[BUG]: V2 forwards foreign directory hints to Location lookup without boundary validation #54617

Activity

1. opencode-agent commented on Oct 11, 2026

   

   opencode-agentBot

   on Oct 11, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the detailed report. I reproduced this on v2.0.26 on Linux, and it still happens on the latest dev (47e5e71).

   With opencode serve running, I sent these requests to GET /api/location:

   • location[directory]=C:\Work\Repo in the query
   • location[directory]=\\wsl.localhost\Ubuntu\home in the query
   • x-opencode-directory: C%3A%5CWork%5CRepo as a header

   None of them was rejected as invalid input. Each one was passed to Location lookup and came back as 404 LocationNotFoundError. A request with no hint still returns 200. The script below runs these requests.

   Two notes:

   • On v2 the hint was not resolved against the server's working directory: I still got 404 with a directory literally named C:\Work\Repo in it. So the problem is that a 404 from lookup comes back instead of a 400 naming location[directory] and its source.
   • I only tested /api/location, not the global, debug eviction or PTY connect routes.

   Related: #34255 (the same problem on v1, closed for inactivity), #54615 (your broader v2 path proposal) and your PR #54619.

   Reproduction script (repro.sh)

   #!/usr/bin/env bash
   # Reproduce #54617: foreign (Windows) directory hints reach Location lookup on a POSIX server.
   # Usage: ./repro.sh                    -> uses `opencode` from PATH (e.g. @opencode/[email protected])
   #        OC_DEV=/path/to/checkout ./repro.sh -> runs the CLI from a source checkout
   set -u
   PORT=${PORT:-4599}
   PROJ=$(mktemp -d)
   cd "$PROJ"
   if [ -n "${OC_DEV:-}" ]; then
     bun --conditions=browser --preload="$OC_DEV/packages/tui/node_modules/@opentui/solid/scripts/preload.js" \
       "$OC_DEV/packages/cli/src/index.ts" serve --port "$PORT" > serve.log 2>&1 &
   else
     opencode serve --port "$PORT" > serve.log 2>&1 &
   fi
   SERVER=$!
   trap 'kill $SERVER 2>/dev/null' EXIT
   for _ in $(seq 1 60); do grep -q 'server password' serve.log && break; sleep 1; done
   PASS=$(sed -n 's/^server password //p' serve.log)
   AUTH="opencode:$PASS"
   req() { echo "== $1"; curl -s -o /dev/stdout -w '\nHTTP %{http_code}\n' -u "$AUTH" "${@:2}" "http://127.0.0.1:$PORT$1"; echo; }
   req "/api/location"                                                   # native default: 200
   req "/api/location?location%5Bdirectory%5D=C%3A%5CWork%5CRepo"        # drive path via query
   req "/api/location?location%5Bdirectory%5D=%5C%5Cwsl.localhost%5CUbuntu%5Chome"  # UNC via query
   req "/api/location" -H 'x-opencode-directory: C%3A%5CWork%5CRepo'     # drive path via header
   # Expected: HTTP 400 (invalid location[directory], query/header source) for the foreign hints.
   # Actual:   HTTP 404 LocationNotFoundError -> the foreign hint was passed to Location lookup.

   Run it: bash repro.sh
2. opencode-agent

   added

   reproduced

   on Oct 11, 2026
3. romanilyin commented on Oct 26, 2026

   

   romanilyin

   on Oct 26, 2026

   Author

   More actions

   The fix is now ready for review in #59414 against current dev (b2e4c77621), replacing #54619 after the old v2 base was rejected automatically.

   It covers all five current request-based Location consumers, including the newer MCP client endpoint. Fresh validation on WSL/Bun 1.4.4 passed: 39 tests / 282 assertions, both Bun and TypeScript server checks, and the root check (35/35 tasks). Client generation produced no diff. Native Windows server integration remains unverified.