feat(mcp): add OAuth redirect URI configuration for MCP servers

[christso]

Summary

This PR implements custom OAuth redirect URI configuration for MCP servers, allowing users to override the default callback URL to match their OAuth server's requirements.

Changes

• ✅ Added optional redirectUri config parameter to MCP OAuth settings
• ✅ Implemented parseRedirectUri() helper function to extract port and path
• ✅ Dynamic callback server configuration based on custom redirect URI
• ✅ Full test coverage for custom URI parsing and edge cases
• ✅ Backward compatible - defaults to http://127.0.0.1:19876/mcp/oauth/callback when not specified

User Configuration

{
  "mcp": {
    "my-server": {
      "type": "remote",
      "url": "https://api.example.com",
      "oauth": {
        "clientId": "my-client-id",
        "redirectUri": "https://custom.example.com/callback"  // NEW
      }
    }
  }
}

Files Changed

• packages/opencode/src/config/config.ts - Added redirectUri to OAuth config schema
• packages/opencode/src/mcp/oauth-provider.ts - Implement parseRedirectUri() and use configured URI
• packages/opencode/src/mcp/oauth-callback.ts - Dynamic server configuration with port/path parsing
• packages/opencode/src/mcp/index.ts - Pass redirectUri through OAuth flow
• packages/opencode/src/cli/cmd/mcp.ts - Pass redirectUri to OAuth provider in debug command
• packages/opencode/test/mcp/oauth-callback.test.ts - Comprehensive test suite

Testing

• Tests cover default behavior (no redirectUri specified)
• Tests cover custom redirectUri with different ports/paths
• Tests cover server reconfiguration when redirectUri changes
• Tests cover invalid URI handling with fallback to defaults
• All tests passing

Related

Closes #7377 - [FEATURE]: Allow custom OAuth redirect URI configuration for MCP servers

Design Rationale

OpenCode already supports overriding clientId for flexible OAuth client configuration. Since OAuth servers validate both client ID and redirect URI, supporting custom redirectUri is essential for feature completeness. This removes the asymmetry where users could point to any OAuth server/client but were constrained to a hardcoded callback URL.

GitHub OAuth:

Keycloak:

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

No duplicate PRs found

[rekram1-node]

/review

[github-actions]

lgtm

[christso]

@rekram1-node I've basically updated this with the latest dev - there's no other changes.
Anything else you need for approval, or is this just in the queue?

[rekram1-node]

This seems like It caused some regressions. Reverting

[christso]

Root cause: I added a call to McpOAuthCallback.ensureRunning() in the MCP connection flow for servers that don't explicitly set oauth: false. This caused servers without OAuth configuration to fail during connection, appearing as "disabled" in the UI.

Workaround: Adding "oauth": false to MCP server configurations skips the problematic code path.

I will create a new PR with a proper fix that ensures the OAuth callback server startup doesn't break non-OAuth MCP connections.