Repository navigation
fix(console): register legacy MCP OAuth callback - #58453
Conversation
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
The change looks sound: adding http://127.0.0.1/mcp/oauth/callback to the CIMD redirect_uris covers the path released 1.x clients send. Current v2 already uses /callback, so it is unaffected. I checked the route output: the new test fails on the base route and passes with this PR, and typecheck:tsc passes. I could not try a real login against Exa or Typeform.
Public API: the only public surface is the metadata document at /oauth/opencode/client.json. One redirect_uris entry is added and nothing is removed, so it is backwards compatible.
For a few-line change like this, test/client-metadata.test.ts only repeats the constant array, so it can be dropped to keep the change minimal.
There was a problem hiding this comment.
This addresses my earlier point: the test is gone and the change is down to the redirect URI addition. I have no new concerns. At the new head, the route still publishes http://127.0.0.1/mcp/oauth/callback alongside the existing /callback entries.
Public API: one redirect_uris entry is added to /oauth/opencode/client.json and nothing is removed, so it is backwards compatible.
There was a problem hiding this comment.
The new commit only updates the docs. The list in mcp-servers.mdx matches the redirect_uris the route publishes, and I have no new concerns.
Public API: same as before. One redirect_uris entry is added to /oauth/opencode/client.json and nothing is removed, so it is backwards compatible.
Summary
This allows authorization servers to validate callbacks from affected released clients while preserving RFC 8252 ephemeral loopback ports. Current v2 continues using /callback.
Fixes #50510
Fixes #58403
Tests
Added by the opencode bot (AI-generated).
Public API: adds http://127.0.0.1/mcp/oauth/callback to redirect_uris in /oauth/opencode/client.json (backwards compatible)