anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

tui: require explicit confirmation when starting external server on non-loopback without OPENCODE_SERVER_PASSWORD #7829

New Issue
Open
opened 2026-02-16 18:08:23 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:08:23 -05:00
Owner
Copy Link
Copy Source

Originally created by @MaxMiksa on GitHub (Jan 28, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

The TUI entrypoint (opencode / tui thread) can start an external HTTP server when network options are configured (e.g. --hostname, --port, --mdns, or global config). This uses a worker RPC call to server.listen(...).

If OPENCODE_SERVER_PASSWORD is unset, this server runs unauthenticated. Unlike serve and web, the TUI path currently has no guardrail for the insecure + non-loopback case.

Suggested fix

Apply the same guardrail as serve/web:

  • If hostname is non-loopback and OPENCODE_SERVER_PASSWORD is unset:
    • On TTY: prompt for confirmation (default No).
    • On non-TTY: refuse to start unless --yes is provided.

Steps to reproduce

  1. Ensure OPENCODE_SERVER_PASSWORD is unset.
  2. Start TUI with external server enabled, e.g. opencode --hostname 0.0.0.0 (or configure global server.mdns=true).
  3. Observe the HTTP server starts unauthenticated.

Environment

  • OS: Windows 11
  • Terminal: Windows Terminal
Originally created by @MaxMiksa on GitHub (Jan 28, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description The TUI entrypoint (`opencode` / `tui thread`) can start an external HTTP server when network options are configured (e.g. `--hostname`, `--port`, `--mdns`, or global config). This uses a worker RPC call to `server.listen(...)`. If `OPENCODE_SERVER_PASSWORD` is unset, this server runs unauthenticated. Unlike `serve` and `web`, the TUI path currently has no guardrail for the insecure + non-loopback case. ### Suggested fix Apply the same guardrail as `serve`/`web`: - If hostname is non-loopback and `OPENCODE_SERVER_PASSWORD` is unset: - On TTY: prompt for confirmation (default No). - On non-TTY: refuse to start unless `--yes` is provided. ### Steps to reproduce 1. Ensure `OPENCODE_SERVER_PASSWORD` is unset. 2. Start TUI with external server enabled, e.g. `opencode --hostname 0.0.0.0` (or configure global `server.mdns=true`). 3. Observe the HTTP server starts unauthenticated. ### Environment - OS: Windows 11 - Terminal: Windows Terminal
yindo added the opentui label 2026-02-16 18:08:23 -05:00
yindo commented 2026-02-16 18:08:23 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 28, 2026):

This issue is part of a series of related security improvements. Related issues applying similar guardrails to other entry points:

  • #10948: serve: require explicit confirmation when binding non-loopback without OPENCODE_SERVER_PASSWORD
  • #10958: web: require explicit confirmation when binding non-loopback without OPENCODE_SERVER_PASSWORD

These are related enhancements rather than duplicates, as they address the same security concern across different entry points (TUI, serve, and web).

@github-actions[bot] commented on GitHub (Jan 28, 2026): This issue is part of a series of related security improvements. Related issues applying similar guardrails to other entry points: - #10948: serve: require explicit confirmation when binding non-loopback without OPENCODE_SERVER_PASSWORD - #10958: web: require explicit confirmation when binding non-loopback without OPENCODE_SERVER_PASSWORD These are related enhancements rather than duplicates, as they address the same security concern across different entry points (TUI, serve, and web).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label opentui
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7829
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?