Repository navigation
web: require explicit confirmation when binding non-loopback without OPENCODE_SERVER_PASSWORD #10958
Description
Description
opencode web starts the API server and prints network-access URLs. If OPENCODE_SERVER_PASSWORD is unset, the server runs unauthenticated (currently only a warning).
When users bind to non-loopback hostnames (e.g. --hostname 0.0.0.0 or --mdns which defaults hostname to 0.0.0.0), this can accidentally expose agent/server capabilities to a LAN/public network.
Suggested fix
- If hostname is non-loopback and
OPENCODE_SERVER_PASSWORDis unset:- On TTY: prompt for confirmation (default No) before starting.
- On non-TTY: refuse to start unless
--yesis provided.
Keep loopback behavior unchanged.
Steps to reproduce
- Ensure
OPENCODE_SERVER_PASSWORDis unset. - Run
opencode web --hostname 0.0.0.0(oropencode web --mdns). - Observe it starts unauthenticated and prints network access addresses.
Environment
- OS: Windows 11
- Terminal: Windows Terminal
Activity
github-actions commentedon Jan 28, 2026
This issue might be a duplicate of existing issues. Please check:
This appears to be the same issue but for the
opencode servecommand, while this one addresses theopencode webcommand. Both should likely be handled together for consistency.Feel free to ignore if this is intentionally separate.
MaxMiksa commentedon Jan 28, 2026
Good catch — it’s the same pattern as #10948, but scoped to a different user entrypoint.
I kept this separate from the
servechange intentionally to keep each PR minimal and reduce review/merge risk (one command, one behavior change).If you’d prefer, I can consolidate the approach later into a shared helper, but this PR just applies the same guardrail to
opencode webfor consistency (non-loopback + no password => confirm/require--yes).github-actions commentedon Mar 30, 2026
To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.