Function authChallenge

internal/httpapi/middleware.go:73–83

authChallenge injects the RFC 6750 §3 WWW-Authenticate header on any 401 response. Every 401 on this Bearer-accepting surface must advertise the scheme so clients know how to retry (and OAuth-bearer failures get the §3.1 error params so MCP clients can trigger the re-flow). The legacy mux set this a

(build func(r *http.Request) string)

// The challenge value comes from the injected builder (agent.API.
// WWWAuthenticateChallenge), so both surfaces emit identical challenges.
func authChallenge(build func(r *http.Request) string) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if build == nil {
				next.ServeHTTP(w, r)
				return
			}
			next.ServeHTTP(&challengeWriter{ResponseWriter: w, r: r, build: build}, r)
		})
	}
}

// challengeWriter sets WWW-Authenticate just before the status line is written,
// but only when that status is 401. Setting it in WriteHeader (and lazily on a