feat(provider): add RFC 8628 device-flow OAuth for custom gateways - #34785

Issue for this PR

Closes # (no associated issue — opening as a feature contribution per CONTRIBUTING.md)

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Adds a generic RFC 8628 device-flow OAuth provider type so any custom OpenAI-compatible gateway can expose browser-based SSO with the same UX as built-in providers (xAI, Copilot).

Users declare deviceAuthorizationUrl + tokenUrl under a provider's options block in opencode.json. opencode detects these and auto-registers a device-flow plugin for that provider — no CLI changes, no per-gateway code.

{
  "provider": {
    "my-gateway": {
      "npm": "@ai-sdk/openai-compatible",
      "options": {
        "baseURL": "https://my-gateway.example.com/v1",
        "deviceAuthorizationUrl": "https://my-gateway.example.com/oauth/device_authorization",
        "tokenUrl": "https://my-gateway.example.com/oauth/token"
      }
    }
  }
}

Optional: options.oauthClientId (default "opencode"), options.oauthScope (omitted from POST body when unset).

Implementation:

• New packages/opencode/src/plugin/oauth-device.ts — parameterized factory OAuthDeviceProviderPlugin porting device-code + refresh logic from xai.ts. Proactive refresh with 120s skew, single-flight per provider instance via module-level refreshPromises map, rotated tokens persisted to auth.json via input.client.auth.set.
• packages/opencode/src/plugin/index.ts — internalPlugins() now takes cfg and derives one plugin instance per config entry that has both deviceAuthorizationUrl and tokenUrl.
• packages/core/src/v1/config/provider.ts — four optional fields on options: deviceAuthorizationUrl, tokenUrl, oauthClientId, oauthScope.
• packages/web/src/content/docs/providers.mdx — new "Custom OAuth (device flow)" section.

Requirements on the OAuth server side: standard RFC 8628 endpoints (device_authorization returns device_code/user_code/verification_uri; token endpoint accepts grant_type=urn:ietf:params:oauth:grant-type:device_code, handles authorization_pending/slow_down/access_denied/expired_token, returns access_token + refresh_token). token_type SHOULD be Bearer.

How did you verify your code works?

• cd packages/opencode && bun test test/plugin/oauth-device.test.ts — 24/24 pass. Covers requestDeviceCode (default client_id, custom client_id, scope omission, error surfacing), pollDeviceCodeToken (success, slow_down/authorization_pending backoff, terminal errors, timeout, NaN-interval defense), and loader behavior (non-oauth passthrough, dummy bearer injection, header override, auth-type flip, proactive refresh + persistence, single-flight dedup, cross-instance isolation).
• cd packages/opencode && bun test test/plugin/xai.test.ts — 26/26 pass (regression).
• bun turbo typecheck --force --filter=@opencode-ai/core --filter=@opencode-ai/server — clean.
• End-to-end smoke against an internal LiteLLM gateway exposing RFC 8628 endpoints: opencode auth login completes the browser flow, access token is injected as Authorization: Bearer … on gateway requests, proactive refresh fires before expiry, and chat completions succeed.

Screenshots / recordings

N/A — no UI changes. Login flow reuses the existing device-flow picker.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR