opencode-webui 2.1.0 → 2.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +5 -2
  2. package/dist/assets/index-CGOluhS1.js +128 -0
  3. package/dist/assets/index-Cn0VQKKh.css +1 -0
  4. package/dist/assets/{report-CczF_91u.js → report-BVuI-XUQ.js} +1 -1
  5. package/dist/index.html +3 -4
  6. package/package.json +1 -1
  7. package/server/auth.ts +63 -13
  8. package/server/index.ts +23 -1
  9. package/skills/webui/SKILL.md +8 -8
  10. package/webui-extensions/README.md +3 -5
  11. package/dist/assets/brother-agent-C1lqxeTh.js +0 -1
  12. package/dist/assets/groq-voice-m-OaABoC.js +0 -1
  13. package/dist/assets/index-Bs1cKqOa.js +0 -129
  14. package/dist/assets/index-D0Y4JI3u.css +0 -1
  15. package/dist/assets/jsx-runtime-B-hcVAMW.js +0 -1
  16. package/dist/assets/rich-render-C-7ieXZz.js +0 -1
package/README.md CHANGED
@@ -33,6 +33,8 @@ Options:
33
33
  | --- | --- | --- |
34
34
  | `WEBUI_PASSWORD` | generated on first boot | Log in with this passphrase. Set it to pin your own instead of the generated one. |
35
35
  | `WEBUI_HOST` | `127.0.0.1` | Bind address. A wildcard (`0.0.0.0` / `::`) is refused without a password. |
36
+ | `WEBUI_ALLOWED_HOSTS` | loopback + bind host | Extra hostnames/IPs accepted (comma-separated, e.g. `192.168.1.5,myserver.lan`). `*` accepts everything — your call, your risk. |
37
+ | `WEBUI_TRUST_PROXY` | unset | Set to `1` when a trusted reverse proxy sits in front, so `X-Forwarded-Host`/`Proto` are honored. Without it those headers are ignored. |
36
38
  | `WEBUI_PROXY_PORT` | `4097` | Port for the UI and `/api/*`. |
37
39
  | `WEBUI_EXTENSION_DIR` | the global + project dirs | Adds a higher-precedence source shadowing both (the sandbox uses this to keep WIP isolated; shipped extensions still load underneath). |
38
40
 
@@ -52,9 +54,10 @@ chmod +x opencode-webui-linux-x64
52
54
  ## Security
53
55
 
54
56
  - One shared passphrase for the whole UI. Generated on first boot if `WEBUI_PASSWORD` is unset, printed once.
55
- - Login sets a signed **HttpOnly `SameSite=Strict`** cookie — `Secure` too when the request arrived over https (`X-Forwarded-Proto`).
56
- - Login is rate-limited per IP with constant-time comparison; `Host`/`Origin` headers are validated.
57
+ - Login sets a signed **HttpOnly `SameSite=Strict`** cookie — `Secure` too when the request arrived over https (`X-Forwarded-Proto`, honored with `WEBUI_TRUST_PROXY=1`).
58
+ - Login is rate-limited per IP with constant-time comparison; `Host`/`Origin` headers are validated against loopback + bind host + `WEBUI_ALLOWED_HOSTS` (`*` opts out — explicit, logged at boot).
57
59
  - Wildcard bind is refused unless a password is set — the refusal names the env var.
60
+ - Remote access in one line: `WEBUI_HOST=<this-machine's-LAN-IP> WEBUI_PASSWORD='<you-pick>' bunx opencode-webui`, then open `http://<that-IP>:4097` on the other device. DHCP may reassign the IP — pin a static one on your router if it annoys you.
58
61
 
59
62
  Behind a reverse proxy (Caddy / nginx samples, incl. websocket + SSE timeouts):
60
63
  [docs/reverse-proxy.md](docs/reverse-proxy.md).