors cleanly when the server disappears from the re-minted config, resolution records uids for both UUID and well-known specs; axum test asserts the preflight returns AuthRequired{Some(ProxyTokenExpired)} instead of the OAuth path.

[Legoben]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• mcp: detect dead transports, add Reconnecting state, background reconnect #15540
• mcp: proactively re-mint managed proxy tokens before expiry during agent runs #15539
• mcp: re-mint expired managed proxy tokens on demand instead of failing or misrouting to OAuth #15538 👈 (View in Graphite)
• mcp: broaden reconnect retry, add per-server backoff, keep tools visible during reconnect #15537
• mcp: classify auth failures (HTTP + SSE) and guard OAuth credential deletion #15536
• mcp: retain spawn configs so reconnect works for ephemeral/managed/builtin servers #15535
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.