Remote MCP OAuth fails against Figma: hardcoded callback path /mcp/oauth/callback rejected by Figma's DCR endpoint #57360

Summary

Connecting to Figma's remote MCP server (https://mcp.figma.com/mcp) via opencode mcp auth <name> fails immediately with an opaque "Authentication failed" (no error detail shown), and opencode mcp debug <name> shows a blank "Connection error:".

Root cause

opencode's remote MCP OAuth flow performs Dynamic Client Registration (RFC 7591) and spins up a local callback listener on a hardcoded path: http://127.0.0.1:19876/mcp/oauth/callback (observed directly in the generated authorization URL for other providers, e.g. Miro).

Figma's DCR endpoint (https://api.figma.com/v1/oauth/mcp/register) rejects any redirect_uri containing a nested path like /mcp/oauth/callback with 400 {"error":"invalid_redirect_uri"}, but accepts simple single-segment paths like /callback.

Repro via curl (bypassing opencode) shows this clearly:

# Rejected (opencode's hardcoded path):
curl -s -X POST https://api.figma.com/v1/oauth/mcp/register \
  -H 'Content-Type: application/json' -H 'User-Agent: Mozilla/5.0' \
  -d '{"client_name":"opencode","redirect_uris":["http://127.0.0.1:19876/mcp/oauth/callback"],"grant_types":["authorization_code"],"response_types":["code"],"token_endpoint_auth_method":"none"}'
# -> {"error":"invalid_redirect_uri"}  (HTTP 400)

# Accepted (simple path, same host/port):
curl -s -X POST https://api.figma.com/v1/oauth/mcp/register \
  -H 'Content-Type: application/json' -H 'User-Agent: Mozilla/5.0' \
  -d '{"client_name":"opencode","redirect_uris":["http://127.0.0.1:19876/callback"],"grant_types":["authorization_code"],"response_types":["code"],"token_endpoint_auth_method":"none"}'
# -> 200 OK with client_id/client_secret issued

Note: a plain curl User-Agent (curl/8.7.1) gets a 403 Forbidden from Figma's edge/WAF regardless of redirect_uri — that's a red herring unrelated to this bug; using a browser-like User-Agent reveals the real 400 invalid_redirect_uri validation error. Since opencode's own HTTP client doesn't send a curl-style UA, it hits the invalid_redirect_uri path directly, which is swallowed into a generic "Authentication failed" with no details surfaced to the user even at --log-level DEBUG.

Impact

opencode cannot complete OAuth against Figma's remote MCP server (https://mcp.figma.com/mcp) at all, despite OpenCode being listed as an officially supported client in Figma's own MCP client compatibility table (https://help.figma.com/hc/en-us/articles/32132100833559). The same hardcoded path presumably also blocks the Figma desktop MCP server, which uses the same OAuth flow.

Suggested fixes

1. Make the local OAuth callback path configurable (or default to a single-segment path like /callback) so DCR registration succeeds against authorization servers with stricter redirect_uri path validation (Figma being one concrete example).
2. Separately: surface the actual HTTP error body from a failed DCR/authorize/token request in opencode mcp auth/opencode mcp debug output instead of a bare "Authentication failed" / blank "Connection error:" — this would have made the root cause discoverable without manual curl reproduction.

Environment

• opencode version: 1.18.32 (confirmed still broken as of checking latest release v1.19.3's changelog — no related fix found)
• OS: macOS (darwin)
• Config: mcp" > "figma-local-app": { "type": "remote", "url": "https://mcp.figma.com/mcp" }