MCP forced re-auth appends prompt=select_account for non-Microsoft OAuth providers

[shulkx]

Describe the bug

When an MCP OAuth flow is started with forced re-authentication, Copilot CLI unconditionally appends prompt=select_account to the authorization URL, including for non-Microsoft authorization servers that do not advertise support for this prompt value.

A non-Microsoft OpenID Connect provider rejects this unsupported value with invalid_request. The same authorization request succeeds after removing only &prompt=select_account from the URL.

Affected version

GitHub Copilot CLI 1.0.80

Steps to reproduce the behavior

1. Configure a remote Streamable HTTP MCP server that uses OAuth with a non-Microsoft OpenID Connect authorization server.
2. Complete Dynamic Client Registration and PKCE setup normally.
3. Trigger forced re-authentication through /mcp auth, the MCP server Authenticate action, or the r re-auth shortcut.
4. Inspect the generated authorization URL.
5. Observe that Copilot CLI appends prompt=select_account.
6. Open the URL and observe that the authorization server rejects it with HTTP 400 invalid_request.
7. Remove only &prompt=select_account and reload the URL while the Copilot CLI callback server remains running.
8. Observe that the OAuth request proceeds successfully.

Control result:

• forceReauth=false: no prompt parameter; authorization proceeds.
• forceReauth=true: prompt=select_account; authorization is rejected.

Expected behavior

Copilot CLI should not add prompt=select_account unconditionally for every authorization server.

Possible solutions include:

• Add the parameter only when the authorization server advertises select_account through prompt_values_supported.
• Make the forced re-authentication prompt configurable.
• Use a provider-neutral re-authentication mechanism such as prompt=login when account-selection support is unknown.

Additional context

Environment:

• Windows 11 x64
• PowerShell
• Remote Streamable HTTP MCP server
• OAuth Authorization Code flow with PKCE
• Dynamic Client Registration
• Non-Microsoft OpenID Connect provider

Temporary workaround: copy the generated authorization URL, remove &prompt=select_account, and open the modified URL while the Copilot CLI OAuth callback server is still running.

No credentials, tokens, or private authorization-server URLs are included in this report.