fix(server): use canonical OAuth health in MCP upstream list

[neylwalecki]

An enabled OAuth upstream with a valid stored token reports Connected / ready / usable=true through the CLI/runtime, but Authentication required / sign_in_required / usable=false through MCP upstream_servers/list.

Reuse the runtime's canonical health projection for the MCP listing instead of reconstructing it without OAuth status and expiry metadata. Keep the existing server visibility filters, scrub health text at the MCP boundary, and preserve the connection-based fallback before runtime state is available. Authentication enforcement and tool search are unchanged.

Fixes #1522.

Validation

• Synthetic red/green regression on upstream f2e58df3; 16 scenarios cover valid/missing/expired tokens, refresh metadata, OAuth failures, logout, 401 rejection, static-header auth, disabled/quarantined servers, redaction/scope, and absent runtime state.
• Focused server regressions with -race -count=3: pass.
• Personal and server-edition core builds: pass.
• go vet ./internal/server/... ./internal/runtime/... ./internal/health/...: pass.
• API E2E: pass using the official harness with loopback-only scratch listeners and an isolated npm cache for the official server-everything fixture. The global npm cache returned EACCES; its permissions and contents were preserved.
• Internal race suite: 70 packages pass; internal/server fails only TestProfileMiddleware_RefusalWorkIndependentOfFleet. The same flake reproduces on the clean, unmodified base in 4/15 isolated runs, tracked separately in [Bug]: Profile-gate allocation parity still flakes under race on Go 1.27/macOS #1523. No assertion was relaxed or skipped to hide it.
• CI-pinned golangci-lint v2.9.0 cannot decode Go 1.27.1 export data in this local environment. The official Go 1.26 lint lane remains to be verified in CI.

The regression uses synthetic tokens, .invalid endpoints and temporary storage. No installed proxy or real OAuth session was changed.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Dumbris]

Thank you @neylwalecki, this is an excellent fix and it's merged. You had it as a draft pending the CI lint lane; that lane (and the full suite) is green, so I marked it ready and merged it.

What made it easy to land:

• The right fix at the right layer. Reusing the runtime's canonical health projection, instead of teaching the MCP path to rebuild OAuth state, means the CLI, REST and MCP surfaces can't drift apart again.
• The MCP boundary is kept. The canonical health is read only after the agent and profile scope filters, Summary and Detail are scrubbed exactly like last_error, and the connection-based fallback still covers startup.
• The tests. The 13-case table runs through the real runtime and dispatcher (valid, missing and expired tokens, refresh, logout, 401, static auth, disabled, quarantined), plus the redaction and scope test and the no-snapshot case. That gave us real confidence.
• The write-up. A precise reproduction, a clear red/green, and an honest note about the unrelated [Bug]: Profile-gate allocation parity still flakes under race on Go 1.27/macOS #1523 flake rather than relaxing anything.

I also reviewed it with an independent second model; there were no defects, and the full CI suite passed on the merge with current main. I had opened a duplicate fix (#1531) without spotting your PR first. I'm closing mine in favour of yours.

Thanks again for this and for your earlier #1291 and #1057. Contributions like these make mcpproxy better for everyone.

[neylwalecki]

Glad to help ;-)