fix(macos): remove OpenCode auth wall, bind to localhost only

Match Windows/Linux behavior: no OPENCODE_SERVER_PASSWORD, bind to
127.0.0.1 instead of 0.0.0.0. Local-only service needs no auth.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

dream-server/installers/macos/install-macos.sh

@@ -672,12 +672,6 @@ OPENCODE_EOF
             ai_ok "OpenCode config already exists"
         fi
 
-        # Read OPENCODE_SERVER_PASSWORD from .env
-        OPENCODE_SERVER_PASSWORD=""
-        if [[ -f "$INSTALL_DIR/.env" ]]; then
-            OPENCODE_SERVER_PASSWORD=$(grep -m1 '^OPENCODE_SERVER_PASSWORD=' "$INSTALL_DIR/.env" | cut -d= -f2- || true)
-        fi
-
         # Install as macOS LaunchAgent (auto-start on login)
         mkdir -p "$HOME/Library/LaunchAgents"
         cat > "$OPENCODE_PLIST" <<PLIST_EOF
@@ -694,7 +688,7 @@ OPENCODE_EOF
         <string>--port</string>
         <string>3003</string>
         <string>--hostname</string>
-        <string>0.0.0.0</string>
+        <string>127.0.0.1</string>
     </array>
     <key>WorkingDirectory</key>
     <string>${HOME}</string>
@@ -704,8 +698,6 @@ OPENCODE_EOF
         <string>${HOME}</string>
         <key>PATH</key>
         <string>${HOME}/.opencode/bin:/usr/local/bin:/usr/bin:/bin</string>
-        <key>OPENCODE_SERVER_PASSWORD</key>
-        <string>${OPENCODE_SERVER_PASSWORD}</string>
     </dict>
     <key>RunAtLoad</key>
     <true/>

dream-server/installers/macos/lib/env-generator.sh

@@ -58,9 +58,6 @@ generate_dream_env() {
     openclaw_token=$(new_secure_hex 24)
     local searxng_secret
     searxng_secret=$(new_secure_hex 32)
-    local opencode_password
-    opencode_password=$(new_secure_base64 16)
-
     # macOS: llama-server runs natively, containers reach it via host.docker.internal
     local llm_api_url="http://host.docker.internal:8080"
 
@@ -115,7 +112,7 @@ OPENCLAW_TOKEN=${openclaw_token}
 
 #=== OpenCode Settings ===
 OPENCODE_PORT=3003
-OPENCODE_SERVER_PASSWORD=${opencode_password}
+OPENCODE_SERVER_PASSWORD=
 
 #=== Voice Settings ===
 WHISPER_MODEL=base