What Problem This Solves

probeMSTeams marks the MS Teams channel unhealthy (delegatedAuth.ok: false) whenever the cached delegated access token is expired (extensions/msteams/src/probe.ts). But an expired access token is not a broken connection: the delegated-token path (token.ts) refreshes it from the stored refresh token on the next API call. The result is false-positive health failures — alert spam and channel restarts — for a connector that is actually fine. The existing code even labels it "will auto-refresh on next use" while still reporting a failure. (Reported in #106566.)

Why This Change Was Made

loadDelegatedTokens() returns a refreshToken alongside the access-token expiresAt, and getDelegatedAccessToken() already auto-refreshes an expired access token using it. So the probe now treats an expired access token as healthy when a refresh token is stored (ok: !isExpired || canAutoRefresh), matching real runtime behavior. The genuine-failure signal is preserved: an expired token with no refresh token still reports ok: false with a clearer "re-run setup wizard" message, because that state genuinely needs operator re-auth. The probe intentionally does not attempt a network refresh to verify the refresh token server-side — that would change a cheap local health check into an API call; presence is the intended, issue-specified proxy.

User Impact

MS Teams channel health checks stop firing false alarms (and stop triggering needless restarts) for connectors whose access token has simply aged out but can auto-refresh. Operators are still alerted when delegated auth is truly unrecoverable (expired with no refresh token).

Evidence

• extensions/msteams/src/probe.test.ts: the prior test that asserted ok: false for an expired-but-refreshable token is corrected to expect ok: true with no error; a new test covers expired + no refresh token → ok: false with the re-auth message. Full file green (5 passed) via node scripts/run-vitest.mjs extensions/msteams/src/probe.test.ts.
• git diff --check clean; 2 files, +45/−4; no CHANGELOG.md edit.
• Source-reproducible: the false positive is a local health computation over stored token fields; no live MS Teams tenant is required to demonstrate it.

Fixes #106566