agent: fence MCP 401 messages, keep challenges; one notice per dropped over-cap message

[jaredLunde]

What

Fixes the four low findings from #146's audit. Each fix has a test that fails without it. I checked this by reverting each fix in place and running its test; the item 1, 2 and 4 fixes were each reverted in two ways, and all seven reverts fail.

#	finding	fix	proving tests
1	The message in a 401's JSON-RPC body went into the tool error raw, at up to 64 KiB.	The message is untrusted text, so it is now cut to 1 KiB (with …) and control characters become spaces. It is fenced the way event payloads are, <mcp_server_message untrusted>…</mcp_server_message>. <, > and quotes are replaced so the message can't close its fence or a challenge parameter's quoted-string.	mcp_unauthorized::a_servers_401_message_is_cut_short_and_fenced_as_untrusted uses a 10 KB message that tries to close its own fence and start a new line. Unit: mcp_wire::a_server_message_is_cut_short_and_cannot_close_its_fence.
2	A 401 with both a WWW-Authenticate challenge and a JSON-RPC body lost the challenge: it became UnexpectedServerResponse.	Such a 401 now stays AuthRequired, carrying the challenge for rmcp's auth client and auth_challenge. The server's reason is added as RFC 6750's error_description. A failed tool call now prints its error's causes, so the challenge and the reason reach the model instead of a bare "Auth required". The post-refresh agent mcp-login error keeps the challenge too.	mcp_unauthorized::a_401_with_a_challenge_and_a_json_rpc_body_keeps_both. Unit: mcp_wire::a_401_with_a_challenge_and_a_reason_keeps_the_challenge.
3	An over-cap server→client request whose id and method both lie past the window became an event stand-in with a misleading gap.	A stand-in made without seeing the method is marked ambiguous. Its gap now says possibly not an event: possibly_not_an_event to the client, and in the model's notice. On a stdio connection with no push stream open, it is logged as dropped instead of reported.	The params-first cases in mcp_message_cap now assert the label on both transports. Unit tests cover the ambiguity mark and the rendered label.
4	Over stdio, a stand-in with no routing is sent to every push stream, so N subscriptions meant N gap notices for one dropped message.	The router stamps each broadcast with one id per dropped message. The hub keeps each subscription's state and status frame, but tells the model once per id.	mcp_message_cap::one_over_cap_message_reaching_two_subscriptions_is_one_notice_to_the_model expects two gap frames and one model notice. Unit: an_unrouted_stand_in_reaches_every_stream_once_with_one_id.

What item 3's tests cover. Before this change, a stdio connection with no push streams already reported no gap: the broadcast reached nobody. So the "log instead" half has no failing-before test; the router unit test exercises that path. The behaviour that changes is the label, and that is tested.

Fixture controls added to the OAuth fixture:

• challenge_with_json_body sends the challenge together with the JSON-RPC body;
• reject_message sets a custom error.message.

Audit fixes (at 99919fd)

As above, each fix's test fails with that fix reverted in place.

#	finding	fix	proving tests
A1	tool_call_err's cause walk printed rmcp's AuthRequiredError / InsufficientScopeError Display, which contains the raw WWW-Authenticate header, unfenced and unbounded. So did the post-refresh agent mcp-login error.	Both now pass the header through fenced_server_message. A grep found two more server bodies that reached model-visible text: a non-JSON-RPC success's body, and a legacy server/discover rejection's body. Both are fenced too.	mcp_unauthorized::a_hostile_oversized_challenge_header_is_cut_short_and_fenced uses a 6 KB realm containing fence-closing text. The bare-challenge login test now expects the header fenced. The non-JSON-RPC body test now expects the body fenced.
A2	fenced_server_message could be fooled by lookalikes and invisible characters.	Fullwidth, small-form and angle-bracket lookalikes of <, >, / and " are replaced. Bidi embeddings, overrides and isolates, zero-width and joiner characters, and the BOM are dropped.	Unit: a_server_message_cannot_close_its_fence_with_lookalikes_or_hide_with_invisibles
A3	A server's own $oversized / $dropped_id / $ambiguous keys were trusted.	These keys are stripped from every events notification at ingress, at the router and on direct-HTTP streams (mcp_stdio::host_params). The exception is a notification carrying the per-process secret that the host stamps into its own stand-ins ($host). The dropped-id sequence now starts from that secret.	Unit: a_servers_host_reserved_keys_are_stripped_at_ingress

Checks

• Tests: 2801 of 2802 pass after the rebase onto main (agent: MCP tasks follow-ups — run --continue resumes, unreachable stays pending, sealed journal #137, agent tests: prove MCP connect concurrency and executor yielding by structure, not wall clock #148). The one failure, mcp_events_nested::a_nested_elicitation_during_an_events_poll_reaches_the_owning_session, passed 3/3 when rerun alone; it is a timing-sensitive test from agent: MCP Events follow-ups — panic exit, delivery by tag, permanent refusals, runtime restore #136 and failed under full-suite load. This includes every tests/mcp_*.rs suite, serve_reaper, serve_http, serve_drain, run_signal_handling, run_cli_flags, serve_harness_deadlines, and the agent and agent-core lib tests.
• Lint and format: cargo clippy with -D warnings is clean, both for the agent with code-mode and for the whole workspace. cargo fmt --check and dprint check are clean.
• Interop: check.py passes 12/12 over HTTP and 12/12 over stdio.
• Docs: ARCHITECTURE.md is updated for all four items.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JimHGjsfk2Ktm5GxyZJKKk