fix(oauth): honor default server grant support

Author: roomote

scripts/check-mcp-oauth-integration.ts

@@ -65,13 +65,10 @@ for (let mask = 0; mask < 1 << advertisedGrantTypes.length; mask++) {
 	checkedCases++
 }
 
-// Repository policy: retain both implemented grants when RFC 8414's optional
-// grant_types_supported metadata is omitted.
+// RFC 8414 defaults omitted grant_types_supported to authorization_code and
+// implicit. Zoo Code implements only authorization_code from that default.
 // https://www.rfc-editor.org/rfc/rfc8414.html#section-2
-// Normative SHOULD: MCP clients that use refresh tokens should include
-// refresh_token in their grant_types client metadata.
-// https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#refresh-tokens
-assert.deepEqual(selectMcpOAuthGrantTypes(), [...MCP_OAUTH_GRANT_TYPES])
+assert.deepEqual(selectMcpOAuthGrantTypes(), [AUTHORIZATION_CODE_GRANT_TYPE])
 assert.deepEqual(
 	selectMcpOAuthGrantTypes([REFRESH_TOKEN_GRANT_TYPE, AUTHORIZATION_CODE_GRANT_TYPE, REFRESH_TOKEN_GRANT_TYPE]),
 	[...MCP_OAUTH_GRANT_TYPES],

src/services/mcp/__tests__/McpOAuthClientProvider.spec.ts

@@ -190,13 +190,29 @@ describe("McpOAuthClientProvider", () => {
 
 			expect(metadata.client_name).toBe("Roo Code")
 			expect(metadata.redirect_uris).toEqual(["http://localhost:0/callback"])
-			expect(metadata.grant_types).toContain("authorization_code")
+			expect(metadata.grant_types).toEqual(["authorization_code", "refresh_token"])
 			expect(metadata.response_types).toContain("code")
 			expect(metadata.token_endpoint_auth_method).toBe("none")
 			expect(metadata).toMatchObject({ application_type: "native" })
 			await provider.close()
 		})
 
+		it("should default to authorization code when server grant metadata is omitted", async () => {
+			mockFetch.mockResolvedValueOnce({
+				ok: true,
+				json: () =>
+					Promise.resolve({
+						issuer: "https://auth.example.com",
+						token_endpoint_auth_methods_supported: ["none"],
+					}),
+			})
+
+			const provider = await McpOAuthClientProvider.create("https://example.com/mcp", createMockSecretStorage())
+
+			expect(provider.clientMetadata.grant_types).toEqual(["authorization_code"])
+			await provider.close()
+		})
+
 		it("should use server name as client_name when provided", async () => {
 			setupCallbackServerMock()
 			const provider = await McpOAuthClientProvider.create(

src/services/mcp/oauthMetadata.ts

@@ -10,11 +10,13 @@ export interface McpOAuthClientMetadata extends OAuthClientMetadata {
 	application_type: "native"
 }
 
+/** Selects the grants Zoo Code implements from authorization-server metadata. */
 export function selectMcpOAuthGrantTypes(supportedGrantTypes?: readonly string[]): McpOAuthGrantType[] {
-	const supported = new Set(supportedGrantTypes ?? MCP_OAUTH_GRANT_TYPES)
+	const supported = new Set(supportedGrantTypes ?? [AUTHORIZATION_CODE_GRANT_TYPE])
 	return MCP_OAUTH_GRANT_TYPES.filter((grantType) => supported.has(grantType))
 }
 
+/** Builds dynamic-registration metadata for Zoo Code's native authorization-code client. */
 export function buildMcpOAuthClientMetadata(options: {
 	clientName: string
 	redirectUrl: string