You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
tui: client polls http://localhost:8000/health every 30s from any project #45172
While any OpenCode TUI client is running, something inside the client sends GET http://localhost:8000/health every 30 seconds to whatever service happens
to be listening on port 8000 on localhost — regardless of working directory or
project. The polling continues indefinitely even though the endpoint returns 404,
is not visible in opencode logs, and cannot be traced to any config, plugin, or
MCP server.
Active plugins: none configured; only MCP server is chrome-devtools (local npx)
Reproduction
Start any local HTTP server on port 8000 that logs requests (in my case a
FastAPI/uvicorn app) with a middleware that logs path + User-Agent.
Start the background service only (opencode2 serve --service equivalent):
no polling occurs.
Kill all opencode processes: polling stops immediately.
Start opencode2 (TUI/client): polling begins within seconds.
Observed server-side log:
11:55:19 /health from 127.0.0.1:58849 UA='opencode2/0.0.0-beta-18269'
INFO: 127.0.0.1:58849 - "GET /health HTTP/1.1" 404 Not Found
11:55:49 /health from 127.0.0.1:58885 UA='opencode2/0.0.0-beta-18269'
INFO: 127.0.0.1:58885 - "GET /health HTTP/1.1" 404 Not Found
Requests arrive exactly ~30s apart, indefinitely, from any directory (tested in
the project dir and in an unrelated neutral directory).
Additional observations:
lsof -i :8000 shows the socket owned by the serve --service process
(i.e., an in-process HTTP client of the server, not a spawned shell/curl).
Nothing appears in ~/.local/share/opencode/log/opencode.log when the
requests fire.
No config file, plugin, MCP config, skill, agent definition, or env var on
the machine references port 8000 or /health.
On one occasion uvicorn reported request.client is None for this request,
which normally doesn't happen for plain TCP connections.
The polled endpoint returns 404 and polling does not back off or stop.
Expected Behavior
If this is intentional dev-server detection/probing, it should be:
documented and logged,
stopped or backed off after repeated non-2xx responses,
restricted to relevant ports/projects, and ideally configurable/disable-able.
If it's not intentional, the client should not send unsolicited requests to
arbitrary local services.
Actual Behavior
Undocumented, unlogged, unstoppable 30s polling of localhost:8000/health
whenever a TUI client is connected, hitting unrelated local services.
Additional Context
Isolation experiments performed:
State
Polling?
Background service only
No
All opencode processes killed
No
Service + TUI client
Yes (~30s interval)
Client started in unrelated directory
Yes
Happy to run further diagnostics on request.
Reacted by legibet, Lewin Kelly, ergou, int_64, Max Stevens, Patrizio Bekerle and Trần Hoàng Hiệp
Thanks for the detailed report and the isolation experiments!
The requests come from OpenCode's built-in vLLM local discovery. By default it checks http://127.0.0.1:8000 every 30 seconds by calling GET /health and then /v1/models, so locally running vLLM models show up automatically. This is intended and listed in the providers docs under Runtimes. But as you found, it keeps probing whatever else is on port 8000, even after repeated 404s, and it never logs the requests.
You can turn it off now by removing the built-in plugin in your config, then restarting the background service:
LM Studio (-opencode.provider.lmstudio, port 1234) and Ollama (-opencode.provider.ollama, port 11434) use the same discovery mechanism and can be removed the same way.
I'm tracking your suggestions as an enhancement: backing off or stopping after non-2xx responses, logging the probes, and a documented setting to turn local runtime discovery on or off. Maintainers will consider it.
Same discovery mechanism, plus one extra facet worth recording: when the probed port is OpenCode's own API, the probe hits itself and then reports its own 401s in its own log.
Setup: opencode serve --port 1234 --hostname 0.0.0.0 (v2.2.7, Linux x64, systemd) protected by OPENCODE_SERVER_PASSWORD (HTTP Basic auth). LM Studio discovery targets http://127.0.0.1:1234, which is exactly the server's own listen address.
Observed:
GET /api/v1/models exactly every 30.000s, unauthenticated → 401 recorded in opencode's own log (11,078 entries over 9 days before I raised the log level).
tcpdump -i lo shows source and destination are the same opencode process (confirmed with ss -tnp: the client socket belongs to the server pid). Headers: Accept: application/json, traceparent, b3, no Authorization, no User-Agent.
The same path with valid Basic auth returns 404: /api/v1/* does not exist in the 2.2.7 openapi.json, so the probe can never succeed against OpenCode itself.
packages/core/src/plugin/provider/lmstudio.ts (origin: "http://127.0.0.1:1234", getJson("/api/v1/models")) and the 30s interval in local.ts match this exactly.
Impact is mostly diagnostic: a permanent unauthenticated 401 loop in the server's own log looks like a broken internal client, and it cost me a long time chasing it while investigating an unrelated "TUI hangs" report.
Two suggestions on top of the ones already raised:
Skip discovery when the target origin resolves to the server's own listen port/address (cheap guard against self-probing).
Treat 401 (auth required) as terminal for that origin rather than retrying every 30s.
Workaround applied here: "plugins": ["-opencode.provider.lmstudio"]. Verified with tcpdump -i lo that /api/v1/models requests dropped to zero over a 70s window (previously 3 per 70s), with api/info still answering in ~1.4ms.
Activity
maxstevens-nl commentedon Sep 22, 2026
They seem to be scanning the localhost for an active vLLM instance. Workaround, turning off the vllm plugin:
opencodejr commentedon Oct 28, 2026
Thanks for the detailed report and the isolation experiments!
The requests come from OpenCode's built-in vLLM local discovery. By default it checks
http://127.0.0.1:8000every 30 seconds by callingGET /healthand then/v1/models, so locally running vLLM models show up automatically. This is intended and listed in the providers docs under Runtimes. But as you found, it keeps probing whatever else is on port 8000, even after repeated 404s, and it never logs the requests.You can turn it off now by removing the built-in plugin in your config, then restarting the background service:
LM Studio (
-opencode.provider.lmstudio, port 1234) and Ollama (-opencode.provider.ollama, port 11434) use the same discovery mechanism and can be removed the same way.I'm tracking your suggestions as an enhancement: backing off or stopping after non-2xx responses, logging the probes, and a documented setting to turn local runtime discovery on or off. Maintainers will consider it.
Related issues:
zumik3-del commentedon Nov 11, 2026
Same discovery mechanism, plus one extra facet worth recording: when the probed port is OpenCode's own API, the probe hits itself and then reports its own 401s in its own log.
Setup:
opencode serve --port 1234 --hostname 0.0.0.0(v2.2.7, Linux x64, systemd) protected byOPENCODE_SERVER_PASSWORD(HTTP Basic auth). LM Studio discovery targetshttp://127.0.0.1:1234, which is exactly the server's own listen address.Observed:
GET /api/v1/modelsexactly every 30.000s, unauthenticated →401recorded in opencode's own log (11,078 entries over 9 days before I raised the log level).tcpdump -i loshows source and destination are the same opencode process (confirmed withss -tnp: the client socket belongs to the server pid). Headers:Accept: application/json,traceparent,b3, noAuthorization, noUser-Agent.404:/api/v1/*does not exist in the 2.2.7openapi.json, so the probe can never succeed against OpenCode itself.packages/core/src/plugin/provider/lmstudio.ts(origin: "http://127.0.0.1:1234",getJson("/api/v1/models")) and the 30s interval inlocal.tsmatch this exactly.Impact is mostly diagnostic: a permanent unauthenticated 401 loop in the server's own log looks like a broken internal client, and it cost me a long time chasing it while investigating an unrelated "TUI hangs" report.
Two suggestions on top of the ones already raised:
401(auth required) as terminal for that origin rather than retrying every 30s.Workaround applied here:
"plugins": ["-opencode.provider.lmstudio"]. Verified withtcpdump -i lothat/api/v1/modelsrequests dropped to zero over a 70s window (previously 3 per 70s), withapi/infostill answering in ~1.4ms.