Activity

1. opencode-agent commented on Oct 23, 2026

   

   opencode-agentBot

   on Oct 23, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed analysis. I could reproduce this on 2.1.3, and it still happens on the latest dev (33726e8).

   I used a local mock OAuth/MCP server that behaves as you describe:

   • the token response has access_token, expires_in and refresh_token, but no scope;
   • a request with an expired token gets 403 with error="insufficient_scope".

   Steps:

   1. Log in with opencode mcp auth gw. This works.
   2. Let the access token expire.
   3. Reconnect with opencode mcp list.

   Result: OpenCode sends the expired token once, gets the 403 and never tries a refresh_token grant. The server ends up as needs authentication; in the interactive flow, this is where the browser opens again. When the only change is that the token response includes scope, the same 403 is followed straight away by a refresh and a successful reconnect. That supports your point that the missing scope is the trigger.

   The script below reproduces both cases (it includes the mock server it starts). Closely related: #49773 (refresh MCP OAuth tokens before they expire).

   Reproduction script (repro.sh)

   #!/usr/bin/env bash
   # Repro for #58319. Usage: ./repro.sh            (opencode from PATH)
   #                         OC_DEV=/path/to/repo ./repro.sh   (run from source)
   # WITH_SCOPE=1 makes the mock token endpoint return `scope` (control case).
   set -u
   D=$(cd "$(dirname "$0")" && pwd)
   PORT=${PORT:-8765}
   if [ -n "${OC_DEV:-}" ]; then
     # BUN_OPTIONS so the background service the CLI spawns also gets the flags
     export BUN_OPTIONS="--conditions=browser --preload=$OC_DEV/packages/tui/node_modules/@opentui/solid/scripts/preload.js"
     oc() { bun "$OC_DEV/packages/cli/src/index.ts" "$@"; }
   else oc() { opencode "$@"; }; fi
   export HOME=$(mktemp -d /tmp/opencode/home.XXXX)
   P=$(mktemp -d /tmp/opencode/proj.XXXX); cd "$P"
   cat > opencode.json <<J
   { "mcp": { "servers": { "gw": { "type": "remote", "url": "http://127.0.0.1:$PORT/mcp", "oauth": { "client_id": "pubclient", "scope": "mcp:tools" } } } } }
   J
   LOG=$P/server.log
   PORT=$PORT bun "$D/server.ts" > "$LOG" 2>&1 & SRV=$!
   sleep 1
   # 1. Log in; play the browser by following the printed authorize URL.
   (sleep 25 | oc mcp auth gw > auth.out 2>&1) &
   for i in $(seq 1 40); do url=$(grep -o "http://127.0.0.1:$PORT/authorize[^ ]*" auth.out 2>/dev/null | head -1); [ -n "$url" ] && break; sleep 0.5; done
   curl -sL "$url" > /dev/null; sleep 3
   echo "--- after login:"; cat "$LOG"
   # 2. Restart the background service so the connection is re-established, wait for token expiry.
   sv=$(grep -o '"pid":[0-9]*' $HOME/.local/state/opencode/service*.json | cut -d: -f2); kill $sv 2>/dev/null
   sleep 7
   # 3. Reconnect with the expired access token (refresh token still valid).
   : > "$LOG.mark"; L0=$(wc -l < "$LOG")
   oc mcp list 2>&1 | tail -3; sleep 1; oc mcp list 2>&1 | tail -3; sleep 2
   echo "--- after token expiry (server log):"; tail -n +$((L0+1)) "$LOG"
   grep -q "grant_type= refresh_token" <(tail -n +$((L0+1)) "$LOG") && echo "RESULT: refresh_token grant used" || echo "RESULT: BUG - no refresh_token grant; refresh token ignored"
   sv=$(grep -o '"pid":[0-9]*' $HOME/.local/state/opencode/service*.json 2>/dev/null | cut -d: -f2); kill $sv $SRV 2>/dev/null

   Run it: bash repro.sh
2. opencode-agent

   added

   reproduced

   on Oct 23, 2026
3. yiaany commented on Oct 23, 2026

   

   yiaany

   on Oct 23, 2026

   More actions

   Hi! I’d like to work on this if no one has picked it up yet.

   I’ll preserve the requested scope when the token response omits it, while keeping an explicitly returned scope authoritative. I’ll also add regression coverage for token refresh without browser re-authentication and for genuine scope expansion still triggering step-up authorization.

   Does that scope sound right?

   👍React with 👍1Reacted by Reed001
4. waytoolongnamae commented on Oct 24, 2026

   

   waytoolongnamae

   on Oct 24, 2026

   Author

   More actions

   @yiaany Hi! Yes your description of the scope sounds right.
5. yiaany commented on Oct 24, 2026

   

   yiaany

   on Oct 24, 2026

   More actions

   Opened #58699 with the fix. It preserves the scope from the actual authorization request when the token response omits it, and keeps that scope across refreshes. Explicitly returned scopes still take precedence. Regression tests cover repeated refreshes after expiry without browser re-authentication, as well as genuine scope expansion still requiring authorization. The MCP tests and local lint/type checks pass. I haven't tested against a live Cognito deployment, so confirmation with your setup would be helpful.
6. yiaany commented on Nov 3, 2026

   

   yiaany

   on Nov 3, 2026

   More actions

   5. @yiaany Hi! Yes your description of the scope sounds right.

   quick bump on it