[lorem-dev]

Summary

• Extends lazy auth-header resolution in locksmith mcp run --url to fire on JSON-RPC body errors (response.error or result.isError: true), not only on HTTP 401/403.
• One resolve attempt per session, shared between transport (HTTP status) and proxy (body) triggers via a new authState. If retry also fails, the response is forwarded to the AI client unchanged.
• Detection looks only at structural fields - no keyword matching against result.content[].text. Notifications and id:null responses never trigger.

Implementation

• internal/mcp/jsonrpc_error.go - inspectResponse / extractID helpers
• internal/mcp/auth_state.go - shared authState with resolveOnce
• internal/mcp/transport_http.go / transport_sse.go - route auth retry through shared state
• internal/mcp/proxy.go - proxyState id-map + body-level retry handshake (with concurrent in-flight support)

Test plan

• TestInspectResponse + TestExtractID table-driven coverage
• TestAuthState_ResolveOnce_* (single, concurrent, resolver-fails, nil-resolver)
• TestStreamableHTTP_BodyResolveThen401_NoSecondResolve - cross-layer guarantee
• 8 new TestProxy_* scenarios in proxy_retry_test.go (success, resolve fail, send fail, retry-also-errors, concurrent ids, only-first-error, after-attempted no-parse, notification not tracked)
• All existing MCP tests adapted to new authState constructor and passing under -race
• make verify green