fix(mcp): port upstream auth status scoping to configured server URL (anomalyco/opencode#33924)
Issue for this PR
Closes #1572
Type of change
- Bug fix
- New feature
- Refactor / code improvement
- Documentation
What does this PR do?
MCP.getAuthStatus looked up stored OAuth tokens by server name only (auth.get(mcpName)). If a remote MCP server's url changed, or a legacy entry had no URL, credentials issued for a different server were reported as authenticated. The status UI then shows the server as signed in while the real connection fails, and the user is never prompted to re-authenticate.
Ported from upstream anomalyco/opencode#33924: read the server config and look the tokens up with auth.getForUrl(mcpName, config.url), the same lookup the connect path already uses. Non-remote or unconfigured servers report not_authenticated. Wrapped in altimate_change markers tagged upstream_fix:.
How did you verify your code works?
New test in test/mcp/oauth-auto-connect.test.ts covers legacy (URL-less) tokens, tokens for an old URL, tokens for the current URL, expired tokens and an unconfigured server. It fails on main and passes on this branch. bun typecheck and bun run script/upstream/analyze.ts --markers --base origin/main --strict are clean.
Cost side effects
None. One extra in-memory config lookup per status call.
Screenshots / recordings
N/A, no UI change.
Checklist
- I have tested my changes locally
- I have not included unrelated changes in this PR
- I checked for cost side effects (model calls, queries or cloud resources that grow with user data) and described them, or wrote "none"
Summary by cubic
Fixes MCP auth status so it only reports credentials stored for the configured server URL, ported from upstream anomalyco/opencode#33924.
Previously getAuthStatus looked up OAuth tokens by server name only, so credentials issued for a different URL were reported as authenticated after a server URL change. The status now reads the server config and uses auth.getForUrl, the same lookup the connect path already uses. Unconfigured or non-remote servers report not_authenticated instead.