fix(mcp): authenticate() clears only its own OAuth state

A token check around the clear could not stop an older call, waiting on the
auth file lock, from deleting a newer flow's state. `clearOAuthState` now
takes the expected state and compares it inside the lock.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172qrhMa5TQgETASi5hxMqD

Author: ralphstodomingo

packages/opencode/src/mcp/auth.ts

@@ -49,7 +49,9 @@ export interface Interface {
   readonly clearCodeVerifier: (mcpName: string) => Effect.Effect<void>
   readonly updateOAuthState: (mcpName: string, oauthState: string) => Effect.Effect<void>
   readonly getOAuthState: (mcpName: string) => Effect.Effect<string | undefined>
-  readonly clearOAuthState: (mcpName: string) => Effect.Effect<void>
+  // altimate_change start — with `expected`, clears only while the stored state is still that one
+  readonly clearOAuthState: (mcpName: string, expected?: string) => Effect.Effect<void>
+  // altimate_change end
   readonly isTokenExpired: (mcpName: string) => Effect.Effect<boolean | null>
 }
 
@@ -135,7 +137,18 @@ export const layer = Layer.effect(
     const updateCodeVerifier = updateField("codeVerifier", "updateCodeVerifier")
     const updateOAuthState = updateField("oauthState", "updateOAuthState")
     const clearCodeVerifier = clearField("codeVerifier", "clearCodeVerifier")
-    const clearOAuthState = clearField("oauthState", "clearOAuthState")
+    // altimate_change start — compare-and-clear inside the lock: a newer flow for the same server
+    // may have stored its own state while this caller waited for the lock
+    const clearOAuthState = Effect.fn("McpAuth.clearOAuthState")(function* (mcpName: string, expected?: string) {
+      yield* mutate((data) => {
+        const entry = data[mcpName]
+        if (!entry) return undefined
+        if (expected !== undefined && entry.oauthState !== expected) return undefined
+        delete entry.oauthState
+        return { ...data, [mcpName]: entry }
+      })
+    })
+    // altimate_change end
 
     const getOAuthState = Effect.fn("McpAuth.getOAuthState")(function* (mcpName: string) {
       const entry = yield* get(mcpName)

packages/opencode/src/mcp/index.ts

@@ -1437,15 +1437,13 @@ export const layer = Layer.effect(
         }
 
         const s = yield* InstanceState.get(state)
-        // A newer call owns the server, and may own the OAuth state too: close this client,
-        // leave the rest alone. Checked again after the clear, which suspends.
-        const superseded = Effect.fnUntraced(function* () {
+        // Only this call's own OAuth state: a newer flow may have stored its own meanwhile.
+        yield* auth.clearOAuthState(mcpName, result.oauthState)
+        // A newer call owns the server: close this client and leave the server to it.
+        if (!isCurrent(s, mcpName, token)) {
           yield* Effect.tryPromise(() => client.close()).pipe(Effect.ignore)
           return s.status[mcpName] ?? ({ status: "disabled" } satisfies Status)
-        })
-        if (!isCurrent(s, mcpName, token)) return yield* superseded()
-        yield* auth.clearOAuthState(mcpName)
-        if (!isCurrent(s, mcpName, token)) return yield* superseded()
+        }
         return yield* storeClient(s, mcpName, client, listing.tools, listing.meta, mcpConfig.timeout)
         // altimate_change end
       }

packages/opencode/test/mcp/auth.test.ts

@@ -76,3 +76,26 @@ test("serializes concurrent auth file updates across service instances", async (
     }),
   )
 })
+
+// altimate_change start — a flow clears only its own OAuth state, never a newer flow's (codex)
+test("clearOAuthState with an expected state leaves a newer state in place", async () => {
+  const file = authFile()
+
+  await Effect.runPromise(
+    Effect.gen(function* () {
+      const auth = yield* authService(file.layer)
+      yield* auth.updateOAuthState("server", "newer")
+
+      yield* auth.clearOAuthState("server", "older")
+      expect(yield* auth.getOAuthState("server")).toBe("newer")
+
+      yield* auth.clearOAuthState("server", "newer")
+      expect(yield* auth.getOAuthState("server")).toBeUndefined()
+
+      yield* auth.updateOAuthState("server", "any")
+      yield* auth.clearOAuthState("server")
+      expect(yield* auth.getOAuthState("server")).toBeUndefined()
+    }),
+  )
+})
+// altimate_change end