Web client fails to fetch when URL contains credentials and throws BrowserAttachments context error

Description

When accessing the OpenCode web client with HTTP basic authentication credentials in the URL (for example http://username:password@127.0.0.1:<port>/), two issues occur:

1. fetch() throws:

TypeError: Failed to execute 'fetch' on 'Window': Request cannot be constructed from a URL that includes credentials

Because clearAuthToken() in packages/app/src/entry.tsx only handles ?auth_token= query parameters and uses a relative path in history.replaceState(), any credentials present in location.username and location.password remain in window.location. Under modern WHATWG Fetch specifications, browsers reject any request constructed from a URL with embedded credentials. Additionally, embedded credentials in the URL are not extracted into auth, causing requests to fail with 401.

2. If a session or route is loaded where BrowserAttachmentsProvider is not active (or outside desktop context), useBrowserAttachments() unconditionally throws:

Error: BrowserAttachments context must be used within a context provider

instead of falling back to a disabled/no-op attachment state on Web.

Steps to reproduce

1. Run OPENCODE_SERVER_PASSWORD=secret opencode serve (or opencode web).
2. Open http://opencode:secret@127.0.0.1:4096/ directly in Google Chrome or Safari.
3. Observe TypeError: Failed to execute 'fetch' on 'Window' and/or Error: BrowserAttachments context must be used within a context provider.

OpenCode version

v2.0.3

Operating System

macOS / Linux / Windows