From 4feddfa810cee964c4a1433a6b77f272c62a39f2 Mon Sep 17 00:00:00 2001
From: bashrusakh <127580858+bashrusakh@users.noreply.github.com>
Date: Wed, 24 Jun 2026 05:50:14 +1100
Subject: [PATCH] fix(auth): honor OPENCODE_SERVER_USERNAME env var for basic
 auth (#1705)

Fix #1685: the Basic auth header for the OpenCode server was hardcoded
to use the username 'opencode', ignoring OPENCODE_SERVER_USERNAME. Users
who set a custom username got 401 errors because the server expected a
different credential.

Both call sites (web server auth-state-runtime.js and VS Code
extension opencode.ts) now read process.env.OPENCODE_SERVER_USERNAME
with a fallback to 'opencode' to preserve prior behavior.

Co-authored-by: Leonid Skorobogatyy <bash@opencode.itc.local>
---
 packages/vscode/src/opencode.ts                        | 3 ++-
 packages/web/server/lib/opencode/auth-state-runtime.js | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/vscode/src/opencode.ts b/packages/vscode/src/opencode.ts
index edcb47a9..2b8620c1 100644
--- a/packages/vscode/src/opencode.ts
+++ b/packages/vscode/src/opencode.ts
@@ -73,7 +73,8 @@ function generateSecureOpenCodePassword(): string {
 }
 
 function buildOpenCodeAuthHeader(password: string): string {
-  return `Basic ${Buffer.from(`opencode:${password}`, 'utf8').toString('base64')}`;
+  const username = process.env.OPENCODE_SERVER_USERNAME || 'opencode';
+  return `Basic ${Buffer.from(`${username}:${password}`, 'utf8').toString('base64')}`;
 }
 
 function isValidOpenCodePassword(password: string): boolean {
diff --git a/packages/web/server/lib/opencode/auth-state-runtime.js b/packages/web/server/lib/opencode/auth-state-runtime.js
index 9c8ce9fc..c95184fc 100644
--- a/packages/web/server/lib/opencode/auth-state-runtime.js
+++ b/packages/web/server/lib/opencode/auth-state-runtime.js
@@ -51,7 +51,8 @@ export const createOpenCodeAuthStateRuntime = (dependencies) => {
       return {};
     }
 
-    const credentials = Buffer.from(`opencode:${password}`).toString('base64');
+    const username = process.env.OPENCODE_SERVER_USERNAME || 'opencode';
+    const credentials = Buffer.from(`${username}:${password}`).toString('base64');
     return { Authorization: `Basic ${credentials}` };
   };