fix: let All servers agent keys reach servers added after issue

Draft
MF
12h ago
+429-46

Why

An agent saved with "All servers" got a key that listed the servers that existed at issue time. A server added later never showed on the agent gateway (/agent-mcp/{agentID}) until someone issued a new key, because the key's stored policy is one of three policies that must all allow. Re-saving the agent did not help.

What changed

Before: the wizard expanded "All servers" into today's servers and dropped any wildcard candidate. Discovery also omitted a wildcard that an owner exclusion overlaps.

After:

  • listDelegableGrants takes carry_exclusions. The wildcard comes back with the overlapping mcp:blocked_connect exclusions beside it, through the existing DelegableGrantsWithExclusions logic.
  • The wizard issues "All servers" keys with the project mcp:connect wildcard plus those exclusions, at delegated grants version 4. When no wildcard is delegable (an owner granted servers one by one), it falls back to the old per-server list.
  • The wrong comment about the agent wildcard carrying new servers is gone.
  • Tests: a server created after the key is issued is listed on the gateway, and an owner-blocked server stays hidden.

Gutternote review steps

No visible UI change. The fix shows on the agent gateway's list_servers, not in the dashboard.

Summary by cubic

Agent keys issued with "All servers" now reach MCP servers added after the key was issued; before, the key only listed servers that existed at the time, so new servers stayed hidden until a new key was issued.

  • The wizard now issues the project wildcard plus any owner-blocked server exclusions, using delegated grants version 4. When no wildcard can be delegated, it falls back to listing servers.
  • Discovery accepts carry_exclusions so the wildcard isn't dropped when an owner exclusion overlaps it.