anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-23 02:36:57 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

add ability to load secrets from external command or environment variables in the config file #162

New Issue
Open
opened 2026-02-16 17:25:30 -05:00 by yindo · 8 comments
yindo commented 2026-02-16 17:25:30 -05:00
Owner
Copy Link
Copy Source

Originally created by @adikari on GitHub (Jun 19, 2025).

Originally assigned to: @thdxr on GitHub.

I have all my dotfiles in a github repository. I want the opencode configuration to be part of my dotfiles. I am using github mcp which requires the github personal access token so I cant commit the file.

Can we make the config file to

  1. evaluate environment variables OR
  2. evaluate command (eg pass)
Originally created by @adikari on GitHub (Jun 19, 2025). Originally assigned to: @thdxr on GitHub. I have all my dotfiles in a github repository. I want the opencode configuration to be part of my dotfiles. I am using github mcp which requires the github personal access token so I cant commit the file. Can we make the config file to 1. evaluate environment variables OR 2. evaluate command (eg pass)
yindo commented 2026-02-16 17:25:30 -05:00
Author
Owner
Copy Link
Copy Source

@thdxr commented on GitHub (Jun 19, 2025):

i believe opencode will load .env files - does that help? typically we try to avoid too much env loading as people always have complex wasy they want to load the env

can you ensure the env is loaded before opencode starts? if not we can figure something out

@thdxr commented on GitHub (Jun 19, 2025): i believe opencode will load `.env` files - does that help? typically we try to avoid too much env loading as people always have complex wasy they want to load the env<br><br>can you ensure the env is loaded before opencode starts? if not we can figure something out
yindo commented 2026-02-16 17:25:30 -05:00
Author
Owner
Copy Link
Copy Source

@adikari commented on GitHub (Jun 20, 2025):

Actually, I ended up doing it differently which works perfectly for my use case. I added a bash script that uses pass to dynamically load the github token, then use the base script as local tool.

Example for others who run into similar issue

# /home/user/.config/opencode/commands/github
#!/bin/bash
TOKEN=$(pass personal/github_token)
docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN=$TOKEN ghcr.io/github/github-mcp-server

"mcp": {
    "github": {
        "type": "local",
        "command": ["/home/user/.config/opencode/commands/github"]
    }
}

@thdxr i did not try the .env route. I had the variable loaded in my shell via .zshrc and it did not work. The script solution works fine for my usecase, so feel free to close this issue if you dont want to investigate further into environment variables.

@adikari commented on GitHub (Jun 20, 2025): Actually, I ended up doing it differently which works perfectly for my use case. I added a bash script that uses pass to dynamically load the github token, then use the base script as local tool. Example for others who run into similar issue ```bash # /home/user/.config/opencode/commands/github #!/bin/bash TOKEN=$(pass personal/github_token) docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN=$TOKEN ghcr.io/github/github-mcp-server ``` ``` "mcp": { "github": { "type": "local", "command": ["/home/user/.config/opencode/commands/github"] } } ``` @thdxr i did not try the .env route. I had the variable loaded in my shell via .zshrc and it did not work. The script solution works fine for my usecase, so feel free to close this issue if you dont want to investigate further into environment variables.
yindo commented 2026-02-16 17:25:30 -05:00
Author
Owner
Copy Link
Copy Source

@aspiers commented on GitHub (Jun 28, 2025):

See also #318 and #342.

@aspiers commented on GitHub (Jun 28, 2025): See also #318 and #342.
yindo commented 2026-02-16 17:25:30 -05:00
Author
Owner
Copy Link
Copy Source

@caleb-reyes-op commented on GitHub (Dec 15, 2025):

I'm also having the same issue with .zshrc -- I have my .env sourced, with all values printable in my terminal, but they arent being loaded in opencode:

expected:

"context7": {
      "type": "remote",
      "url": "https://mcp.context7.com/mcp",
      "headers": {
        "CONTEXT7_API_KEY": "{env:CONTEXT7_API_KEY}"
      },
      "enabled": true
},

opencode debug config:

"context7": {
      "type": "remote",
      "url": "https://mcp.context7.com/mcp",
      "enabled": true,
      "headers": {
        "CONTEXT7_API_KEY": ""
}

the API key is printable in my shell.

@caleb-reyes-op commented on GitHub (Dec 15, 2025): I'm also having the same issue with .zshrc -- I have my .env sourced, with all values printable in my terminal, but they arent being loaded in opencode: expected: ```json "context7": { "type": "remote", "url": "https://mcp.context7.com/mcp", "headers": { "CONTEXT7_API_KEY": "{env:CONTEXT7_API_KEY}" }, "enabled": true }, ``` opencode debug config: ```json "context7": { "type": "remote", "url": "https://mcp.context7.com/mcp", "enabled": true, "headers": { "CONTEXT7_API_KEY": "" } ``` the API key is printable in my shell.
yindo commented 2026-02-16 17:25:30 -05:00
Author
Owner
Copy Link
Copy Source

@betaboon commented on GitHub (Jan 14, 2026):

https://github.com/olimorris/codecompanion.nvim uses a syntax like this {cmd:pass some-token} which is quite nice.

@betaboon commented on GitHub (Jan 14, 2026): https://github.com/olimorris/codecompanion.nvim uses a syntax like this `{cmd:pass some-token}` which is quite nice.
yindo commented 2026-02-16 17:25:30 -05:00
Author
Owner
Copy Link
Copy Source

@EvanNotFound commented on GitHub (Jan 17, 2026):

I agree this feature will be pretty helpful, because in this way I can e.g. use 1Password cli to retrieve secrets, and never store the secrets locally.

right now i am using an approach where i put all my keys inside .secrets directory and use file references {file:./.secrets/xxx.key} to inject them. this way i can commit my opencode config to my private remote repo

@EvanNotFound commented on GitHub (Jan 17, 2026): I agree this feature will be pretty helpful, because in this way I can e.g. use 1Password cli to retrieve secrets, and never store the secrets locally. right now i am using an approach where i put all my keys inside `.secrets` directory and use file references `{file:./.secrets/xxx.key}` to inject them. this way i can commit my opencode config to my private remote repo
yindo commented 2026-02-16 17:25:30 -05:00
Author
Owner
Copy Link
Copy Source

@liby commented on GitHub (Jan 19, 2026):

opencode will load .env files

Heads-up: the packaged CLI currently does NOT auto-load project .env files. It only reads existing environment variables.

Dev build sets autoloadDotenv: false, and earlier builds used --env-file="".

So {env:VAR} resolves only if the env var is already set before opencode starts. The docs line about project .env looks outdated.

@liby commented on GitHub (Jan 19, 2026): > opencode will load `.env` files Heads-up: the packaged CLI currently does NOT auto-load project `.env` files. It only reads existing environment variables. Dev build sets [`autoloadDotenv: false`](https://github.com/anomalyco/opencode/blob/dev/packages/opencode/script/build.ts#L137), and earlier builds used [`--env-file=""`](https://github.com/anomalyco/opencode/commit/ff1f4d6bf9fead4683c8ae32da9d6522119783ad). So `{env:VAR}` resolves only if the env var is already set before opencode starts. [The docs line about project `.env` looks outdated.](https://github.com/anomalyco/opencode/pull/9372/files)
yindo commented 2026-02-16 17:25:30 -05:00
Author
Owner
Copy Link
Copy Source

@nikaro commented on GitHub (Jan 20, 2026):

Did not found this issue before, so i closed mine.

Here is the associated PR: https://github.com/anomalyco/opencode/pull/8917

@thdxr do you mind taking a look at it?

@nikaro commented on GitHub (Jan 20, 2026): Did not found this issue before, so i closed mine. Here is the associated PR: https://github.com/anomalyco/opencode/pull/8917 @thdxr do you mind taking a look at it?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#162
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?