fix(mcp): port upstream OAuth callback loopback bind (anomalyco/opencode#30022)

DE
1d ago
+36-2

Issue for this PR

Closes #1474

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

Ports upstream https://github.com/anomalyco/opencode/pull/30022.

The MCP OAuth callback server called server.listen(port) with no host, which in Node binds every interface. While an MCP OAuth flow is pending, the callback endpoint (default port 19876) was reachable from other hosts on the network, so they could probe it or race the authorization callback. The redirect URI we register is always http://127.0.0.1:<port>/... and isPortInUse already probes 127.0.0.1, so binding there changes nothing for the legitimate browser redirect.

Change: server.listen(currentPort, OAUTH_CALLBACK_HOST, ...) with OAUTH_CALLBACK_HOST = "127.0.0.1", wrapped in altimate_change ... upstream_fix markers.

How did you verify your code works?

  • New test binds the callback server to IPv4 loopback only: connects on 127.0.0.1 succeeds, ::1 fails.
  • bun test test/mcp/oauth-callback.test.ts: 8 pass, 0 fail.
  • bun run typecheck in packages/opencode: passes.
  • bun run script/upstream/analyze.ts --markers --base origin/main --strict: exit 0. The upstream remote couldn't be fetched in this environment, so it used the pattern-based fallback.
  • bun script/check-tracker-leaks.ts: passes.

Screenshots / recordings

N/A, not a UI change.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

Written by Devin

Summary by cubic

Ports anomalyco/opencode#30022 to bind the MCP OAuth callback server to IPv4 loopback only, so a pending redirect callback is no longer reachable from other network hosts. The registered redirect URI and port-in-use check already use 127.0.0.1, so legitimate browser redirects are unaffected. Closes #1474.

Adds a test verifying the callback server accepts connections on 127.0.0.1 but not on ::1.