Repository navigation
agent: writing a file via the write tool leaks secret content into the visible transcript #51907
Description
Summary
When the agent uses the write tool to persist content containing a secret
(e.g. a plaintext database password), the full tool-call parameters — including
the secret — are rendered into the visible conversation transcript. Deleting
the resulting file afterward does not remove the secret from the transcript/
session history, so there is currently no safe way for an agent to write
sensitive data to disk on the user's behalf without also permanently leaking
it into logs.
Environment
- opencode version: 1.18.15
- OS: Darwin 25.6.0 (darwin arm64)
- Terminal: TERM=xterm-256color (TERM_PROGRAM/COLORTERM unset)
- Shell: /bin/zsh
- Install/channel: Unavailable: not exposed by
opencode --version - Active plugins: None found in config
Reproduction
- Ask the agent to fetch a secret (e.g. a credential from a secrets manager)
and use thewritetool to save it to a file. - Observe the tool-call parameters (including the secret) are rendered in
full in the conversation transcript. - Delete the file afterward — the secret remains visible in the transcript/
session history with no redaction.
Expected Behavior
Tool inputs/outputs known to contain sensitive values should be maskable/
redactable in the rendered transcript (e.g. a way to mark content as sensitive
so it's stored but not echoed in full), rather than always being fully
rendered.
Actual Behavior
Secret values passed to the write tool are fully visible in transcript/
session logs with no built-in redaction mechanism, independent of whether the
underlying file is later deleted.
Additional Context
No plugins were involved; this is core tool-call rendering behavior.
Activity
github-actions commentedon Sep 28, 2026
This issue might be a duplicate of existing issues. Please check:
writetool arguments remaining visible in the transcript.big-andy-coates commentedon Sep 29, 2026
Doesn't look like a duplicate - this is the write tool outputting senstive info - it wouldn't know its parameters were sensetive.
opencodejr commentedon Oct 28, 2026
Thanks for the detailed report, @big-andy-coates.
You're on 1.18.15, which is OpenCode v1. v1 only gets fixes for critical bugs, so this is unlikely to change there. The transcript showing a tool call's full parameters (including
writecontent) is how the app is built to work today. Adding a way to mark values as sensitive so they're stored but not shown would be a new feature, not a fix.For now, you can keep the secret out of the transcript by having a shell command move it straight into the file instead of passing it to
write. For example, ask the agent to run your secrets manager's CLI and redirect its output to the file, so the value never becomes a tool parameter. Note that the output of whatever command the agent runs is also shown, so the command must not print the secret.We'd encourage upgrading to v2 (
@opencode/cli), where active development happens. If you can reproduce this on v2, or believe it's critical, reply here and we'll take another look.Related issues, ordered by how closely they match:
opencodejr commentedon Oct 29, 2026
Closing this as not planned, since there's been no reply. The report is about OpenCode v1 (1.18.15), which only gets critical fixes. A way to mark tool inputs as sensitive so they aren't shown in the transcript would be a new feature, not a fix. Until then, a shell command that moves the secret straight into the file keeps it out of the
writeparameters.If you see the same thing on v2 (
@opencode/cli), or think it's critical, please reply here or open a new issue with the v2 version. Related: #30433, #50904, #59571, #57213. Thanks again for the detailed report!