fix(cli): read OPENCODE_SERVER_USERNAME in attach command

[kevinWangSheng]

Issue for this PR

Closes #18611

Type of change

• Bug fix

What does this PR do?

opencode attach hardcodes "opencode" as the Basic auth username, ignoring the OPENCODE_SERVER_USERNAME environment variable. This causes silent authentication failure when the server is configured with a custom username.

The fix reads process.env.OPENCODE_SERVER_USERNAME with "opencode" as fallback, matching the existing pattern in run.ts, worker.ts, and plugin/index.ts.

How did you verify your code works?

• Typecheck passes (all packages)
• Pattern is identical to the existing implementation in run.ts:659, worker.ts:154, and plugin/index.ts:65
• Single line change with no runtime behavior difference for default username users

Screenshots / recordings

N/A — 1-line code change

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Found 1 potential duplicate:

• PR fix(attach): read OPENCODE_SERVER_USERNAME instead of hardcoding opencode #18641: "fix(attach): read OPENCODE_SERVER_USERNAME instead of hardcoding opencode"
  • fix(attach): read OPENCODE_SERVER_USERNAME instead of hardcoding opencode #18641
  • This appears to be addressing the exact same issue as the current PR fix(cli): read OPENCODE_SERVER_USERNAME in attach command #18646 — reading the OPENCODE_SERVER_USERNAME environment variable in the attach command instead of hardcoding "opencode".

These PRs are likely duplicates or one may have been created before the other was merged. You should check which one is more recent or if one has already been merged to dev.

[github-actions]

Thanks for updating your PR! It now meets our contributing guidelines. 👍

[atharvau]

Code Review for PR #18646: CLI Username Fix

✅ Overall Assessment: APPROVED

This is a small but important fix that makes authentication more configurable by allowing custom usernames via environment variables.

---

🔍 Changes Summary

File: packages/opencode/src/cli/cmd/tui/attach.ts

• Adds support for OPENCODE_SERVER_USERNAME environment variable
• Falls back to "opencode" as the default username (preserving existing behavior)

---

✅ What's Good

1. Backwards Compatible: Uses "opencode" as fallback, maintaining existing behavior
2. Simple & Clear: Single-purpose change that's easy to understand
3. Consistent: Follows same pattern as OPENCODE_SERVER_PASSWORD
4. Security Conscious: Allows custom usernames without hardcoding

---

🔧 Code Quality

• Clean Implementation: Uses nullish coalescing operator appropriately
• No Side Effects: Change is isolated to authentication logic
• Proper Scoping: Variable is declared in appropriate scope

---

📋 Minor Suggestions (Optional)

Consider adding this to documentation if there's a CLI reference guide, so users know about the environment variable option.

---

🚀 Recommendation: APPROVE

This is a good, focused improvement that adds flexibility without breaking existing functionality. The implementation is clean and follows established patterns.

Rating: ⭐⭐⭐⭐⭐

[atharvau]

Code Review Summary

Overall Assessment: ✅ APPROVE

Simple security improvement for configurable authentication.

✅ Strengths:

• Security Enhancement: Allows custom username via environment variable
• Backward Compatible: Falls back to "opencode" if not specified
• Clean Implementation: Minimal, focused change

🟡 Observations:

• Identical implementation to PR #18641 (duplicate fix?)
• No validation on username format/content
• Environment variable not documented in the change

Security Analysis:

• ✅ No injection vulnerabilities (Base64 encoding used)
• ✅ Secure fallback behavior
• ✅ Standard Basic Auth pattern

Minor Suggestion: Consider adding input validation for if it accepts user input.

Recommendation: Ready to merge

[atharvau]

Code Review Summary

Overall Assessment: ✅ APPROVE

Simple security improvement for configurable authentication.

✅ Strengths:

• Security Enhancement: Allows custom username via environment variable
• Backward Compatible: Falls back to 'opencode' if not specified
• Clean Implementation: Minimal, focused change

🟡 Observations:

• Identical implementation to PR #18641 (duplicate fix?)
• No validation on username format/content
• Environment variable not documented in the change

Security Analysis:

• ✅ No injection vulnerabilities (Base64 encoding used)
• ✅ Secure fallback behavior
• ✅ Standard Basic Auth pattern

Minor Suggestion: Consider adding input validation for username if it accepts user input.

Recommendation: Ready to merge

[sapient-engineer]

Any news on this? Any way to help this along? I am running a server with custom username so having this would be amazing.

Changes look good to me, but if there is more that needs to be done I am happy to help out.