Wire auto-auth self-healing channels into Vault Agent cache handler

[VishalGawade1]

Description

Fixes #31995.

Vault Agent's auto-auth self-healing (introduced in #26307) is not wired up for the cache/proxy listener. In command/proxy.go, after the auth handler is created, the local authInProgress and invalidTokenErrCh variables are reassigned to the auth handler's AuthInProgress / InvalidToken channels before being passed to cache.ProxyHandler. The equivalent reassignment is missing in command/agent.go, so the cache handler ends up sending on an orphaned, unbuffered channel with no reader.

As a result, when vault agent is run with a cache listener and the auto-auth token is revoked, a request made with the revoked token hangs until timeout instead of triggering re-authentication (and each such request leaks a blocked goroutine). This affects both the leaseCache and api_proxy proxier paths, since both receive the same channels.

This PR adds the missing reassignment in command/agent.go, mirroring command/proxy.go, and adds a regression test (TestAgent_ReTriggerAutoAuth_RevokedToken) modeled on the existing TestProxy_ReTriggerAutoAuth_RevokedToken. With the fix the test passes; reverting the fix makes the revoked-token request hang, which the test's timeout guard catches.

@heatherezell — as discussed in the issue, here's the PR. Thanks!

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-ui	Error		Jun 18, 2026 9:31pm

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[hashicorp-cla-app]

All committers have signed the CLA.