Description

The WebFetch tool description (packages/opencode/src/tool/webfetch.txt) tells the model "HTTP URLs will be automatically upgraded to HTTPS". Nothing in webfetch.ts does that. The only scheme handling there is a check that the URL starts with http:// or https://, after which the URL is fetched exactly as given.

The description is part of the prompt, so this is the model being told something untrue about a tool it uses — it can reasonably assume an http:// URL it passes will end up encrypted when it will not.

OpenCode version

1.18.7 (dev @ 55b0211)

Steps to reproduce

1. Point WebFetch at a plain-HTTP host, e.g. a local dev server on http://localhost:<port>.
2. The request goes out over HTTP and succeeds. If the upgrade the description promises actually happened, this would fail against an HTTP-only host.

Operating System

macOS 26.5.2