v2.0.5: opencode serve returns 401 when server auth env vars are unset or empty

Description

On v2.0.5, opencode serve returns HTTP 401 for a loopback-only server even when both OPENCODE_SERVER_PASSWORD and OPENCODE_SERVER_USERNAME are absent or explicitly empty in a clean HOME/XDG environment. The server logs an auto-generated password. Please clarify whether this is intentional and, if so, how to disable it; otherwise, please treat it as a regression.

Plugins

None.

OpenCode version

v2.0.5 (official opencode upgrade 2.0.5 --method curl).

Steps to reproduce

1. probe_root=$(mktemp -d); mkdir -p "$probe_root"/{config,data,state,cache,home}
2. Run: env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOME="$probe_root/home" XDG_CONFIG_HOME="$probe_root/config" XDG_DATA_HOME="$probe_root/data" XDG_STATE_HOME="$probe_root/state" XDG_CACHE_HOME="$probe_root/cache" opencode serve --hostname 127.0.0.1 --port 4097 --print-logs
3. In another terminal: curl -i http://127.0.0.1:4097/global/health
4. Stop the server; repeat step 2 with OPENCODE_SERVER_PASSWORD="" OPENCODE_SERVER_USERNAME="" added.

Expected: clarify whether auth should be disabled with variables absent/empty, and provide an opt-out if auth is intentional.

Actual: both variants log an auto-generated password and return 401.

Screenshot and/or share link

None. Do not paste the generated password.

Operating System

Ubuntu 26.04.1 LTS

Terminal

zsh 5.9