anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 10:15:31 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Session accessing .env file without asking the user. Curious what is the default behavior to prevent reading .env files and the likes of it. #2845

New Issue
Closed
opened 2026-02-16 17:37:31 -05:00 by yindo · 6 comments
yindo commented 2026-02-16 17:37:31 -05:00
Owner
Copy Link
Copy Source

Originally created by @raymelon on GitHub (Nov 13, 2025).

Question

I was testing OpenCode on a test LibreChat project, and I noticed that it reads the project's .env file without any warning, nor asking the user to allow it.

OpenCode is in Plan mode (Plan Agent).

Image

.env is in LibreChat's .gitignore as well, so what happened?

.gitignore:

### node etc ###

# Logs
data-node
meili_data*
data/
logs
*.log

# Runtime data
pids
*.pid
*.seed
.git

# CI/CD data
test-image*

# Directory for instrumented libs generated by jscoverage/JSCover
lib-cov

# Coverage directory used by tools like istanbul
coverage

# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
.grunt

# translation services
config/translations/stores/*
client/src/localization/languages/*_missing_keys.json

# Compiled Dirs (http://nodejs.org/api/addons.html)
build/
dist/
public/main.js
public/main.js.map
public/main.js.LICENSE.txt
client/public/images/
client/public/main.js
client/public/main.js.map
client/public/main.js.LICENSE.txt

# Azure Blob Storage Emulator (Azurite)
__azurite**
__blobstorage__/**/*

# Dependency directorys
# Deployed apps should consider commenting these lines out:
# see https://npmjs.org/doc/faq.html#Should-I-check-my-node_modules-folder-into-git
node_modules/
meili_data/
api/node_modules/
client/node_modules/
bower_components/
*.d.ts
!vite-env.d.ts

# AI
.clineignore
.cursor
.aider*

# Floobits
.floo
.floobit
.floo
.flooignore

#config file
librechat.yaml
librechat.yml

# Environment
.npmrc
.env*
my.secrets
!**/.env.example
!**/.env.test.example
cache.json
api/data/
owner.yml
archive
.vscode/settings.json
src/style - official.css
/e2e/specs/.test-results/
/e2e/playwright-report/
/playwright/.cache/
.DS_Store
*.code-workspace
.idx
monospace.json
.idea
*.iml
*.pem
config.local.ts
**/storageState.json
junit.xml
**/.venv/
**/venv/

# docker override file
docker-compose.override.yaml
docker-compose.override.yml

# meilisearch
meilisearch
meilisearch.exe
data.ms/*
auth.json

/packages/ux-shared/
/images

!client/src/components/Nav/SettingsTabs/Data/

# User uploads
uploads/

# owner
release/

# Helm
helm/librechat/Chart.lock
helm/**/charts/
helm/**/.values.yaml

!/client/src/@types/i18next.d.ts

# SAML Idp cert
*.cert

# AI Assistants
/.claude/
/.cursor/
/.copilot/
/.aider/
/.openai/
/.tabnine/
/.codeium
*.local.md

Curious what is the default behavior for the likes of .env files? By default, the agent should never read those files unless explicitly allowed, right?

Originally created by @raymelon on GitHub (Nov 13, 2025). ### Question I was testing OpenCode on a test LibreChat project, and I noticed that it reads the project's .env file without any warning, nor asking the user to allow it. OpenCode is in Plan mode (Plan Agent). <img width="1668" height="598" alt="Image" src="https://github.com/user-attachments/assets/2956e5e6-460d-4c4a-aecb-b49494040c0d" /> `.env` is in LibreChat's `.gitignore` as well, so what happened? `.gitignore`: ``` ### node etc ### # Logs data-node meili_data* data/ logs *.log # Runtime data pids *.pid *.seed .git # CI/CD data test-image* # Directory for instrumented libs generated by jscoverage/JSCover lib-cov # Coverage directory used by tools like istanbul coverage # Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files) .grunt # translation services config/translations/stores/* client/src/localization/languages/*_missing_keys.json # Compiled Dirs (http://nodejs.org/api/addons.html) build/ dist/ public/main.js public/main.js.map public/main.js.LICENSE.txt client/public/images/ client/public/main.js client/public/main.js.map client/public/main.js.LICENSE.txt # Azure Blob Storage Emulator (Azurite) __azurite** __blobstorage__/**/* # Dependency directorys # Deployed apps should consider commenting these lines out: # see https://npmjs.org/doc/faq.html#Should-I-check-my-node_modules-folder-into-git node_modules/ meili_data/ api/node_modules/ client/node_modules/ bower_components/ *.d.ts !vite-env.d.ts # AI .clineignore .cursor .aider* # Floobits .floo .floobit .floo .flooignore #config file librechat.yaml librechat.yml # Environment .npmrc .env* my.secrets !**/.env.example !**/.env.test.example cache.json api/data/ owner.yml archive .vscode/settings.json src/style - official.css /e2e/specs/.test-results/ /e2e/playwright-report/ /playwright/.cache/ .DS_Store *.code-workspace .idx monospace.json .idea *.iml *.pem config.local.ts **/storageState.json junit.xml **/.venv/ **/venv/ # docker override file docker-compose.override.yaml docker-compose.override.yml # meilisearch meilisearch meilisearch.exe data.ms/* auth.json /packages/ux-shared/ /images !client/src/components/Nav/SettingsTabs/Data/ # User uploads uploads/ # owner release/ # Helm helm/librechat/Chart.lock helm/**/charts/ helm/**/.values.yaml !/client/src/@types/i18next.d.ts # SAML Idp cert *.cert # AI Assistants /.claude/ /.cursor/ /.copilot/ /.aider/ /.openai/ /.tabnine/ /.codeium *.local.md ``` Curious what is the default behavior for the likes of .env files? By default, the agent should never read those files unless explicitly allowed, right?
yindo closed this issue 2026-02-16 17:37:31 -05:00
yindo commented 2026-02-16 17:37:31 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Nov 13, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #539: [SECURITY] allow ignoring files to prevent secrets being leaked from .env to LLM - specifically addresses .env file security and suggests .opencodeignore files
  • #3205: Agent should request permission before reading or editing files - same behavior where agents read files without asking permission
  • #3164: Exclude files from being used - asks about excluding password/secret files from being read

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Nov 13, 2025): This issue might be a duplicate of existing issues. Please check: - #539: [SECURITY] allow ignoring files to prevent secrets being leaked from .env to LLM - specifically addresses .env file security and suggests .opencodeignore files - #3205: Agent should request permission before reading or editing files - same behavior where agents read files without asking permission - #3164: Exclude files from being used - asks about excluding password/secret files from being read Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:37:31 -05:00
Author
Owner
Copy Link
Copy Source

@raymelon commented on GitHub (Nov 13, 2025):

This issue might be a duplicate of existing issues. Please check:

Feel free to ignore if none of these address your specific case.

Cool! However, it is concerning that a tool like OpenCode needs a third-party plugin to have a critical functionality like this — such as preventing a known secret store such as .env files from being accessed entirely by OpenCode.

From https://github.com/sst/opencode/issues/539#issuecomment-3522270009:

OpenCode already supports .ignore files, but it's not blocking, for example, the read tool or grep tool from reading from those files. You can check this plugin, https://github.com/lgladysz/opencode-ignore which extends some blocking functionalities for those tools except the bash tool, so, for example, Agent can read a file through the cat command. Gemini CLI is not blocking that, though.

Curious about the deeper decisions behind leaving this functionality unimplemented within OpenCode.

@raymelon commented on GitHub (Nov 13, 2025): > This issue might be a duplicate of existing issues. Please check: > > * [[SECURITY] allow ignoring files to prevent secrets being leaked from .env to LLM #539](https://github.com/sst/opencode/issues/539): [SECURITY] allow ignoring files to prevent secrets being leaked from .env to LLM - specifically addresses .env file security and suggests .opencodeignore files > * [Agent should request permission before reading or editing files #3205](https://github.com/sst/opencode/issues/3205): Agent should request permission before reading or editing files - same behavior where agents read files without asking permission > * [Exclude files from being used #3164](https://github.com/sst/opencode/issues/3164): Exclude files from being used - asks about excluding password/secret files from being read > > Feel free to ignore if none of these address your specific case. Cool! However, it is concerning that a tool like OpenCode needs a third-party plugin to have a critical functionality like this — such as preventing a known secret store such as `.env` files from being accessed entirely by OpenCode. From https://github.com/sst/opencode/issues/539#issuecomment-3522270009: > OpenCode [already supports](https://opencode.ai/docs/tools/#ignore-patterns) `.ignore` files, but it's not blocking, for example, the read tool or grep tool from reading from those files. You can check this plugin, https://github.com/lgladysz/opencode-ignore which extends some blocking functionalities for those tools except the bash tool, so, for example, Agent can read a file through the `cat` command. Gemini CLI is not blocking that, though. Curious about the deeper decisions behind leaving this functionality unimplemented within OpenCode.
yindo commented 2026-02-16 17:37:31 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 13, 2025):

i brought this up before i joined the team a while ago

im making it deny reads to .envs going forward it makes more sense

@rekram1-node commented on GitHub (Nov 13, 2025): i brought this up before i joined the team a while ago im making it deny reads to .envs going forward it makes more sense
yindo commented 2026-02-16 17:37:31 -05:00
Author
Owner
Copy Link
Copy Source

@redtux commented on GitHub (Nov 13, 2025):

It doesn't just read it, it also overwrites it, cries when realizing its mistake, and kindly apologizes. 🤭 Had the same issue yesterday.

@redtux commented on GitHub (Nov 13, 2025): It doesn't just read it, it also overwrites it, cries when realizing its mistake, and kindly apologizes. 🤭 Had the same issue yesterday.
yindo commented 2026-02-16 17:37:31 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 13, 2025):

fixed in next release: https://github.com/sst/opencode/commit/4c2e888709fde5aa870d426cf272c6d00495d5b5

@rekram1-node commented on GitHub (Nov 13, 2025): fixed in next release: https://github.com/sst/opencode/commit/4c2e888709fde5aa870d426cf272c6d00495d5b5
yindo commented 2026-02-16 17:37:31 -05:00
Author
Owner
Copy Link
Copy Source

@pjmartos commented on GitHub (Dec 2, 2025):

Hi team,
I've built a plugin to support excluding sensitive content from the agent's reach: https://github.com/pjmartos/opencode-leak-proof
It honours .aiexclude files at various locations as well as project-root .gitignore files (.gitignore files in subfolders are still not supported).

It's still in kind of an experimental phase, but early results are encouraging.

I would greatly appreciate any feedback you may have.
Cheers.

@pjmartos commented on GitHub (Dec 2, 2025): Hi team, I've built a plugin to support excluding sensitive content from the agent's reach: https://github.com/pjmartos/opencode-leak-proof It honours `.aiexclude` files at various locations as well as project-root `.gitignore` files (`.gitignore` files in subfolders are still not supported). It's still in kind of an experimental phase, but early results are encouraging. I would greatly appreciate any feedback you may have. Cheers.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#2845
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?