feat(opencode): CAS OAuth connect, list agents, and select

[Alter-Igor]

Issue for this PR

#8 (extends CAS bridge with OAuth connect + list + select)

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Lets OpenCode OAuth to CAS, list specialised agents, and select one for the project.

1. MCP alterspective-agent uses OAuth (opencode mcp auth alterspective-agent) instead of a static empty Bearer header
2. Tokens read from OpenCode mcp-auth.json (optional CAS_MCP_TOKEN override)
3. Tools: cas_auth_status, cas_select_agent (+ existing cas_safe_*)
4. Slash command /cas for connect → list → select → delegate
5. Preferred agent saved to .opencode/cas-selection.json

Depends on CAS deploy: OAuth discovery currently advertises dead agent.alterspective.io. Companion fix is branch cas-oauth-issuer on alterspective-agent (resolveMcpOauthIssuer). Until deployed, set Azure env MCP_OAUTH_ISSUER=https://agent.alterspective.com.au or OAuth browser flow may fail.

How did you verify your code works?

• bun test test/plugin/cas-bridge/cas-bridge-routing.test.ts: 12 named tests pass (observed)
• Live opencode mcp auth alterspective-agent not completed in this session (blocked on CAS issuer metadata until deploy)

Screenshots / recordings

N/A

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

No user-doc impact: developer/fork integration.

Summary by CodeRabbit

• New Features

  • Added OAuth-based CAS authentication with connection-status guidance.
  • Added the /cas workflow for authentication, browsing available agents, selecting an agent, and optionally delegating tasks.
  • Agent selections are remembered for future delegations.
  • Improved handling of unavailable connections and authorization errors with recovery guidance.

• Documentation

  • Added guidance for OAuth setup, browser authentication, agent selection, and safe CAS usage.

• Tests

  • Expanded coverage for authentication states, agent selection, persistence, validation, and safe output handling.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f5a5a820-8ce0-4f60-b09d-d61d135ac633

📥 Commits

Reviewing files that changed from the base of the PR and between 2625dd3 and d0e42c4.

📒 Files selected for processing (12)

• .opencode/agent/cas-delegate.md
• .opencode/command/cas.md
• .opencode/opencode.jsonc
• .opencode/plugin/cas-bridge-routing.ts
• .opencode/tool/cas-auth-status.ts
• .opencode/tool/cas-bridge-lib.ts
• .opencode/tool/cas-safe-delegate.ts
• .opencode/tool/cas-safe-list-agents.ts
• .opencode/tool/cas-select-agent.ts
• AGENTS.md
• docs/implementation/current/FEAT-CAS-OPENCODE-BRIDGE/oauth-select.md
• packages/opencode/test/plugin/cas-bridge/cas-bridge-routing.test.ts

---

📝 Walkthrough

Walkthrough

The CAS bridge now supports OAuth or environment-token authentication, reports connection state, persists selected agents, and uses the selection during delegation. Routing and command workflows require authentication and agent selection. Documentation and tests describe and validate the updated flow.

Changes

CAS OAuth and agent selection

Layer / File(s)	Summary
OAuth authentication foundation .opencode/opencode.jsonc, .opencode/tool/cas-bridge-lib.ts, .opencode/tool/cas-auth-status.ts, .opencode/tool/cas-safe-list-agents.ts, packages/opencode/test/plugin/cas-bridge/*	The MCP configuration uses OAuth with the cas.access scope. Shared code resolves OAuth or environment credentials and reports authentication state. Authorization failures direct re-authentication through OpenCode MCP.
Agent selection and delegation .opencode/tool/cas-select-agent.ts, .opencode/tool/cas-safe-delegate.ts, packages/opencode/test/plugin/cas-bridge/*	The selection tool validates and stores an agent in the project directory. Delegation accepts an explicit agent ID or uses the stored selection.
Routing and command workflow .opencode/agent/cas-delegate.md, .opencode/command/cas.md, .opencode/plugin/cas-bridge-routing.ts, packages/opencode/test/plugin/cas-bridge/*	CAS routing requires authentication, agent listing, and explicit selection before delegation. The /cas command forwards arguments and applies token and untrusted-output rules.
OAuth usage documentation AGENTS.md, docs/implementation/current/FEAT-CAS-OPENCODE-BRIDGE/oauth-select.md	Documentation describes OAuth setup, token storage, agent selection, available tools, and the /cas command.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

• feat: bridge OpenCode to CAS specialised agents #8 — The PR implements and extends the CAS–OpenCode bridge described by the issue.

Possibly related PRs

• Alter-Igor/opencode#9 — This PR evolves the earlier CAS bridge from token-only access to OAuth authentication and agent selection.

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant CASCommand
  participant cas-auth-status
  participant cas-select-agent
  participant cas-safe-delegate
  participant CASMCP
  User->>CASCommand: Run /cas with task arguments
  CASCommand->>cas-auth-status: Check authentication
  cas-auth-status-->>CASCommand: Return OAuth or token status
  CASCommand->>CASMCP: List available agents
  CASMCP-->>CASCommand: Return agent list
  User->>cas-select-agent: Select agent ID
  cas-select-agent-->>User: Persist selection and confirm
  CASCommand->>cas-safe-delegate: Delegate task with selected agent
  cas-safe-delegate->>CASMCP: Submit task
  CASMCP-->>cas-safe-delegate: Return delegation result

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cas-oauth-select

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

---

_{Comment @coderabbitai help to get the list of available commands.}