fix(mcp): harden OAuth callback recovery

[mattzcarey]

Summary

Harden the MCP OAuth callback state machine:

• verify a callback's state nonce before it can fail or otherwise mutate a connection;
• leave the active flow unchanged for forged, expired, or replayed state;
• allow a genuine callback to complete a flow that previously entered failed;
• make addMcpServer() reconnect when an authorization URL embeds expired state, so it returns a fresh flow instead of an unusable URL.

Why this is needed

A well-formed callback carrying an unknown nonce could move an in-flight connection from authenticating to failed and clear its authorization URL. The genuine callback was then rejected. Separately, preserving the connection on expired state requires refreshing the expired URL or the flow remains stuck.

The minimized callback tests and stale-flow integration test both fail on current main and pass with this branch.

Validation

• pnpm --filter agents exec vitest run src/tests/mcp — 30 files, 549 tests passed
• focused package lint and both Agents TypeScript projects passed
• build, exports, and formatting passed
• repo-wide typecheck remains blocked by unchanged main voice errors in examples/voice-agent and voice-providers/assemblyai

Includes a patch changeset for agents.

[changeset-bot]

🦋 Changeset detected

Latest commit: c1b8b40

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agents	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[pkg-pr-new]

Open in StackBlitz

agents

npm i https://pkg.pr.new/agents@1926

@cloudflare/ai-chat

npm i https://pkg.pr.new/@cloudflare/ai-chat@1926

@cloudflare/codemode

npm i https://pkg.pr.new/@cloudflare/codemode@1926

create-think

npm i https://pkg.pr.new/create-think@1926

hono-agents

npm i https://pkg.pr.new/hono-agents@1926

@cloudflare/shell

npm i https://pkg.pr.new/@cloudflare/shell@1926

@cloudflare/think

npm i https://pkg.pr.new/@cloudflare/think@1926

@cloudflare/voice

npm i https://pkg.pr.new/@cloudflare/voice@1926

@cloudflare/worker-bundler

npm i https://pkg.pr.new/@cloudflare/worker-bundler@1926

commit: c1b8b40