Method writeAuthError

internal/agent/api.go:831–834

writeAuthError writes a 401 response with an RFC 6750 §3 WWW-Authenticate challenge. Every 401 on an endpoint that accepts Bearer auth MUST advertise the Bearer scheme so clients know how to retry (§3, first paragraph). When the failing credential WAS an OAuth bearer (sentinel err wrap or `ate2a_`

(w http.ResponseWriter, r *http.Request, err error)

// metadata document lands, add `resource_metadata="<url>"` here so MCP
// clients can auto-discover the authorization server.
func (a *API) writeAuthError(w http.ResponseWriter, r *http.Request, err error) {
	w.Header().Set("WWW-Authenticate", a.authChallenge(r, err))
	http.Error(w, "authentication required", http.StatusUnauthorized)
}

// authChallenge builds the RFC 6750 §3 WWW-Authenticate value for a 401 on a
// Bearer-accepting endpoint, given the request and the auth error that caused