Feature Request: Secret/Incognito Mode for Session Privacy #12766

Summary

When conversations are stored locally on disk (~/.local/share/opencode/storage/), there is a risk of sensitive information being exposed if the device is sold, lost, or accessed by unauthorized users. Session data may contain API keys, credentials, proprietary code, and other sensitive information discussed during development.

Request: Add a "Secret Mode" (or Incognito Mode) that prevents conversation sessions from being persisted to disk.

Motivation

• Device resale/disposal: Users may forget to wipe session data before selling or disposing of their machines
• Device loss/theft: Locally stored conversation history becomes immediately accessible
• Shared workstations: Multiple users on the same machine could access each other's session history
• Compliance: Some organizations require that sensitive development conversations are not persisted

Current Behavior

All conversations are automatically saved to ~/.local/share/opencode/storage/ with no way to disable persistence. Users can delete sessions after the fact (Ctrl+D in TUI), but there is no way to prevent saving in the first place.

Proposed Solutions

Any of the following would address this concern (in order of preference):

1. CLI Flag: --ephemeral or --incognito

opencode --ephemeral

Sessions run with this flag are kept in memory only and never written to disk.

2. Config Option: session.persist

{
  "session": {
    "persist": false
  }
}

3. Environment Variable

OPENCODE_EPHEMERAL=true opencode

4. TUI Command: /incognito

Toggle incognito mode within a running session — new messages after toggling are not persisted.

Additional Context

• The existing Ctrl+D delete is a mitigation but not a prevention — data is still written to disk temporarily
• Similar tools (web browsers, messaging apps) offer incognito/secret modes for exactly this reason
• Even brief disk writes can be recovered with forensic tools, so in-memory-only mode is preferred