[FEATURE]: trigger MCP authentication from the ACP client #55048

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Summary

When opencode runs as an ACP agent (e.g. Zed), the client cannot authenticate or re-authenticate opencode's native MCP servers. OAuth servers can only be signed in from a terminal (opencode mcp auth <name>) or the TUI (/mcps). With short-lived OAuth sessions this means re-login outside the client on every expiry.

Environment

• opencode: 2.0.27 (release/latest)
• OS: Linux 7.0.0-38-generic (x64)
• Client: Zed (custom agent_servers, opencode acp); TERM=xterm-256color
• Shell: /usr/bin/zsh
• Plugins: local (~/.config/opencode/plugins/: attention.js, knowledge-capture.js, session-branch.js)

Reproduction

1. Add a remote OAuth MCP server to mcp.servers.
2. Open opencode from Zed (ACP). opencode mcp list shows needs authentication; the client offers no way to sign in.
3. Log in once from a terminal, then use the agent until the OAuth session expires — refresh is rejected, the credential is invalidated, MCP calls return 401, and there is still no in-client way to re-authorize.

Expected Behavior

The ACP client can trigger MCP auth/re-auth, similar to provider login over ACP.

Actual Behavior

Only opencode-login (provider auth) is advertised. MCP OAuth servers require a browser flow reachable only outside the client. On invalid_grant opencode invalidates the credential and the client just keeps getting 401s with no actionable prompt.

mcp oauth authorization completed  hasRefreshToken=true  expiresIn=400
mcp oauth request rejected         error=invalid_grant
  message="Refresh session expired by policy. Please re-authorize via OAuth."
mcp oauth credential invalidated   scope=tokens

Additional Context

• Client-forwarded MCP servers (session/new mcpServers) don't use OAuth (headers only), so Zed's context_servers can't substitute for opencode's native OAuth servers.

• Proposed:
  (1) expose servers needing auth via ACP authenticate as terminal methods (args: ["mcp","auth","<name>"]);
  (2) send a session update when re-auth is needed; (3) expose an MCP command via available_commands_update.

• Consistently reproducible; in the reported setup re-auth was needed ~8 min after login.