Generate opencode's config from a tracked template, with matching commands, agents and pwswitch

user/README.md

@@ -14,8 +14,12 @@ and one file says where each piece goes.
 | --- | --- | --- |
 | `agents/AGENTS.md` | `~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, `~/.config/opencode/AGENTS.md` | Three tools, one file. These were byte-identical copies before this, waiting to disagree. |
 | `agents/skills/` | `~/.agents/skills`, `~/.claude/skills` | Personal skills live once in the checkout. Both destinations use `linkdir` so Panama's shipped skills can live beside them. opencode reads both directories itself. |
-| `agents/rules/` | `~/.claude/rules` | opencode loads these through `instructions` in its config, which `setup/scripts/link-mcp` writes. |
+| `agents/rules/` | `~/.claude/rules` | opencode loads these through `instructions` in its config, which `setup/scripts/link-mcp` generates. |
+| `agents/commands/` | `~/.config/opencode/commands` | Claude Code carries its commands as plugins, which opencode cannot read. These are the same commands in opencode's own format. |
+| `agents/agents/` | `~/.config/opencode/agents` | The same again for subagents. |
+| `agents/opencode/config.json` | read by `setup/scripts/link-mcp` | Not linked. The opencode config is generated from it, because that file also has to carry the MCP servers and their tokens, and a symlink cannot be half written. |
 | `ssh/config` | `~/.ssh/config` | Host aliases only. Keys are per-machine and are never tracked. |
+| `bin/pwswitch` | `~/.local/bin/pwswitch` | `pwswitch off` makes sudo passwordless for an agent session, `pwswitch on` restores the password. |
 | `espanso/identity.yml` | `~/.config/espanso/match/identity.yml` | Copied, not linked, because a machine may add its own triggers. |
 
 `manifest` is the authority; this table is a summary of it.
@@ -44,6 +48,23 @@ Two consequences, recorded rather than fixed:
   A tool that installs directly into a home skill directory creates a
   machine-local skill until it is moved into the checkout.
 
+## What link-mcp generates
+
+The opencode config is the one destination here that is generated rather than linked or
+copied. It cannot be a symlink because it has to carry the MCP servers and their tokens,
+and a token is exactly what cannot live in this repository. So `setup/scripts/link-mcp`
+builds the whole file: `agents/opencode/config.json` supplies everything that is not a
+secret, `agents/mcp/servers` supplies the server list, and the machine-local
+`agents/mcp/env` supplies the tokens.
+
+The result is `~/.config/opencode/opencode.jsonc`, written private and replaced in
+place. It opens with a comment saying where to edit it, and that comment is the whole
+warning: **hand-edits to the generated file do not survive an upgrade.** Put the change in
+`agents/opencode/config.json` and it reaches every machine.
+
+Anything already at that path that this stage did not write moves to `config/old/`, the
+same promise everything else here makes.
+
 ## It is off unless you say yes
 
 The installer asks, naming the destinations, and the default is no. Nothing here