fix(opencode): block unmatched /api/* paths from Web UI proxy - #374
Merged
Million-mo merged 1 commit intoAug 17, 2026
Merged
Conversation
The OpenCode TUI calls GET /api/fs/find when completing @-mentions.
wolfharness had no route for it, so the request fell through to the
Web UI proxy catch-all and was forwarded to app.opencode.ai. The cloud
responds 200 with text/html (the SPA index.html), which the SDK parses
as a text string (Content-Type text/html;charset=UTF-8 -> parseAs text),
so the TUI receives result.data as a string and crashes on
result.data.data.map(...).
Add 'api/' to the proxy block prefixes and extract the decision into
is_proxy_path_blocked() so unmatched /api/* routes now return 404 JSON.
The SDK then produces { error }, and the TUI's guard (!result.error)
safely skips the crashy code path.
coderlihong
pushed a commit
to coderlihong/wolfharness
that referenced
this pull request
Aug 18, 2026
…l-worker-tools Integrate upstream wolf1069b#364/wolf1069b#356/wolf1069b#368/wolf1069b#372/wolf1069b#374/wolf1069b#375/wolf1069b#367 changes. Resolved: - pyproject/uv.lock: openviking-sdk 0.1.8 (keep local; image download_bytes comment) - mcp_server_cap.py: keep fork's self._tool_prefix logic - viking/tools.py: combine imports (PurePosixPath + json/Path/shutil/tempfile) - test_viking*.py: accept upload_tree (local wiki feature), 4→5 / 12→13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The OpenCode TUI calls
GET /api/fs/findwhen completing@-mentions. wolfharness has no route for it, so the request fell through to the Web UI proxy catch-all and was forwarded tohttps://app.opencode.ai/api/fs/find. The cloud responds200withtext/html(the SPAindex.html), which the SDK parses as atextstring (Content-Type: text/html;charset=UTF-8→parseAs: "text"). The TUI then receivesresult.dataas a string and crashes onresult.data.data.map(...):Root cause
server.py's Web UI proxy catch-all blocks a fixed list of API path prefixes before forwarding to the cloud. The list was missingapi/, so every unmatched/api/*route (including/api/fs/find) was proxied to the hosted Web UI and returned atext/htmlSPA page with200.Fix
"api/"to the proxy block prefixesis_proxy_path_blocked(path)(module-level constantPROXY_BLOCKED_PREFIXES)After the fix, unmatched
/api/*routes return404JSON. The SDK then produces{ error, request, response }, and the TUI'sif (!result.error && result.data)guard safely skips the crashing code path.Verification
tests/servers/opencode_server/test_proxy_path_blocking.py(29 parametrized cases)uv run ruff checkpassesresult.datawas a string; now it's a 404{ error }→ TUI guard blocks the crash