Feat/sys wide auth support

packages/opencode/src/cli/cmd/tui/app.tsx

@@ -131,6 +131,8 @@ export function tui(input: {
                         directory={input.directory}
                         fetch={input.fetch}
                         events={input.events}
+                        username={input.args.username}
+                        password={input.args.password}
                       >
                         <SyncProvider>
                           <ThemeProvider mode={mode}>

packages/opencode/src/cli/cmd/tui/attach.ts

@@ -19,12 +19,23 @@ export const AttachCommand = cmd({
         alias: ["s"],
         type: "string",
         describe: "session id to continue",
+      })
+      .option("username", {
+        alias: ["u"],
+        type: "string",
+        default: "opencode",
+        describe: "username to authenticate with",
+      })
+      .option("password", {
+        alias: ["p"],
+        type: "string",
+        describe: "password to authenticate with",
       }),
   handler: async (args) => {
     if (args.dir) process.chdir(args.dir)
     await tui({
       url: args.url,
-      args: { sessionID: args.session },
+      args: { sessionID: args.session, username: args.username, password: args.password },
       directory: args.dir ? process.cwd() : undefined,
     })
   },

packages/opencode/src/cli/cmd/tui/context/args.tsx

@@ -1,6 +1,8 @@
 import { createSimpleContext } from "./helper"
 
 export interface Args {
+  username?: string
+  password?: string
   model?: string
   agent?: string
   prompt?: string

packages/opencode/src/cli/cmd/tui/context/sdk.tsx

@@ -9,13 +9,18 @@ export type EventSource = {
 
 export const { use: useSDK, provider: SDKProvider } = createSimpleContext({
   name: "SDK",
-  init: (props: { url: string; directory?: string; fetch?: typeof fetch; events?: EventSource }) => {
+  init: (props: { url: string; directory?: string; fetch?: typeof fetch; events?: EventSource, username?: string; password?: string }) => {
     const abort = new AbortController()
     const sdk = createOpencodeClient({
       baseUrl: props.url,
       signal: abort.signal,
       directory: props.directory,
       fetch: props.fetch,
+      headers: props.password && props.username
+        ? {
+            Authorization: `Basic ${Buffer.from(`${props.username}:${props.password}`).toString("base64")}`
+          }
+        : undefined,
     })
 
     const emitter = createGlobalEmitter<{

packages/opencode/src/server/server.ts

@@ -97,7 +97,29 @@ export namespace Server {
             status: 500,
           })
         })
+        .use(
+          cors({
+            origin(input) {
+              if (!input) return
+
+              if (input.startsWith("http://localhost:")) return input
+              if (input.startsWith("http://127.0.0.1:")) return input
+              if (input === "tauri://localhost" || input === "http://tauri.localhost") return input
+
+              // *.opencode.ai (https only, adjust if needed)
+              if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(input)) {
+                return input
+              }
+              if (_corsWhitelist.includes(input)) {
+                return input
+              }
+
+              return
+            },
+          }),
+        )
         .use((c, next) => {
+          if (c.req.path === "/global/health") return next()
           const password = Flag.OPENCODE_SERVER_PASSWORD
           if (!password) return next()
           const username = Flag.OPENCODE_SERVER_USERNAME ?? "opencode"
@@ -120,27 +142,6 @@ export namespace Server {
             timer.stop()
           }
         })
-        .use(
-          cors({
-            origin(input) {
-              if (!input) return
-
-              if (input.startsWith("http://localhost:")) return input
-              if (input.startsWith("http://127.0.0.1:")) return input
-              if (input === "tauri://localhost" || input === "http://tauri.localhost") return input
-
-              // *.opencode.ai (https only, adjust if needed)
-              if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(input)) {
-                return input
-              }
-              if (_corsWhitelist.includes(input)) {
-                return input
-              }
-
-              return
-            },
-          }),
-        )
         .get(
           "/global/health",
           describeRoute({
@@ -159,7 +160,7 @@ export namespace Server {
             },
           }),
           async (c) => {
-            return c.json({ healthy: true, version: Installation.VERSION })
+            return c.json({ healthy: true, version: Installation.VERSION, authenticated: !!Flag.OPENCODE_SERVER_PASSWORD })
           },
         )
         .get(

packages/web/src/content/docs/cli.mdx

@@ -368,6 +368,8 @@ This starts an HTTP server that provides API access to opencode functionality wi
 | `--hostname` | Hostname to listen on                      |
 | `--mdns`     | Enable mDNS discovery                      |
 | `--cors`     | Additional browser origin(s) to allow CORS |
+| `--username  | Username set on server for basic auth      |
+| `--password  | Password set on server for basic auth      |
 
 ---