[bug] Keep the local OpenCode MCP token valid across service restarts #2397

Automatically submitted on behalf of the user by an AI agent.

Problem

On Windows, Executor's local OpenCode MCP setup can start returning 401 Unauthorized after the background service restarts.

The OpenCode config uses the local endpoint http://127.0.0.1:4312/mcp and reads its bearer credential from ~/.executor/v2/cli/opencode-mcp-token. After a service restart, that file still contained the previous value, while server.json contained a different active password. The file and active password were both 43 characters but did not match. The direct MCP initialize request with the file value returned HTTP 401. Updating the file to the active password made the same request return HTTP 200.

This is an authentication failure, not the stale-port/connection-refused case described in #2176.

Reproduction

1. Connect OpenCode to the local Executor MCP endpoint using the generated opencode-mcp-token file reference.
2. Restart the Executor background service.
3. Run opencode mcp list or send an authenticated initialize request to http://127.0.0.1:4312/mcp.
4. Observe HTTP 401 until the token file is updated to match the active server password.

Expected

The supported local OpenCode connection should remain authenticated after a normal Executor service restart, or Executor should refresh the generated client credential/config as part of startup. Users should not need to manually copy a value from server.json into another file.

Environment

• Windows 11 x64
• Executor 2.0.0-beta.29
• OpenCode 2.0.22
• Local MCP endpoint on port 4312

No credential values are included.