Repository navigation
[FEATURE]: Managed settings with admin-controlled priority for enterprise #6358
Description
Feature hasn't been suggested before.
- I have verified this feature I'm about to request hasn't been suggested before.
Describe the enhancement you want to request
Problem
Organizations deploying OpenCode to teams need a way to enforce certain settings that users cannot override. Currently, there's no mechanism for administrators to set high-priority configurations that take precedence over user/project settings.
E.g. claude code solves this with /Library/Application Support/ClaudeCode/managed-settings.json - a system-level config file that can be deployed by admins and takes precendence over user rules
Usecases for managed settings
- configuring company-wide approved providers and models
- disabling share functionality to comply with cybersec rules
- disabling autoupdate
Proposed Solution
Add support for a managed settings file, taking precedence over user settings. Meaning that configs will be applied in this priority:
- Managed settings (admin-controlled, read-only for users)
- macOS: /Library/Application Support/opencode/managed-settings.json
- Linux: /etc/opencode/managed-settings.json
- Windows: %ProgramData%\opencode\managed-settings.json
- Project settings (./opencode.json)
- User settings (~/.config/opencode/config.json)
That way the config will override the user provided settings
Activity
github-actions commentedon Dec 29, 2025
This issue might be a duplicate of or related to existing issues. Please check:
Your feature request is more comprehensive as it proposes a hierarchical configuration system with admin-controlled overrides, which goes beyond these individual issues. Feel free to ignore if this specifically addresses a different use case.
thdxr commentedon Dec 30, 2025
yep this was on my list
btw curious at your organization what is the mechanism to distribute that file?
Mishkun commentedon Dec 30, 2025
I believe for macs they use jamf. I'll check and come back
Mishkun commentedon Dec 30, 2025
@thdxr yep, they use jamf to put these files, but this doesn't protect them from being changed by end user really. It is a feasible workaround, but other software is managed by reading userdefaults
Mishkun commentedon Dec 30, 2025
mind if I submit a pr?
mrw commentedon Jan 1, 2026
Thanks for doing this @Mishkun! It's definitely somewhat helpful to add this to
/Library/Application Support/opencode/managed-settings.json, as you're doing in a5479a80588baaf9451254fc71fa59929ea58e24, but I want to echo your point above:End users are going to be able to edit the
managed-settings.jsonfile, but can't edit MDM-enforceduserdefaultssettings, which should always take precedence.@thdxr, regarding your question, we also use Jamf but every MDM out there (Jamf, Mosyle, Kandji, etc...) supports distributing preference overrides in this way. For reference, here's how VS Code handles this: https://code.visualstudio.com/docs/setup/enterprise#_centrally-manage-vs-code-settings
They allow MDM-controlled preference files to override any other settings. For example, here's how it works on macs: https://code.visualstudio.com/docs/setup/enterprise#_configuration-profiles-on-macos
That plist file format (for Macs) or group policy (for Windows) itself isn't something super complex for admins, this is very common and how other software is configured on MDM settings also.
I appreciate your consideration of this! It's definitely very important for us to be able to roll this out more broadly within our company.
scottrbaxter commentedon Jan 6, 2026
Not sure if this is being considered yet, but i don't see it mentioned anywhere above.
Following other standard practice solutions out there (i like to use Ansible as an example, since it's quite granular), the
OPENCODE_CONFIGenv var should take priority over flat files.https://opencode.ai/docs/config/#custom-path
paraddise commentedon Jan 12, 2026
AFAIK to use user defaults we need to have bundle id, otherwise macos won't be able to find our settings. But I think creating application bundle and sign it for macos is a greate improvement in quality of the product. Signed apps seem more secure and can be used in some companies with restrictions to use only signed apps.
paraddise commentedon Jan 15, 2026
Also, I have to mention that it is hard to manage a file on Windows and it is better to use the registry for settings. As an administrator, you can manage registry values for the computer.
feat(config): add managed settings support for enterprise deployments