Report privately through GitHub Security Advisories. Please do not open a public issue for a vulnerability.

It runs inside the OpenCode background service with the same user privileges as OpenCode itself. Specifically it:

• reads the active built-in OpenAI credential after a ChatGPT OAuth login,
• stores pooled OAuth credentials under $XDG_DATA_HOME/opencode2-chatgpt-pool/accounts.json (default ~/.local/share/...),
• refreshes pooled tokens through https://auth.openai.com/oauth/token, and
• replaces the bearer token and chatgpt-account-id header on OpenAI model requests.

It does not send credentials anywhere except OpenAI's authentication and Codex endpoints, run shell commands, or expose account-management tools by default.

The pool contains bearer and refresh tokens in plaintext, like OpenCode's own local credential store. The plugin forces the directory to mode 0700 and the file to mode 0600, but anything already able to read files as your user can read those tokens. Protect backups and do not share the file.

Invalid pool data is rejected rather than silently overwritten.

Releases publish from GitHub Actions using npm trusted publishing (OIDC), so no long-lived npm token remains after the one-shot bootstrap release. Published versions carry npm provenance attestations. Verify with:

npm audit signatures

CI pins actions to commit SHAs and installs dependencies with --frozen-lockfile --ignore-scripts.