fix(vscode): Fix workflow save, token persistence, and auth token refresh

[Copilot]

Addresses all review comments from PR #9406. Fixes silent data loss on workflow save, "undefined" literal leaking into Authorization headers, and missing token refresh in the local designer panel.

Core Bugs Fixed

• httpClient.ts — All HTTP methods (get/patch/post/put/delete) used template literals for the Authorization header, producing the literal string "undefined" when no token was set. Changed to this._accessToken ?? ''.
• getAuthorizationToken.ts — Returned "******" when silentAuth was enabled with no cached session. Now throws Error('No access token available.') so callers fail fast instead of sending bad auth headers.
• Both serializers (designer + designer-v2) — parseWorkflowParameterValue catch block returned undefined, silently dropping parameter data. Now returns the raw parameterValue with a contextual console.error log.

New Features

• HttpClient.updateAccessToken(token: string | undefined) — Exposes token mutation so the webview can refresh credentials without recreating the client instance. Documented as not thread-safe (in-flight requests use the old token).
• Token refresh loop (localDesignerPanel.ts) — Added a recursive setTimeout (5-min interval) after initialize to fetch a fresh token and post update_access_token to the webview. Uses recursive setTimeout instead of setInterval to prevent overlapping async fetches. Clears on panel dispose.
• mergeJsonParameters — Now backfills file-only parameter properties into the designer output, preserving metadata the designer doesn't emit.

State Management

• DesignerSlice.ts — Added updateDesignerAccessToken reducer (PayloadAction<string | undefined>) using Immer direct mutation.
• webviewCommunication.tsx — update_access_token handler now dispatches to both workflowSlice (used by workflow services) and designerSlice (triggers useMemo to recreate HttpClient with the fresh token).
• appV2.tsx — Removed unused clearDirtyState parameter from saveWorkflowFromDesigner; dirty state is managed by the extension host via resetDesignerDirtyState after confirmed file write.

Tests

• httpClient.spec.ts — 12 new tests: auth token handling, undefined-token fallback, updateAccessToken preventing stale-token failures (including post-401 retry scenario).
• saveWorkflow.test.ts (new) — 18 tests with vi.mock('fs', ...) at module scope covering definition serialization, concurrent saves, error handling, and code-view JSON parsing.
• getAuthorizationToken.test.ts (new) — 10 tests covering token format, throw behavior on missing token, and node-subscription credentials path.

Commit Type

• feature - New functionality
• fix - Bug fix
• refactor - Code restructuring without behavior change
• perf - Performance improvement
• docs - Documentation update
• test - Test-related changes
• chore - Maintenance/tooling

Risk Level

• Low - Minor changes, limited scope
• Medium - Moderate changes, some user impact
• High - Major changes, significant user/system impact

What & Why

Fixes token expiration causing silent failures on workflow save in the local VS Code designer. When the Azure AD token expired mid-session, HTTP requests sent Authorization: "undefined" and saves silently dropped parameter data. Adds a background token refresh and corrects all auth header construction.

Impact of Change

• Users: Workflow saves no longer fail silently after ~1 hour sessions; token is refreshed in the background.
• Developers: HttpClient now exposes updateAccessToken(); updateDesignerAccessToken action added to designer Redux slice.
• System: Replaces setInterval with recursive setTimeout for token refresh to avoid overlapping async calls.

Test Plan

• Unit tests added/updated
• E2E tests added/updated
• Manual testing completed
• Tested in:

Contributors

Screenshots/Videos