Basic Auth breaks the CORS support #10047

Description

I am trying to create a simple web UI that connects from browser to Opencode API using @opencode-ai/sdk/client. This works anonymous, or same-server, but in a scenario where my Opencode server is in the network (and therefore I need to add basic auth) the code no longer works.

The issue is that when doing fetch with authentication headers (GET/POST etc.), browser will first make a preflight check (OPTIONS) and this is done without credentials. This now fails because basic authentication guards OPTIONS verb (all requests).

FIX: I believe , you could just fix this in server.ts by switching .use(cors(... (line 103) before the .use(..basicAuth( (line 80). I am not familiar with Hono, so perhaps someone should check this, but I am pretty sure that generally with CORS preflight (OPTIONS) should respond to anonymous calls and the order of these uses now breaks things.

Plugins

None

OpenCode version

"@opencode-ai/sdk": "^1.1.27", server is the docker from 2026-01-20

Steps to reproduce

To reproduce:

• Client (browser) and server must be in different origins (domains) and server must be non-localhost
• Add client cors to server or use localhost as client
• Create a browser UI like below
• Observe preflight failing. In more detail,

Code (taken form larger project. I can add a real example if necessary):

function fetchWithBasicAuth(input: RequestInfo | URL, init?: RequestInit) {
  const username = "opencode";
  const password = "pwdherefromsomeuserintput";
  return globalThis.fetch(input, {
    ...init,
    headers: {
      ...init?.headers,
      Authorization: `Basic ${btoa(`${username}:${password}`)}`,
    },
    credentials: "include",
  });
}

const client = createOpencodeClient({
    baseUrl: "https://myinstance-of-opencode.foobar.com",
    fetch: fetchWithBasicAuth,
  });

useEffect(() => {
    client.project.list().then((response) => {
      // THIS NOW FAILS
      setProjects(response.data ?? []);
    });

Screenshot and/or share link

No response

Operating System

Windows 11, Server is the current Docker.

Terminal

None