fix(opencode): preserve valid MCP OAuth state

packages/opencode/src/mcp/auth.ts

@@ -147,11 +147,10 @@ export const layer = Layer.effect(
       return yield* Effect.gen(function* () {
         const data = yield* read()
         const entry = data[mcpName]
-        if (!entry?.oauthState) return false
-        const matches = entry.oauthState === oauthState
+        if (entry?.oauthState !== oauthState) return false
         delete entry.oauthState
         yield* fs.writeJson(filepath, { ...data, [mcpName]: entry }, 0o600).pipe(Effect.orDie)
-        return matches
+        return true
       }).pipe(flock.withLock(lockKey), Effect.orDie)
     })
 

packages/opencode/src/mcp/index.ts

@@ -951,14 +951,16 @@ export const layer = Layer.effect(
       oauthState: string,
     ) {
       yield* requireMcpConfig(mcpName)
-      const transport = pendingOAuthTransports.get(mcpName)
-      if (!transport) return yield* new OAuthError({ message: `No pending OAuth flow for MCP server: ${mcpName}` })
-
       if (!(yield* auth.consumeOAuthState(mcpName, oauthState))) {
-        yield* cleanupAuth(mcpName)
         return yield* new OAuthError({ message: "Invalid or expired OAuth state - potential CSRF attack" })
       }
 
+      const transport = pendingOAuthTransports.get(mcpName)
+      if (!transport) {
+        yield* cleanupAuth(mcpName)
+        return yield* new OAuthError({ message: `No pending OAuth flow for MCP server: ${mcpName}` })
+      }
+
       const result = yield* Effect.tryPromise({
         try: () => transport.finishAuth(authorizationCode).then(() => true as const),
         catch: (error) => {

packages/opencode/src/server/routes/instance/httpapi/groups/mcp.ts

@@ -88,7 +88,7 @@ export const McpApi = HttpApi.make("mcp")
             identifier: "mcp.auth.callback",
             summary: "Complete MCP OAuth",
             description:
-              "Complete OAuth authentication for a Model Context Protocol (MCP) server using the authorization code.",
+              "Complete OAuth authentication for a Model Context Protocol (MCP) server using the authorization code and state returned by the start endpoint.",
           }),
         ),
         HttpApiEndpoint.post("authAuthenticate", McpPaths.authAuthenticate, {