mcp: v2 ignores v1 mcp-auth.json, servers stuck at needs authentication #55964

Summary

After upgrading from v1 (1.18.x) to v2 (2.0.28), a remote MCP server with OAuth credentials stored in the v1 mcp-auth.json file shows needs authentication in opencode mcp list, even though the stored tokens are valid. V2 appears to never read the v1 flat-file store.

Environment

• opencode version: 2.0.28 (channel latest, release build, local=false); last working version: 1.18.35
• OS: Linux 7.2.5-3-omarchy (linux x64)
• Terminal: TERM=xterm-256color, COLORTERM=truecolor
• Shell: /usr/bin/zsh
• Install/channel: mise (npm:@opencode/cli / aqua:anomalyco/opencode backends observed), release channel latest
• Active plugins: none found in config

Reproduction

1. On v1 (1.18.35), configure a remote MCP server with an oauth block and complete login so ~/.local/share/opencode/mcp-auth.json contains a valid entry:

   { "imanage-work": { "tokens": { "accessToken": "...", "refreshToken": "...", "expiresAt": ..., "scope": "..." }, "clientInfo": { "clientId": "...", "clientSecret": "..." }, "serverUrl": "https://..." } }

2. Verify opencode mcp list shows ✓ imanage-work connected (OAuth) on v1, and that the access token works (direct tools/call against the MCP endpoint succeeds).
3. Upgrade to v2 (2.0.28) with the same config and the same mcp-auth.json in place.
4. Run opencode mcp list.

Expected Behavior

Per the V1 migration guide, supported V1 functionality should keep working in V2. The valid stored OAuth credentials should be honored (or migrated), and the server should show connected.

Actual Behavior

V2 reports ⚠ imanage-work needs authentication. There are zero references to mcp-auth.json in the v2 codebase (verified via code search), while v2's MCP layer stores OAuth state through the Credential service instead (packages/core/src/mcp/index.ts — "the credential lives in the global store"; packages/core/src/mcp/oauth.ts Store abstraction backed by Credential). So v1 credentials are silently orphaned with no migration path and no warning pointing at the new store.

Additional Context

• Consistently reproducible: v1 binary against the same files → connected (OAuth); v2 → needs authentication. Token validity confirmed independently of either CLI.
• Config uses the V1 mcp.<name> shape with camelCase oauth.clientId/clientSecret/scope/redirectUri, which V2 is documented to normalize, so the failure is in credential lookup, not config parsing.
• Workaround: pin to [email protected] (e.g. via mise version = "1.18"), which tracks 1.18.x patches while holding back the v2 breaking change.
• Suggestion: on startup, detect a non-empty v1 mcp-auth.json with no corresponding v2 credential and either import it or emit a warning telling the user to re-run opencode mcp auth <name>.