Commit a project opencode.json: on an untrusted clone

Tip: Share team defaults

Put model, MCP, and permission defaults in the repo. Keep network and write on ask until you read skills and MCP.

{ "model": "anthropic/claude-sonnet-4-6", "autoupdate": false }

Gotcha: User config silently winning (on an untrusted clone)

Know the merge order before you debug it-works-on-my-machine. A malicious skill is an install script; YOLO permissions are how it runs.

/* ~/.config/opencode may shadow keys */

Source: https://opencode.ai/docs/config