opencode-secret-tools

Configurable secret bridge for OpenCode.

Provides list_secrets, get_secret, and clear_secret tools that shell out to any CLI-based secret store. After a secret is loaded into the environment, a tool.execute.after hook redacts its value from all subsequent tool outputs before they reach the LLM.

Install

Add to your OpenCode config at ~/.config/opencode/config.json:

{
  "plugin": ["@renjfk/opencode-secret-tools"]
}

Configuration

{
  "plugin": [
    [
      "@renjfk/opencode-secret-tools",
      {
        "folder": "Secrets",
        "listCmd": ["rbw", "list", "--fields", "name,folder"],
        "getCmd": ["rbw", "get", "--folder", "Secrets", "{name}"]
      }
    ]
  ]
}

Options

| Option | Required | Description | | --------- | -------- | ----------------------------------------------------------------------------------------- | | listCmd | Yes | Command returning secret names. One per line, or TSV name\tfolder when folder is set. | | getCmd | Yes | Command returning the secret value. {name} is replaced at runtime. | | folder | No | Filter listCmd output to this folder. If omitted, every line is treated as a name. |

Tools

• list_secrets({}) — run listCmd, parse and filter, return names.
• get_secret({ name }) — run getCmd with {name} replaced, inject into process.env, track value for redaction.
• clear_secret({ name }) — delete from process.env, stop tracking.

How it works

1. User configures listCmd and getCmd for their vault CLI (e.g. rbw, op, gopass).
2. list_secrets runs listCmd, parses the output (optionally filtering by folder), and returns names.
3. get_secret runs getCmd with {name} replaced, injects the value into process.env, and tracks it for redaction.
4. tool.execute.after replaces tracked values with [REDACTED: {name}] in output, title, and metadata of all tools except list_secrets.
5. clear_secret removes the env var and stops tracking.
6. Values shorter than 4 characters are not redacted to avoid false positives.

Contributing

opencode-secret-tools is open to contributions and ideas!

Issue conventions

Format: type: brief description

• feat: new features or functionality
• fix: bug fixes
• enhance: improvements to existing features
• chore: maintenance tasks, dependencies, cleanup
• docs: documentation updates
• build: build system, CI/CD changes

Development

npm run test         # node --test
npm run check        # lint + fmt
npm run lint         # oxlint
npm run fmt          # oxfmt --check
npm run fmt:fix      # oxfmt --write

Test local plugin in OpenCode

To test unpublished changes in the OpenCode TUI, point ~/.config/opencode/config.json at the local repo path, not the npm package name:

{
  "plugin": ["/Users/your-user/opencode-secret-tools/index.js"]
}

Release process

Manual releases via opencode; see RELEASE_PROCESS.md.

License

This project is licensed under the MIT License.