diff --git a/.env.test b/.env.test
index db311f6..fe85439 100644
--- a/.env.test
+++ b/.env.test
@@ -6,4 +6,4 @@ TRAP_CCLIBS_TEST_TIMEOUT_WATCHDOG_SECONDS=1
 
 # Test placeholder. The real value is generated in `.env` on first `just install`,
 # or after `just clean` / `just reinstall`.
-TRAP_CCLIBS_OPENCODE_PASSWORD=redacted
+OPENCODE_SERVER_PASSWORD=redacted
diff --git a/Justfile b/Justfile
index ea1194f..55affa3 100644
--- a/Justfile
+++ b/Justfile
@@ -102,8 +102,8 @@ generate-env:
     password="$(openssl rand -hex 32)"
     while IFS= read -r line || [ -n "$line" ]; do
         case "$line" in
-            TRAP_CCLIBS_OPENCODE_PASSWORD=*)
-                printf '%s\n' "TRAP_CCLIBS_OPENCODE_PASSWORD=$password"
+            OPENCODE_SERVER_PASSWORD=*)
+                printf '%s\n' "OPENCODE_SERVER_PASSWORD=$password"
                 ;;
             *)
                 printf '%s\n' "$line"
@@ -214,6 +214,41 @@ trapos-install: check-install
 repl:
     @just trapos --cli
 
+# Serve opencode for remote/browser attachment using repo-local .env secrets.
+[positional-arguments]
+opencode-serve *args:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    repo='{{justfile_directory()}}'
+    if [ -f "$repo/.env" ]; then set -a; . "$repo/.env"; set +a; fi
+    if [ -z "${OPENCODE_SERVER_PASSWORD:-}" ]; then
+        printf '%s\n' 'Missing OPENCODE_SERVER_PASSWORD in .env' >&2
+        exit 1
+    fi
+    export OPENCODE_SERVER_PASSWORD
+    hostname="${TRAP_CCLIBS_OPENCODE_HOSTNAME:-0.0.0.0}"
+    port="${TRAP_CCLIBS_OPENCODE_PORT:-4242}"
+    exec opencode serve --hostname "$hostname" --port "$port" "$@"
+
+# Attach to the local opencode server. Pass a URL first to override the default.
+[positional-arguments]
+opencode-attach *args:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    repo='{{justfile_directory()}}'
+    if [ -f "$repo/.env" ]; then set -a; . "$repo/.env"; set +a; fi
+    if [ -z "${OPENCODE_SERVER_PASSWORD:-}" ]; then
+        printf '%s\n' 'Missing OPENCODE_SERVER_PASSWORD in .env' >&2
+        exit 1
+    fi
+    export OPENCODE_SERVER_PASSWORD
+    port="${TRAP_CCLIBS_OPENCODE_PORT:-4242}"
+    target="http://127.0.0.1:$port"
+    if [ "${1:-}" != "" ]; then
+        case "$1" in http://*|https://*) target="$1"; shift ;; esac
+    fi
+    exec opencode attach "$target" "$@"
+
 # Local CI entry point used by Git hooks. Pass args through to `test`.
 ci *args: check-craftos check check-packages
     @just test {{args}}