chore(deps): bump rmcp from 2.2.0 to 3.2.0 and port the OAuth transport

Supersedes the red Dependabot PR #5877. rmcp 3.2 reshaped
`transport::auth`; this ports our client and the in-process OAuth mock
to the new contract without changing any product guarantee.

What changed in rmcp, and what we adapted to:

1. `AuthorizationManager::discover_metadata()` is now
   `resolve_metadata()`, returning `AuthorizationMetadataResolution
   { metadata, source }`. The discovery order (RFC 9728 protected
   resource metadata, then RFC 8414 / OIDC, then legacy synthesized
   endpoints) and the legacy fallback are unchanged, so the two call
   sites just take `.metadata`.

2. `OAuthState::start_authorization(scopes, redirect_uri, client_name)`
   is now a single `AuthorizationRequest` builder. It also introduces a
   client-identity priority order (pre-registered client ID, then a
   Client ID Metadata Document, then Dynamic Client Registration); we
   supply neither of the first two, so we still land on DCR exactly as
   before. Empty scopes now mean "let the SDK select from the
   WWW-Authenticate challenge / PRM / AS metadata" rather than "request
   none" — strictly better, and our explicit scopes still win.

3. Discovery now validates the `issuer` in the fetched authorization
   server metadata against the discovery URL (RFC 8414 / OIDC) and
   fails with `AuthError::AuthorizationServerMismatch` instead of
   silently accepting it. Our in-process mock answered *every*
   `/.well-known/oauth-authorization-server*` path with one document
   whose `issuer` is the origin root, including rmcp's first candidate
   `/.well-known/oauth-authorization-server/mcp`, whose issuer must be
   `<origin>/mcp`. The mock now answers only the canonical path, which
   is what a real authorization server at the origin root does. That is
   a conformance fix to a test double, not a product behavior change:
   every assertion in the eight tests is untouched.

4. `AuthError` split the refresh outcomes: `TokenRefreshFailed` is now
   the retryable case and the new `TokenRefreshRejected` carries a
   definitive `invalid_grant`; separately, `refresh_token()` returns
   `AuthError::AuthorizationRequired` where 2.2 returned
   `TokenRefreshFailed("No refresh token available")`. The
   `invalid_grant` text still reaches us intact, so the dead-grant
   guarantees hold unchanged, but "OAuth authorization required" — a
   credential with no usable grant left — was classified as a plain
   transport failure on every surface. `error_text_looks_auth_required`
   now matches rmcp's full phrase, so that case flips the server to
   `auth required` and offers the login tool like every other
   unrecoverable credential.

Not adapted because nothing depended on it: `StoredCredentials` gained
an `issuer` field and `initialize_from_store` now discards tokens when
the authorization server changes; `CredentialStore` gained an optional
`acquire_refresh_guard`; the RFC 8707 `resource` parameter on refreshes
now prefers the discovered PRM resource indicator and falls back to the
base URL, which is what 2.2 always sent. We keep our own credential
store, so rmcp's in-memory default is untouched by any of these.

Verified locally:
  cargo fmt                                                      clean
  cargo check -p codewhale-tui                                   clean
  RUST_MIN_STACK=16777216 cargo test -p codewhale-tui --lib -- mcp::
      230 passed; 0 failed; 1 ignored   (was 222 passed; 8 failed)
  RUST_MIN_STACK=16777216 cargo test -p codewhale-tui --lib
      11717 passed; 0 failed; 13 ignored

Two earlier full-suite runs each tripped one different pre-existing
parallel-execution flake in a module this change does not touch
(`model_inventory::...ollama_default_prefers_live_local_tags...`, then
`remote_control::...distinct_recovery_turn_ids`); both pass alone and
the run above is clean.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0188XYyJaw9Mh9uSrqQBoqhm
Signed-off-by: CodeWhale Bot <bot@codewhale.net>

Author: CodeWhale Bot

Cargo.lock

@@ -62,7 +62,7 @@ ratatui = { version = "=0.30.2", features = ["unstable-rendered-line-info"] }
 regex = "1.11"
 reqwest = { workspace = true, features = ["blocking", "stream", "form", "http2"] }
 rusqlite.workspace = true
-rmcp = { version = "2.2.0", default-features = false, features = ["auth", "client"] }
+rmcp = { version = "3.2.0", default-features = false, features = ["auth", "client"] }
 rustls.workspace = true
 qrcode = { version = "0.14", default-features = false }
 similar = { version = "3", features = ["unicode"] }

crates/tui/Cargo.toml

@@ -10,7 +10,9 @@ use reqwest::Url;
 use reqwest::header::{HeaderMap, HeaderName, HeaderValue};
 use rmcp::transport::AuthorizationManager;
 use rmcp::transport::AuthorizationSession;
-use rmcp::transport::auth::{AuthError, OAuthClientConfig, OAuthState, OAuthTokenResponse};
+use rmcp::transport::auth::{
+    AuthError, AuthorizationRequest, OAuthClientConfig, OAuthState, OAuthTokenResponse,
+};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
@@ -76,6 +78,14 @@ pub fn error_text_looks_auth_required(text: &str) -> bool {
         || text.contains("unauthorized")
         || text.contains("authentication_required")
         || text.contains("invalid_grant")
+        // rmcp 3.2 collapsed several unrecoverable refresh outcomes onto
+        // `AuthError::AuthorizationRequired` (Display: "OAuth authorization
+        // required") — a stored credential with no usable refresh grant, and
+        // every refresh the server definitively rejected. In 2.2 those
+        // arrived as `TokenRefreshFailed("No refresh token available")`, which
+        // no surface recognised. The full phrase is matched so it stays
+        // anchored to rmcp's own wording.
+        || text.contains("oauth authorization required")
         || text.contains("◆ auth required")
         || text.contains("requires oauth login")
         || text.contains("requires oauth authentication")
@@ -611,9 +621,9 @@ async fn discover_streamable_http_oauth_with_headers(
         .context("building MCP OAuth discovery client")?;
     let mut manager = AuthorizationManager::new(url).await?;
     manager.with_client(client)?;
-    match manager.discover_metadata().await {
-        Ok(metadata) => Ok(Some(McpOAuthDiscovery {
-            scopes_supported: normalize_scopes(metadata.scopes_supported),
+    match manager.resolve_metadata().await {
+        Ok(resolution) => Ok(Some(McpOAuthDiscovery {
+            scopes_supported: normalize_scopes(resolution.metadata.scopes_supported),
         })),
         Err(AuthError::NoAuthorizationSupport) => Ok(None),
         Err(err) => Err(err.into()),
@@ -1344,14 +1354,18 @@ async fn start_authorization(
     let Some(client_id) = oauth_client_id.filter(|client_id| !client_id.trim().is_empty()) else {
         let mut oauth_state = OAuthState::new(server_url, Some(client)).await?;
         oauth_state
-            .start_authorization(scopes, redirect_uri, Some("Codewhale"))
+            .start_authorization(
+                AuthorizationRequest::new(redirect_uri)
+                    .with_scopes(scopes.iter().copied())
+                    .with_client_name("Codewhale"),
+            )
             .await?;
         return Ok(oauth_state);
     };
 
     let mut manager = AuthorizationManager::new(server_url).await?;
     manager.with_client(client)?;
-    let metadata = manager.discover_metadata().await?;
+    let metadata = manager.resolve_metadata().await?.metadata;
     manager.set_metadata(metadata);
     manager.configure_client(
         OAuthClientConfig::new(client_id, redirect_uri)
@@ -1677,6 +1691,15 @@ mod tests {
         assert!(!error_text_looks_auth_required(
             "invalid_request: missing parameter"
         ));
+        // rmcp's own `AuthError::AuthorizationRequired` wording: a stored
+        // credential that can no longer be refreshed is a login, not a
+        // transport failure.
+        assert!(error_text_looks_auth_required(
+            "refreshing MCP OAuth token for server wiki: OAuth authorization required"
+        ));
+        assert!(!error_text_looks_auth_required(
+            "authorization required for the requested file"
+        ));
     }
 
     #[test]

crates/tui/src/mcp/oauth.rs

@@ -5986,9 +5986,16 @@ impl OAuthMcpMock {
                             .to_ascii_lowercase()
                             .contains("authorization: bearer cw-test-access");
 
-                    if method == "GET"
-                        && path_only.starts_with("/.well-known/oauth-authorization-server")
-                    {
+                    // RFC 8414: the authorization server lives at the origin
+                    // root, so it publishes its metadata only at the canonical
+                    // `/.well-known/oauth-authorization-server` and its
+                    // `issuer` is the root origin. The path-insertion
+                    // candidates rmcp probes first (`.../oauth-authorization-server/mcp`)
+                    // belong to a *different* issuer and must 404 here: rmcp
+                    // 3.2 validates the discovered `issuer` against the
+                    // discovery URL and rejects metadata served at the wrong
+                    // one.
+                    if method == "GET" && path_only == "/.well-known/oauth-authorization-server" {
                         let metadata = serde_json::json!({
                             "issuer": format!("http://{addr}"),
                             "authorization_endpoint": format!("http://{addr}/authorize"),