Repository navigation
Conversation
opencode2 serve unconditionally resolved the daemon-managed password and served with mandatory HTTP basic auth (generating a fresh password per start when OPENCODE_SERVER_PASSWORD was unset), contradicting the documented behavior where setting OPENCODE_SERVER_PASSWORD opts in to protection. It also made deployments that are already gated at the edge (e.g. Cloudflare Access) pay for a rotating credential they never asked for. Serve unsecured with a warning when no password is configured, matching packages/opencode serve; keep daemon (--register) flows on the daemon credential so managed clients keep working. Signed-off-by: cd-slash <[email protected]>
github-actions
Bot
added
the
needs:compliance
Contributor
|
This PR doesn't fully meet our contributing guidelines and PR template. What needs to be fixed:
Please edit this PR description to address the above within 2 hours, or it will be automatically closed. If you believe this was flagged incorrectly, please let a maintainer know. |
Contributor
|
Thanks for your contribution! This PR doesn't have a linked issue. All PRs must reference an existing issue. Please:
See CONTRIBUTING.md for details. |
Contributor
|
This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window. Feel free to open a new pull request that follows our guidelines. |
github-actions
Bot
removed
the
needs:compliance
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
opencode2 serveunconditionally resolved the daemon-managed password and served with mandatory HTTP basic auth — generating and printing a fresh password per start whenOPENCODE_SERVER_PASSWORDwas unset. This contradicts the documented behavior (both V1 and V2 docs describeOPENCODE_SERVER_PASSWORDas opt-in: "Set OPENCODE_SERVER_PASSWORD to protect the server with HTTP basic auth"), and it breaks headless deployments that are already gated at the edge (e.g. Cloudflare Access in front of a tunnel), which get a rotating credential they never asked for.Repro (beta 18684)
Change
packages/cliserve handler: pass the password tocreateRoutesonly whenOPENCODE_SERVER_PASSWORDis set; otherwise serve unsecured with the same warning thatpackages/opencodeserve prints. Daemon (--register) flows keep the daemon-managed credential, so managed clients (TUI/desktop) are unaffected.ServerAuth.required()and the authorization middleware already treat a missing password as "no auth", andcreateRoutes(password?: string)already accepted an optional password — so this only removes the forced resolution in the CLI handler.Test
packages/cli(linux-x64) and verified: no env → warning + unauthenticated200 /api/health;OPENCODE_SERVER_PASSWORD=secret123→401unauthenticated,200withBasic opencode:secret123.httpapi-authorization.test.ts: "allows requests when server password is not configured`).