ceos/opencode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(opencode): redact provider model secrets

Browse source
This commit is contained in:
Aiden Cline 2026-06-24 16:58:40 -05:00
commit d3da6b8e27
2 changed files with 43 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

19
packages/opencode/src/config/config.ts
View file

@ -128,6 +128,22 @@ export function toPublicInfo(info: Info): Info {
options: provider.options
? (redactProviderOptions(provider.options) as typeof provider.options)
: undefined,
models: provider.models
? Object.fromEntries(
Object.entries(provider.models).map(([id, model]) => [
id,
{
...model,
options: model.options
? (redactProviderOptions(model.options) as typeof model.options)
: undefined,
headers: model.headers
? Object.fromEntries(Object.keys(model.headers).map((key) => [key, redacted]))
: undefined,
},
]),
)
: undefined,
},
]),
)
@ -168,6 +184,9 @@ export function toPublicInfo(info: Info): Info {
function redactProviderOptions(value: unknown, key?: string): unknown {
const normalized = key?.replaceAll(/[-_]/g, "").toLowerCase()
if (normalized === "headers" && isRecord(value)) {
return Object.fromEntries(Object.keys(value).map((key) => [key, redacted]))
}
if (
normalized &&
(normalized.endsWith("apikey") ||

27
packages/opencode/test/server/httpapi-config.test.ts
View file

@ -71,6 +71,9 @@ describe("config HttpApi", () => {
"CANARY_PROVIDER_API_KEY",
"CANARY_PROVIDER_CLIENT_SECRET",
"CANARY_PROVIDER_NESTED_TOKEN",
"CANARY_PROVIDER_HEADER",
"CANARY_MODEL_API_KEY",
"CANARY_MODEL_HEADER",
"CANARY_MCP_ENV",
"CANARY_MCP_HEADER",
"CANARY_MCP_CLIENT_SECRET",
@ -88,22 +91,31 @@ describe("config HttpApi", () => {
apiKey: "{file:secret-0}",
clientSecret: "{file:secret-1}",
nested: { accessToken: "{file:secret-2}", temperature: 0.5 },
headers: { "x-custom-auth": "{file:secret-3}" },
baseURL: "https://provider.example.com",
},
models: {
canary: {
name: "Canary Model",
status: "active",
options: { apiKey: "{file:secret-4}", temperature: 0.7 },
headers: { "x-custom-auth": "{file:secret-5}" },
},
},
},
},
mcp: {
local: {
type: "local",
command: ["canary-command"],
environment: { TOKEN: "{file:secret-3}" },
environment: { TOKEN: "{file:secret-6}" },
enabled: false,
},
remote: {
type: "remote",
url: "https://mcp.example.com",
headers: { Authorization: "{file:secret-4}" },
oauth: { clientId: "canary-client", clientSecret: "{file:secret-5}", scope: "read" },
headers: { Authorization: "{file:secret-7}" },
oauth: { clientId: "canary-client", clientSecret: "{file:secret-8}", scope: "read" },
enabled: false,
},
},
@ -132,8 +144,17 @@ describe("config HttpApi", () => {
apiKey: "[redacted]",
clientSecret: "[redacted]",
nested: { accessToken: "[redacted]", temperature: 0.5 },
headers: { "x-custom-auth": "[redacted]" },
baseURL: "https://provider.example.com",
},
models: {
canary: {
name: "Canary Model",
status: "active",
options: { apiKey: "[redacted]", temperature: 0.7 },
headers: { "x-custom-auth": "[redacted]" },
},
},
},
},
mcp: {