MCP OAuth callback fails on Windows: callback server binds IPv6 but redirect URI uses 127.0.0.1 #31824

Bug description

On Windows, opencode mcp auth <server> can fail after successful OAuth approval because the local callback server listens on IPv6, while the redirect URI uses IPv4.

Observed behaviour:

• browser opens normally
• OAuth approval succeeds in Keycloak / identity provider
• browser is redirected to http://127.0.0.1:19876/mcp/oauth/callback?...
• OpenCode reports authentication failure / OAuth completion failure

Root cause

packages/opencode/src/mcp/oauth-callback.ts starts the callback server with:

server!.listen(currentPort, () => {
  resolve()
})

On Windows/Bun, this binds the callback server to :: / IPv6.

But the redirect URI generated by packages/opencode/src/mcp/oauth-provider.ts is:

http://127.0.0.1:19876/mcp/oauth/callback

So the browser redirects to IPv4 (127.0.0.1), while the server is listening on IPv6. On affected Windows machines, the IPv4 callback does not reach the IPv6 listener, and OAuth completion fails.

Relevant code

Callback server bind:

• https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/mcp/oauth-callback.ts#L155

Redirect URI generation:

• https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/mcp/oauth-provider.ts

Expected behaviour

After OAuth approval, the callback should be received and the MCP server should become authenticated.

Actual behaviour

Authentication fails even though the browser auth step succeeded.

Reproduction

Environment:

• Windows 10/11
• OpenCode 1.17.3
• MCP remote server with OAuth enabled

Steps:

1. Configure an OAuth-enabled remote MCP server.
2. Run:

   opencode mcp auth <server>

3. Complete login in the browser.
4. Observe callback failure / auth failure.

Suggested fix

Bind the callback server explicitly to IPv4 to match the redirect URI:

server!.listen(currentPort, "127.0.0.1", () => {
  resolve()
})

Alternatively, if IPv6 binding is intended, the redirect URI generation should be made consistent with the bind address.

Extra context

This appears to be the same class of bug reported in another CLI project here:

• OAuth callback fails in devcontainers: server binds to IPv6 (::1) but VS Code port forwarding connects via IPv4 anthropics/claude-code#44844

Workaround

Manual OAuth code exchange works, which suggests the failure is specifically in the local callback listener path rather than the provider configuration or token exchange itself.