Description

opencode serve reads its Basic Auth password only from OPENCODE_SERVER_PASSWORD (packages/opencode/src/server/auth.ts:18-19, v1.18.32). There is no flag, config key, file or file descriptor for it (packages/opencode/src/cli/network.ts:6-33).

A process's startup environment stays readable by every same-user process for its whole lifetime: ps eww -p <pid> on macOS, /proc/<pid>/environ on Linux. Deleting the variable from process.env after startup does not change what those show. So any child the server starts (a shell tool command, an MCP server, an LSP server) can run ps eww -p $PPID, read the password, and call the server's API with full access, including answering permission requests. Scrubbing the child's own environment does not help, because the child reads the parent's.

Steps to reproduce

1. OPENCODE_SERVER_PASSWORD=secret opencode serve
2. In a session, run a shell command: ps eww -p $PPID
3. The output contains OPENCODE_SERVER_PASSWORD=secret.

Seen on 1.18.32, macOS.

Proposal

Accept the password through a channel that never enters the exec environment or argv, read once at startup:

• OPENCODE_SERVER_PASSWORD_FILE=<path>: read the file, then use its contents (the path is not secret), or
• --password-fd <n>: read the password from an inherited file descriptor, then close it.

Either lets an embedding app keep the secret out of ps output. Keeping OPENCODE_SERVER_PASSWORD as is would stay compatible.

Related: #52427 (the password also reaches local MCP servers through their own environment).