anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

web: require explicit confirmation when binding non-loopback without OPENCODE_SERVER_PASSWORD #7812

New Issue
Open
opened 2026-02-16 18:08:19 -05:00 by yindo · 2 comments
yindo commented 2026-02-16 18:08:19 -05:00
Owner
Copy Link
Copy Source

Originally created by @MaxMiksa on GitHub (Jan 28, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Description

opencode web starts the API server and prints network-access URLs. If OPENCODE_SERVER_PASSWORD is unset, the server runs unauthenticated (currently only a warning).

When users bind to non-loopback hostnames (e.g. --hostname 0.0.0.0 or --mdns which defaults hostname to 0.0.0.0), this can accidentally expose agent/server capabilities to a LAN/public network.

Suggested fix

  • If hostname is non-loopback and OPENCODE_SERVER_PASSWORD is unset:
    • On TTY: prompt for confirmation (default No) before starting.
    • On non-TTY: refuse to start unless --yes is provided.

Keep loopback behavior unchanged.

Steps to reproduce

  1. Ensure OPENCODE_SERVER_PASSWORD is unset.
  2. Run opencode web --hostname 0.0.0.0 (or opencode web --mdns).
  3. Observe it starts unauthenticated and prints network access addresses.

Environment

  • OS: Windows 11
  • Terminal: Windows Terminal
Originally created by @MaxMiksa on GitHub (Jan 28, 2026). Originally assigned to: @adamdotdevin on GitHub. ### Description `opencode web` starts the API server and prints network-access URLs. If `OPENCODE_SERVER_PASSWORD` is unset, the server runs unauthenticated (currently only a warning). When users bind to non-loopback hostnames (e.g. `--hostname 0.0.0.0` or `--mdns` which defaults hostname to `0.0.0.0`), this can accidentally expose agent/server capabilities to a LAN/public network. ### Suggested fix - If hostname is non-loopback and `OPENCODE_SERVER_PASSWORD` is unset: - On TTY: prompt for confirmation (default No) before starting. - On non-TTY: refuse to start unless `--yes` is provided. Keep loopback behavior unchanged. ### Steps to reproduce 1. Ensure `OPENCODE_SERVER_PASSWORD` is unset. 2. Run `opencode web --hostname 0.0.0.0` (or `opencode web --mdns`). 3. Observe it starts unauthenticated and prints network access addresses. ### Environment - OS: Windows 11 - Terminal: Windows Terminal
yindo added the web label 2026-02-16 18:08:19 -05:00
yindo commented 2026-02-16 18:08:19 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 28, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #10948: serve: require explicit confirmation when binding non-loopback without OPENCODE_SERVER_PASSWORD

This appears to be the same issue but for the opencode serve command, while this one addresses the opencode web command. Both should likely be handled together for consistency.

Feel free to ignore if this is intentionally separate.

@github-actions[bot] commented on GitHub (Jan 28, 2026): This issue might be a duplicate of existing issues. Please check: - #10948: serve: require explicit confirmation when binding non-loopback without OPENCODE_SERVER_PASSWORD This appears to be the same issue but for the `opencode serve` command, while this one addresses the `opencode web` command. Both should likely be handled together for consistency. Feel free to ignore if this is intentionally separate.
yindo commented 2026-02-16 18:08:19 -05:00
Author
Owner
Copy Link
Copy Source

@MaxMiksa commented on GitHub (Jan 28, 2026):

Good catch — it’s the same pattern as #10948, but scoped to a different user entrypoint.

I kept this separate from the serve change intentionally to keep each PR minimal and reduce review/merge risk (one command, one behavior change).

If you’d prefer, I can consolidate the approach later into a shared helper, but this PR just applies the same guardrail to opencode web for consistency (non-loopback + no password => confirm/require --yes).

@MaxMiksa commented on GitHub (Jan 28, 2026): Good catch — it’s the same pattern as #10948, but scoped to a different user entrypoint. I kept this separate from the `serve` change intentionally to keep each PR minimal and reduce review/merge risk (one command, one behavior change). If you’d prefer, I can consolidate the approach later into a shared helper, but this PR just applies the same guardrail to `opencode web` for consistency (non-loopback + no password => confirm/require `--yes`).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label web
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7812
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?