feat(cli): add no-auth serve option - #43069

AI code review — automated review for reference; please use your judgment.

• Security-sensitive: --no-auth / OPENCODE_AUTH=false removes the previously hard-failed "Missing server password" guard. Default remains authenticated (good), but consider logging a prominent warning line when auth is disabled — especially since --hostname can bind non-localhost, which would expose a fully open server (tools, filesystem) to the network.
• packages/cli/src/server-process.ts:108 — registration info now omits password when unset (...(password ? { password } : {})). Please confirm the infoJson schema marks password optional; if it's required, every consumer decoding the instance file (TUI attach, service discovery) will fail on no-auth servers.
• server-process.ts:65 — auth = !options.noAuth && Env.auth composes flag + env cleanly; env var is documented as explicit opt-out in the comment. Note OPENCODE_AUTH=false silently disables auth for all servers started from that environment, including service mode.
• packages/server/src/process.ts — dropping the missing-password failure aligns with createRoutes(password?) already supporting Option.none(); new process test covers unauthenticated start. No blocking issues found beyond the two confirmations above.

AI code review — automated review for reference; please use your judgment.

• Security consideration: nothing prevents --no-auth --hostname 0.0.0.0, which exposes an unauthenticated opencode server to the network. Since this flag exists precisely for sandboxed/container use, consider either refusing the combination or printing a prominent warning when auth is off and the address isn't loopback.
• packages/cli/src/env.ts:17 — OPENCODE_AUTH=false silently disables auth for every future invocation when set in a shell profile; worth documenting prominently in troubleshooting/security docs since it's an easy footgun to forget about.
• packages/server/src/process.ts:179 — ServerAuth.required(auth) gating both lifecycle control (stop) and app dispatch is consistent; note that with auth disabled anyone who can reach the port can stop the daemon — acceptable given the feature's purpose, but part of the same exposure story as above.
• packages/cli/src/server-process.ts:125 — correctly avoids writing/echoing a password when auth is off, and register omits the field rather than writing null; make sure all info-file consumers tolerate its absence (the schema change suggests yes).
• Test covers unauthenticated /api/health; consider one more asserting the lifecycle endpoint also respects the disabled-auth path.

I run OpenCode2 behind Cloudflare Access, which I have configured to require GitHub login (and we auth using only my email address). OpenCode's password adds a second login to access the same instance. I'd ideally like to not have to type in a password that I can't remember on my phone when actioning something on the opencode web ui. An explicit auth-disable option would help here. It would be ideal if this also supported persisting it for serve --service 👀

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

• The PR was created more than 1 month ago
• The PR had fewer than 2 positive reactions
• Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.

I run OpenCode2 behind Cloudflare Access, which I have configured to require GitHub login (and we auth using only my email address). OpenCode's password adds a second login to access the same instance. I'd ideally like to not have to type in a password that I can't remember on my phone when actioning something on the opencode web ui. An explicit auth-disable option would help here. It would be ideal if this also supported persisting it for serve --service 👀

same I also protect it behind my own oidc SSO, it's far more hassle to access via mobile now

could this be reopened and merged? still valid request as of #43039 and another implementation also closed too #46270

+1 from a real-world deployment that needs exactly this:

• opencode web as systemd --user service on a VPS, bound to localhost only
• Authelia (forward-auth) is the single auth layer at the edge
• v1 ran passwordless this way and worked great
• v2. now auto-generates a password → double auth (Authelia + Basic Auth),
  which makes mobile access impractical

For localhost-bound services behind an auth proxy, upstream Basic auth adds
no security value — just friction. A --no-auth / OPENCODE_AUTH=false
opt-out (default stays on) would fix it.