Opencode maliciously storing state in `.git` index

[MatthewCroughan]

I see that whenever opencode sees it is in a git repo, it will sneak away some files inside of this git repo inside of .git/opencode. How can I turn this functionality off? It's annoying and very rude to put files in there without the user's consent.

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• No trusted workspace functionality leads to arbitrary commands execution on startup #6361: No trusted workspace functionality leads to arbitrary commands execution on startup
• Security Issue - Autoloading Repository Plugins #7163: Security Issue - Autoloading Repository Plugins
• Snapshot feature needs safeguards for large directories (home directory filled disk) #8577: Snapshot feature needs safeguards for large directories (home directory filled disk)
• OpenCode doesnt respect git env vars #8694: OpenCode doesnt respect git env vars

Feel free to ignore if none of these address your specific case.

[rekram1-node]

"snapshot": false in your config, it's used so that you can /undo and /redo changes the agent makes during a conversation

[MatthewCroughan]

For me, (and I'm not the biggest user of advanced tools, IDEs, etc) it seems really unusual and uncool for a tool to start storing state in another program's data structure like .git by default.

Can you point me to other third party tools/programs that do stuff like this, and without asking the user for consent?

[jsageryd]

OpenCode storing a hash in .git/opencode interferes with Git itself; Git thinks it's something it can check out. Minimal example below, but I encountered this trying to checkout+create new branch from a remote branch called origin/opencode; after which git checkout opencode instead checks out the hash in .git/opencode.

$ git version
git version 2.52.0
$ git init foo
$ cd foo
$ touch foo
$ git add foo
$ git commit -m 'Initial commit'
[master (root-commit) 375c6fe45d6d2099] Initial commit
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 foo
$ opencode
$ cat .git/opencode; echo
375c6fe45d6d2099ffb0254a21c64110f628c063

In this state, it's possible to check out opencode:

$ git checkout opencode
HEAD is now at 375c6fe45d6d2099 Initial commit
$ git status
## HEAD (no branch)

Removing .git/opencode fixes it:

$ rm .git/opencode
$ git checkout opencode
error: pathspec 'opencode' did not match any file(s) known to git

[bongcoy]

OpenCode storing a hash in .git/opencode interferes with Git itself; Git thinks it's something it can check out. Minimal example below, but I encountered this trying to checkout+create new branch from a remote branch called origin/opencode; after which git checkout opencode instead checks out the hash in .git/opencode.

$ git version
git version 2.52.0
$ git init foo
$ cd foo
$ touch foo
$ git add foo
$ git commit -m 'Initial commit'
[master (root-commit) 375c6fe45d6d2099] Initial commit
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 foo
$ opencode
$ cat .git/opencode; echo
375c6fe45d6d2099ffb0254a21c64110f628c063

In this state, it's possible to check out opencode:

$ git checkout opencode
HEAD is now at 375c6fe45d6d2099 Initial commit
$ git status
## HEAD (no branch)

Removing .git/opencode fixes it:

$ rm .git/opencode
$ git checkout opencode
error: pathspec 'opencode' did not match any file(s) known to git

I think I have issue with this, when we open Opencode from a project folder, it will create the .git/opencode file again. Then the terminal title in Opencode will have :main affixes. For example: C:\Username\ProjectName:main.

Why this happened to me? Does this happen to you too?

Because I have issue with Opencode can't find my chat sessions if I open Opencode from the project folder and it seems like it happened because of this activity (store state in .git folder)

[hadikoub]

Same issue here, any fix ?

I'm also having an issue that my sessions are not showing, nor can I use opencode. If I delete the .git folder, everything works fine. It seems that the .git/opencode is always created there

[jpalomaki]

"snapshot": false in your config, it's used so that you can /undo and /redo changes the agent makes during a conversation

@rekram1-node Does this actually work? For me (opencode 1.3.10), .git/opencode still gets created, even with that setting