What the the purpose of this comment? Neither of those "red flags" you linked to are related (one is about config loading precedence, and the other is about Codex CLI, which is completely a completely different product and development team.

Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.

Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.