opencode → Microsoft login (AADSTS900144) diagnosis

CLIProxyAPI is not the cause. The popup comes from a loaded opencode plugin.

Root cause

It is not CLIProxyAPI and not the OpenAI oauth in auth.json. By elimination:

Direct curl to :8317 for gemini-3.1-pro-low returns 200. The proxy is clean.
The openai oauth entry decodes to auth.openai.com (ChatGPT Plus, google-oauth2 sub). That is the OpenAI/codex path, nothing Microsoft.
The popup uses login.microsoftonline.com, tenant 86f4caf4-0d6f-4682-9a06-ea57f3e4e76c, client da963901-2375-442b-9e99-14e59f43eda2. Those strings are in zero config/credential files. A value in no config is hardcoded inside a plugin.

Two plugins load in the session log: opencode-cliproxyapi and @aexol/opencode-wizard. opencode-cliproxyapi is a thin OpenAI-compatible passthrough with no Microsoft/Azure code. That leaves @aexol/opencode-wizard firing an Azure AD (Entra) OAuth against Aexol's own tenant. AADSTS900144: missing 'scope' means the wizard builds its /authorize URL without a scope param, a bug in the plugin's auth flow, so it never completes and keeps re-opening the browser.

It only looks Gemini-specific: the wizard triggers on session / build-agent start, and you run those sessions on gemini-3.1-pro-low. The model is a coincidence.

Fix — disable the wizard plugin

The wizard is not in your opencode.jsonc plugin array, so it is registered elsewhere. Find and kill it:

# 1. backup
copy "C:\Users\jkaram\.config\opencode\opencode.jsonc" "C:\Users\jkaram\.config\opencode\opencode.jsonc.bak"

# 2. locate where the wizard is registered
findstr /S /I /M "opencode-wizard aexol" "C:\Users\jkaram\.config\opencode\*" "C:\Users\jkaram\.local\share\opencode\*"
dir "C:\Users\jkaram\.config\opencode\plugin"     & REM auto-loaded plugin files live here
npm ls -g @aexol/opencode-wizard                  & REM or a global npm install

Then remove whichever hit you get:

A file in ...\opencode\plugin\ → delete that .js/.ts file.
A global npm package → npm rm -g @aexol/opencode-wizard
A line in a project opencode.json in the folder you launch from → delete that plugin line.

Restart opencode and run a gemini-3.1-pro-low session. The Microsoft page will not appear.

Credential files

Nothing to edit in auth.json / account.json. The wizard's broken flow never persisted a credential (no Microsoft/aexol entry in either file), which is exactly why it re-prompts. Removing the plugin is the whole fix. Do not touch the openai / google / opencode-go entries.

One caveat

That the tenant/client belongs to Aexol is inference by elimination, not a live lookup. If you want certainty, WebSearch the tenant 86f4caf4-0d6f-4682-9a06-ea57f3e4e76c / client da963901-2375-442b-9e99-14e59f43eda2 to confirm it is Aexol before relying on this.