anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #8217] feat(server): Add token-based authentication for server mode #12661

New Issue
Open
opened 2026-02-16 18:17:33 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:17:33 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/8217

State: open
Merged: No

What does this PR do?

Authentication is enabled by default for server mode and uses 128-bit tokens.

  • Persistent tokens created and managed via CLI, stored in ~/.config/opencode/auth-tokens.json
  • Explicit permissions (read, write, execute), optional expiry (default: 90 days, or never)
  • Tokens can be created via CLI: opencode auth token {create,list,delete} with optional name, permissions, and expiry
  • Tokens default to full permissions, 90-day expiry, and are only shown once at creation

Permissions are inferred from the request:

  • GET, HEAD → read
  • POST, PUT, PATCH, DELETE → write
  • Interactive endpoints (/pty, /session, /message) additionally require execute
  • Requests with missing permissions return 403

How did you verify your code works?

All tests pass; authentication was verified via updated server tests and manual server/TUI validation.

**Original Pull Request:** https://github.com/anomalyco/opencode/pull/8217 **State:** open **Merged:** No --- ### What does this PR do? Authentication is enabled by default for server mode and uses 128-bit tokens. - Persistent tokens created and managed via CLI, stored in ~/.config/opencode/auth-tokens.json - Explicit permissions (`read`, `write`, `execute`), optional expiry (default: 90 days, or `never`) - Tokens can be created via CLI: `opencode auth token {create,list,delete}` with optional name, permissions, and expiry - Tokens default to full permissions, 90-day expiry, and are only shown once at creation Permissions are inferred from the request: - `GET`, `HEAD` → `read` - `POST`, `PUT`, `PATCH`, `DELETE` → `write` - Interactive endpoints (`/pty`, `/session`, `/message`) additionally require `execute` - Requests with missing permissions return `403` ### How did you verify your code works? All tests pass; authentication was verified via updated server tests and manual server/TUI validation.
yindo added the pull-request label 2026-02-16 18:17:33 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#12661
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?