[BUG] v2.0.12: Infinite loading of sessions/models, all API endpoints return 401 Unauthorized with no password set #50369

Description

Describe the bug
After upgrading to opencode v2.0.12, the web UI at http://127.0.0.1:4096 hangs on infinite loading for sessions and models. All API endpoints return HTTP 401 Unauthorized even though OPENCODE_SERVER_PASSWORD is NOT set in the environment. The web UI also does not prompt for a password. Restarting the server multiple times sometimes makes it work temporarily.

To Reproduce

1. Run opencode serve --port 4096 --print-logs --log-level debug
2. Open http://127.0.0.1:4096 in browser
3. Observe infinite Loading spinners for sessions and empty model list
4. Run curl -sS http://127.0.0.1:4096/global/health -> returns HTML with HTTP 401
5. Check auth: echo $OPENCODE_SERVER_PASSWORD -> empty

Expected behavior

• API endpoints should return JSON without requiring auth when OPENCODE_SERVER_PASSWORD is unset
• Sessions and models should load in the UI
• Auth should only be enforced when OPENCODE_SERVER_PASSWORD is explicitly set

Environment

• OS: Linux localhost 6.17.0-PRoot-Distro feat: compact and other improvements #1 SMP PREEMPT_DYNAMIC Fri, 10 Oct 2025 00:00:00 +0000 aarch64 GNU/Linux
• OpenCode version: opencode v2.0.12
• Node: v22.23.2
• Bun: 1.4.2
• Command: opencode serve --port 4096 --print-logs --log-level debug

Diagnostic Output
=== 1. SYSTEM & VERSION ===
Linux localhost 6.17.0-PRoot-Distro #1 SMP PREEMPT_DYNAMIC Fri, 10 Oct 2025 00:00:00 +0000 aarch64 GNU/Linux
Node: v22.23.2
Bun: 1.4.2
OpenCode: opencode v2.0.12

=== 2. PROCESS STATUS ===
aid_u0_+ 17869 1.8 0.3 6477992 37440 pts/0 S<l+ 2023 0:24 opencode serve --port 4096 --print-logs --log-level debug

=== 5. LATEST LOG (last 40 lines) ===
timestamp=2026-09-21T14:01:39.159Z level=INFO run=ce8be381 message="Sent HTTP response" http.span=6 role=server http.method=GET http.url=/global/health http.status=401
timestamp=2026-09-21T14:01:39.283Z level=INFO run=ce8be381 message="Sent HTTP response" http.span=3 role=server http.method=GET http.url=/session http.status=401
timestamp=2026-09-21T14:01:39.520Z level=INFO run=ce8be381 message="Sent HTTP response" http.span=1 role=server http.method=GET http.url=/ http.status=401
timestamp=2026-09-21T13:57:41.475Z level=INFO run=868b1a5a cause="InterruptError: All fibers interrupted without error..." http.span=3332 role=server http.method=GET http.url=/api/event http.status=200

=== 6. API ENDPOINTS TEST (v2 paths) ===
GET /global/health -> HTTP 401 | CT:
HTML/Other (not JSON)
GET /session -> HTTP 401 | CT:
HTML/Other (not JSON)
GET /project -> HTTP 401 | CT:
HTML/Other (not JSON)
GET /config/providers -> HTTP 401 | CT:
HTML/Other (not JSON)

=== 7. AUTH CHECK ===
OPENCODE_SERVER_PASSWORD NOT set in current env

Additional context

• Tried clearing ~/.local/share/opencode and ~/.cache/opencode — no effect
• ps aux shows the process running
• Logs show InterruptError: All fibers interrupted without error at ServerProcess.start — may be related to the infinite loading
• This issue may be related to Desktop: orange dot (server not connected) after 1.18.23 — bundled serve returns 401 Basic Auth #45596 (Desktop: orange dot after 1.18.23 — bundled serve returns 401 Basic Auth) and Regression since v1.4.8: startup can enter a blank/partially empty TUI state before real data is ready #23281 (Regression since v1.4.8: startup can enter a blank/partially empty TUI state)

Plugins

not using

OpenCode version

2.0.12

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

Debian GNU/Linux 13 (trixie) (trixie) aarch64

Terminal

Termux PRoot Distro