feat(tui): add username and password options for basic authentication for TUI attach

packages/opencode/src/cli/cmd/tui/app.tsx

@@ -131,6 +131,8 @@ export function tui(input: {
                         directory={input.directory}
                         fetch={input.fetch}
                         events={input.events}
+                        username={input.args.username}
+                        password={input.args.password}
                       >
                         <SyncProvider>
                           <ThemeProvider mode={mode}>

packages/opencode/src/cli/cmd/tui/attach.ts

@@ -1,3 +1,4 @@
+import { Flag } from "@/flag/flag"
 import { cmd } from "../cmd"
 import { tui } from "./app"
 
@@ -19,12 +20,25 @@ export const AttachCommand = cmd({
         alias: ["s"],
         type: "string",
         describe: "session id to continue",
+      })
+      .option("username", {
+        alias: ["u"],
+        default: "opencode",
+        type: "string",
+        describe: "username to use",
+      })
+      .option("password", {
+        alias: ["p"],
+        type: "string",
+        describe: "password to use",
       }),
   handler: async (args) => {
     if (args.dir) process.chdir(args.dir)
+    const username = args.username ?? Flag.OPENCODE_SERVER_USERNAME ?? "opencode"
+    const password = args.password ?? Flag.OPENCODE_SERVER_PASSWORD
     await tui({
       url: args.url,
-      args: { sessionID: args.session },
+      args: { sessionID: args.session, username, password },
       directory: args.dir ? process.cwd() : undefined,
     })
   },

packages/opencode/src/cli/cmd/tui/context/args.tsx

@@ -1,6 +1,8 @@
 import { createSimpleContext } from "./helper"
 
 export interface Args {
+  username?: string
+  password?: string
   model?: string
   agent?: string
   prompt?: string

packages/opencode/src/cli/cmd/tui/context/sdk.tsx

@@ -9,13 +9,16 @@ export type EventSource = {
 
 export const { use: useSDK, provider: SDKProvider } = createSimpleContext({
   name: "SDK",
-  init: (props: { url: string; directory?: string; fetch?: typeof fetch; events?: EventSource }) => {
+  init: (props: { url: string; directory?: string; fetch?: typeof fetch; events?: EventSource; username?: string; password?: string }) => {
     const abort = new AbortController()
     const sdk = createOpencodeClient({
       baseUrl: props.url,
       signal: abort.signal,
       directory: props.directory,
       fetch: props.fetch,
+      headers: props.username && props.password ? {
+        Authorization: `Basic ${btoa(`${props.username}:${props.password}`)}`,
+      } : undefined,
     })
 
     const emitter = createGlobalEmitter<{

packages/opencode/src/server/server.ts

@@ -97,6 +97,27 @@ export namespace Server {
             status: 500,
           })
         })
+        .use(
+          cors({
+            origin(input) {
+              if (!input) return
+
+              if (input.startsWith("http://localhost:")) return input
+              if (input.startsWith("http://127.0.0.1:")) return input
+              if (input === "tauri://localhost" || input === "http://tauri.localhost") return input
+
+              // *.opencode.ai (https only, adjust if needed)
+              if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(input)) {
+                return input
+              }
+              if (_corsWhitelist.includes(input)) {
+                return input
+              }
+
+              return
+            },
+          }),
+        )
         .use((c, next) => {
           const password = Flag.OPENCODE_SERVER_PASSWORD
           if (!password) return next()
@@ -120,27 +141,6 @@ export namespace Server {
             timer.stop()
           }
         })
-        .use(
-          cors({
-            origin(input) {
-              if (!input) return
-
-              if (input.startsWith("http://localhost:")) return input
-              if (input.startsWith("http://127.0.0.1:")) return input
-              if (input === "tauri://localhost" || input === "http://tauri.localhost") return input
-
-              // *.opencode.ai (https only, adjust if needed)
-              if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(input)) {
-                return input
-              }
-              if (_corsWhitelist.includes(input)) {
-                return input
-              }
-
-              return
-            },
-          }),
-        )
         .get(
           "/global/health",
           describeRoute({

packages/web/src/content/docs/cli.mdx

@@ -77,10 +77,12 @@ opencode attach http://10.20.30.40:4096
 
 #### Flags
 
-| Flag        | Short | Description                       |
-| ----------- | ----- | --------------------------------- |
-| `--dir`     |       | Working directory to start TUI in |
-| `--session` | `-s`  | Session ID to continue            |
+| Flag        | Short | Description                           |
+| ----------- | ----- | ------------------------------------- |
+| `--dir`     |       | Working directory to start TUI in     |
+| `--session` | `-s`  | Session ID to continue                |
+| `--username | `-u`  | Username set on server for basic auth |
+| `--password | `-p`  | Password set on server for basic auth |
 
 ---