anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #8213] Add token-based authentication for server mode #12660

New Issue
Closed
opened 2026-02-16 18:17:33 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:17:33 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/8213

State: closed
Merged: No

What does this PR do?

Introduction of token-based authentication for server mode + always-on auth security rule and opencode auth CLI utility.

Authentication is enabled by default for server mode and uses 128-bit tokens.

  • Persistent tokens (created and managed via CLI, stored in ~/.config/opencode/auth-tokens.json

  • Explicit permissions (read, write, execute), optional expiry (default: 90 days, or never)

  • Tokens can be created via CLI: opencode auth token {create,list,delete} for managing persistent server tokens, with optional name, permissions, and expiry.

  • Tokens default to full permissions, 90-day expiry, and are only shown once at creation.

  • Permissions are inferred from the request:

  • GET, HEAD → read

  • POST, PUT, PATCH, DELETE → write

  • Interactive endpoints (/pty, /session, /message) additionally require execute

  • Requests with missing permissions return 403

How did you verify your code works?

All tests pass; authentication was verified via updated server tests and manual server/TUI validation.

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/8213 **State:** closed **Merged:** No --- ### What does this PR do? Introduction of token-based authentication for server mode + always-on auth security rule and opencode auth CLI utility. Authentication is enabled by default for server mode and uses 128-bit tokens. - Persistent tokens (created and managed via CLI, stored in ~/.config/opencode/auth-tokens.json - Explicit permissions (`read`, `write`, `execute`), optional expiry (default: 90 days, or `never`) - Tokens can be created via CLI: `opencode auth token {create,list,delete}` for managing persistent server tokens, with optional name, permissions, and expiry. - Tokens default to full permissions, 90-day expiry, and are only shown once at creation. - Permissions are inferred from the request: - `GET`, `HEAD` → `read` - `POST`, `PUT`, `PATCH`, `DELETE` → `write` - Interactive endpoints (`/pty`, `/session`, `/message`) additionally require `execute` - Requests with missing permissions return `403` ### How did you verify your code works? All tests pass; authentication was verified via updated server tests and manual server/TUI validation.
yindo added the pull-request label 2026-02-16 18:17:33 -05:00
yindo closed this issue 2026-02-16 18:17:33 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#12660
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?