OPENCODE_SERVER_PASSWORD in env prevents user from working in TUI

[LeonMueller-OneAndOnly]

Description

When setting the OPENCODE_SERVER_PASSWORD variable in the env file, the TUI cannot be used anymore.

This is the cli output:

➜  git:(master) opencode
Unauthorized

➜  git:(master) opencode --hostname 127.0.0.1 --port 4096
^[[?2027;0$y^[[?2031;0$y^[[?1004;2$y^[[?2004;2$y^[[?2026;0$yUnauthorized
^[[?2027;0$y^[[?2031;0$y^[[?1004;2$y^[[?2004;2$y^[[?2026;0$y^[[1;1R%

It would be desirable to be able to start opencode in the tui and also keep the web gui open (for notification sounds, checking in from other devices when networking is set up, personal preferences about using tui and web-gui concurrently, ...)

Plugins

No response

OpenCode version

1.1.16

Steps to reproduce

1. Run OPENCODE_SERVER_PASSWORD='secure-password' opencode

Screenshot and/or share link

No response

Operating System

macOS Sequoia

Terminal

Cursor / VSCode

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• [FEATURE]: Adding Authentication to opencode server api #5256: [FEATURE]: Adding Authentication to opencode server api

Feel free to ignore if none of these address your specific case.

[LeonMueller-OneAndOnly]

This issue is sadly not fixed, could you please reopen the issue?

Setting the env variables for server password still leads to the TUI crashing / not starting:

OPENCODE_SERVER_PASSWORD='test' OPENCODE_SERVER_USERNAME="opencode" bun dev . --hostname localhost --port 4096
$ bun run --cwd packages/opencode --conditions=browser src/index.ts . --hostname localhost --port "4096"
^[[?1016;2$y^[[?2027;0$y^[[?2031;0$y^[[?1004;2$y^[[?2004;2$y^[[?2026;0$y^[[1;1R^[[1;1R^[[4;315;1351t^[[<35;27;8MUnauthorized

OPENCODE_SERVER_PASSWORD='test' bun dev . --hostname localhost --port 4096          
$ bun run --cwd packages/opencode --conditions=browser src/index.ts . --hostname localhost --port "4096"
^[[?2027;0$y^[[?2031;0$y^[[?1004;2$y^[[?2004;2$y^[[?2026;0$y^[[1;1R^[[1;1R^[[4;315;1351tUnauthorized
➜  opencode git:(dev) 2027;0$y2031;0$y1004;2$y2004;2$y2026;0$yRR;315;1351t

Currently not sure why previously thought that this issue was solved. Maybe something changed in the codebase elsewhere in the meantime OR I probably just forgot to provide "--hostname" and "--port" flags when checking - a few version ago opencode changed its behaviour about not starting a server instance that way anymore and therefore doesnt crash.

[alberti42]

I have the same problems. Is there any fix now?

[LeonMueller-OneAndOnly]

I have the same problems. Is there any fix now?

This open PR #9095
fixed the issue.

[R44VC0RP]

Can you provide a repro so I can test it @LeonMueller-OneAndOnly as we have already merged #8179, as well as @alberti42

[alberti42]

This open PR #9095
fixed the issue.

Awesome! I love it. I created an integration of opencode in the zsh prompt for interactive usage

https://github.com/alberti42/Zsh-Opencode-Tab

and I wanted to test access to the server with username and password. It is for me not important, it was more important to provide it for future users of my app, but until it is not merged upstream, I will and test the merged version. Hopefully this will be soon so that things can be chained together.

Thanks a lot for the quick reply!

[alberti42]

Can you provide a repro so I can test it @LeonMueller-OneAndOnly as we have already mer

Sorry.. it was dummy I did not notice your message and that the PR was already merged. I am running the with the dev version compiled today: 0.0.0-dev-fork-202602021439

I start the server with this script

#!/usr/bin/env zsh

source "$HOME/.local/envs/opencode"

export OPENCODE_SERVER_USERNAME="$OPENCODE_SERVER_USERNAME"
export OPENCODE_SERVER_PASSWORD="$OPENCODE_SERVER_PASSWORD"

exec opencode serve --port 4096

like this from my $HOME:

zsh -f opencode_pwd.sh
opencode server listening on http://127.0.0.1:4096

and then I try to attach to the server in a different shell like this:

source .local/envs/opencode
echo "USERNAME: $OPENCODE_SERVER_USERNAME; PW: $OPENCODE_SERVER_PASSWORD"
opencode attach http://localhost:4096 --dir . --log-level DEBUG --print-logs

USERNAME: andrea; PW: 123456
INFO  2026-02-04T18:30:25 +152ms service=default version=0.0.0-dev-fork-202602021439 args=["attach","http://localhost:4096","--dir",".","--log-level","DEBUG","--print-logs"] opencode
Unauthorized

I also tried directly:

OPENCODE_SERVER_USERNAME="andrea" OPENCODE_SERVER_PASSWORD="123456" opencode attach http://localhost:4096 --dir . --log-level DEBUG --print-logs

but same "unauthorized" message.
Do I do anything wrong? Or likely the problem is still upstream?

[alberti42]

Even simpler to reproduce the issue:

# Terminal A: start protected server
export OPENCODE_SERVER_USERNAME=andrea
export OPENCODE_SERVER_PASSWORD=123456
opencode serve --hostname 127.0.0.1 --port 4096

replies:

opencode server listening on http://127.0.0.1:4096

We can test

# Terminal B: prove server auth works
curl -i http://127.0.0.1:4097/global/health
curl -i -u andrea:123456 http://127.0.0.1:4097/global/health

resulting in

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="Secure Area"
content-type: application/octet-stream
Date: Wed, 04 Feb 2026 18:57:00 GMT
Content-Length: 12

UnauthorizedHTTP/1.1 200 OK
Content-Type: application/json
Vary: Origin
Date: Wed, 04 Feb 2026 18:57:00 GMT
Content-Length: 56

{"healthy":true,"version":"0.0.0-dev-fork-202602021439"}

And finally

# Terminal B: attach fails (no auth headers)
export OPENCODE_SERVER_USERNAME=andrea
export OPENCODE_SERVER_PASSWORD=123456
opencode attach http://127.0.0.1:4097 --log-level DEBUG --print-logs
# => Unauthorized

producing the error

# => Unauthorized
INFO  2026-02-04T18:57:51 +152ms service=default version=0.0.0-dev-fork-202602021439 args=["attach","http://127.0.0.1:4098","--log-level","DEBUG","--print-logs"] opencode
Unauthorized

[LeonMueller-OneAndOnly]

Can you provide a repro so I can test it @LeonMueller-OneAndOnly as we have already merged #8179, as well as @alberti42

The merged PR only handled the case when starting opencode + an rpc server. When an http server is started (due to using hostname and/or port) the auth headers are still missing -> we get the Unauthorized error.

Furthermore the new PR also solves the same issue when using the attach command and for plugin clients too.

In the description of the new PR #9095

Test command:

OPENCODE_SERVER_PASSWORD="test" bun dev . --hostname 127.0.0.1 --port 4096

[LeonMueller-OneAndOnly]

To furthermore test that the TUI attach command is solved following test can be done:

Terminal 1 [start server process]:
OPENCODE_SERVER_PASSWORD="test" bun dev serve --hostname 127.0.0.1 --port 4096

Terminal 2 [attach TUI to existing server]:
OPENCODE_SERVER_PASSWORD="test" bun dev attach http://127.0.0.1:4096

In the current dev branch this both yields "Unauthorized". In the branch of the new PR this works as someone would expect by starting the OpenCode client successfully.

[alberti42]

Thanks a lot. The new PR #9095 also says "merged" ... but then I should be already running with this, no? I need to check carefully the structure of opencode repo. I am now running on the latest dev branch.