anomalyco / anomalyco/opencode
WebFetch description promises an HTTP to HTTPS upgrade that does not happen
Open
@jlongster is already working on this.
Since Jul 27, 2026.
- Dominant language
- TypeScript
- Stars
- 209k
- Forks
- 27.5k
- PR merge metrics
- PR metrics pending
Description
Description
The WebFetch tool description (packages/opencode/src/tool/webfetch.txt) tells the model "HTTP URLs will be automatically upgraded to HTTPS". Nothing in webfetch.ts does that. The only scheme handling there is a check that the URL starts with http:// or https://, after which the URL is fetched exactly as given.
The description is part of the prompt, so this is the model being told something untrue about a tool it uses — it can reasonably assume an http:// URL it passes will end up encrypted when it will not.
OpenCode version
1.18.7 (dev @ 55b0211690)
Steps to reproduce
- Point WebFetch at a plain-HTTP host, e.g. a local dev server on
http://localhost:<port>. - The request goes out over HTTP and succeeds. If the upgrade the description promises actually happened, this would fail against an HTTP-only host.
Operating System
macOS 26.5.2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.