Repository navigation
Conversation
Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com>
Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com>
Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com>
github-actions
Bot
added
the
needs:compliance
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
opencode serve --no-auth, OPENCODE_AUTH=false and opencode service set auth false work as described. With the PR, serve --no-auth printed no password and /api/info returned 200. Plain serve still printed a password and returned 401. The server and CLI service tests pass (4 and 30), and both packages type-check.
Public API (all additions, backwards compatible because auth stays on by default):
- the
--no-authflag onopencode serve - the
OPENCODE_AUTHenvironment variable (boolean, defaulttrue) - the
authkey in the managed service config, settable withopencode service get/set/unset auth - in the service registration file,
passwordis now omitted when auth is off; clients that read it must treat a missing password as "no auth", whichService.discoveralready does ServerProcess.startin@opencode/serverno longer fails whenpasswordis missing or empty; it now serves without auth instead
Concerns:
- When auth is off and remote access is on, the tunnel is open without a password (see inline).
- Nothing is printed when auth is disabled, even when the server listens on a non-loopback hostname (see inline).
OPENCODE_AUTH=falseis read as a process-wide default, so it also turns off auth for the private stdio servers the TUI starts. Consider limiting it todefaultandservicemodes.
| yield* RetainedImage.retain(global.cache, "service") | ||
| const { start } = yield* Effect.promise(() => import("@opencode/server/process")) | ||
| const environmentPassword = yield* Env.password | ||
| const auth = !options.noAuth && (config.auth ?? (yield* Env.auth)) |
There was a problem hiding this comment.
When auth is false and config.remote is set, the service still starts RemoteTunnel.run (around line 190), so the server becomes reachable from the internet with no password. The only protection left is the route subdomain. The consent text in pair.ts (remoteWarning) also still says "access requires your server password". Please either refuse to start the tunnel when auth is disabled, or refuse service set auth false and pair --remote while the other is on.
There was a problem hiding this comment.
Fixed in 62b62a4. Service startup now fails if remote access is on and authentication is off. A local process check confirmed that it fails before the tunnel starts.
| @@ -204,7 +206,7 @@ const processEffect = Effect.fnUntraced(function* (options: Options) { | |||
| } | |||
| const url = HttpServer.formatAddress(server.address) | |||
| console.log(options.mode === "stdio" ? JSON.stringify({ url }) : `server listening on ${url}`) | |||
There was a problem hiding this comment.
Nothing tells the user that auth is off. Running --no-auth --hostname 0.0.0.0, or a service config with hostname: 0.0.0.0 and auth: false, exposes the server (shell and filesystem tools) to the network without a word. Please log a clear warning when password is undefined, at least when the address is not loopback.
There was a problem hiding this comment.
Fixed in 62b62a4. The server now prints a warning whenever authentication is off. A local process check confirmed the warning and HTTP 200 without credentials. Private stdio servers also keep authentication on when OPENCODE_AUTH=false; verified with HTTP 401.
github-actions
Bot
removed
the
needs:compliance
This branch has not been deployed
2 participants
Issue for this PR
Closes #43039.
Type of change
What does this PR do?
This builds on #43069 to let the service run without authentication.
Add
serve --no-auth,OPENCODE_AUTH=false, andservice set auth false. Save the service setting across restarts. Authentication stays on by default.Keep authentication on for private stdio servers. Reject service startup if remote access is on and authentication is off. Print a warning when authentication is off.
How did you verify your code works?
bun run checkpasses.OPENCODE_AUTH=false.Screenshots / recordings
Not applicable. This change has no UI.
Checklist