zn-gate for OpenCode

Install zn-gate for OpenCode: a small plugin that blocks reads of .env files with values and credential files, scrubs every tool's output and blocks secrets pasted into prompts.

View .md

You need Node.js 18 or later. Paste each line in a terminal and press Enter after each one:

npm install -g zn-gate
zn hooks install opencode

zn-gate installs a small OpenCode plugin. Then restart OpenCode.

What you get

  • Reads of .env files with values, credential files and ~/.zn are blocked in every tool.
  • Every tool's output is scrubbed before the model sees it, and so is the preview in the terminal interface.
  • A secret pasted into a prompt is blocked (OpenCode shows it as an error).
  • If the zn plugin cannot run, calls and messages are blocked.

Limits

  • Not tested on Windows.
  • zn-gate check confirms zn's rules for OpenCode but does not start OpenCode.

Keep your .env values in the vault

The agent cannot read .env files with real values. Move the values into zn-gate's encrypted vault, and the file keeps markers such as __ZN_STRIPE_KEY__:

zn unlock            # creates the vault the first time
zn env shadow .env

After this your own app also reads the markers: start it with zn-gate's run command once you allow it. env shadow tells you how to undo it. More: the vault.

Check that it works

In a new terminal, run zn-gate check. It should show OK for OpenCode. What the output means.