Config variables in `opencode.json` overwritten with actual values on start up

[spenceforce]

Description

I set api keys following guidance on variables in config files here. When I start opencode, the variables are overwritten with the actual value in opencode.json.

This defeats the purpose of using variables to keep secrets outside of opencode.json and makes it impossible to commit opencode.json as it can expose secrets.

Plugins

No response

OpenCode version

1.1.25

Steps to reproduce

1. Use the env variable in opencode.json for a provider API key.
2. Start opencode.
3. Reload opencode.json to see if the variable was replaced with the actual value.

Screenshot and/or share link

No response

Operating System

Ubuntu 25.10

Terminal

Ubuntu terminal