MCP forced re-auth appends prompt=select_account for non-Microsoft OAuth providers

Describe the bug

When an MCP OAuth flow is started with forced re-authentication, Copilot CLI unconditionally appends prompt=select_account to the authorization URL, including for non-Microsoft authorization servers that do not advertise support for this prompt value.

A non-Microsoft OpenID Connect provider rejects this unsupported value with invalid_request. The same authorization request succeeds after removing only &prompt=select_account from the URL.

Affected version

GitHub Copilot CLI 1.0.80

Steps to reproduce the behavior

1. Configure a remote Streamable HTTP MCP server that uses OAuth with a non-Microsoft OpenID Connect authorization server.
2. Complete Dynamic Client Registration and PKCE setup normally.
3. Trigger forced re-authentication through /mcp auth, the MCP server Authenticate action, or the r re-auth shortcut.
4. Inspect the generated authorization URL.
5. Observe that Copilot CLI appends prompt=select_account.
6. Open the URL and observe that the authorization server rejects it with HTTP 400 invalid_request.
7. Remove only &prompt=select_account and reload the URL while the Copilot CLI callback server remains running.
8. Observe that the OAuth request proceeds successfully.

Control result:

• forceReauth=false: no prompt parameter; authorization proceeds.
• forceReauth=true: prompt=select_account; authorization is rejected.

Expected behavior

Copilot CLI should not add prompt=select_account unconditionally for every authorization server.

Possible solutions include:

• Add the parameter only when the authorization server advertises select_account through prompt_values_supported.
• Make the forced re-authentication prompt configurable.
• Use a provider-neutral re-authentication mechanism such as prompt=login when account-selection support is unknown.

Additional context

Environment:

• Windows 11 x64
• PowerShell
• Remote Streamable HTTP MCP server
• OAuth Authorization Code flow with PKCE
• Dynamic Client Registration
• Non-Microsoft OpenID Connect provider

Temporary workaround: copy the generated authorization URL, remove &prompt=select_account, and open the modified URL while the Copilot CLI OAuth callback server is still running.

No credentials, tokens, or private authorization-server URLs are included in this report.

Bắt đầu từ việc tạo URL ủy quyền OAuth được truy cập thông qua /mcp auth, hành động Authenticate của máy chủ MCP và phím tắt xác thực lại r; theo dõi cách forceReauth thêm prompt=select_account. Kiểm tra metadata prompt_values_supported được máy chủ ủy quyền công bố và xác minh rằng việc xác thực lại bắt buộc không còn gửi prompt không được hỗ trợ đến các nhà cung cấp không phải Microsoft, trong khi luồng OAuth vẫn thành công.