Bound and cancel MCP proxy discovery during session startup

[aurokin]

Summary

discoverMCPServers() performs MCP proxy health and server-list requests sequentially. The health request can consume five seconds and the list request can then consume another ten seconds. Callers cannot cancel the operation, and an unavailable or transiently failing proxy is returned as the same empty configuration as a healthy proxy with no configured servers.

Discovery should have one caller-controlled cancellation and deadline contract so startup cannot continue doing work after its caller has abandoned the session.

Current behavior

In src/mcp-proxy.ts:

1. discoverMCPServers() awaits isMCPProxyAvailable().
2. Only after that request succeeds does it request the server list.
3. Each request owns a separate timeout, making the total wait additive.
4. The public function does not accept an AbortSignal or deadline.
5. Proxy unavailability and a valid empty server list both produce an empty object.

This behavior can add the full health timeout and list timeout to a startup path. It also leaves no structured way for callers to distinguish a valid empty configuration from discovery that could not complete.

Expected behavior

• Callers can cancel discovery through the SDK API.
• Health and list discovery share one overall time budget rather than independent additive budgets.
• Cancellation stops the active fetch and does not leave a timer or request running.
• A valid empty server list remains a successful result.
• Consumers have a documented way to observe that discovery was unavailable, cancelled, timed out, or invalid without parsing log output.
• Existing consumers that rely on the convenience API can migrate without an unrelated MCP configuration rewrite.

Reproduction and test cases

Add deterministic tests for:

• Healthy proxy with one server.
• Healthy proxy with an empty server list.
• Health endpoint that never responds.
• List endpoint that never responds after a successful health check.
• Cancellation during health discovery.
• Cancellation during list discovery.
• Connection failure, non-success response, and malformed response body.

The elapsed time test should prove that one overall deadline is enforced rather than the sum of two request timeouts.

Proposed scope

• Add caller cancellation and an overall discovery deadline.
• Define how discovery outcome is reported without conflating a valid empty list with failure.
• Preserve the current conversion from discovered proxy entries to Copilot SDK MCP server configuration.

Non-goals

• Caching MCP discovery results.
• Adding a general retry policy.
• Changing the MCP proxy protocol.
• Changing MCP authentication behavior.
• Adding GitHub App-specific startup behavior to this SDK.

Acceptance criteria

• A caller can abort either discovery request.
• One elapsed-time budget bounds the full operation.
• Tests distinguish valid-empty, unavailable, timed-out, cancelled, and invalid-response outcomes.
• No request or timeout remains active after cancellation.
• The API and migration behavior are documented.