fix(mcplocal): propagate caller's bearer to prompt-index and LLM-config calls

The proxy-path fix (5d10728) covered upstream tools/call routing via
McpdUpstream, but getOrCreateRouter in project-mcp-endpoint.ts had TWO
more mcpd-bound call sites that silently fell back to the pod's empty
default token:

  1. fetchProjectLlmConfig(mcpdClient, projectName)
  2. router.setPromptConfig(mcpdClient.withHeaders({...}))
     → which is what gate.ts begin_session uses via ctx.fetchPromptIndex()
       to hit /api/v1/projects/:name/prompts/visible

Symptom: in the k8s mcplocal pod, LiteLLM would initialize + tools/list
fine (showing begin_session), but tools/call begin_session returned
`{isError: true, content: "McpError: Authentication failed: invalid or
expired token"}`. Reproduced against the live cluster by driving
LiteLLM's /mcp/ endpoint with qwen3-thinking's exact payload.

Fix: build `requestClient = mcpdClient.withToken(authToken)` once at the
top of getOrCreateRouter and thread it through fetchProjectLlmConfig
and setPromptConfig. withHeaders still adds X-Service-Account for
mcpd-side audit tagging, but the bearer now carries the caller's
McpToken identity (resolves as McpToken:<sha> on mcpd).

Verified: unit tests pass (mock needed withToken/withTimeout stubs).
Next step: rebuild image + roll pod + retest LiteLLM→mcp flow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/mcpd/src/main.ts

@@ -315,10 +315,13 @@ async function main(): Promise<void> {
   const backupService = new BackupService(serverRepo, projectRepo, secretRepo, userRepo, groupRepo, rbacDefinitionRepo, promptRepo, templateRepo);
   const restoreService = new RestoreService(serverRepo, projectRepo, secretRepo, userRepo, groupRepo, rbacDefinitionRepo, promptRepo, templateRepo);
 
-  // Auth middleware for global hooks
-  const authMiddleware = createAuthMiddleware({
-    findSession: (token) => authService.findSession(token),
-    findMcpToken: async (tokenHash) => {
+  // Shared auth dependencies. Both the global auth hook and the per-route
+  // preHandler on /api/v1/mcp/proxy must know how to resolve both session
+  // bearers AND mcpctl_pat_ bearers, or mcplocal→mcpd proxy calls with a
+  // McpToken will 401 at the route layer even though the global hook accepts them.
+  const authDeps = {
+    findSession: (token: string) => authService.findSession(token),
+    findMcpToken: async (tokenHash: string) => {
       const row = await mcpTokenRepo.findByHash(tokenHash);
       if (row === null) return null;
       return {
@@ -332,7 +335,8 @@ async function main(): Promise<void> {
         revokedAt: row.revokedAt,
       };
     },
-  });
+  };
+  const authMiddleware = createAuthMiddleware(authDeps);
 
   // Server
   const app = await createServer(config, {
@@ -436,7 +440,7 @@ async function main(): Promise<void> {
   registerMcpProxyRoutes(app, {
     mcpProxyService,
     auditLogService,
-    authDeps: { findSession: (token) => authService.findSession(token) },
+    authDeps,
   });
   registerRbacRoutes(app, rbacDefinitionService);
   registerUserRoutes(app, userService);

src/mcplocal/src/discovery.ts

@@ -46,7 +46,13 @@ export async function refreshProjectUpstreams(
     servers = await mcpdClient.get<McpdServer[]>(path);
   }
 
-  return syncUpstreams(router, mcpdClient, servers);
+  // Downstream upstream-proxy calls go through `mcpdClient` too. In HTTP-mode
+  // mcplocal the pod has no credentials of its own, so the default token on
+  // `mcpdClient` is an empty string — every /api/v1/mcp/proxy call would 401.
+  // Bind a per-request client with the caller's bearer so each McpdUpstream
+  // forwards the same identity that passed project discovery.
+  const upstreamClient = authToken ? mcpdClient.withToken(authToken) : mcpdClient;
+  return syncUpstreams(router, upstreamClient, servers);
 }
 
 /**

src/mcplocal/src/http/mcpd-client.ts

@@ -60,6 +60,16 @@ export class McpdClient {
     return new McpdClient(this.baseUrl, this.token, { ...this.extraHeaders }, timeoutMs);
   }
 
+  /**
+   * Create a new client with a different Bearer token. The HTTP-mode mcplocal
+   * pod has no credentials of its own — each incoming client request carries
+   * its McpToken, and this method is how we thread that token through to the
+   * McpdUpstream instances created during project discovery.
+   */
+  withToken(token: string): McpdClient {
+    return new McpdClient(this.baseUrl, token, { ...this.extraHeaders }, this.timeoutMs);
+  }
+
   async get<T>(path: string): Promise<T> {
     return this.request<T>('GET', path);
   }

src/mcplocal/src/http/project-mcp-endpoint.ts

@@ -62,21 +62,31 @@ export function registerProjectMcpEndpoint(app: FastifyInstance, mcpdClient: Mcp
       return existing.router;
     }
 
+    // HTTP-mode mcplocal has no pod-level credentials — the default
+    // `mcpdClient.token` is an empty string. Every downstream call from this
+    // request (upstream discovery, LLM config fetch, prompt index for
+    // begin_session) has to use the CALLER's McpToken as the bearer, or mcpd
+    // rejects with 401. Build one per-request client here and thread it
+    // everywhere instead of sprinkling `.withToken(authToken)` at each call site.
+    const requestClient = authToken ? mcpdClient.withToken(authToken) : mcpdClient;
+
     // Create new router or refresh existing one
     const router = existing?.router ?? new McpRouter();
     await refreshProjectUpstreams(router, mcpdClient, projectName, authToken);
 
     // Resolve project LLM model: local override → mcpd recommendation → global default
     const localOverride = loadProjectLlmOverride(projectName);
-    const mcpdConfig = await fetchProjectLlmConfig(mcpdClient, projectName);
+    const mcpdConfig = await fetchProjectLlmConfig(requestClient, projectName);
     const resolvedModel = localOverride?.model ?? mcpdConfig.llmModel ?? undefined;
 
     // If project llmProvider is "none", disable LLM for this project
     const llmDisabled = mcpdConfig.llmProvider === 'none' || localOverride?.provider === 'none';
     const effectiveRegistry = llmDisabled ? null : (providerRegistry ?? null);
 
-    // Configure prompt resources with SA-scoped client for RBAC
-    const saClient = mcpdClient.withHeaders({ 'X-Service-Account': `project:${projectName}` });
+    // Configure prompt resources with SA-scoped client for RBAC.
+    // Keep the X-Service-Account header for mcpd-side audit tagging, but carry
+    // the caller's bearer so auth passes (the principal resolves as McpToken:<sha>).
+    const saClient = requestClient.withHeaders({ 'X-Service-Account': `project:${projectName}` });
     router.setPromptConfig(saClient, projectName);
 
     // System prompt fetcher for LLM consumers (uses router's cached fetcher)

src/mcplocal/tests/project-discovery.test.ts

@@ -13,6 +13,7 @@ function mockMcpdClient(servers: Array<{ id: string; name: string; transport: st
     forward: vi.fn(async () => ({ status: 200, body: servers })),
     withTimeout: vi.fn(() => client),
     withHeaders: vi.fn(() => client),
+    withToken: vi.fn(() => client),
   };
   return client;
 }

src/mcplocal/tests/project-mcp-endpoint.test.ts

@@ -30,9 +30,13 @@ function mockMcpdClient() {
     delete: vi.fn(),
     forward: vi.fn(async () => ({ status: 200, body: [] })),
     withHeaders: vi.fn(),
+    withToken: vi.fn(),
+    withTimeout: vi.fn(),
   };
-  // withHeaders returns a new client-like object (returns self for simplicity)
+  // Chainable withX returns the same client for simplicity
   (client.withHeaders as ReturnType<typeof vi.fn>).mockReturnValue(client);
+  (client.withToken as ReturnType<typeof vi.fn>).mockReturnValue(client);
+  (client.withTimeout as ReturnType<typeof vi.fn>).mockReturnValue(client);
   return client;
 }