feat(clone): Phase 4 — warn on clones with missing auth headers

Autonomous decisions:
- Light clone-wizard touch (header-name preview, not a new form step) — Phase 1 already seeds parent extra_headers; a preview plus updated footer copy is enough visibility at create time
- Expected header keys from parent extra_headers plus required ${input:ID} HTTP definition headers — reuses existing clone/parent and registry shapes without new backend metadata
- Warn-only on enable/reconnect/refresh/retry via toast plus persistent row banner — matches Decision #3; no blocking of enable or connect

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

apps/desktop/src/features/servers/CloneAccountModal.tsx

@@ -54,6 +54,10 @@ export function CloneAccountModal({
   const previewAlias = deriveCloneAlias(suffix);
   const hasSuffix = suffix.trim().length > 0;
   const hasCollision = hasSuffix && isAvailable === false;
+  const sourceHeaderKeys =
+    sourceServer.transport.type === 'http'
+      ? Object.keys(sourceServer.extra_headers ?? {}).filter((key) => key.trim())
+      : [];
 
   useEffect(() => {
     if (!open) {
@@ -293,6 +297,31 @@ export function CloneAccountModal({
             </div>
           )}
 
+          {sourceServer.transport.type === 'http' && (
+            <div className="rounded-lg border border-[rgb(var(--border-subtle))] bg-[rgb(var(--surface-dim))] p-3">
+              <p className="text-sm font-medium text-[rgb(var(--foreground))]">
+                {t('cloneModal.headersPreviewTitle')}
+              </p>
+              <p className="mt-1 text-xs text-[rgb(var(--muted))]">
+                {t('cloneModal.headersPreviewDesc')}
+              </p>
+              {sourceHeaderKeys.length > 0 ? (
+                <ul
+                  className="mt-2 space-y-1 font-mono text-xs text-[rgb(var(--foreground))]"
+                  data-testid="clone-headers-preview"
+                >
+                  {sourceHeaderKeys.map((headerKey) => (
+                    <li key={headerKey}>{headerKey}</li>
+                  ))}
+                </ul>
+              ) : (
+                <p className="mt-2 text-xs text-[rgb(var(--muted))]">
+                  {t('cloneModal.headersPreviewEmpty')}
+                </p>
+              )}
+            </div>
+          )}
+
           <p className="text-xs text-[rgb(var(--muted))]">{t('cloneModal.footerNote')}</p>
 
           {submitError && (

apps/desktop/src/features/servers/ServersPage.tsx

@@ -112,6 +112,70 @@ function resolveCloneSource(
   return current;
 }
 
+/**
+ * Resolve the parent server row used to infer expected HTTP header keys for a clone.
+ */
+function getCloneHeaderParent(
+  server: ServerViewModelWithClone,
+  allServers: ServerViewModelWithClone[]
+): ServerViewModelWithClone | undefined {
+  if (!server.cloned_from) {
+    return undefined;
+  }
+
+  return (
+    allServers.find((candidate) => candidate.id === server.cloned_from) ??
+    resolveCloneSource(server, allServers)
+  );
+}
+
+/**
+ * Header keys a clone is expected to override based on its parent and HTTP definition.
+ */
+function getExpectedCloneHeaderKeys(
+  server: ServerViewModelWithClone,
+  allServers: ServerViewModelWithClone[]
+): string[] {
+  if (!server.cloned_from || server.transport.type !== 'http') {
+    return [];
+  }
+
+  const keys = new Set<string>();
+
+  const parent = getCloneHeaderParent(server, allServers);
+  if (parent?.extra_headers) {
+    for (const key of Object.keys(parent.extra_headers)) {
+      if (key.trim()) {
+        keys.add(key);
+      }
+    }
+  }
+
+  const inputs = server.transport.metadata?.inputs ?? [];
+  const requiredInputIds = new Set(
+    inputs.filter((input) => input.required).map((input) => input.id)
+  );
+  for (const [headerKey, headerValue] of Object.entries(server.transport.headers ?? {})) {
+    const match = headerValue.match(/\$\{input:([^}]+)\}/);
+    if (match && requiredInputIds.has(match[1])) {
+      keys.add(headerKey);
+    }
+  }
+
+  return [...keys];
+}
+
+/**
+ * Returns true when a clone is missing expected HTTP header overrides.
+ */
+function hasCloneMissingAuthHeaders(
+  server: ServerViewModelWithClone,
+  allServers: ServerViewModelWithClone[]
+): boolean {
+  const cloneHeaders = server.extra_headers ?? {};
+  return getExpectedCloneHeaderKeys(server, allServers).some((key) => !cloneHeaders[key]?.trim());
+}
+
 // Helper to merge definitions with states (same as registryStore)
 function mergeDefinitionsWithStates(
   definitions: ServerDefinition[],
@@ -389,6 +453,18 @@ export function ServersPage() {
     setTimeout(() => setToast(null), 5000);
   }, []);
 
+  /**
+   * Show a non-blocking toast when a clone is missing expected HTTP header overrides.
+   */
+  const warnCloneMissingAuthHeaders = useCallback(
+    (server: ServerViewModel) => {
+      if (hasCloneMissingAuthHeaders(server, installedServers)) {
+        showToast(t('cloneAuthWarning.connectToast'), 'warning');
+      }
+    },
+    [installedServers, showToast, t]
+  );
+
   const loadData = useCallback(async () => {
     try {
       setIsLoading(true);
@@ -850,6 +926,8 @@ export function ServersPage() {
       return;
     }
 
+    warnCloneMissingAuthHeaders(server);
+
     setActionLoading(`enable-${server.id}`);
     // Optimistically mark as enabled so runtime status events (Connecting/Error)
     // are reflected in the UI immediately instead of showing stale "Enable" button
@@ -1216,6 +1294,7 @@ export function ServersPage() {
 
   // Retry connection - uses new ServerManager v2
   const handleRetry = async (server: ServerViewModel) => {
+    warnCloneMissingAuthHeaders(server);
     setActionLoading(`retry-${server.id}`);
     try {
       await retryConnectionV2(server.id);
@@ -1441,6 +1520,7 @@ export function ServersPage() {
   // Refresh server - Quick reconnect with EXISTING credentials
   // If succeeds → connected, if fails → shows Connect button
   const handleRefresh = async (server: ServerViewModel) => {
+    warnCloneMissingAuthHeaders(server);
     setActionLoading(`refresh-${server.id}`);
     try {
       await retryConnectionV2(server.id);
@@ -1455,6 +1535,7 @@ export function ServersPage() {
   // Reconnect server - Logout + auto-start OAuth (for OAuth servers)
   // For non-OAuth servers, just does a fresh connection
   const handleReconnect = async (server: ServerViewModel) => {
+    warnCloneMissingAuthHeaders(server);
     setActionLoading(`reconnect-${server.id}`);
     try {
       // OAuth is detected at runtime - check if server has oauth_connected or auth type
@@ -1795,6 +1876,15 @@ export function ServersPage() {
                             </button>
                           </div>
                         )}
+
+                        {hasCloneMissingAuthHeaders(server, installedServers) && (
+                          <div
+                            className="mt-2 px-3 py-2 rounded-lg text-xs bg-[rgb(var(--warning))]/10 text-[rgb(var(--warning))]"
+                            data-testid={`clone-auth-warning-${server.id}`}
+                          >
+                            {t('cloneAuthWarning.banner')}
+                          </div>
+                        )}
                       </div>
                     </div>
 

apps/desktop/src/locales/en/servers.json

@@ -165,10 +165,17 @@
     "serverId": "Server ID",
     "toolPrefix": "Tool prefix",
     "checkingAvailability": "Checking availability…",
-    "footerNote": "The clone copies the server definition but not credentials. You will configure this account before enabling it.",
+    "headersPreviewTitle": "HTTP headers copied from source",
+    "headersPreviewDesc": "Header names from the source account are copied into the new clone. Update their values in Configure before enabling.",
+    "headersPreviewEmpty": "No custom HTTP headers on the source account.",
+    "footerNote": "The clone copies the server definition and HTTP header overrides from the source. Swap account-specific header values in Configure before enabling.",
     "creating": "Creating…",
     "createAccount": "Create account"
   },
+  "cloneAuthWarning": {
+    "banner": "This clone may be using the wrong credentials — review its headers in Configure.",
+    "connectToast": "This clone is missing HTTP headers from its source — review Configure before connecting."
+  },
   "uninstallClones": {
     "title": "Uninstall server with account clones?",
     "description_one": "{{sourceName}} has {{count}} account clone in this space: {{dependentList}}.",