From 4425345609c9a0de52702d7338059960f5baf0be Mon Sep 17 00:00:00 2001
From: Marceli Pawlinski <marceli@pawlinski.pl>
Date: Mon, 5 Oct 2026 14:52:19 +0100
Subject: [PATCH 1/9] Stop restoring OpenCode passwords from localStorage

---
 src/main.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/main.js b/src/main.js
index c3b99ac..97cacde 100644
--- a/src/main.js
+++ b/src/main.js
@@ -15,9 +15,12 @@ class App {
       const savedConfig = {
         url: localStorage.getItem('opencode-url'),
         username: localStorage.getItem('opencode-username') || 'opencode',
-        password: localStorage.getItem('opencode-password') || ''
+        password: ''
       };
 
+      // Remove credentials stored by older versions. Passwords now stay in memory only.
+      localStorage.removeItem('opencode-password');
+
       // Restore theme
       const savedTheme = localStorage.getItem('opencode-theme');
       if (savedTheme) {

From ae4087ecdddf419ace18992fc7bf90dfcbf8e4f2 Mon Sep 17 00:00:00 2001
From: Marceli Pawlinski <marceli@pawlinski.pl>
Date: Mon, 5 Oct 2026 14:52:22 +0100
Subject: [PATCH 2/9] Keep OpenCode password in memory only

---
 src/ui.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/ui.js b/src/ui.js
index 6be1935..bf82966 100644
--- a/src/ui.js
+++ b/src/ui.js
@@ -731,7 +731,7 @@ class OpenCodeUI {
           </div>
           <div class="form-group">
             <label for="settings-password">Password</label>
-            <input type="password" id="settings-password" class="form-input" placeholder="••••••••">
+            <input type="password" id="settings-password" class="form-input" placeholder="Not stored — re-enter after reload" autocomplete="current-password">
           </div>
           <div class="form-group">
             <label>
@@ -771,7 +771,7 @@ class OpenCodeUI {
     // Save to localStorage
     localStorage.setItem('opencode-url', url);
     localStorage.setItem('opencode-username', username);
-    localStorage.setItem('opencode-password', password);
+    localStorage.removeItem('opencode-password');
 
     // Apply theme
     document.documentElement.dataset.theme = darkMode ? 'dark' : 'light';

From 65ac20b6f48c56caf3dbb718763a907681d02500 Mon Sep 17 00:00:00 2001
From: Marceli Pawlinski <marceli@pawlinski.pl>
Date: Mon, 5 Oct 2026 14:52:24 +0100
Subject: [PATCH 3/9] Remove persisted password from auth helper

---
 src/auth.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/auth.js b/src/auth.js
index 8800b24..9a19e03 100644
--- a/src/auth.js
+++ b/src/auth.js
@@ -6,15 +6,16 @@
 class Auth {
   constructor() {
     this.storageKey = 'opencode-auth';
+    this.password = null;
   }
 
   /**
    * Store credentials
    */
   saveCredentials(username, password) {
+    this.password = password;
     const credentials = {
       username,
-      password: this.encode(password),
       timestamp: new Date().toISOString()
     };
     localStorage.setItem(this.storageKey, JSON.stringify(credentials));
@@ -27,9 +28,10 @@ class Auth {
     try {
       const data = JSON.parse(localStorage.getItem(this.storageKey));
       if (!data) return null;
+      if (!this.password) return null;
       return {
         username: data.username,
-        password: this.decode(data.password),
+        password: this.password,
         timestamp: data.timestamp
       };
     } catch (e) {
@@ -41,6 +43,7 @@ class Auth {
    * Clear credentials
    */
   clearCredentials() {
+    this.password = null;
     localStorage.removeItem(this.storageKey);
   }
 

From 0527a31b037b8f8650cb20ae6165782010a19456 Mon Sep 17 00:00:00 2001
From: Marceli Pawlinski <marceli@pawlinski.pl>
Date: Mon, 5 Oct 2026 14:52:27 +0100
Subject: [PATCH 4/9] Default OpenCode server to localhost and disable
 auto-install

---
 src/server.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/server.js b/src/server.js
index a3f1a9e..5e2ae25 100644
--- a/src/server.js
+++ b/src/server.js
@@ -12,7 +12,7 @@ class OpenCodeServer {
   constructor(options = {}) {
     this.options = {
       port: options.port || 4096,
-      hostname: options.hostname || '0.0.0.0',
+      hostname: options.hostname || '127.0.0.1',
       password: options.password || process.env.OPENCODE_SERVER_PASSWORD,
       username: options.username || process.env.OPENCODE_SERVER_USERNAME || 'opencode',
       cors: options.cors || [],
@@ -79,8 +79,9 @@ class OpenCodeServer {
 
     const installed = await this.checkOpenCodeInstalled();
     if (!installed) {
-      console.log('OpenCode not installed. Installing...');
-      await this.installOpenCode();
+      throw new Error(
+        'OpenCode is not installed. Install it explicitly from the official OpenCode instructions before starting this server.'
+      );
     }
 
     console.log('🚀 Starting OpenCode web server...');

From 008cd7d393c4e6ef8f213b8161284665fed0fe01 Mon Sep 17 00:00:00 2001
From: Marceli Pawlinski <marceli@pawlinski.pl>
Date: Mon, 5 Oct 2026 14:52:30 +0100
Subject: [PATCH 5/9] Do not print OpenCode server password

---
 src/server-manager.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/server-manager.js b/src/server-manager.js
index e2b182c..2b59b8d 100644
--- a/src/server-manager.js
+++ b/src/server-manager.js
@@ -32,7 +32,7 @@ async function main() {
       console.log(`   http://localhost:${port}`);
       console.log(`\n🔐 Credentials:`);
       console.log(`   Username: ${username}`);
-      console.log(`   Password: ${password}`);
+      console.log('   Password: configured via OPENCODE_SERVER_PASSWORD');
       console.log('\nPress Ctrl+C to stop\n');
       
       // Keep process alive

From 8474a64a3fbf9a828d7278e2a356831c2dad7327 Mon Sep 17 00:00:00 2001
From: Marceli Pawlinski <marceli@pawlinski.pl>
Date: Mon, 5 Oct 2026 14:55:58 +0100
Subject: [PATCH 6/9] Fix server ESM runtime and remove shell installer

---
 src/server.js | 77 +++++++++++++++++++--------------------------------
 1 file changed, 28 insertions(+), 49 deletions(-)

diff --git a/src/server.js b/src/server.js
index 5e2ae25..0eb8792 100644
--- a/src/server.js
+++ b/src/server.js
@@ -3,10 +3,10 @@
  * Starts and manages the OpenCode web server
  */
 
-const { exec, spawn } = require('child_process');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import fs from 'node:fs';
+import os from 'node:os';
 
 class OpenCodeServer {
   constructor(options = {}) {
@@ -28,9 +28,13 @@ class OpenCodeServer {
    */
   checkOpenCodeInstalled() {
     return new Promise((resolve) => {
-      exec('opencode --version', (error) => {
-        resolve(!error);
+      const openCodePath = this.getOpenCodePath();
+      const child = spawn(openCodePath, ['--version'], {
+        stdio: 'ignore',
+        shell: process.platform === 'win32' && openCodePath.endsWith('.cmd')
       });
+      child.once('error', () => resolve(false));
+      child.once('exit', (code) => resolve(code === 0));
     });
   }
 
@@ -134,51 +138,27 @@ class OpenCodeServer {
   }
 
   /**
-   * Install OpenCode
+   * Wait for server to be ready
    */
-  installOpenCode() {
-    return new Promise((resolve, reject) => {
-      const install = spawn('bash', ['-c', 'curl -fsSL https://opencode.ai/install | bash'], {
-        stdio: 'inherit',
-        shell: false
-      });
+  async waitForServer() {
+    const timeout = 10000;
+    const start = Date.now();
+    const url = `http://${this.options.hostname}:${this.options.port}/doc`;
 
-      install.on('exit', (code) => {
-        if (code === 0) {
-          console.log('OpenCode installed successfully');
-          resolve();
-        } else {
-          reject(new Error('Failed to install OpenCode'));
+    while (Date.now() - start <= timeout) {
+      try {
+        const response = await fetch(url, { signal: AbortSignal.timeout(1500) });
+        if (response.ok) {
+          console.log(`✅ OpenCode server ready at http://${this.options.hostname}:${this.options.port}`);
+          return;
         }
-      });
-    });
-  }
+      } catch {
+        // Server is still starting.
+      }
+      await new Promise(resolve => setTimeout(resolve, 1000));
+    }
 
-  /**
-   * Wait for server to be ready
-   */
-  waitForServer() {
-    return new Promise((resolve) => {
-      const timeout = 10000;
-      const start = Date.now();
-      
-      const check = setInterval(() => {
-        const port = this.options.port;
-        const { exec } = require('child_process');
-        
-        exec(`curl -s http://${this.options.hostname}:${port}/doc`, (error, stdout) => {
-          if (!error && stdout) {
-            clearInterval(check);
-            console.log(`✅ OpenCode server ready at http://${this.options.hostname}:${port}`);
-            resolve();
-          } else if (Date.now() - start > timeout) {
-            clearInterval(check);
-            console.log('⚠️  Server not ready within timeout, but may still be starting...');
-            resolve();
-          }
-        });
-      }, 1000);
-    });
+    console.log('⚠️  Server not ready within timeout, but may still be starting...');
   }
 
   /**
@@ -205,5 +185,4 @@ class OpenCodeServer {
   }
 }
 
-// Export for CommonJS
-module.exports = { OpenCodeServer }; 
\ No newline at end of file
+export { OpenCodeServer }; 
\ No newline at end of file

From 0691ca0327d5466913f4a66c623d2f064dd82284 Mon Sep 17 00:00:00 2001
From: Marceli Pawlinski <marceli@pawlinski.pl>
Date: Mon, 5 Oct 2026 14:56:06 +0100
Subject: [PATCH 7/9] Use ESM in server manager

---
 src/server-manager.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/server-manager.js b/src/server-manager.js
index 2b59b8d..6b50c1e 100644
--- a/src/server-manager.js
+++ b/src/server-manager.js
@@ -3,8 +3,8 @@
  * Run: node src/server-manager.js [start|stop|status]
  */
 
-const { OpenCodeServer } = require('./server.js');
-require('dotenv').config();
+import { OpenCodeServer } from './server.js';
+import 'dotenv/config';
 
 const command = process.argv[2] || 'start';
 const port = parseInt(process.env.OPENCODE_PORT || process.argv[3] || '4096', 10);

From b7e7b51eff225ff094b82813acda090716bc0afc Mon Sep 17 00:00:00 2001
From: Marceli Pawlinski <marceli@pawlinski.pl>
Date: Mon, 5 Oct 2026 14:56:09 +0100
Subject: [PATCH 8/9] Remove obsolete password obfuscation helpers

---
 src/auth.js | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/src/auth.js b/src/auth.js
index 9a19e03..77043e2 100644
--- a/src/auth.js
+++ b/src/auth.js
@@ -54,20 +54,6 @@ class Auth {
     return this.getCredentials() !== null;
   }
 
-  /**
-   * Encode password (obfuscation, not encryption)
-   */
-  encode(text) {
-    return btoa(encodeURIComponent(text));
-  }
-
-  /**
-   * Decode password
-   */
-  decode(encoded) {
-    return decodeURIComponent(atob(encoded));
-  }
-
   /**
    * Verify server connection with credentials
    */

From ceff5f031a778a2d12de264c4135d1c0994c57ed Mon Sep 17 00:00:00 2001
From: Marceli Pawlinski <marceli@pawlinski.pl>
Date: Mon, 5 Oct 2026 14:57:16 +0100
Subject: [PATCH 9/9] Add security hardening CI checks

---
 .github/workflows/ci.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c6ee85e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,19 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - run: node --check src/server.js
+      - run: node --check src/server-manager.js