Remote MCP OAuth tokens never refreshed; restart loses auth state (IBKR connector)

Remote MCP OAuth tokens never refreshed; restart loses auth state

What happens

• A remote MCP server (IBKR mcp-public, OAuth via browser flow) works right after activation, then starts failing minutes later with 401 after successful authentication on every endpoint — snapshots, search, everything.
• Restarting opencode flips the server back to needs_auth on its own.
• Re-authenticating does not reliably revive the running session.

Evidence from my machine (Windows, global opencode.jsonc, type: remote, no custom headers)

• ~/.local/share/opencode/mcp-auth.json holds the entry with dynamically registered clientInfo, serverUrl, and a tokens object containing accessToken, refreshToken, expiresAt, scope. So both tokens persist — the refresh just never fires.
• Stored access-token lifetimes are on the order of tens of minutes, so any session longer than that hits this wall.
• Same IBKR sessions stay alive fine when driven from other MCP clients, so this is the client's refresh handling, not the authorization server.

Expected

• Silent refresh_token grant before expiry; running session picks up the rotated token without re-auth or restart.

Related (same symptom family)

• #34582 — refresh token present but never used, manual re-auth required after expiry
• #21702 — running session keeps stale token after re-auth; only restart helps
• #16893 — restart loses OAuth state, no automatic re-auth flow

Happy to pull redacted mcp debug output if useful — token values stay with me.

Start by tracing remote MCP OAuth handling from the persisted entry in ~/.local/share/opencode/mcp-auth.json through token expiry and the running session. Done means an access token is refreshed before expiry, rotated credentials are used by active endpoints, and restarting opencode preserves authentication without manual re-authentication.