OpenCode history: answering an audit or security questionnaire

A customer asks how AI-generated code is reviewed and retained. What do we show them?

Why this is hard

The question has stopped being hypothetical: customer security questionnaires now ask about prompt logging and retention directly. The answer has to be a system rather than a description of good intentions, and it has to cover a period that already happened.

What OpenCode specifically does to you here

Being able to answer an auditor's question with a SQL query is a real advantage over every other tool here. The weakness is durability: one file, no expiry, no second copy, and cp on a live database can capture a torn write.

sqlite3 -readonly ~/.local/share/opencode/opencode.db "PRAGMA integrity_check;"

Where OpenCode keeps this in the first place: ~/.local/share/opencode/opencode.db. One database holds every session, it grows without limit, and nothing else has a copy.

What a working answer looks like

A working answer means a retained, timestamped record you can point at — with a retention policy you chose rather than inherited from a tool's default.

Start by measuring what you have. npx promptwake doctor reports what every AI tool on the machine is holding and how much of it sits inside a deletion window — no account, writes nothing, sends nothing anywhere. If the conclusion is that the record should not depend on one laptop, that is what PromptWake captures: prompt, response and the resulting diff, local by default and synced into a shared timeline on the paid tiers.