docs: refresh for OpenCode v1.17.13, add Go coverage, and rebrand

.github/ISSUE_TEMPLATE/config.yml

@@ -7,5 +7,5 @@ contact_links:
     url: https://opencode.ai/docs
     about: Official documentation.
   - name: OpenCode community Discord
-    url: https://discord.gg/opencode
+    url: https://opencode.ai/discord
     about: Real-time chat with the OpenCode community.

.github/PULL_REQUEST_TEMPLATE.md

@@ -22,9 +22,9 @@ Drive-by claims without sources will get held until they can be verified.
 
 ## Checklist
 
-- [ ] I read [`CONTRIBUTING.md`](../CONTRIBUTING.md)
+- [ ] I read [`CONTRIBUTING.md`](https://github.com/wesammustafa/OpenCode-Everything-You-Need-to-Know/blob/main/CONTRIBUTING.md)
 - [ ] Every factual claim cites a source (in the PR or inline in the doc)
 - [ ] In-page anchors and cross-doc links still resolve
 - [ ] No trailing whitespace; code fences have language tags
-- [ ] Emoji follow the [`AGENTS.md` policy](../AGENTS.md#style-conventions) (H2 navigation + callout prefixes only)
+- [ ] Emoji follow the [`AGENTS.md` policy](https://github.com/wesammustafa/OpenCode-Everything-You-Need-to-Know/blob/main/AGENTS.md#style-conventions) (H2 navigation + callout prefixes only)
 - [ ] If I touched the README, I updated the "Last reviewed" line at the bottom

.markdownlint.json

@@ -8,6 +8,7 @@
   "MD026": { "punctuation": ".,;:" },
   "MD028": false,
   "MD029": false,
+  "MD060": false,
   "MD033": false,
   "MD036": false,
   "MD040": false,

.opencode/agents/code-reviewer.md

@@ -1,7 +1,7 @@
 ---
 description: Senior code reviewer — reads diffs and surfaces bugs, security issues, and maintainability problems without modifying files.
 mode: subagent
-model: anthropic/claude-sonnet-4-5
+model: anthropic/claude-sonnet-5
 temperature: 0.1
 permission:
   edit: deny

.opencode/agents/security-auditor.md

@@ -1,7 +1,7 @@
 ---
 description: Security-focused reviewer — audits code for vulnerabilities (OWASP Top 10, secret leaks, auth/authz issues) and reports findings without modifying files.
 mode: subagent
-model: anthropic/claude-sonnet-4-5
+model: anthropic/claude-sonnet-5
 temperature: 0.1
 permission:
   edit: deny

.opencode/commands/pr.md

@@ -7,9 +7,9 @@ Create a pull request from the current branch:
 
 1. Read the current state:
 
-!git status --short
-!git log main..HEAD --oneline
-!git diff main...HEAD --stat
+!`git status --short`
+!`git log main..HEAD --oneline`
+!`git diff main...HEAD --stat`
 
 2. Decide on a PR title:
    - Match the repo's conventional-commits style (`feat:`, `fix:`, `refactor:`, `docs:`, …)

.opencode/commands/review.md

@@ -8,7 +8,7 @@ Run a code review with these inputs:
 - Scope: `$ARGUMENTS` if provided, otherwise the current branch's diff vs `main`.
 - Changed files (always check):
 
-!git diff --name-only main...HEAD
+!`git diff --name-only main...HEAD`
 
 For each changed file, evaluate (in this order):
 

.opencode/commands/test.md

@@ -7,7 +7,7 @@ Run the project test suite and triage failures.
 
 1. Detect the runner from the repo and run it:
 
-!cat package.json 2>/dev/null | grep -E '"test"|"scripts"' | head -5
+!`cat package.json 2>/dev/null | grep -E '"test"|"scripts"' | head -5`
 
 Pick the right command:
 
@@ -17,9 +17,7 @@ Pick the right command:
 - `cargo test` for Rust
 - Other: read the project's `AGENTS.md` for the canonical command
 
-2. Run it and capture the output:
-
-!{the chosen test command}
+2. Run the chosen test command with the bash tool and capture the output. (Shell injections like the one above expand *before* the model runs, so the command you picked in step 1 has to be run as a normal tool call, not a template.)
 
 3. If everything passes, print a one-line summary and stop.
 

.opencode/plugins/README.md

@@ -33,7 +33,7 @@ Sample line:
 Three options:
 
 1. Move the plugin file out of `.opencode/plugins/`.
-2. Comment out the `export default` line.
+2. Comment out **all** exports in the file (every export is loaded, so a leftover one keeps the plugin alive) — or rename the file to a non-`.js`/`.ts` extension.
 3. Gate the body of the plugin on an env var:
 
    ```js

.opencode/plugins/audit-log.js

@@ -31,5 +31,3 @@ export const AuditLog = async ({ directory }) => {
     },
   };
 };
-
-export default AuditLog;

.opencode/plugins/protect-secrets.js

@@ -5,7 +5,7 @@
 // on top of `external_directory: deny` and gitignore — never your only line
 // of defense, but a useful one.
 
-const SENSITIVE = /(^|\/)(\.env(\..*)?|secrets|credentials|id_rsa|id_ed25519|\.npmrc|\.pypirc)(\b|\/)/i;
+const SENSITIVE = /(^|[\s\/"'=])(\.env(\.[^\s]*)?|secrets|credentials|id_rsa|id_ed25519|\.npmrc|\.pypirc)(\b|\/)/i;
 
 // Pull the most likely path/command field out of a tool's arguments.
 // `read`/`edit`/`write` use `filePath`; `bash` uses `command`; others vary.
@@ -36,5 +36,3 @@ export const ProtectSecrets = async () => {
     },
   };
 };
-
-export default ProtectSecrets;

AGENTS.md

@@ -13,7 +13,9 @@ A practical, opinionated guide to using [OpenCode](https://opencode.ai) — READ
 ├── README.md                       # Main guide (the centerpiece)
 ├── AGENTS.md                       # This file
 ├── CONTRIBUTING.md                 # How to contribute
+├── SECURITY.md · CODE_OF_CONDUCT.md
 ├── LICENSE                         # MIT
+├── opencode.json · tui.json        # Example configs with safe defaults
 ├── docs/
 │   ├── quickstart.md               # 5-minute getting-started
 │   ├── zen.md                      # Zen model gateway details
@@ -25,22 +27,24 @@ A practical, opinionated guide to using [OpenCode](https://opencode.ai) — READ
 │   ├── mcp.md                      # MCP integration
 │   ├── workflows.md                # Real-world recipes
 │   ├── migration.md                # Migration from Claude Code / Cursor
-│   ├── faq.md                      # FAQ + troubleshooting
 │   └── reference/
 │       ├── cli.md                  # All CLI commands
 │       ├── slash-commands.md       # All TUI slash commands
 │       ├── permissions.md          # Permission model
 │       ├── changelog.md            # OpenCode releases
+│       ├── faq.md                  # FAQ + troubleshooting
 │       └── further-reading.md      # External resources
 ├── .opencode/
 │   ├── agents/                     # Example custom agents
 │   ├── commands/                   # Example custom commands
+│   ├── plugins/                    # Example plugins (audit log, secret blocker)
 │   └── skills/                     # Example agent skills
+├── .github/                        # CI (lint-docs.yml), issue/PR templates
 ├── mcp-servers/                    # MCP server walkthroughs
 ├── specialized-agents/             # Drop-in specialist prompts
-│   ├── system-prompts/             # System prompts (10 roles)
+│   ├── system-prompts/             # System prompts (7 roles)
 │   └── descriptions/               # Role descriptions
-└── Images/                         # Diagrams and screenshots
+└── Images/                         # Banner, diagrams, screenshots
 ```
 
 ## Editing rules
@@ -93,14 +97,17 @@ A practical, opinionated guide to using [OpenCode](https://opencode.ai) — READ
 
 ## Commands
 
-This repo has no build/test stack — it's pure markdown. Useful housekeeping:
+No build step, but CI (`.github/workflows/lint-docs.yml`) lints every push/PR to `main`. Run the same checks locally before committing:
 
 ```bash
-# Spell-check (if installed)
-codespell README.md docs/
+# Markdown lint (config: .markdownlint.json)
+npx markdownlint-cli2 "**/*.md"
 
-# Find broken internal links
-grep -nE '\]\(#[a-z0-9-]+\)' README.md docs/*.md
+# Spell-check (ignore list: .github/codespell-ignore.txt)
+codespell --ignore-words=.github/codespell-ignore.txt --skip="./LICENSE,./.git,./node_modules" .
+
+# Link check (config: .github/markdown-link-check.json)
+npx markdown-link-check -c .github/markdown-link-check.json README.md
 ```
 
 ## How OpenCode should work in this repo

CODE_OF_CONDUCT.md

@@ -30,7 +30,7 @@ This Code of Conduct applies within all project spaces — issues, pull requests
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the maintainers by opening a confidential issue or contacting the repository owner directly. All complaints will be reviewed and investigated promptly and fairly.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the maintainers by contacting the repository owner directly via their GitHub profile. (For security issues specifically, use [GitHub's private vulnerability reporting](https://github.com/wesammustafa/OpenCode-Everything-You-Need-to-Know/security/advisories/new) instead — see [`SECURITY.md`](SECURITY.md).) All complaints will be reviewed and investigated promptly and fairly.
 
 Maintainers are obligated to respect the privacy and security of the reporter of any incident.
 

CONTRIBUTING.md

@@ -62,19 +62,24 @@ A good system prompt has:
 
 Add the matching short description under [`specialized-agents/descriptions/`](specialized-agents/descriptions/) and update the table in [`specialized-agents/README.md`](specialized-agents/README.md).
 
-## Local check
+## Local checks
 
-There's no build system to run, but a quick mental checklist before submitting:
+CI (`.github/workflows/lint-docs.yml`) runs markdownlint, a link check, and a spell check on every PR. Run the same checks locally before submitting:
 
-- [ ] All links resolve (in-page anchors and external URLs)
-- [ ] Code fences have language tags
-- [ ] No trailing whitespace
-- [ ] No emoji clutter
-- [ ] Facts cite a source
+```bash
+# Markdown lint (same rules as CI)
+npx markdownlint-cli2 "**/*.md"
+
+# Spell check (same ignore list as CI)
+codespell --ignore-words .github/codespell-ignore.txt --skip "./LICENSE,./.git,./node_modules"
+
+# Link check (same config as CI) — run per changed file
+npx markdown-link-check -c .github/markdown-link-check.json README.md
+```
 
 ## Questions
 
-Open a [GitHub Discussion](../../discussions) or an [issue](../../issues). Drive-by PRs are welcome too — we'll suggest changes in review.
+Open a [GitHub Discussion](https://github.com/wesammustafa/OpenCode-Everything-You-Need-to-Know/discussions) or an [issue](https://github.com/wesammustafa/OpenCode-Everything-You-Need-to-Know/issues). Drive-by PRs are welcome too — we'll suggest changes in review.
 
 ---
 

Images/README.md

@@ -12,6 +12,8 @@ Diagrams, screenshots, and visual assets for this guide.
   ![Alt text describing the image](Images/your-image.svg)
   ```
 
+  Paths are relative to the *referencing* file — `Images/your-image.svg` works from the root `README.md`, but a doc under `docs/` needs `../Images/your-image.svg`.
+
 - **Include alt text.** Always.
 - **Mermaid before raster.** When a concept can be expressed as a flowchart or sequence diagram, prefer Mermaid (renders natively on GitHub) over an exported PNG. See [`docs/mcp.md`](../docs/mcp.md) for an example.