[PR #10960] fix(opencode): confirm insecure web #13616

Open
opened 2026-02-16 18:18:27 -05:00 by yindo · 0 comments
Owner

Original Pull Request: https://github.com/anomalyco/opencode/pull/10960

State: open
Merged: No


Fixes #10958.

What does this PR do?

  • When binding opencode web to a non-loopback hostname without OPENCODE_SERVER_PASSWORD, require explicit confirmation before starting.
  • Avoids hanging in non-interactive environments by refusing to start unless --yes is provided.

How did you verify your code works?

  • bun test test/cli/web-security.test.ts
  • bun run typecheck
**Original Pull Request:** https://github.com/anomalyco/opencode/pull/10960 **State:** open **Merged:** No --- Fixes #10958. ### What does this PR do? - When binding `opencode web` to a non-loopback hostname without `OPENCODE_SERVER_PASSWORD`, require explicit confirmation before starting. - Avoids hanging in non-interactive environments by refusing to start unless `--yes` is provided. ### How did you verify your code works? - `bun test test/cli/web-security.test.ts` - `bun run typecheck`
yindo added the pull-request label 2026-02-16 18:18:27 -05:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#13616