OpenCode vs Qwen Code

OpenCode

Runs with no key or account on free OpenCode Zen models. Most permissions default to allow, and SECURITY.md says the permission system is not a sandbox.

Qwen Code

Apache-2.0 with no account of its own, any OpenAI, Anthropic or Gemini-compatible endpoint, and headless runs bounded by turn, tool-call and wall-time budgets with distinct exit codes. Out of the box, Auto mode lets an LLM classifier approve tool calls, with the sandbox and folder trust both off. Usage statistics are on by default.

OpenCode

1. Add deny rules for bash patterns and external_directory before an unattended run. Most tools default to allow
2. Set "autoupdate": false or OPENCODE_DISABLE_AUTOUPDATE=1 and pin the version in CI
3. Configure a provider key. With none, prompts go to free Zen models that may train on them
4. Set OPENCODE_SERVER_PASSWORD before opencode serve. Without it the server runs unauthenticated
5. Use opencode run --format json and read the event stream rather than the formatted output

Qwen Code

1. Pass --approval-mode on every run. The settings default is auto, and one docs page says headless runs default to asking, so don't rely on either
2. Add --max-session-turns, --max-wall-time and --max-tool-calls. All three are unlimited by default. Exit 53 is the turn limit and 55 a budget
3. --yolo doesn't turn on a sandbox. Add --sandbox, or on Linux set tools.executionSandbox with network set to closed
4. Set QWEN_USAGE_STATISTICS_ENABLED=false to stop usage statistics
5. Authenticate with OPENAI_API_KEY, OPENAI_BASE_URL and OPENAI_MODEL in CI. The browser sign-in is discontinued