Repository navigation
Conversation
github-actions
Bot
added
the
needs:compliance
|
The following comment was made by an LLM, it may be inaccurate: |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
opencode serve --no-auth, OPENCODE_AUTH=false and opencode service set auth false work as described. With the PR, serve --no-auth printed no password and /api/info returned 200. Plain serve still printed a password and returned 401. The server and CLI service tests pass (4 and 30), and both packages type-check.
Public API (all additions, backwards compatible because auth stays on by default):
- the
--no-authflag onopencode serve - the
OPENCODE_AUTHenvironment variable (boolean, defaulttrue) - the
authkey in the managed service config, settable withopencode service get/set/unset auth - in the service registration file,
passwordis now omitted when auth is off; clients that read it must treat a missing password as "no auth", whichService.discoveralready does ServerProcess.startin@opencode/serverno longer fails whenpasswordis missing or empty; it now serves without auth instead
Concerns:
- When auth is off and remote access is on, the tunnel is open without a password (see inline).
- Nothing is printed when auth is disabled, even when the server listens on a non-loopback hostname (see inline).
OPENCODE_AUTH=falseis read as a process-wide default, so it also turns off auth for the private stdio servers the TUI starts. Consider limiting it todefaultandservicemodes.
| yield* RetainedImage.retain(global.cache, "service") | ||
| const { start } = yield* Effect.promise(() => import("@opencode/server/process")) | ||
| const environmentPassword = yield* Env.password | ||
| const auth = !options.noAuth && (config.auth ?? (yield* Env.auth)) |
There was a problem hiding this comment.
When auth is false and config.remote is set, the service still starts RemoteTunnel.run (around line 190), so the server becomes reachable from the internet with no password. The only protection left is the route subdomain. The consent text in pair.ts (remoteWarning) also still says "access requires your server password". Please either refuse to start the tunnel when auth is disabled, or refuse service set auth false and pair --remote while the other is on.
There was a problem hiding this comment.
Fixed in 62b62a4. Service startup now fails if remote access is on and authentication is off. A local process check confirmed that it fails before the tunnel starts.
| @@ -204,7 +206,7 @@ const processEffect = Effect.fnUntraced(function* (options: Options) { | |||
| } | |||
| const url = HttpServer.formatAddress(server.address) | |||
| console.log(options.mode === "stdio" ? JSON.stringify({ url }) : `server listening on ${url}`) | |||
There was a problem hiding this comment.
Nothing tells the user that auth is off. Running --no-auth --hostname 0.0.0.0, or a service config with hostname: 0.0.0.0 and auth: false, exposes the server (shell and filesystem tools) to the network without a word. Please log a clear warning when password is undefined, at least when the address is not loopback.
There was a problem hiding this comment.
Fixed in 62b62a4. The server now prints a warning whenever authentication is off. A local process check confirmed the warning and HTTP 200 without credentials. Private stdio servers also keep authentication on when OPENCODE_AUTH=false; verified with HTTP 401.
github-actions
Bot
removed
the
needs:compliance
|
Thanks for updating your PR! It now meets our contributing guidelines. 👍 |
Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com>
Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com>
Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com>
62b62a4 to
f3c83f9
Compare
There was a problem hiding this comment.
The new commit addresses both earlier points. A service with remote access on and auth off now refuses to start before the tunnel is created. A warning is printed whenever auth is disabled. Private stdio servers always keep auth. I checked this by running serve --no-auth (warning shown, /api/info returned 200) and serve --service with auth: false and remote set (fails with the new error). The CLI service tests and server process tests pass, and tsc -b is clean in both packages.
The public API is the same as in my previous review: serve --no-auth, OPENCODE_AUTH, the auth service config key, and password left out of the registration file when auth is off. All of it is backwards compatible. OPENCODE_AUTH=false no longer applies to stdio servers.
One new concern: the check runs only at startup, so the conflicting setting can still be saved and then leaves the service unable to start (see inline).
packages/cli/src/server-process.ts:88: This check only runs when the service starts. The conflicting setting can still be saved:opencode pair --remote(viaServiceConfig.set("remote", "true")) whileauthis false, oropencode service set auth falsewhile remote is on. After that, every service start fails, including clients auto-starting it, until the user edits the config, andpair --remoteends with a generic connection or timeout error instead of this message. Please reject the combination where it is written, inServiceConfig.setforauth/remoteand inpair --remote, so the config can never reach a state where the service cannot start. Keep this startup check as a fallback.
Issue for this PR
Closes #43039.
Type of change
What does this PR do?
This builds on #43069 to let the service run without authentication.
Add
serve --no-auth,OPENCODE_AUTH=false, andservice set auth false. Save the service setting across restarts. Authentication stays on by default.Keep authentication on for private stdio servers. Reject service startup if remote access is on and authentication is off. Print a warning when authentication is off.
How did you verify your code works?
bun run checkpasses.OPENCODE_AUTH=false.Screenshots / recordings
Not applicable. This change has no UI.
Checklist
Added by the opencode bot (AI-generated).
Fixes #43039
Related: #49452, #51724
Public API: adds
serve --no-auth, theOPENCODE_AUTHenv var and theauthservice config key; registration omitspasswordwhen auth is off (backwards compatible, auth stays on by default)