anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

fix: Plugin client returns 401 Unauthorized when OPENCODE_SERVER_PASSWORD is set (Desktop) #6203

New Issue
Open
opened 2026-02-16 18:01:42 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:01:42 -05:00
Owner
Copy Link
Copy Source

Originally created by @jonnyhoo on GitHub (Jan 15, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Bug Description

When running OpenCode via Desktop app, plugins that use client.session.create(), client.session.prompt(), or other HTTP API calls receive 401 Unauthorized errors.

Root Cause

OpenCode Desktop (Tauri) automatically generates a UUID password and sets OPENCODE_SERVER_PASSWORD environment variable when spawning the local server:

packages/desktop/src-tauri/src/lib.rs:416

let password = uuid::Uuid::new_v4().to_string();

packages/desktop/src-tauri/src/lib.rs:159

.env("OPENCODE_SERVER_PASSWORD", password)

This enables the basicAuth middleware in server.ts:

packages/opencode/src/server/server.ts:100-104

const password = Flag.OPENCODE_SERVER_PASSWORD
if (!password) return next()
return basicAuth({ username, password })(c, next)

However, the client created for plugins in plugin/index.ts does not include the corresponding Basic Auth credentials, causing all plugin HTTP requests to fail with 401.

Steps to Reproduce

  1. Install OpenCode Desktop (exe version)
  2. Install a plugin that uses client.session.create() (e.g., @menkan/opencode with sisyphus_task)
  3. Run the plugin tool
  4. Observe 401 Unauthorized error

Proposed Fix

Add Basic Auth headers to the plugin client when OPENCODE_SERVER_PASSWORD is configured:

packages/opencode/src/plugin/index.ts

const authHeaders: Record<string, string> = {}
if (Flag.OPENCODE_SERVER_PASSWORD) {
  const username = Flag.OPENCODE_SERVER_USERNAME ?? "opencode"
  const credentials = Buffer.from(`${username}:${Flag.OPENCODE_SERVER_PASSWORD}`).toString("base64")
  authHeaders["Authorization"] = `Basic ${credentials}`
}

const client = createOpencodeClient({
  baseUrl: "http://localhost:4096",
  fetch: async (...args) => Server.App().fetch(...args),
  headers: Object.keys(authHeaders).length > 0 ? authHeaders : undefined,
})

Workaround

Use CLI version (opencode command) instead of Desktop, as CLI does not set OPENCODE_SERVER_PASSWORD.

Environment

  • OpenCode Desktop on Windows
  • Plugin SDK version: 1.1.21
Originally created by @jonnyhoo on GitHub (Jan 15, 2026). Originally assigned to: @adamdotdevin on GitHub. ## Bug Description When running OpenCode via Desktop app, plugins that use `client.session.create()`, `client.session.prompt()`, or other HTTP API calls receive `401 Unauthorized` errors. ## Root Cause OpenCode Desktop (Tauri) automatically generates a UUID password and sets `OPENCODE_SERVER_PASSWORD` environment variable when spawning the local server: **packages/desktop/src-tauri/src/lib.rs:416** ```rust let password = uuid::Uuid::new_v4().to_string(); ``` **packages/desktop/src-tauri/src/lib.rs:159** ```rust .env("OPENCODE_SERVER_PASSWORD", password) ``` This enables the `basicAuth` middleware in `server.ts`: **packages/opencode/src/server/server.ts:100-104** ```typescript const password = Flag.OPENCODE_SERVER_PASSWORD if (!password) return next() return basicAuth({ username, password })(c, next) ``` However, the client created for plugins in `plugin/index.ts` does **not** include the corresponding Basic Auth credentials, causing all plugin HTTP requests to fail with 401. ## Steps to Reproduce 1. Install OpenCode Desktop (exe version) 2. Install a plugin that uses `client.session.create()` (e.g., @menkan/opencode with sisyphus_task) 3. Run the plugin tool 4. Observe 401 Unauthorized error ## Proposed Fix Add Basic Auth headers to the plugin client when `OPENCODE_SERVER_PASSWORD` is configured: **packages/opencode/src/plugin/index.ts** ```typescript const authHeaders: Record<string, string> = {} if (Flag.OPENCODE_SERVER_PASSWORD) { const username = Flag.OPENCODE_SERVER_USERNAME ?? "opencode" const credentials = Buffer.from(`${username}:${Flag.OPENCODE_SERVER_PASSWORD}`).toString("base64") authHeaders["Authorization"] = `Basic ${credentials}` } const client = createOpencodeClient({ baseUrl: "http://localhost:4096", fetch: async (...args) => Server.App().fetch(...args), headers: Object.keys(authHeaders).length > 0 ? authHeaders : undefined, }) ``` ## Workaround Use CLI version (`opencode` command) instead of Desktop, as CLI does not set `OPENCODE_SERVER_PASSWORD`. ## Environment - OpenCode Desktop on Windows - Plugin SDK version: 1.1.21
yindo added the web label 2026-02-16 18:01:42 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label web
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6203
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?