Recover remote auth after vMCP session expires

Summary

A thv run connection to a vMCP gateway authenticated with --remote-auth becomes unauthenticated after approximately one hour. The runner logs a 401 and marks the remote server unauthenticated. thv restart does not initiate or recover authentication; it immediately receives another 401. Removing the server and running it again is currently required to restore the connection.

The gateway URL has been intentionally redacted for privacy.

Reproduction

1. Run a vMCP gateway using remote authentication:

   thv run <redacted-vmcp-gateway-url> --remote-auth --name stacklok-vmcp --remote-auth-scopes openid,profile,email,offline_access
   

2. Keep the connection active for about one hour.
3. Observe the server transition to unauthenticated after a 401 response.
4. Run thv restart stacklok-vmcp.

Actual behavior

The client logs:

{"time":"2026-09-08T17:41:06-04:00","level":"WARN","msg":"received 401 Unauthorized response for remote server, marking as unauthenticated","server":"stacklok-vmcp"}

Restarting immediately encounters another 401 and does not recover the session.

Expected behavior

With the offline_access scope, ToolHive should refresh or otherwise re-establish remote authentication when the access token or session expires. A restart should recover an expired authentication session or provide an actionable re-authentication flow without requiring removal and recreation of the server.

Impact

Long-running vMCP gateway connections require manual removal and re-creation after token or session expiry.

Start by tracing the authentication flow used by thv run and thv restart for remote servers, focusing on the 401 transition described in the reproduction. Verify how the offline_access scope is handled when the session expires. Done means restart refreshes or re-establishes authentication, or presents an actionable re-authentication flow without removing and recreating the server.