Skip to content

Cross-Project OIDC Adoption Checklist

S-331 AC-3. Tracks which static-token (DEPTHFUSION_MCP_TOKEN / DEPTHFUSION_API_TOKEN) clients on this host have migrated to OIDC device-code auth (real, capability-bearing identity) vs. which are still on the zero-capability legacy path. See docs/mcp-client-setup.md § Getting capability_denied for the adoption steps themselves.

This is a status tracker, not a migration tool. Nothing here performs the migration automatically — each client adopts OIDC on its own schedule and updates its own row when it does. Out of scope for this doc/story: actually running depthfusion auth login for any of these clients (S-331 is explicit that operator-side migration is out of scope).

Fleet-wide adoption mechanism — ~/bin/cc-auto OIDC wiring (2026-09-23)

The primary adoption path on this host is a one-line override at the top of ~/bin/cc-auto (right after set -euo pipefail):

command -v depthfusion >/dev/null 2>&1 && eval "$(depthfusion auth token 2>/dev/null)" || true

It overrides the static DEPTHFUSION_API_TOKEN/DEPTHFUSION_MCP_TOKEN (inherited from ~/.bashrc/~/.zshrc) with the capability-bearing OIDC token, auto-renewing via the cached refresh token, with a safe fallback to the static token if login lapses. Placement recommended by the agent-ops PM as the fleet-wide chokepoint (covers cc-auto's multiple claude exec points in one spot). The OIDC cache (~/.depthfusion/auth_token.json) is per-OS-user, not per-account slot — verified independent of CLAUDE_CONFIG_DIR — so one depthfusion auth login + this one wiring covers all four cc-auto account slots and every project at once.

Scope boundary (precise): this covers any Claude Code session launched via cc-auto — which is every agent-hub PM/worker session AND Greg's interactive cc-auto 1|2 account-switch launches — NOT "PM/worker sessions only". It does not cover standalone GUI MCP clients (Cursor, Windsurf, Cline, ChatGPT Desktop), which each need their own OIDC config per docs/mcp-client-setup.md. Effective on the next session launch; already-running sessions keep the static token until relaunched.

Client Status Notes
kitabu (cc-auto sessions) ✅ Adopted via cc-auto OIDC wiring (2026-09-23) Surfaced the original capability_denied (2026-09-18). Now covered by the fleet-wide ~/bin/cc-auto OIDC wiring below; effective on session relaunch.
agent-ops (cc-auto sessions) ✅ Adopted via cc-auto OIDC wiring (2026-09-23) Same original report. Covered by the fleet-wide cc-auto wiring below (agent-ops PM recommended this placement); effective on session relaunch.
Cursor ⬜ Not migrated (static token) Standalone GUI client — NOT cc-auto-launched; needs its own OIDC config per docs/mcp-client-setup.md.
Windsurf ⬜ Not migrated (static token) Same as Cursor.
Cline ⬜ Not migrated (static token) Same as Cursor.
ChatGPT Desktop (SSE) ⬜ Not migrated (static token) See docs/chatgpt-mcp-setup.md. NOT cc-auto-launched — needs its own OIDC config.
scripts/mcp-smoke-test.sh (in-repo) ✅ Adopted depthfusion auth token Calls the non-interactive renewal path itself when the CLI is on PATH (S-321 T-1058); falls back to the static token otherwise.

Status legend

  • ✅ Adopted — this client authenticates via OIDC device-code (depthfusion auth login / depthfusion auth token) and holds real capabilities.
  • 🟨 Partial — logged in once but not wired for non-interactive renewal (will fall back to the static token, or fail, once the ID token expires).
  • ⬜ Not migrated — still only using the static token; zero write capability, by design.

Updating this table

When a client's maintainer/operator completes migration for that client:

  1. Change its row's Status to ✅ (or 🟨 if login-only, no renewal wiring yet).
  2. Note the date and what was done in the Notes column.
  3. Commit the change alongside (or immediately after) the client-side config change — this table should never claim a migration that hasn't happened.

Adding a newly-discovered static-token consumer: append a row with status ⬜ rather than leaving it untracked — an unlisted client is exactly the legibility gap this story exists to close.