fix(review): align falsy merge semantics with original JS

parseToolAllowlist array branch back to || (drop 0/false entries). readFileNumber falls through on 0 like fileConfig.X || default. buildBackendAuthHeaders coerces truthy non-strings via String() as before. Document that Docker images do not bake local config.json.

Author: samson910022

docs/docker.md

@@ -92,6 +92,8 @@ docker run -d \
 
 > 后端 `10001` 仅容器内部使用，不要对外发布（compose 默认也只映射代理端口；改端口用 `OPENCODE_PROXY_PORT`，如 `8090`）。
 
+> 注意：镜像构建时**不会**把本地 `config.json` 烘焙进去（多阶段构建只复制 `dist/` 与依赖，避免把本地密钥带进镜像）。容器内配置请用环境变量，或 `-v ./config.json:/home/node/project/config.json:ro` 挂载（代理会按 `dist/` 同层 → 项目根 → 工作目录顺序查找）。
+
 ### 多架构
 
 `ghcr.io/samson910022/opencode2api:latest` 同时含 `linux/amd64` 与 `linux/arm64`，ARM 机器可直接 pull，无需本地 build（仅自带 `custom-bin/opencode` 二进制时才需按架构重建）。

index.ts

@@ -23,7 +23,10 @@ function parseBool(value: unknown, fallback: boolean): boolean {
 
 function parseToolAllowlist(value: unknown, fallback: string[] = []): string[] {
   if (Array.isArray(value)) {
-    return [...new Set((value as unknown[]).map((entry) => String(entry ?? '').trim()).filter(Boolean))];
+    // NOTE: `||` (not `??`) matches the original JS verbatim: falsy entries
+    // (0/false) stringify to '' and are filtered out instead of becoming
+    // "0"/"false" allowlist entries.
+    return [...new Set((value as unknown[]).map((entry) => String((entry as unknown) || '').trim()).filter(Boolean))];
   }
   if (typeof value === 'string') {
     return [...new Set(value.split(',').map((entry) => entry.trim()).filter(Boolean))];
@@ -96,7 +99,9 @@ function readFileString(key: string, fallback: string): string {
 
 function readFileNumber(key: string, fallback: number): number {
   const v: unknown = fileConfig[key];
-  if (typeof v === 'number' && Number.isFinite(v)) return v;
+  // NOTE: `0` falls through to fallback to match the original
+  // `fileConfig.X || default` semantics verbatim.
+  if (typeof v === 'number' && Number.isFinite(v) && v !== 0) return v;
   if (typeof v === 'string' && v.trim() !== '') {
     const n = parseInt(v, 10);
     if (Number.isFinite(n)) return n;

src/backend/manager.ts

@@ -230,8 +230,10 @@ export function lock(task: unknown, timeout: unknown = 120000): Promise<unknown>
  * Robust Health Check Helper
  */
 export function buildBackendAuthHeaders(password: unknown = ''): Record<string, string> | undefined {
-  if (!password || typeof password !== 'string' || !password) return undefined;
-  const token = Buffer.from(`opencode:${password}`).toString('base64');
+  // NOTE: falsy check (not typeof) matches the original JS verbatim: truthy
+  // non-strings (e.g. numeric 123 from config.json) are coerced via String().
+  if (!password) return undefined;
+  const token = Buffer.from(`opencode:${String(password)}`).toString('base64');
   return { Authorization: `Basic ${token}` };
 }