zengate 1.1.0 → 1.2.0

package/README.md

@@ -63,7 +63,7 @@ zengate
 
 ```bash
 docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate
-docker logs zengate   # shows the generated key once
+docker exec zengate node index.js setup --show   # prints the generated key
 ```
 
 Images are published for `linux/amd64` and `linux/arm64`, tagged `latest`, `1`, `1.2` and `1.2.3`.
@@ -101,17 +101,19 @@ npm start
 
 ### First start
 
-The gateway creates a config file with a random API key and prints the key once:
+The gateway creates a config file with a random API key and says where it is. The key itself is not printed, so it does not end up in service logs:
 
 ```
-  Created a gateway API key (saved to /home/you/.config/zengate/config.json):
-
-    sk-zg-...
+  Created a gateway API key and saved it to /home/you/.config/zengate/config.json.
+  Use it as the OpenAI API key in your client. To see it, run `zengate setup --show`
+  or read API_KEY from that file; `zengate setup --rotate` replaces it.
 
 OpenAI-compatible API on http://127.0.0.1:8083/v1 (auth: API key)
 7 models: big-pickle, ...
 ```
 
+In Docker, run `docker exec zengate node index.js setup --show`; under systemd, read `/var/lib/zengate/config.json` with `sudo`.
+
 Where the config file lives:
 
 | How you run it | Config file |
@@ -129,6 +131,7 @@ Key commands (`npm run setup -- <flag>` from a source checkout):
 ```bash
 zengate setup            # create a key if none exists
 zengate setup --rotate   # replace the key
+zengate setup --show     # print the saved key
 zengate setup --print    # print a fresh key without saving it (for env vars and secret stores)
 zengate --help
 ```
@@ -240,7 +243,7 @@ Set values as environment variables or in the config file (same names; see [`con
 | `OPENCODE_AGENT` | `plan` | The OpenCode agent each session uses. |
 | `OPENCODE_PATH` | bundled | Use a different `opencode` binary. |
 | `OPENCODE_SERVER_URL` | none | Attach to an existing `opencode serve` instead of starting one (see below). |
-| `OPENCODE_SERVER_USERNAME` / `OPENCODE_SERVER_PASSWORD` | `opencode` / none | Basic auth for that server. |
+| `OPENCODE_SERVER_USERNAME` / `OPENCODE_SERVER_PASSWORD` | `opencode` / none | Basic auth for that server. Credentials inside `OPENCODE_SERVER_URL` are refused. |
 | `ALLOW_INSECURE_BACKEND_HTTP` | `false` | Allow a non-loopback `http://` server URL. |
 | `CONFIG_FILE` | see [First start](#first-start) | Where the config file lives (environment variable only). |
 
@@ -275,12 +278,12 @@ sha256sum -c checksums.txt
 
 ## Security
 
-- The API key is required unless you set `ALLOW_NO_AUTH`. Keys are compared in constant time, the config file is written with mode `0600`, and keys are never logged.
+- The API key is required unless you set `ALLOW_NO_AUTH`. Keys are compared in constant time, the config file is written with mode `0600`, and keys are never logged: the first start reports where the generated key was saved, not the key.
 - The gateway binds to loopback by default and warns when it listens elsewhere, because traffic is plain HTTP, so put TLS in front.
 - OpenCode tools are never executed, and OpenCode runs isolated from your home directory and configuration.
 - Attachment URLs must be `https` and resolve to public addresses. Loopback, private, link-local and similar ranges (including IPv6 forms that embed them) are refused, which blocks SSRF into your network. The gateway fetches them itself and connects only to the address it checked, including on every redirect, so DNS rebinding cannot reach an internal host. OpenCode never sees the URL.
 - Conversation history is sent to the model as a tagged transcript. Message text, file names and tool names are escaped so they cannot fake another turn, a tool result or a function call.
-- Rate limiting, a bounded queue with a wait limit, body and attachment size limits, and per-request timeouts all apply. Requests that are uploading, queued or running are capped at `MAX_CONCURRENT + MAX_QUEUE`, which bounds the memory held by request bodies, and one client address may be uploading at most a quarter of that at once. Attachment URLs appear in errors and logs without their query string or credentials. A request with `n` choices uses `n` concurrency slots, and slots are always released on disconnect or timeout.
+- Rate limiting, a bounded queue with a wait limit, body and attachment size limits, and per-request timeouts all apply. Requests that are uploading, queued or running are capped at `MAX_CONCURRENT + MAX_QUEUE`, which bounds the memory held by request bodies, and one client address may be uploading at most a quarter of that at once. Attachment hosts are resolved inside the request's slot and timeout, with at most two DNS lookups in flight across the gateway. Attachment URLs appear in errors and logs as their origin only, without path, query string or credentials. A request with `n` choices uses `n` concurrency slots, and slots are always released on disconnect or timeout.
 - Stored responses (`previous_response_id`, `GET /v1/responses/{id}`) are visible only to the API key that created them.
 - The gateway sends no telemetry and never logs request bodies. OpenCode's auto-update and session sharing are disabled.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zengate",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Keyless OpenAI-compatible API (Chat Completions + Responses) for OpenCode's free Zen models, served through the real OpenCode CLI.",
   "author": {
     "name": "developingchet",
@@ -52,7 +52,7 @@
   "license": "MIT",
   "dependencies": {
     "express": "^5.1.0",
-    "opencode-ai": "1.18.32"
+    "opencode-ai": "1.18.34"
   },
   "overrides": {
     "es-define-property": "npm:@socketregistry/es-define-property@^1",

package/scripts/setup.mjs

@@ -2,6 +2,7 @@
 // Gateway key helper (same as `zengate setup`).
 //   npm run setup               create config.json with a key (keeps an existing key)
 //   npm run setup -- --rotate   replace the key in config.json
+//   npm run setup -- --show     print the key saved in config.json
 //   npm run setup -- --print    only print a fresh key (for env vars / secret stores)
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -12,7 +13,7 @@ const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const { command, flags } = parseCommand(['setup', ...process.argv.slice(2)]);
 
 if (command !== 'setup') {
-    process.stderr.write(`Unknown option: ${process.argv.slice(2).join(' ')}. Use --rotate or --print.\n`);
+    process.stderr.write(`Unknown option: ${process.argv.slice(2).join(' ')}. Use --rotate, --show or --print.\n`);
     process.exitCode = 2;
 } else {
     try {

package/src/bootstrap.js

@@ -41,13 +41,11 @@ export function loadOrProvisionConfig({ configPath, env = process.env, logger, p
             'or set ALLOW_NO_AUTH=true to deliberately serve without a key.',
         ]);
     }
+    // Only where the key is, never the key: service managers keep stdout as logs.
     print('');
-    print(`  Created a gateway API key (saved to ${configPath}):`);
-    print('');
-    print(`    ${key}`);
-    print('');
-    print('  Use it as the OpenAI API key in your client. It is not shown again;');
-    print('  read it from that file, or run `zengate setup --rotate` to replace it.');
+    print(`  Created a gateway API key and saved it to ${configPath}.`);
+    print('  Use it as the OpenAI API key in your client. To see it, run `zengate setup --show`');
+    print('  or read API_KEY from that file; `zengate setup --rotate` replaces it.');
     print('');
     logger.debug('Provisioned a new API key', { configPath });
     return loadConfig({ ...fileConfig, API_KEY: key }, env);

package/src/cli.js

@@ -1,7 +1,7 @@
 import { generateApiKey, writeConfigFile } from './bootstrap.js';
 import { readConfigFile } from './config.js';
 
-const SETUP_FLAGS = new Set(['--rotate', '--print']);
+const SETUP_FLAGS = new Set(['--rotate', '--print', '--show']);
 
 export const HELP_TEXT = `zengate: an OpenAI-compatible API for OpenCode's free Zen models
 
@@ -9,6 +9,7 @@ Usage:
   zengate                   start the gateway (creates an API key on first start)
   zengate setup             create config.json with an API key (keeps an existing key)
   zengate setup --rotate    replace the API key
+  zengate setup --show      print the saved API key
   zengate setup --print     print a fresh key without saving it
   zengate --version         print the version
   zengate --help            show this help
@@ -29,19 +30,29 @@ export function parseCommand(args) {
     return { command: 'unknown', flags: args };
 }
 
+/** Print the API key saved in config.json. */
+function showKey({ configPath, flags, out }) {
+    if (flags.length > 1) throw new Error('--show cannot be combined with other setup options.');
+    const { API_KEY: key } = readConfigFile(configPath);
+    if (!key) throw new Error(`${configPath} has no API_KEY. Run \`zengate setup\` to create one.`);
+    out(key);
+    return 0;
+}
+
 /**
- * Create, keep or rotate the gateway API key in config.json.
+ * Create, keep, show or rotate the gateway API key in config.json.
  * @param {{ configPath: string, flags: string[], out: (line?: string) => void }} options
  * @returns {number} process exit code
  */
 export function runSetup({ configPath, flags, out }) {
+    if (flags.includes('--show')) return showKey({ configPath, flags, out });
     if (flags.includes('--print')) {
         out(generateApiKey());
         return 0;
     }
     const current = readConfigFile(configPath);
     if (current.API_KEY && !flags.includes('--rotate')) {
-        out(`${configPath} already has an API_KEY. Use --rotate to replace it.`);
+        out(`${configPath} already has an API_KEY. Use --show to print it or --rotate to replace it.`);
         return 0;
     }
     const key = generateApiKey();

package/src/config.js

@@ -127,6 +127,9 @@ function validateServerUrl(config, problems) {
         problems.push('OPENCODE_SERVER_URL must be an absolute http(s) URL');
         return;
     }
+    if (url.username || url.password) {
+        problems.push('OPENCODE_SERVER_URL must not contain a username or password; set OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD instead');
+    }
     if (url.protocol !== 'http:' && url.protocol !== 'https:') {
         problems.push('OPENCODE_SERVER_URL must use http or https');
     } else if (url.protocol === 'http:' && !isLoopbackHost(url.hostname) && !config.ALLOW_INSECURE_BACKEND_HTTP) {

package/src/openai/chat.js

@@ -7,7 +7,6 @@ import { mapLimited } from './map-limited.js';
 import { buildPrompt } from './prompt.js';
 import { inlineRemoteAttachments } from './remote-media.js';
 import { openSse } from './sse-writer.js';
-import { assertPublicUrls } from './url-guard.js';
 
 const completionId = () => `chatcmpl-${crypto.randomBytes(12).toString('hex')}`;
 const now = () => Math.floor(Date.now() / 1000);
@@ -40,7 +39,6 @@ export function chatCompletionsHandler({ runner, catalog, limits }) {
         const request = parseChatRequest(req.body, limits);
         const model = await catalog.resolve(request.model);
         const prompt = buildPrompt(request, model);
-        await assertPublicUrls(prompt.parts);
         setIgnoredParams(res, request.ignored);
         await req.withSlot(async (signal, parallel) => {
             const ready = await inlineRemoteAttachments(prompt, { ...limits, signal });

package/src/openai/remote-media.js

@@ -4,7 +4,7 @@ import { ApiError, invalidRequest, unsupported } from '../server/errors.js';
 import { fileBlock } from './markup.js';
 import { mapLimited } from './map-limited.js';
 import { kindForMime } from './media.js';
-import { isBlockedAddress, MAX_REMOTE_PARTS, publicLookup, resolvePublic } from './url-guard.js';
+import { assertPublicUrls, isBlockedAddress, publicLookup, resolvePublic } from './url-guard.js';
 
 const FETCH_TIMEOUT_MS = 30000;
 const MAX_REDIRECTS = 3;
@@ -18,14 +18,15 @@ const USER_AGENT = 'zengate (+https://github.com/developingchet/zengate)';
 const attachmentError = (message) => invalidRequest(message, null, 'invalid_attachment_url');
 
 /**
- * An attachment URL as it may appear in errors and logs: signed URLs carry
- * their token in the query string, and some URLs carry credentials, so both
- * are left out.
+ * An attachment URL as it may appear in errors and logs: only its origin.
+ * Signed URLs carry their token in the query string or in a path segment,
+ * and some URLs carry credentials, so all of those are left out.
  */
 export function shown(url) {
     try {
         const parsed = new URL(url);
-        return `${parsed.origin}${parsed.pathname}${parsed.search ? '?…' : ''}`;
+        const bare = parsed.pathname === '/' && !parsed.search && !parsed.hash;
+        return `${parsed.origin}/${bare ? '' : '…'}`;
     } catch {
         return '(invalid URL)';
     }
@@ -157,7 +158,7 @@ function requestOnce(url, { transport, lookup, signal }) {
 async function download(url, { transport, lookup, isBlocked, signal, limit }) {
     let current = new URL(url);
     for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
-        if (net.isIP(current.hostname.replace(/^\[|\]$/g, ''))) await resolvePublic(current.hostname, isBlocked);
+        if (net.isIP(current.hostname.replace(/^\[|\]$/g, ''))) await resolvePublic(current.hostname, { isBlocked });
         const response = await requestOnce(current, { transport, lookup, signal });
         const status = response.statusCode || 0;
         if (status >= 300 && status < 400 && response.headers.location) {
@@ -198,6 +199,10 @@ async function inlinePart(part, options) {
  * inlined text) fetched by the gateway, so OpenCode never fetches a
  * client-chosen URL itself: no redirects to internal hosts, no DNS
  * rebinding, and remote files obey the same size limits as inline ones.
+ * Every host is checked before the first download starts. Callers run this
+ * inside the request's slot, so the DNS lookups and downloads count against
+ * MAX_CONCURRENT and stop when `signal` aborts (client disconnect or
+ * REQUEST_TIMEOUT_MS).
  * @param {{ parts: object[] }} prompt from buildPrompt
  * @param {{ maxBytes: number, maxTotalBytes: number, signal: AbortSignal,
  *           transport?: { request: typeof https.request }, isBlocked?: (address: string) => boolean }} options
@@ -206,14 +211,13 @@ async function inlinePart(part, options) {
 export async function inlineRemoteAttachments(prompt, { maxBytes, maxTotalBytes, signal, transport = https, isBlocked = isBlockedAddress }) {
     const remote = prompt.parts.filter((part) => typeof part.url === 'string' && part.url.startsWith('https:'));
     if (remote.length === 0) return prompt;
-    if (remote.length > MAX_REMOTE_PARTS) {
-        throw invalidRequest(`At most ${MAX_REMOTE_PARTS} attachments may be URLs; send the rest as data URIs.`, null, 'too_many_attachment_urls');
-    }
+    await assertPublicUrls(remote, { isBlocked, signal });
     // One failed attachment fails the request, so the other downloads are cancelled too.
     const siblings = new AbortController();
+    const downloads = AbortSignal.any([signal, siblings.signal]);
     const options = {
-        transport, lookup: publicLookup(isBlocked), isBlocked,
-        signal: AbortSignal.any([signal, siblings.signal]),
+        transport, lookup: publicLookup({ isBlocked, signal: downloads }), isBlocked,
+        signal: downloads,
         budget: createBudget({ maxBytes, maxTotalBytes }),
     };
     const fetched = await mapLimited(remote, PARALLEL_FETCHES, (part) => inlinePart(part, options), () => siblings.abort());

package/src/openai/responses.js

@@ -6,7 +6,6 @@ import { inlineRemoteAttachments } from './remote-media.js';
 import { createResponseBuilder } from './response-builder.js';
 import { parseResponsesRequest } from './responses-request.js';
 import { openSse } from './sse-writer.js';
-import { assertPublicUrls } from './url-guard.js';
 
 function assistantHistory(result) {
     return { role: 'assistant', content: result.content, media: [], toolCalls: result.toolCalls.map(({ id, name, arguments: args }) => ({ id, name, arguments: args })) };
@@ -22,7 +21,6 @@ export function responsesHandlers({ runner, catalog, store, limits }) {
         const request = parseResponsesRequest(req.body, limits, scoped);
         const model = await catalog.resolve(request.model);
         const prompt = buildPrompt(request, model);
-        await assertPublicUrls(prompt.parts);
         setIgnoredParams(res, request.ignored);
 
         await req.withSlot(async (signal) => {

package/src/openai/url-guard.js

@@ -1,6 +1,7 @@
 import dns from 'node:dns/promises';
 import net from 'node:net';
 import { invalidRequest } from '../server/errors.js';
+import { mapLimited } from './map-limited.js';
 
 /**
  * Attachment URLs are fetched by the gateway, so a client could otherwise
@@ -23,9 +24,64 @@ const BLOCKED_V6 = new net.BlockList();
 ].forEach(([address, prefix]) => BLOCKED_V6.addSubnet(address, prefix, 'ipv6'));
 
 const LOOKUP_TIMEOUT_MS = 5000;
+/**
+ * dns.lookup runs getaddrinfo on libuv's thread pool (four threads by
+ * default, shared with file system and crypto work) and cannot be cancelled:
+ * a lookup the caller stopped waiting for keeps its thread until the resolver
+ * answers or gives up. Each lookup holds a permit until it really settles, so
+ * names that never resolve occupy at most this many threads process-wide.
+ */
+const MAX_LOOKUPS_IN_FLIGHT = 2;
 /** Most attachments one request may send as URLs. */
 export const MAX_REMOTE_PARTS = 16;
 
+let lookupsInFlight = 0;
+const lookupWaiters = new Set();
+
+/** Waits for a lookup permit; rejects with the signal's reason if it aborts first. */
+function acquireLookup(signal) {
+    if (signal.aborted) return Promise.reject(signal.reason);
+    if (lookupsInFlight < MAX_LOOKUPS_IN_FLIGHT) {
+        lookupsInFlight += 1;
+        return Promise.resolve();
+    }
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            lookupWaiters.delete(grant);
+            reject(signal.reason);
+        };
+        const grant = () => {
+            signal.removeEventListener('abort', onAbort);
+            lookupsInFlight += 1;
+            resolve();
+        };
+        lookupWaiters.add(grant);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+
+function releaseLookup() {
+    lookupsInFlight -= 1;
+    const [next] = lookupWaiters;
+    if (next) {
+        lookupWaiters.delete(next);
+        next();
+    }
+}
+
+/** Settles like `promise`, or rejects with the signal's reason once it aborts. */
+function untilAborted(promise, signal) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        if (signal.aborted) {
+            onAbort();
+            return;
+        }
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+    });
+}
+
 /** The eight 16-bit groups of a valid IPv6 address (which may end in dotted IPv4). */
 function ipv6Groups(address) {
     let text = address.toLowerCase();
@@ -62,30 +118,30 @@ export function isBlockedAddress(address) {
     return v4 ? BLOCKED_V4.check(v4, 'ipv4') : BLOCKED_V6.check(plain, 'ipv6');
 }
 
-async function resolve(hostname) {
+/** The addresses of `hostname`, within LOOKUP_TIMEOUT_MS (waiting for a permit included). */
+async function resolve(hostname, signal) {
     const literal = hostname.replace(/^\[|\]$/g, '');
     if (net.isIP(literal)) return [{ address: literal, family: net.isIP(literal) }];
-    let timer;
-    const timeout = new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error('DNS lookup timed out')), LOOKUP_TIMEOUT_MS);
-        timer.unref();
-    });
-    try {
-        return await Promise.race([dns.lookup(literal, { all: true, verbatim: true }), timeout]);
-    } finally {
-        clearTimeout(timer);
-    }
+    const deadline = AbortSignal.any([AbortSignal.timeout(LOOKUP_TIMEOUT_MS), ...(signal ? [signal] : [])]);
+    await acquireLookup(deadline);
+    const lookup = (async () => dns.lookup(literal, { all: true, verbatim: true }))();
+    lookup.then(releaseLookup, releaseLookup);
+    return untilAborted(lookup, deadline);
 }
 
 /**
  * Every address `hostname` resolves to, provided all of them are public.
  * @param {string} hostname
- * @param {(address: string) => boolean} [isBlocked]
+ * @param {{ isBlocked?: (address: string) => boolean, signal?: AbortSignal }} [options]
+ *        `signal` stops the wait (rejecting with its reason) when the request ends
  * @returns {Promise<{ address: string, family: number }[]>}
  */
-export async function resolvePublic(hostname, isBlocked = isBlockedAddress) {
+export async function resolvePublic(hostname, { isBlocked = isBlockedAddress, signal } = {}) {
     // One message for both failures, so clients cannot probe which internal names exist.
-    const records = await resolve(hostname).catch(() => []);
+    const records = await resolve(hostname, signal).catch(() => {
+        if (signal?.aborted) throw signal.reason;
+        return [];
+    });
     if (!records.length || records.some((record) => isBlocked(record.address))) {
         throw invalidRequest(`Attachment host '${hostname}' is not a public address.`, null, 'invalid_attachment_url');
     }
@@ -96,11 +152,11 @@ export async function resolvePublic(hostname, isBlocked = isBlockedAddress) {
  * A `lookup` for http(s).request that only ever connects to the addresses it
  * has just checked, so DNS rebinding between check and connect cannot reach
  * an internal address.
- * @param {(address: string) => boolean} [isBlocked]
+ * @param {{ isBlocked?: (address: string) => boolean, signal?: AbortSignal }} [options]
  */
-export function publicLookup(isBlocked = isBlockedAddress) {
+export function publicLookup({ isBlocked = isBlockedAddress, signal } = {}) {
     return (hostname, options, callback) => {
-        resolvePublic(hostname, isBlocked).then((records) => {
+        resolvePublic(hostname, { isBlocked, signal }).then((records) => {
             const wanted = options?.family ? records.filter((record) => record.family === options.family) : records;
             if (!wanted.length) {
                 callback(Object.assign(new Error(`No IPv${options.family} address for ${hostname}`), { code: 'ENOTFOUND' }));
@@ -114,16 +170,21 @@ export function publicLookup(isBlocked = isBlockedAddress) {
 }
 
 /**
- * Reject prompt parts whose https URL resolves to a non-public address. This
- * is a fast early check; the fetch itself re-checks through publicLookup.
+ * Reject prompt parts whose https URL resolves to a non-public address, so a
+ * request fails before any download starts. The fetch itself re-checks
+ * through publicLookup.
  * @param {{ url?: string }[]} parts OpenCode prompt parts
+ * @param {{ isBlocked?: (address: string) => boolean, signal?: AbortSignal }} [options]
  */
-export async function assertPublicUrls(parts) {
+export async function assertPublicUrls(parts, { isBlocked = isBlockedAddress, signal } = {}) {
     const remote = parts.filter((part) => typeof part.url === 'string' && part.url.startsWith('https:'));
     // Checked before resolving anything, so one request cannot queue thousands of DNS lookups.
     if (remote.length > MAX_REMOTE_PARTS) {
         throw invalidRequest(`At most ${MAX_REMOTE_PARTS} attachments may be URLs; send the rest as data URIs.`, null, 'too_many_attachment_urls');
     }
-    const hosts = new Set(remote.map((part) => new URL(part.url).hostname));
-    await Promise.all([...hosts].map((hostname) => resolvePublic(hostname)));
+    const hosts = [...new Set(remote.map((part) => new URL(part.url).hostname))];
+    // Once one host is refused, the others stop waiting for a lookup permit.
+    const siblings = new AbortController();
+    const checks = AbortSignal.any([siblings.signal, ...(signal ? [signal] : [])]);
+    await mapLimited(hosts, hosts.length, (hostname) => resolvePublic(hostname, { isBlocked, signal: checks }), () => siblings.abort());
 }

package/src/opencode/backend.js

@@ -1,5 +1,5 @@
 import { execFile, spawn } from 'node:child_process';
-import { createOpencodeClient } from './client.js';
+import { backendOrigin, createOpencodeClient } from './client.js';
 import { resolveOpencodeBinary, spawnCommand } from './binary.js';
 import {
     backendEnv, createIsolatedRoot, HEARTBEAT_MS, randomPassword, recordBackendPid, removeIsolatedRoot, sweepStaleRoots, touchIsolatedRoot,
@@ -227,6 +227,7 @@ export function createManagedBackend({ opencodePath, logger }) {
 /** Uses an OpenCode server someone else runs (OPENCODE_SERVER_URL). */
 export function createAttachedBackend({ url, username, password, logger }) {
     const client = createOpencodeClient({ baseUrl: url, username, password });
+    const shownUrl = backendOrigin(url);
     let ready = false;
     let version = null;
     let timer = null;
@@ -245,8 +246,8 @@ export function createAttachedBackend({ url, username, password, logger }) {
     return Object.freeze({
         mode: 'attached',
         async start() {
-            if (!(await probe())) throw new Error(`OpenCode server at ${url} is not healthy (GET /global/health). Check the URL and credentials.`);
-            logger.info(`Using OpenCode ${version || ''} at ${url}`.replace('  ', ' '));
+            if (!(await probe())) throw new Error(`OpenCode server at ${shownUrl} is not healthy (GET /global/health). Check the URL and credentials.`);
+            logger.info(`Using OpenCode ${version || ''} at ${shownUrl}`.replace('  ', ' '));
             logger.warn('Attached mode: the gateway rejects tool permissions for its own sessions, but the server\'s own configuration still applies. Prefer the managed backend.');
             timer = setInterval(probe, 10000);
             timer.unref();

package/src/opencode/client.js

@@ -19,11 +19,25 @@ export function basicAuthHeader(username, password) {
     return `Basic ${Buffer.from(`${username || 'opencode'}:${password}`).toString('base64')}`;
 }
 
+/**
+ * A backend URL as it may appear in logs and errors: scheme, host and port.
+ * Credentials, a path and a query string can all carry secrets.
+ * @param {string} url
+ */
+export function backendOrigin(url) {
+    try {
+        return new URL(url).origin;
+    } catch {
+        return '(invalid URL)';
+    }
+}
+
 /**
  * @param {{ baseUrl: string, username?: string, password?: string, fetchImpl?: typeof fetch }} options
  */
 export function createOpencodeClient({ baseUrl, username, password, fetchImpl = fetch }) {
     const base = String(baseUrl).replace(/\/+$/, '');
+    const shownBase = backendOrigin(base);
     const auth = basicAuthHeader(username, password);
     const headers = (extra) => ({ accept: 'application/json', ...(auth ? { authorization: auth } : {}), ...extra });
 
@@ -41,7 +55,7 @@ export function createOpencodeClient({ baseUrl, username, password, fetchImpl =
             });
         } catch (error) {
             if (error?.name === 'AbortError' || error?.name === 'TimeoutError') throw error;
-            throw new BackendError(`OpenCode backend unreachable at ${base}: ${error?.cause?.code || error?.message}`, { cause: error });
+            throw new BackendError(`OpenCode backend unreachable at ${shownBase}: ${error?.cause?.code || error?.message}`, { cause: error });
         }
         const text = await response.text();
         let parsed = null;