How to Find and Interpret OpenCode Forensic Artifacts
Summary
The article identifies OpenCode’s Windows configuration and data folders and explains how its configuration files, authentication data, and SQLite database can help investigators examine agent use and session history.
Key points
- On Windows, OpenCode configuration is stored in C:\Users\<username>\.config\opencode; opencode.json can identify configured providers, plugins, and MCPs.
- OpenCode’s data folder is C:\Users\<username>\.local\share\opencode.
- The data folder includes auth.json, which contains authentication information such as API keys.
- The opencode.db SQLite database stores sessions, messages, projects, and workspaces.
- The session table includes session identifiers, titles, timestamps, sharing status, model and provider information, and token counts.
- In the part table, text entries with timing data represent model responses; text entries without that timing data represent user messages.
Article Details
- Defense Focus
- Forensic identification and reconstruction of OpenCode use from its configuration and cached data artifacts.
- Detection Methods
- Inspect opencode.json for configured external providers, plugins, and MCPs.
- Examine opencode.db tables for session, project, workspace, and message history.
- Use the part table's data.type and presence or absence of data.time to distinguish model responses from user messages.
- Correlate part.session_id with session.id to associate messages with sessions and their model information.
- Data Sources
- C:\Users\<username>\.config\opencode\opencode.json
- C:\Users\<username>\.local\share\opencode\auth.json
- C:\Users\<username>\.local\share\opencode\opencode.db, including the session and part tables
- Platforms
- Windows
- Defensive Actions
- Preserve and examine OpenCode configuration and data folders during forensic investigations.
- Review auth.json for authentication information, including API keys, and handle discovered credentials securely.
- Use session fields such as title, share_url, timestamps, model, provider, and token counts to characterize recorded sessions.
- Use message text and timestamps in the part table to reconstruct user messages and model responses.