Kilo Code adds CIMD and a pre-connect token refresh to opencode's OAuth path

Kind: nuance · Status: current · Last verified: 2026-11-10 · Clients: kilocode · Revisions: 2025-11-25

opencode at 7cde8329 registered OAuth clients by DCR or a configured clientId, with no CIMD. Kilo's McpOAuthProvider adds a clientMetadataUrl getter returning https://kilo.ai/docs/oauth/kilo/client.json. The getter returns nothing when a clientId or clientSecret is configured, or when the redirect URI is not the default http://127.0.0.1:<port>/<callback path>, because the hosted document describes a public client with that callback. SDK 1.32.1 uses the URL as the client_id when the authorization server advertises support for URL-based client ids, and falls back to DCR otherwise. Codex is the other client read here with CIMD, and it also prefers CIMD to DCR.

The refresh covers a server behaviour the SDK does not handle. Some servers reject an expired access token with 403. The SDK retries only a 401 as an auth failure, so an expired token that could be refreshed is reported as needs_auth and the user is sent through sign-in again. Before connecting, Kilo refreshes a stored token that has expired or has less than 30 seconds left. The refresh is bounded by the connect timeout and goes to the authorization server the credentials are bound to, not one rediscovered from the resource URL. It is single-flight per server URL because several directory instances share one credential file and refresh tokens rotate. A fetch wrapper ties any automatic invalidation to the credential that was rejected, so a late failure cannot wipe a newer rotated token.

The patch Kilo applies to SDK 1.32.1 also changes scope selection: it appends offline_access when the authorization server lists it and the client metadata includes the refresh_token grant.

Sources