diff --git a/packages/opencode/src/auth/anthropic.ts b/packages/opencode/src/auth/anthropic.ts
index f35d39ad..cd1c2331 100644
--- a/packages/opencode/src/auth/anthropic.ts
+++ b/packages/opencode/src/auth/anthropic.ts
@@ -1,6 +1,8 @@
 import { generatePKCE } from "@openauthjs/openauth/pkce"
 import { Global } from "../global"
 import path from "path"
+import fs from "fs/promises"
+import type { BunFile } from "bun"
 
 export namespace AuthAnthropic {
   const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
@@ -45,7 +47,9 @@ export namespace AuthAnthropic {
       }),
     })
     if (!result.ok) throw new ExchangeFailed()
-    await Bun.write(path.join(Global.Path.data, "anthropic.json"), result)
+    const file = Bun.file(path.join(Global.Path.data, "anthropic.json"))
+    await Bun.write(file, result)
+    await fs.chmod(file.name!, 0o600)
   }
 
   export async function access() {
diff --git a/packages/opencode/src/cli/cmd/run.ts b/packages/opencode/src/cli/cmd/run.ts
index 190796ba..837d4b66 100644
--- a/packages/opencode/src/cli/cmd/run.ts
+++ b/packages/opencode/src/cli/cmd/run.ts
@@ -82,6 +82,8 @@ export const RunCommand = {
               printEvent(UI.Style.TEXT_INFO_BOLD, "Read", args.filePath)
             if (tool === "opencode_write")
               printEvent(UI.Style.TEXT_SUCCESS_BOLD, "Create", args.filePath)
+            if (tool === "opencode_list")
+              printEvent(UI.Style.TEXT_INFO_BOLD, "List", args.path)
             if (tool === "opencode_glob")
               printEvent(
                 UI.Style.TEXT_INFO_BOLD,