feat: JIT scope upgrade via ElicitationAgent

[mattzcarey]

Summary

• When the execute tool hits a 403 from the Cloudflare API, creates an ElicitationAgent (Durable Object via Agents SDK) that serves a scope picker UI
• The scope picker matches the Cloudflare design system and shows current scopes pre-checked so the user can add what they need
• After selecting scopes, the user is redirected through Cloudflare OAuth to get a new token — no full MCP reconnection required
• The upgraded token is stored in KV and automatically picked up by subsequent execute calls

How it works

1. execute tool catches 403 → elicitUpdatedScopes() creates ElicitationAgent with error context + current scopes
2. User opens the elicitation URL → sees scope picker with templates (Read Only, Workers Full, DNS Full) + individual checkboxes
3. User adds scopes, clicks Continue → redirected to Cloudflare OAuth
4. /oauth/callback detects scope_upgrade state → exchanges code → stores upgraded token in OAUTH_KV as token-upgrade:{tokenHash}
5. Next execute call → getUpgradedToken() finds the upgrade in KV → uses the new token transparently

Changes

File	Change
src/elicitation-agent.ts	New — ElicitationAgent with scope picker UI, OAuth redirect, token storage
src/server.ts	elicitUpdatedScopes() passes scopes/tokenHash/userId to agent; execute handler checks KV for upgrades
src/auth/oauth-handler.ts	Stores scopes in props; /oauth/callback handles scope_upgrade flow
src/auth/types.ts	Added scopes?: string[] to UserAuthProps
src/executor.ts	HTTP status propagation from sandbox worker errors (httpStatus field)
src/index.ts	Exports ElicitationAgent; routes /elicitation/:id[/action] to DO
wrangler.jsonc	DO binding + migration for ElicitationAgent (all envs)
worker-configuration.d.ts	ELICITATION_AGENT binding type
src/tests/jit-auth.test.ts	New — tests for httpStatus propagation and elicitUpdatedScopes

Test plan

• npm run typecheck passes
• npm test — 92 tests pass
• Deployed to staging (staging.mcp.cloudflare.com)
• Triggered 403 via execute → elicitation URL returned
• Opened elicitation URL → scope picker renders correctly
• Selected "Workers Full Access" template → 21 scopes checked
• Clicked Continue → redirected to Cloudflare OAuth login