anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Config variables in opencode.json overwritten with actual values on start up #6600

New Issue
Open
opened 2026-02-16 18:04:42 -05:00 by yindo · 7 comments
yindo commented 2026-02-16 18:04:42 -05:00
Owner
Copy Link
Copy Source

Originally created by @spenceforce on GitHub (Jan 17, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

I set api keys following guidance on variables in config files here. When I start opencode, the variables are overwritten with the actual value in opencode.json.

This defeats the purpose of using variables to keep secrets outside of opencode.json and makes it impossible to commit opencode.json as it can expose secrets.

Plugins

No response

OpenCode version

1.1.25

Steps to reproduce

  1. Use the env variable in opencode.json for a provider API key.
  2. Start opencode.
  3. Reload opencode.json to see if the variable was replaced with the actual value.

Screenshot and/or share link

No response

Operating System

Ubuntu 25.10

Terminal

Ubuntu terminal

Originally created by @spenceforce on GitHub (Jan 17, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description I set api keys following guidance on variables in config files [here](https://opencode.ai/docs/config/#variables). When I start opencode, the variables are overwritten with the actual value in `opencode.json`. This defeats the purpose of using variables to keep secrets outside of `opencode.json` and makes it impossible to commit `opencode.json` as it can expose secrets. ### Plugins _No response_ ### OpenCode version 1.1.25 ### Steps to reproduce 1. Use the `env` variable in `opencode.json` for a provider API key. 2. Start opencode. 3. Reload `opencode.json` to see if the variable was replaced with the actual value. ### Screenshot and/or share link _No response_ ### Operating System Ubuntu 25.10 ### Terminal Ubuntu terminal
yindo added the bugdocs labels 2026-02-16 18:04:42 -05:00
yindo commented 2026-02-16 18:04:43 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 17, 2026):

This issue might be a duplicate of or related to existing issues. Please check:

  • #231: add ability to load secrets from external command or environment variables in the config file
  • #5299: {env:...} variable substitution inconsistently fails for specific MCP server URLs
  • #5054: {env:MY_VAR} support in agent yaml
  • #5423: Store provider credentials in environment variables
  • #4961: Feature Request: Zero-Trust Architecture for Environment Variable Security

These issues all relate to how environment variables and secrets are handled in configuration files. If your case is specific to the overwriting behavior you described, it may be a distinct bug worth investigating separately.

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Jan 17, 2026): This issue might be a duplicate of or related to existing issues. Please check: - #231: add ability to load secrets from external command or environment variables in the config file - #5299: {env:...} variable substitution inconsistently fails for specific MCP server URLs - #5054: {env:MY_VAR} support in agent yaml - #5423: Store provider credentials in environment variables - #4961: Feature Request: Zero-Trust Architecture for Environment Variable Security These issues all relate to how environment variables and secrets are handled in configuration files. If your case is specific to the overwriting behavior you described, it may be a distinct bug worth investigating separately. Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 18:04:43 -05:00
Author
Owner
Copy Link
Copy Source

@cravenceiling commented on GitHub (Jan 17, 2026):

I couldn't reproduce this. Where is your opencode.json file? Also, what is the output of opencode debug config? Does your api key appear there?

@cravenceiling commented on GitHub (Jan 17, 2026): I couldn't reproduce this. Where is your `opencode.json` file? Also, what is the output of `opencode debug config`? Does your api key appear there?
yindo commented 2026-02-16 18:04:43 -05:00
Author
Owner
Copy Link
Copy Source

@spenceforce commented on GitHub (Jan 17, 2026):

This happens in .config/opencode/opencode.json and my project specific opencode.json. I put the {env:API_KEY} back and when I opened opencode it didn't change it. But when I removed "$schema": "https://opencode.ai/config.json" from opencode.json and restarted opencode, it replaced the variable again. I assume it reads the config, then rewrites it if "$schema": "https://opencode.ai/config.json" is missing and writes the values for each field instead of the original string.

@spenceforce commented on GitHub (Jan 17, 2026): This happens in `.config/opencode/opencode.json` and my project specific `opencode.json`. I put the `{env:API_KEY}` back and when I opened opencode it didn't change it. But when I removed `"$schema": "https://opencode.ai/config.json"` from `opencode.json` and restarted opencode, it replaced the variable again. I assume it reads the config, then rewrites it if `"$schema": "https://opencode.ai/config.json"` is missing and writes the values for each field instead of the original string.
yindo commented 2026-02-16 18:04:43 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 17, 2026):

yes that is the case, if that schema field is missing

@rekram1-node commented on GitHub (Jan 17, 2026): yes that is the case, if that schema field is missing
yindo commented 2026-02-16 18:04:43 -05:00
Author
Owner
Copy Link
Copy Source

@spenceforce commented on GitHub (Jan 17, 2026):

Ok, thats a security issue. Opencode should never write secrets to its config files. I find it odd that it rewrites my config at all instead of using a default value for "$schema" considering it uses default values for everything else.

@spenceforce commented on GitHub (Jan 17, 2026): Ok, thats a security issue. Opencode should never write secrets to its config files. I find it odd that it rewrites my config at all instead of using a default value for `"$schema"` considering it uses default values for everything else.
yindo commented 2026-02-16 18:04:43 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 17, 2026):

fixed: https://github.com/anomalyco/opencode/commit/052f887a9a7aaf79d9f1a560f9b686d59faa8348

@rekram1-node commented on GitHub (Jan 17, 2026): fixed: https://github.com/anomalyco/opencode/commit/052f887a9a7aaf79d9f1a560f9b686d59faa8348
yindo commented 2026-02-16 18:04:43 -05:00
Author
Owner
Copy Link
Copy Source

@spenceforce commented on GitHub (Jan 18, 2026):

Awesome, thank you!

@spenceforce commented on GitHub (Jan 18, 2026): Awesome, thank you!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug docs
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#6600
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?