fix(app): skip url password setting for same-origin server and web app by OpeOginni · Pull Request #19923 · anomalyco/opencode

OpeOginni · 2026-03-29T17:38:33Z

Issue for this PR

Closes #19920

Type of change

Bug fix
New feature
Refactor / code improvement
Documentation

What does this PR do?

This PR adds a check to know if the origin of the server and that of the opencode web client is equal. If it is it does not override the already authenticated url instance, since the browser will give the native username and password auth prompt.

How did you verify your code works?

Built and locally served the app’s production bundle, pointed opencode serve at that local app instance, then verified the web client could connect to and use the same opencode serve URL.

Screenshots / recordings

Screen.Recording.2026-03-29.at.18.05.41.mov

Checklist

I have tested my changes locally
I have not included unrelated changes in this PR

github-actions · 2026-03-29T17:39:17Z

The following comment was made by an LLM, it may be inaccurate:

Based on my search, I found one potentially related PR:

PR #17970: fix(app): don't override browser basic auth on terminal WebSocket

This PR appears to address a similar issue - preventing override of browser basic authentication. It's related to the same problem space (handling authentication credentials in the web app), though it specifically focuses on terminal WebSocket whereas PR #19923 addresses same-origin server detection.

The other results (PRs #9095, #12000, #18091, #18674, #15866) are less directly related as they address different authentication or connectivity concerns.

onixau-go · 2026-03-30T12:00:36Z

opencode version 1.3.7
opencode web ui - version 1.3.6
Browser access.
If you don't specify authorization, the terminal works.
If you specify OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD or
connect through an nginx reverse proxy with basic auth, the error remains the same.
Incorrectly adding opencode@ to the WSS connection when starting the terminal.
wss://opencode@ssl-domain.com/pty/pty_d3 ...

onixau-go · 2026-03-31T09:47:45Z

linux opencode version 1.3.9
opencode web ui - version 1.3.8
Browser access - still a bug, still not fixed.

onixau-go · 2026-03-31T18:48:33Z

Solving the problem of accessing the terminal via the web UI in a browser - without editing the source code.

Close all projects.
Click on the server on the main page.
Select the edit server menu (three dots).
Enter the username and password with basic authentication. Save.

After this, the WSS URL will be generated using the specified username and password.

However, in general, using the "opencode" login with an empty password as the default is absolutely wrong.
This results in the user simply not being able to use the terminal if the login and password are specified via the OPENCODE_SERVER_ variables.

* fix: bump openrouter ai sdk pkg to fix openrouter issues (anomalyco#21242) * chore: update nix node_modules hashes * chore: remove ai-sdk/provider-utils patch and update pkg (anomalyco#21245) * chore: update nix node_modules hashes * chore: bump anthropic ai sdk pkg, delete patch (anomalyco#21247) * refactor(core): add full http proxy and change workspace adaptor interface (anomalyco#21239) * go: add mimo * feat: add --dangerously-skip-permissions flag to opencode run (anomalyco#21266) * chore: update nix node_modules hashes * feat(opencode): Add PDF attachment Drag and Drop (anomalyco#16926) Co-authored-by: Aiden Cline <63023139+rekram1-node@users.noreply.github.com> Co-authored-by: Aiden Cline <aidenpcline@gmail.com> * feat(app): show full names on composer attachment chips (anomalyco#21306) * style(app): redesign jump-to-bottom button per figma spec (anomalyco#21313) * Move auto-accept permissions to settings (anomalyco#21308) * go: support coupon * fix(opencode): keep user message variants scoped to model (anomalyco#21332) * chore: generate * chore: update web stats * feat(app): better subagent experience (anomalyco#20708) * refactor(core): support multiple event streams in worker and remove workspaces from plugin api (anomalyco#21348) * fix(tui): use sentence case for theme mode command palette items (anomalyco#21192) Co-authored-by: Aiden Cline <63023139+rekram1-node@users.noreply.github.com> * fix: ensure the alibaba provider errors are retried (anomalyco#21355) * fix(opencode): improve console login transport errors (anomalyco#21350) * chore: generate * feat(tui): allow variant_list keybind for the "Switch model variant" command (anomalyco#21185) Co-authored-by: Aiden Cline <63023139+rekram1-node@users.noreply.github.com> * test: disable GPG signing in test fixtures (anomalyco#20386) * fix(opencode): clear webfetch timeouts on failed fetches (anomalyco#21378) * feat(opencode): add OTLP observability support (anomalyco#21387) * zen: glm5.1 doc * zen: glm5.1 doc * go: glm5.1 * core: refactor tool system to remove agent context from initialization (anomalyco#21052) * refactor(snapshot): store unified patches in file diffs (anomalyco#21244) Co-authored-by: Adam <2363879+adamdotdevin@users.noreply.github.com> * chore: generate * release: v1.4.0 * chore: update nix node_modules hashes * fix(tui): simplify console org display (anomalyco#21339) Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com> * ui: fix sticky session diffs header (anomalyco#21486) * test: update webfetch test (anomalyco#21398) Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com> * fix: ensure that /providers list and shell endpoints are correctly typed in sdk and openapi schema (anomalyco#21543) * fix(app): patch tool diff rendering * fix(app): diff list normalization * fix: dont show invalid variants for BP (anomalyco#21555) * tweak: separate ModelsDev.Model and Config model schemas (anomalyco#21561) * refactor(effect): build task tool from agent services (anomalyco#21017) * fix(app): skip url password setting for same-origin server and web app (anomalyco#19923) * fix: propagate abort signal to inline read tool (anomalyco#21584) * refactor(effect): inline session processor interrupt cleanup (anomalyco#21593) * feat(llm): integrate GitLab DWS tool approval with permission system (anomalyco#19955) Co-authored-by: Aiden Cline <63023139+rekram1-node@users.noreply.github.com> * chore: update nix node_modules hashes * fix(lsp): remove CMakeLists.txt and Makefile from clangd root markers (anomalyco#21466) * Remove CLI from electron app (anomalyco#17803) Co-authored-by: LukeParkerDev <10430890+Hona@users.noreply.github.com> * chore: generate * chore: update nix node_modules hashes * feat: add opencode go upsell modal when limits are hit (anomalyco#21583) Co-authored-by: Frank <frank@anoma.ly> * release: v1.4.1 * app: remove min loading duration (anomalyco#21655) * fix: preserve interrupted bash output in tool results (anomalyco#21598) * fix: preserve text part timing in session processor (anomalyco#21691) * refactor(effect): drop shell abort signals from runner (anomalyco#21599) * refactor: fix tool call state handling and clean up imports (anomalyco#21709) * release: v1.4.2 * feat(mcp): add OAuth redirect URI configuration for MCP servers (anomalyco#21385) Co-authored-by: Aiden Cline <63023139+rekram1-node@users.noreply.github.com> * chore: generate * fix(tui): restore hidden session scrollbar default (anomalyco#20947) * feat: add support for fast modes for claude and gpt models (that support it) (anomalyco#21706) * opencode: lazy-load top-level CLI commands The CLI imports every top-level command before argument parsing has decided which handler will run. This makes simple invocations pay for the full command graph up front and slows down the default startup path. Parse the root argv first and load only the command module that matches the selected top-level command. Keep falling back to the default TUI path for non-command positionals, and preserve root help, version and completion handling * delete unused withALS method (anomalyco#21723) * Revert "opencode: lazy-load top-level CLI commands" (anomalyco#21726) * fix(effect): suspend agent default layer construction (anomalyco#21732) --------- Co-authored-by: Aiden Cline <63023139+rekram1-node@users.noreply.github.com> Co-authored-by: opencode-agent[bot] <opencode-agent[bot]@users.noreply.github.com> Co-authored-by: James Long <longster@gmail.com> Co-authored-by: Frank <frank@anoma.ly> Co-authored-by: gitpush-gitpaid <149759805+gitpush-gitpaid@users.noreply.github.com> Co-authored-by: Aiden Cline <aidenpcline@gmail.com> Co-authored-by: Shoubhit Dash <shoubhit2005@gmail.com> Co-authored-by: Dax <mail@thdxr.com> Co-authored-by: Adam <2363879+adamdotdevin@users.noreply.github.com> Co-authored-by: Ariane Emory <97994360+ariane-emory@users.noreply.github.com> Co-authored-by: Kit Langton <kit.langton@gmail.com> Co-authored-by: Kyle Altendorf <sda@fstab.net> Co-authored-by: opencode <opencode@sst.dev> Co-authored-by: Brendan Allan <brendonovich@outlook.com> Co-authored-by: OpeOginni <107570612+OpeOginni@users.noreply.github.com> Co-authored-by: Vladimir Glafirov <vglafirov@gitlab.com> Co-authored-by: Cho HyeonJong <mbin96@gmail.com> Co-authored-by: LukeParkerDev <10430890+Hona@users.noreply.github.com> Co-authored-by: Aleksandr Lossenko <aleksandr.lossenko@gmail.com> Co-authored-by: Simon Klee <hello@simonklee.dk>

anomalyco#19923)

fix(app): skip url password setting for same-origin server and web app

8cba824

OpeOginni requested a review from adamdotdevin as a code owner March 29, 2026 17:38

github-actions bot added the contributor label Mar 29, 2026

Merge branch 'dev' into fix/terminal-auth

1d9607b

Brendonovich enabled auto-merge (squash) April 8, 2026 07:21

Brendonovich disabled auto-merge April 8, 2026 23:12

Merge branch 'dev' into fix/terminal-auth

b6481f8

Brendonovich merged commit 51535d8 into anomalyco:dev Apr 8, 2026
7 of 8 checks passed

OpeOginni mentioned this pull request Apr 9, 2026

Remove CLI from electron app #17803

Merged

5 tasks

timrichardson pushed a commit to timrichardson/opencode that referenced this pull request Apr 9, 2026

fix(app): skip url password setting for same-origin server and web app (

b1515dd

anomalyco#19923)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(app): skip url password setting for same-origin server and web app#19923

fix(app): skip url password setting for same-origin server and web app#19923
Brendonovich merged 3 commits intoanomalyco:devfrom
OpeOginni:fix/terminal-auth

OpeOginni commented Mar 29, 2026

Uh oh!

github-actions bot commented Mar 29, 2026

Uh oh!

onixau-go commented Mar 30, 2026 •

edited

Loading

Uh oh!

onixau-go commented Mar 31, 2026 •

edited

Loading

Uh oh!

onixau-go commented Mar 31, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

OpeOginni commented Mar 29, 2026

Issue for this PR

Type of change

What does this PR do?

How did you verify your code works?

Screenshots / recordings

Checklist

Uh oh!

github-actions bot commented Mar 29, 2026

Uh oh!

onixau-go commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

onixau-go commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

onixau-go commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

onixau-go commented Mar 30, 2026 •

edited

Loading

onixau-go commented Mar 31, 2026 •

edited

Loading

onixau-go commented Mar 31, 2026 •

edited

Loading