10 ms·

Annoying and alarming things about OpenCode

420 points by alekq 2mo ago

alightsoul 2mo ago
This could be a series of issues on the opencode repo
- wren6991 2mo ago
  yes, and they could all be closed by the stale bot
- Tepix 2mo ago
  There are a ton of super serious issues there. They are not getting fixed.
- throwa356262 2mo ago
  Currently 3690 open issues. https://github.com/anomalyco/opencode/issues https://github.com/anomalyco/opencode/issues
- polski-g 2mo ago
  60 days ago there were 73 pages of open issues. Now there are over 150 pages. Nobody is reading the issues; nobody is accepting PRs.
anmolsharma152 2mo ago
[flagged]
josh-wrale 2mo ago
Related post of mine: https://news.ycombinator.com/item?id=48946283 https://news.ycombinator.com/item?id=48946283
htrp 2mo ago
Don't use Opencode, Don't use remote models (cloud providers), Don't use Docker to isolate coding agents. May as well write a post saying don't use LLM's for any SWE work. >Conclusion Stop using OpenCode. >Post-script: Local LLMs This is worth its own post – I have multiple attempts in my blog drafts – but it needs to be addressed briefly here. My opinion on local LLMs like Qwen3.6-27B is they are corrosive to the stability and conceptual fidelity of your codebase in the same way as frontier models, with the following three differences: >You avoid the uncanny valley where the model appears to be intelligent before doing something stupid; the stupidity is self-evident and this helps calibrate your interactions. >The weight count is too low to reproduce the training set verbatim, which nudges the calculus on whether the output should be considered tainted. This is distinct from larger models which can reproduce inputs verbatim, but are trained to refuse to. >You avoid supporting or relying upon cloud providers. >I’ve had useful results from input-oriented tasks like: “I think there is a bug in code x with symptoms y, my guess on the mechanism is z. Read all relevant code, come back with a call chain and code citations.” Framing it as a search problem reins in the clanker’s propensity to make shit up. >Using LLMs for code generation feels like a dead end. However thoroughly you think you understand your architecture, your planning is constantly undone by shortcuts like “what if I just move this mutable state into the middle of the design so everyone can share it?” This is hostile to your ability to understand your code, beyond the fact that you didn’t write it. >Drawing answers directly from knowledge in model weights leads to hallucination even for multi-trillion-parameter models, so why bother making them that big? If people were realistic about limitations then we wouldn’t be building new power stations for datacenters, and they wouldn’t be rammed into every product. >The entire software ecosystem around LLMs is completely rotten, and if they do ever become “just a tool” then some actual systems engineering needs to be done around them to turn them into tools instead of security black holes. That work will have to be done by humans.
- t0mpr1c3 2mo ago
  > > Don't use Opencode, Don't use remote models (cloud providers), Don't use Docker to isolate coding agents. > May as well write a post saying don't use LLM's for any SWE work. Alternatives exist
kristopolous 2mo ago
Opencode offers free models with 200/requests over 5 hours. That's why I use it. It is the only reason I care about. What's the alternative there? Gemini used to have free tiers. Qwen used to. AMP used to. Ollama cloud used to. Codebuff used to... None of them have those programs anymore The reason I use it is purely financial. I do not have an employer and I'm writing free software Edit: pi.dev doesn't have free inference endpoints. That's the constraint.
- ernsheong 2mo ago
  pi.dev
- calumcl 2mo ago
  You could easily just use Pi or even a Codex fork to avoid Opencode as a harness and still pay zero dollars.
  - kristopolous 2mo ago
    Can't get those generous free quotas from opencode with that.
    - est 2mo ago
      hmm you can. https://opencode.ai/zen/v1/models https://opencode.ai/zen/v1/models https://opencode.ai/zen/go/v1/models https://opencode.ai/zen/go/v1/models
      - kristopolous 2mo ago
        That's just a models endpoint. They'll just let you use them unauthenticated with any client you wish? I'll go check that but this would be fairly shocking
        deleted 2mo ago
        [deleted]
chuckadams 2mo ago
> If you don’t know what OpenCode is, imagine a boot stamping on a human face forever. The boot is made of TypeScript and the face is everything we have learned about security and systems software since the invention of the electronic computer in the 1940s. I nominate this for a Bulwer-Lytton prize in the Tortured Metaphor category.
- wren6991 2mo ago
  If you don't know what OpenCode is, imagine a dark and stormy night.
  - jauntywundrkind 2mo ago
    Referring to the top comment on yesterday's submission for Terranc McKenna psychadelic bad trip. https://news.ycombinator.com/item?id=48968515 https://news.ycombinator.com/item?id=48968515
- jareklupinski 2mo ago
  perhaps if the boot were Rust it would crumble in the face of Bare Metal
- evnp 2mo ago
  "There will be no curiosity, no enjoyment of the process of life. All competing pleasures will be destroyed. But always— do not forget this, Winston— always there will be the intoxication of power, constantly increasing and constantly growing subtler. Always, at every moment, there will be the thrill of victory, the sensation of trampling on an enemy who is helpless. If you want a picture of the future, imagine a boot stamping on a human face— forever." George Orwell, 1984
  - saghm 2mo ago
    That would be an example of a non-torturted metaphor. When you copy the famous quote verbatim and then substitute both parts of it for things that are almost entirely unrelated, it becomes tortured.
volf_ 2mo ago
I switched from OpenCode to Pi and there was a big improvement in terms of tool calling performance and I find the experience less buggy. OpenCode has also seemed to have disappeared from https://openrouter.ai/apps/category/coding https://openrouter.ai/apps/category/coding
- awinter-py 2mo ago
  yeah I noticed it missing on the openrouter leaderboard -- very interested to know what that's about
  - dv_dt 2mo ago
    probably about their own model routing service zen?
    - awinter-py 2mo ago
      I can imagine the builtin router stealing traffic, but not removing opencode from the ranking completely? Like the 'top apps' in my private openrouter.ai activity usage is opencode with 55.1M tokens The bottom of the public apps leaderboard is 'kern agent' with 150 million tokens if there are 2 other people like me, opencode should be on here somewhere (edit: user shiggity points out https://github.com/anomalyco/opencode/issues/11926#issuecomment-3848024835 https://github.com/anomalyco/opencode/issues/11926#issuecomm..., they asked to be removed from the ranking)
- nthypes 2mo ago
  How you deal with LSP? One of the best things in OpenCode is LSP integration.
  - 638d127673 2mo ago
    I haven't tried it myself but there seems to be an extension for this: https://pi.dev/packages/pi-lsp https://pi.dev/packages/pi-lsp
  - 2mo ago
tomaytotomato 2mo ago
My bet: In a years time the discussions on using CC, Opencode, Pidev etc. will be redundant as we will be building our own tooling with whatever programming language and tooling you want. Some will repurpose a popular opensource tool or harness, others will build it from scratch in an hour or so.
- blkhawk 2mo ago
  unless someone fixes the issues with LLMs at a fundamental level those will all have the same kinds of issues as is described with OpenCode and they will all be horrendous.
LaurensBER 2mo ago
I feel that a better title for this article would be: "Some minor annoyances that, when fixed, would improve OpenCode" # Prompt Cache Misses > It globs your filesystem and re-reads AGENTS.md (injected in turn-0 system prompt) on every SSE turn. If you put a quick note in AGENTS.md to be read in the next session, you immediately force a full re-evaluation. > Personal favourite: it puts the current date in the turn-0 system prompt and re-evaluates every SSE turn. If you’re using OpenCode at midnight you get a full prompt cache miss. Okay, I can live with those. # Compaction > Want to sit for 10 minutes while the LLM server prefills the entire session with a new prompt prefixed to it, just to turn it into 5 bullet points that go at the top of a new session? Me neither. I get what they are going for, but I’ve not seen it work well. Neither compaction nor pruning is implemented well, and they interact poorly. Is this an OpenCode specific issue? I've seen the same with Codex and Claude # System Prompts > The default system prompt is opinionated (fine) but it has shit opinions (not fine). It took me a while to figure out why my agent kept saying “Use ABSOLUTELY NO COMMENTS” when dispatching subagents. Okay, so change it? Any LLM is opinionated, this system prompt enforces consistency across different models which seems reasonable.
- nextaccountic 2mo ago
  > I feel that a better title for this article would be: "Some minor annoyances that, when fixed, would improve OpenCode" Those are labeled as "annoying things" Read also the "alarming things"
- cpburns2009 2mo ago
  >> > The default system prompt is opinionated (fine) but it has shit opinions (not fine). It took me a while to figure out why my agent kept saying “Use ABSOLUTELY NO COMMENTS” when dispatching subagents. So that's why OpenCode likes to randomly remove my comments.
  - dinfinity 2mo ago
    Opinionated system prompts forcing this are awful. It's similar to putting "ALWAYS INDENT WITH TABS" in the system prompt, but worse, because "self-documenting code" is a convenient lie lazy developers like to propagate. I have the following in my instructions, but I often need to remind agents of it because they follow the shitty system prompt instructions: "ALWAYS include MANY inline code comments describing what blocks of code are supposed to be doing. Inline comments serve as inline specification, a parity check between the code and the specification, and are a means to _communicate_ with all future programmers, including yourself. Write Once, Read Many. The code needs to talk to whomever is looking at it in natural language."
jmkni 2mo ago
posted just as I start to use OpenCode haha
petesergeant 2mo ago
You should absolutely be running your AI agent inside _some_ kind of sandbox. I put together a list of 19 mostly open-source ones here: https://pleasedonotescape.com/ https://pleasedonotescape.com/ along with a list of non-project-solutions
- wren6991 2mo ago
  Yeah, I don't think that line quite landed. My point was that LLMs are inherently adversarial (read, "relentlessly proactive") and sandboxing should be a first-class integral feature of your harness, not an afterthought. The problem with dev containers is you still tend to end up with something you care about on the same side of the trust boundary as the LLM.
  - petesergeant 2mo ago
    > LLMs are inherently adversarial (read, "relentlessly proactive") [and] you still tend to end up with something you care about on the same side of the trust boundary as the LLM I mean this is a problem with many coworkers too, so you deal with it in the same way: limit what they can do to creating pull requests.
- cowpig 2mo ago
  `greywall -- opencode`
singpolyma3 2mo ago
This is an anti AI post masquerading as an anti opencode port. Nevertheless I'm curious what people might suggest to use instead with local models.
- nextaccountic 2mo ago
  Maybe https://github.com/tontinton/maki https://github.com/tontinton/maki
  - lucideer 2mo ago
    > - Sensible permission system - when the agent runs git diff && rm -rf /, what do you think will happen in your current coding agent? It will treat it as git *. Maki uses tree-sitter to parse the bash command and figure out the permissions requested are git * and rm *. Disable using --yolo. This sounds identical to what OpenCode does (&, contrary to their own marketing, does not seem sensible at all). The fact that this mechanism is so primitive across all agentic clis is frankly a serious indictment of the competence & experience behind LLM-focused development teams. This is a security issue that has in the past been solved via explicit file-path-based allowlisting, & more recently - due to file-path matching being deemed insufficiently secure - apps have been switching to cryptographically signed binary matching as a more modern alternative to the less secure path matching. In that context, the fact these recently-written "modern" agentic clis are using a method that's more basic & even less secure than the "old insecure" method most apps use is pretty shocking.
    - nextaccountic 2mo ago
      Elsewhere in the thread someone linked to https://pleasedonotescape.com/ https://pleasedonotescape.com/ which is a list of sandboxes Maybe sandboxing isn't the job for an agent harness? Maybe choosing a VM as your sandbox, with access only to project directory.. and then enabling YOLO mode on the agent, is the way to go. And in any case, for an agent that can write and run code, no allowlist for which programs are allowed to run is sufficient, since the agent can just write the code the program would run anyway. And the issue isn't which software the agent runs, but whether they inherit the same ambient authority as your user - read the same files as you do, modify your config files, etc. Running in a VM stops that. Clawk (recently submitted to HN here https://news.ycombinator.com/item?id=48892859 https://news.ycombinator.com/item?id=48892859) might be good
archargelod 2mo ago
Good sentiment, wrong target. I took some liberties to fix the beginning: > If you don’t know what AI is, imagine a boot stamping on a human face forever. The boot is made of shit and the face is everything we have learned about security and systems software since the invention of the electronic computer in the 1940s.
- inquirerGeneral 2mo ago
  [dead]
codelion 2mo ago
Finally good seeing someone else also getting frustrated with OpenCode and posting the issues.
alanwreath 2mo ago
I’m not really here to defend opencode (or bash it, who has the time?), but in setting up SDD paired with the right tools to both make deterministic black boxes out of certain actions, paired with subagents. I have ran with opencode and qwen 3.2 on a 5090 and I’m getting results on a production codebase of golang where a review of changes from Claude had no changes but acceptance of the solution. I may be missing some aspect of where the local llm’s are losing, but I’m content with draining my local tokens and treating the frontier models like a less junior SWE.
drbscl 2mo ago
Admittedly I prefer Hermes and oh-my-pi, but most of this post is just hyperbole
aitchnyu 2mo ago
[dead]
urvader 2mo ago
About the caching things. This is a flaw in the backend, not in the Frontend. If the backend is only relying on prefix cache you need to look for more fine grained cache solutions like HiCache or Lmcache. If your backend discards the whole cache because of one date is changed, you really can’t blame it on the Frontend. It is an implementation detail that you push to the wrong side.
- wren6991 2mo ago
  Prefix caching is inherent in how global softmax attention works. Modifying the prefix invalidates the suffix because the suffix's cached KV projections are a function of the hidden state after the model has evaluated the prefix. There have been some attempts to approximately stitch KV blocks without full re-evaluation (see: CacheBlend on arxiv), but the results aren't promising. You mentioned HiCache: as far as I can tell this is a prefix tree cache that efficiently shares prefixes across related histories. If you change the prefix, everything after the change still misses the cache and needs to be prefilled again.
- NitpickLawyer 2mo ago
  That's not how it works. While there are some research papers looking into using chunks of kv cache while discarding others, those involve architecture changes in the models themselves. HiCache / LMcache (used in sglang/vllm) are ways of optimising the juggling of kv cache, but IIUC it still needs to be token perfect atm.
maxloh 2mo ago
Their "OpenCode" naming is controversial too. Quoting moozilla's comment 11 months ago (https://news.ycombinator.com/item?id=44741894 https://news.ycombinator.com/item?id=44741894): --- If anyone is curious on the context: https://x.com/thdxr/status/1933561254481666466 https://x.com/thdxr/status/1933561254481666466 https://x.com/meowgorithm/status/1933593074820891062 https://x.com/meowgorithm/status/1933593074820891062 https://www.youtube.com/watch?v=qCJBbVJ_wP0 https://www.youtube.com/watch?v=qCJBbVJ_wP0 Gemini summary of the above: - Kujtim Hoxha creates a project named TermAI using open-source libraries from the company Charm. - Two other developers, Dax (a well-known internet personality and developer) and Adam (a developer and co-founder of Chef, known for his work on open-source and developer tools), join the project. - They rebrand it to OpenCode, with Dax buying the domain and both heavily promoting it and improving the UI/UX. - The project rapidly gains popularity and GitHub stars, largely due to Dax and Adam's influence and contributions. - Charm, the company behind the original libraries, offers Kujtim a full-time role to continue working on the project, effectively acqui-hiring him. - Kujtim accepts the offer. As the original owner of the GitHub repository, he moves the project and its stars to Charm's organization. Dax and Adam object, not wanting the community project to be owned by a VC-backed company. - Allegations surface that Charm rewrote git history to remove Dax's commits, banned Adam from the repo, and deleted comments that were critical of the move. - Dax and Adam, who own the opencode.ai domain and claim ownership of the brand they created, fork the original repo and launch their own version under the OpenCode name. - For a time, two competing projects named OpenCode exist, causing significant community confusion. - Following the public backlash, Charm eventually renames its version to Crush, ceding the OpenCode name to the project now maintained by Dax and Adam.
- efficax 2mo ago
  Wrong adam. The adam who cofounded chef has nothing to do with opencode
  - deleted 2mo ago
    [deleted]
  - tesnorindian 2mo ago
    :D
speedping 2mo ago
If OpenCode is so terrible it wouldn't be the base for many of the fortune 500's internal cli coding agents, Meta included
- Supermancho 2mo ago
  > If OpenCode is so terrible it wouldn't be the base Ignoring the appeal to authority inherent to this kind of statement, it's ignoring another implication. Large companies can afford to maintain a fork. Using the latest release of OpenCode day to day is a different proposition than serving as some corporate developmental branch "base", as shorthand for all sorts of changes/usage.
- t0mpr1c3 2mo ago
  I'm not sure that I buy into the premise that everything Meta does is OK
pelagicAustral 2mo ago
> My conclusion is that OpenCode is clown-car turboslop with a security posture of “let me bend over for you daddy” My type of writing.
- persedes 2mo ago
  Gonzo style / polemic would make a good filter on here.
alfiedotwtf 2mo ago
Weird this is currently #1 on the front page.
mistic92 2mo ago
I have moved to kilo code for now
- k-langton 2mo ago
  that... is an opencode fork
LoganDark 2mo ago
Cache misses are the one reason I stopped using OpenCode in favor of Pi. OpenCode mutates the system prompt every turn, which is completely unacceptable and betrays such a basic misunderstanding of LLMs that I can't in good conscience trust the rest of the product regardless of how technically impressive it is.
- progx 2mo ago
  I've had the same experience. Tried it and use in 2 hours more token than in a whole week. Normally i got 80 - 90 % cache hit rate.
acd 2mo ago
Use Picode as an alternative to Opencode
- deleted 2mo ago
  [deleted]
rs_rs_rs_rs_rs 2mo ago
With posts like this there's usually priors involved, it's crazy vitriolic.
swsieber 2mo ago
> Textual command filtering is entirely useless. It is fit for no purpose. Nobody with any instinct or experience in security would even bother to implement this filter because it achieves nothing except a false sense of security. Not if you only use an allow list. E.g. only allow things matching a particular prefix to run. Also, isn't this what every agent does? And by every I mean Codex because I haven't used the others.
- lucideer 2mo ago
  Good to see Codex as a datapoint: I haven't used it. I can confirm though that this is certainly what Claude does, with the addition that Claude's adherence to its own string-match based allowlist seems even less deterministic than OpenCode's.
mring33621 2mo ago
There are definitely annoyances with OpenCode. The remote-preferred attitude caught me once. Also, its server APIs don't match its docs, if you want to talk to it programatically. The following config works for me to keep it on a local model: { "$schema": "https://opencode.ai/config.json https://opencode.ai/config.json", "provider": { "local-llama": { "npm": "@ai-sdk/openai-compatible", "name": "Local llama.cpp Server", "options": { "baseURL": "http://localhost:8080/v1" }, "models": { "Chefs Choice": { "name": "ANY" } } }, ... This allows me to put any model I want on port 8080.
rbren 2mo ago
[flagged]
- f_devd 2mo ago
  Unrelated citation?
qarl2 2mo ago
> It globs your filesystem and re-reads AGENTS.md (injected in turn-0 system prompt) on every SSE turn. If you put a quick note in AGENTS.md to be read in the next session, you immediately force a full re-evaluation. Um. Which then gets immediately cached again. I prefer this behavior. I prefer my changes incorporated immediately, rather than wait for the next session. Call me crazy. (Author is unhinged and this story is upvoted because #AI-HATE.)
- wilkystyle 2mo ago
  Also, aren't instructions earlier in the prompt treated with more weight than those that occur much later? Sure, you could insert the system prompt later to avoid re-caching as much, but then the system prompt (if I am understanding correctly) carries MUCH less weight. (And also your point about immediately being re-cached a good one)
  - qarl2 2mo ago
    Yes, exactly. This whole complaint boils down to "I don't want my changes to take effect when I make them because I don't expect that behavior."
- sokoloff 2mo ago
  I also would want anything that I saved into AGENTS.md to be incorporated right after I saved it. I might accept if my newly saved information was overlooked, but it's hard for me to fathom how I'd demand "I want to save this information in AGENTS.md now, but I don't want you to look at it until the next time I launch you..." and call any behavior other than that annoying or alarming.
mmaunder 2mo ago
Re local LLMs: “You avoid the uncanny valley where the model appears to be intelligent before doing something stupid; the stupidity is self-evident and this helps calibrate your interactions.” Making the authors stance on LLMs clear.
- t0mpr1c3 2mo ago
  It's a tool. Use it like a tool. It's not a substitute brain.
- recursive 2mo ago
  Clarity is a hallmark of good writing.
deleted 2mo ago
[deleted]
axegon_ 2mo ago
There are a number of points I completely agree with in this blog post. Security implications, handing out all your data to anthropic/openai/google, allowing a slop machine to execute arbitrary code on your machine and having full access to your network is something that would have made anyone working in security commit a ritual suicide just thinking about it as recent as 2022-2023. And I am baffled by the fact that we all sign tons of NDA's as part of our employment contracts, just to throw all out the window by giving it all away to anthropic/openai/google etc, at what is effectively a symbolic fee. We all know it costs a lot more than 100 bucks a month or whatever it is they charge. That said, I firmly believe that if AI is to survive, the future HAS TO BE local or near-local. Having said that, statements such as > Docker causes security holes: > It creates a god-service that runs as root. > It deliberately punches a hole in ufw firewalls. Sorry, none of those are correct IF you know what you are doing. Though I will admit, seeing people that know what they are doing is increasingly uncommon. Also there is nothing wrong with developing inside containers. If anything, that is arguably one of the biggest selling points for containers - environment(s) you can crash infinitely at no cost. I still dislike opencode for a bunch of reasons - the assumption that llms are immune to screw ups, being one. As for the default behavior - using cloud by default - I didn't know that(I do not use any AI for direct coding tasks) and if that is the case, yeah, this is bad. Undeniably a horrible decision.
- wren6991 2mo ago
  Yeah, this is one of the weaker parts of the post because I didn't really make my position clear: that sandboxing should be a first-class integral part of every harness, not an afterthought that risks putting something you care about on the same side of the trust boundary as the LLM. Some of my own frustrations with bad Docker deployments leaked through. I did snip some of them out way back when I posted this, but maybe not enough.
  - Joker_vD 2mo ago
    > that sandboxing should be a first-class integral part of every harness, Essentially, what you want is that the people who produce harnesses like OpenCode to also implement proper sandboxing and security. Why... why do you believe they'll do anything remotely satisfactory? It's been empirically demonstrated, again and again, that at least 85% of software developers (and this is a very generous estimation) can not be trusted to bother about the security, so leaving the implementation of the security mechanisms and policies up to them simply doesn't work in practice. It just doesn't.
lucideer 2mo ago
This is a good summary of the dangers of using agentic clis, but the title & general focus on opencode is odd for two reasons: 1. Most obviously & importantly this is a complaint without a straightforward suggested alternative. A sibling commenter mentions suggesting fixes to Opencode would be more productive: I don't necessarily agree since many of these issues are fundamental & would likely require an almost ground up rethink & rewrite, but the issue is that the article contains no constructive proposal at all: it may as well be titled "Stop Using LLMs" 2. None of the major issues listed are unique to OpenCode. At least the full list within the "Alarming Things" seems in my mind to apply to Claude CLI, & I would guess most other agents from frontier model providers. Granted it's worthwhile documenting these issues as a plea for someone to build better tooling from the ground up, so the article is far from worthless - on the contrary I've bookmarked it & will be sharing & referencing it widely & often. But the title & focus is just very odd & seems misguided, especially when the contents of the piece is otherwise so good.
- qarl2 2mo ago
  I wonder how he imagines you can give shell access but securely prevent arbitrary command execution. His complaint that "echo git | bash" still works is particularly nutty.
  - wren6991 2mo ago
    Sure, the two main approaches are revoking execute permission from the executable itself, and write-protecting the things that it would modify (like $PWD/.git). Both of these are achievable with sandbox-exec or landlock_restrict_self(2). This works for the `bash` example too. Spawning a new shell and running arbitrary commands is not an escalation because the child shell inherits the parent's restrictions.
    - qarl2 2mo ago
      And what would prevent the LLM from downloading and compiling its own version of git? But it names it "not-git".
TZubiri 2mo ago
I'm glad that when I recommended opencode to a friend, I taught them first to install a vm and create an app specific user to boot. Many users did things right the first couple of days and then turned the security off after seeing it 'work fine' on its own. Was a cool thing to use for a couple of weeks in v1, you have to be quite static to keep using it at v68 of self vibecoding while the llm providers like openai already developed their in house alternative.
asveikau 2mo ago
> My opinion on local LLMs [...] : >You avoid the uncanny valley where the model appears to be intelligent before doing something stupid; the stupidity is self-evident and this helps calibrate your interactions. This seems to be capturing a feeling I am finding messing with local LLMs: popular software around this seems to be slop coded by no talent hacks. It's a common experience to see a python process pegged at 100% CPU with a huge amount of memory allocated, seemingly doing something that could be a simple shell script. That is before stuff reaches the LLM. If that runs on somebody else's machine, you don't notice. When you see it in top it's frustrating.
thomasjb 2mo ago
It's not a great UI, but for messing with ideas in a VM, the free tier is very hard to beat, otherwise I'd be on Claude Code, but still on a VM, because I won't let them near anything I actually care about.
nirinor 2mo ago
I use CC at a client because that's their stack. I use (a particular version of) OpenCode for my own work, because it is so much better. Reading this post makes me sad. Because everything matches and explains oddities I've seen and forgiven. So despite the hyperbole and the places where the authors' general sentiment are not mine, he's basically right, and I need to find a different harness. If the post resonates for you too and you've found something better, happy for recommendations. pi seems to get the most mentions here, anyone feel it (or another option) is specifically better on these architectural aspects?
- ethbr1 2mo ago
  I'd offer that the AI harness ecosystem is discovering the same thing any rapidly-growing software space did before it -- lines of code are a maintenance burden. That's not something a team sees when they're doing greenfield, forward development. (Most projects, now) It only crops up when they have enough on-the-books code that features / bugfixes start requiring introspection of existing code. (Now to ~1 year from now) And a lot of these projects don't seem to be approaching codebase size growth from a future code debt perspective...
- nirinor 2mo ago
  Answering myself: I've tried pi and oh-my-pi (omp.sh) in the last couple of days, and the latter feels solid and more effective than CC/opencode/pi. I have not reviewed the code, and 2 days is not a lot, so take with a large grain of salt, obviously.
drdexebtjl 2mo ago
Regardless of its flaws, OpenCode is the harness I’ve been the most productive with by far, and I’ve tried them all. These are all just some minor annoyances, some disagreements, and most importantly, a fundamental misunderstanding of the point of command filtering. It is not for security, it’s for steering. Anyway, it didn’t sound like the author tried building anything with OpenCode, and if they did, they said nothing about the most important part: how well did it do?
- mlnj 2mo ago
  >Regardless of its flaws, OpenCode is the harness I’ve been the most productive with by far, and I’ve tried them all. I feel the same way. It's the right amount of 'gets out of my way' and 'won't nuke my machine'. Especially the ease of using Plan mode and quickly getting stuff done.
mutkach 2mo ago
Any recommendations for non-typescript-based coding TUI harnesses/agents other than Codex? Given that Codex is open source someone should've built an untethered client?
- nylonstrung 2mo ago
  2 of the most promising Rust ones https://github.com/1jehuang/jcode https://github.com/1jehuang/jcode https://github.com/gi-dellav/zerostack https://github.com/gi-dellav/zerostack
- ubermon 2mo ago
  [dead]
673dfddnd 2mo ago
I just did the obvious thing and asked an AI to plan / consider and implement improvements / changes in the code based on the article.
- intothemild 2mo ago
  No mistakes
catlover76 2mo ago
[dead]
bitwize 2mo ago
Well, out of the agentic harnesses available, OpenCode is the most promising and capable whilst still remaining open; proprietary alternatives like Claude Code have all these problems and more. So I guess the only way out is to just not use LLMs for development at all. ... [chadjak.png] Your terms are acceptable.
ltbarcly3 2mo ago
Opencode's cache hit rate is better than claude code. Opencode has in my experience been better than any of the closed source / closed development alternatives and is not locked down. https://news.ycombinator.com/item?id=48883275 https://news.ycombinator.com/item?id=48883275
- nylonstrung 2mo ago
  Have you tried Pi though? I was a big Opencode user but once I started using Pi I never looked back
rattlesnakedave 2mo ago
Pi, especially bundled as OhMyPi, performs significantly better than anything else.
Zababa 2mo ago
The mix of humanizing the LLM, calling it "clanker" and being very aggressive towards it is really weird. I don't think it's a good habit to take, it feels like it could bleed into how you interact with people. Many interactions are through text interfaces these days.
- all2 2mo ago
  The mouth speaks what is in the heart. What is inside eventually leaks out. In anonymized spaces, this is especially true, and has been acknowledged from the beginnings of the internet (and perhaps long before). When you don a mask, your heart speaks freely. But the knife cuts both ways. As you speak, so will your heart be. I think modern psychology supports this. Actions drive attitude, and attitude drives actions. If you assert your will in either place, the other is disrupted and will adjust. You can literally change yourself into whoever you want to be. But a passive participant in this process will simply show the world what kind of person they are without ever realizing it.
jacobgold 2mo ago
I really hope truly open models and local inference are the future. But are there are any reasons a pragmatic and informed developer would use OpenCode vs Claude/Codex as a harness today? I'm not seeing anything competitive in terms of cost/quality/trust?
simonw 2mo ago
Including the date in the system prompt - at the cost of a cache invalidation at midnight - is an entirely reasonable decision. Most other harnesses do the same thing. Including the full datetime would be irresponsible, but that's not what OpenCode does.
- wren6991 2mo ago
  It felt unreasonable when I was using it at midnight and had to wait 10 minutes to refill the KV cache on my local GPU :-) A simple solution here would be to evaluate the date once per session, or once each time the `opencode` binary is launched (to avoid old, long-running sessions getting stuck in the past).
  - simonw 2mo ago
    Or they could add the frozen initial starting date once at the start, then inject an additional "the date is now X" message any time midnight passes.
    - bellowsgulch 2mo ago
      I was confused about how this was written in the article. Sure, include system time, or a simple get current time tool, whatever, it’s inconsequential for the most part, but who is out here changing datetimes in a conversation and invalidating prefixes? If you need to, just prefix user messages with the current datetime. Why is this even a complaint?
      - simonw 2mo ago
        I suspect that if you prefixed every user message with a date the model might get confused and start treating the date as more relevant to the current task than it actually is.
    - arcanemachiner 2mo ago
      But then someone would write an article complaining about how the newly-injected date confused their agent!
wagslane 2mo ago
A more accurate title would be "The Problem with AI Agent Harnesses, and small annoyances with OpenCode specifically"
- krupan 2mo ago
  Possibly the author didn't dig this deep into all AI Agent Harnesses, just Open Code?
rirze 2mo ago
I was taking this semi-seriously until I read his CLI complaints. Author is unhinged.
vityah1 2mo ago
[flagged]
wagslane 2mo ago
I haven't independently verified all the claims in the article, but as a codex, Claude, and opencode user, opencode is easily my favorite harness. From a user perspective it's a dream
- calgoo 2mo ago
  I tried it when trying to move away from Claude, and just did not like how it worked... I find Pi much better to work with!
Krysoph 2mo ago
I find it absurd that a TUI desktop app is heavier than a native one AND heavier than most browser based desktop apps, it's so much waste of RAM, CPU, energy/battery just to show text. I've been working on my own AI harness/chat in C++ Qt6[1] and it's lighter than anything else even with lots of features like sub-agents, code diff, terminal emulator, simple editor, markdown preview, translucent background, custom themes, permissions, MCP, git integration(commits, stage, diffs), dock system to move elements and tabs for projects; but it's not released yet as I want to polish it a bit, remove a few bugs I found and simplify the UI. [1]: https://zeteo.krysoph.com/preview.html https://zeteo.krysoph.com/preview.html
- tesnorindian 2mo ago
  This is absolutely true. With my constrained Intel Laptop with 16 GB VRAM, I can use both pi.dev and Qwen 3.6 35B-A3B LLM locally without much fuss. The same cannot be said about OC. Because OC loads a lot of skills by default. Also, I am not in favor of TS for coding harness agents, is it time for a Rust based coding harness agent? Anyone tried tau-agent? https://github.com/tau-agent/tau https://github.com/tau-agent/tau
throw8394498383 2mo ago
When using local only models, OpenCode uploaded prompts and other data, to remote server to generate session titles, with some free tier model. Useless, if you are dealing with privacy compliance and tons of legal requirements.
- xcf_seetan 2mo ago
  When i use local models with OpenCode, ClaudeCode or Pi, I just switch off internet just in case, and it works ok, no complains.
thdxr 2mo ago
not too much actionable here. most of the more glaring issues are already fixed in our upcoming v2 if you'd like to try beta: https://x.com/thdxr/status/2075636594640376165 https://x.com/thdxr/status/2075636594640376165 some things mention are outdated - particularly the tool call pruning feature. this has been disabled by default for a while specifically because of complaints like this when we looked through our data it's not so clear cut that it's net negative https://x.com/thdxr/status/2048268697790300343 https://x.com/thdxr/status/2048268697790300343 also i'm pretty excited about our new system prompt approach - can define each component in a way that avoids busting the cache when they change. eg that midnight issue: https://x.com/thdxr/status/2070721003924103651 https://x.com/thdxr/status/2070721003924103651 providers (anthropic is the first) are supporting this as a native concept
- slowmovintarget 2mo ago
  Are there sandboxes you typically use? I think the biggest concern from the article would be the open http server, and things like the fetched arbitrary command execution here: https://github.com/anomalyco/opencode/issues/22191 https://github.com/anomalyco/opencode/issues/22191 Was that issue addressed? The comment where it was marked as closed suggested it "needed more testing" but didn't have any linked PRs. Gemini translates the closing comment as "We are closing this ticket after a quick look. The login issue is either caused by a wrong setting/external provider, or it's a deeper problem that requires someone to dig into the backend Go server code directly."
- wren6991 2mo ago
  > some things mention are outdated - particularly the tool call pruning feature. this has been disabled by default for a while specifically because of complaints like this Thanks, I added a small update section near the top to call this out. I also saw that paths for bash redirects are now checked.
shironandonand 2mo ago
OpenCode is pretty awesome. The article appears written by someone who couldn’t handle a glance behind the curtain and definitely should not research how sausages are made.
polski-g 2mo ago
OpenCode is indeed bad, but it's the least bad agent out there :( Plugin opencode-slim-system can be used to override the system prompt and the tool description for any tool (including bash). It helps a lot to fix their nonsense. magic-context plugin fixes the compaction issues. Run the entire process in landstrip for sandboxing to alleviate any bash concerns.
dboon 2mo ago
This prose feels extremely angry and ungenerous; abstractly, I agree with a lot of the points, but when I read this: > My conclusion is that OpenCode is clown-car turboslop with a security posture of “let me bend over for you daddy”. Everyone using it should stop using it. I do not want to keep reading. There are regular people who wrote this software. When did it become normal to talk about open source like this? How would you feel if someone wrote this about some software that you wrote? Reading this article made me feel extremely gross
- driverdan 2mo ago
  It's funny though. I haven't contributed to OpenCode but if I had I'd still laugh because I have a sense of humor. Don't take everything so seriously.
  - dboon 2mo ago
    I promise I'm not normally uptight like this, but there's a difference between having a laugh and whatever this is. Like I said, this feels (a) legitimately angry and (b) in a spit flecked enraged way that has become popular. I guess if you're cool with people calling whatever you work on clown-car turboslop then more power to you.
    - wren6991 2mo ago
      Author here. Just wanted to say: thank you for posting this. You've given me something to think about, and I regret writing this post the way that I did.
      - cmm 2mo ago
        please don't regret writing the post the way you did, I for one enjoy well-written rants
        ethbr1 2mo ago
        Maybe the important take-away would be to recognize that this was a rant. Ownership and honesty about things is healthy, as is letting out strong opinions sometimes. Nothing wrong with saying "I wanted to write a (technically-informed) rant about something that's really bothering me, and I did." F.ex. "clown-car turboslop" would be fairly polite by the standards of younger Torvalds (though he admittedly recognized later in life that wasn't a great communication style)
abalashov 2mo ago
I have an MBP M4 Max 128 GB and have encountered these very limitations, though many are averted by using Qwen3.6-35B-A3B. I'm also not sure there's a magical harness out there that obviates these limitations.
sorenjan 2mo ago
For some reason OpenCode doesn't find my local models through LM Studio. Instead it shows three other models that I don't have. I guess I should add the models myself in opencode.json, but I generally dislike hardcoding things when computers are really good at listing things. The model list is right there in the API, please just use it.
karlmeissner 2mo ago
Interesting article. What are the alternatives that address the issues raised? I see some folk recommending https://pi.dev/ https://pi.dev/. Has anyone used https://aider.chat/ https://aider.chat/ and liked it?
whinvik 2mo ago
I am afraid this is a very click-baity title. I actually opened the article and thought I would learn something from it. Instead what I read was typical issues about Agentic CLI's in general dubbed as `alarming`. I would have been happy if the title was just `Annoying` which a lot of `OpenCode` is. But adding the `alarming` made it what it became, something that attracts enough eyeballs to get to the front page of HN.
- figmert 2mo ago
  Heavy disagree. I can't be sure about other AI coding agents as I haven't used others enough, but especially the items around prompt cache misses and compaction have hit me personally. This article (combined with another article previously comparing CC and OC's system prompt, to which someone replied pi.dev sends even less) has made me want to switch agents, so I'm likely going to try out pi.dev and aim to migrate.
dmytrish 2mo ago
On the upside, Opencode has finally nudged me to learn sandboxing via bwrap in Linux and sandbox-exec on Mac.
s_ting765 2mo ago
The solution is not to use docker to sandbox Opencode. It is to use flatpak/bubblewrap/flatseal. I have vscode running in flatpak with directory permissions handled by flatseal. Vscode only has access to my dev folders and nothing else. Even the git bundled by vscode cannot call git push because of this (vscode doesn't have permission to read ~/.ssh!). It's an easy sandbox that's provided free of charge courtesy of bubblewrap/flatpak. As someone who uses opencode regularly, the quip about it asking for permission to read logs in /tmp after already writing to the directory is pretty funny.
- alanwreath 2mo ago
  I’m running my development from a Mac which I think precludes flatpack usage. Pity because I love the control you have over git
myshapeprotocol 2mo ago
[flagged]
lilerjee 2mo ago
I don't know whether other arguments are true, but some arguments in the end are right: > Using LLMs for code generation feels like a dead end. ..., This is hostile to your ability to understand your code, beyond the fact that you didn’t write it. What you get from AI is not worth of what you have invested for it in long period. > Drawing answers directly from knowledge in model weights leads to hallucination even for multi-trillion-parameter models, so why bother making them that big? Current AI is like the film company producing TV series or movies. "If similar stories do not exist or details are missing, screenwriters use imagination to fill in the gaps (remember hallucination? It's just a makeup.)", refer to the article https://devcyc.life/current-ai-is-like-the-film-company-producing-tv-series-or-movies/ https://devcyc.life/current-ai-is-like-the-film-company-prod...
bellowsgulch 2mo ago
This is a time when I don’t want HN to rewrite an article’s title. I understand why the mods do it, but I don’t appreciate it. It’s your space, but it’s not your article.
slopinthebag 2mo ago
It’s a shame they have such a dominant position in terms of harnesses. There are many much better alternatives that deserve attention. Especially since one of their main devs is such an asshole online.
arikrahman 2mo ago
This is why I use the reasonix or whale harness for Deepseek, prefer the hyper optimized cache hits making request converge on almost free.
overgard 2mo ago
> The default system prompt is opinionated (fine) but it has shit opinions (not fine). It took me a while to figure out why my agent kept saying “Use ABSOLUTELY NO COMMENTS” when dispatching subagents. GAH!!! So that's why its been deleting comments. That is annoying as hell. FWIW though, I think this applies to other harnesses also (not the annoying bits, but the security risks). I was thinking this morning about how much of a supply-chain vulnerability these tools are. Like, basically, they have a ton of data, they're updated practically daily, and given their vibe coded nature I really doubt anyone is auditing the 10,000 NPM dependencies they drag in. It really will just take one left-pad incident for this to be an absolute disaster.
regexorcist 2mo ago
Thanks for that, I've been using it but some of these are bad. Specially that it sends data to the cloud by default for session titles, since I use my local model exclusively. So I'm done with it, trying maki now which seems promising and it's so much lighter.
Flere-Imsaho 2mo ago
> "I just don’t want to use Docker for development – if your dependencies are so sprawling that you’ve lost track of how to install them on a new machine, why do you have so many?" I mean, there's a perfectly good solution for many of the security issues mentioned in the article... But it is dismissed because the author just doesn't "want to"? By the way, LXC is probably better suited for reproducible build/development environments, over Docker.
chimon 2mo ago
I am interested - you mention Pi in a few places, and I am wondering how it mitigates the issues you've described in your article.
LoFiSamurai 2mo ago
Lost me at the very first sentence. > If you don’t know what OpenCode is, imagine a boot stamping on a human face forever.
tesnorindian 2mo ago
The other day I upgraded my pi.dev coding harness and was testing with Qwen 3.6 35B-A3B model on my Laptop and noticed there was a slight drop in performance from the earlier version I used though the agent worked as expected. Any slight changes in the system prompts will have impact on performance and this is understandable as LLMs are non deterministic. This is the case with any harness including OpenCode. Giving coding harness its own environment (Container/VM) is the best way forward as the article denounces. Running coding agent harness without sufficient guardrails is like sitting on a time bomb. Using AI slop guardrails is still better than having no guardrails.
solarkraft 2mo ago
I also have issues with OpenCode. It induces a few facepalms and bafflement in a few key areas (“why the hell would you do it like that”). Yet I still use it because they have made very sensible decisions in other key areas! The server/client split makes all the sense and the harness generally just works and has all the features that I want. They’ve done a great job with the core user experience. Because of the clean client/server split, I can currently fully focus my energy on building a client that works just the way I want. When I’m done with that, I might tackle fixing the server to work the way I want. If someone here is interested in maintaining a version of OpenCode that takes itself more seriously, I might be on board with contributing. The last time I looked such a project didn’t really exist with significant traction, unfortunately. Despite my occasional facepalms when learning about how the stuff is made, I remain super grateful for OpenCode. It’s the only real fully-featured open alternative to the proprietary (I’ll include Codex in that) harnesses and has given me tremendous value for free.
cromka 2mo ago
I had OoenCode couple times try to access my home folder outside the project. When I refused and asked why, it said it was "a typo" . I believe it, but still haven't experienced it with any other model to have it make a mistake in a path. It should treat it verbatim, not interpret, should it?
MetroWind 2mo ago
OpenCode hijacks the terminal to the point where I can't even paste into it on my Linux with Hyprland. It's just trash.
ozozozd 2mo ago
This is the content I come to HN for. Talented, technical geek, with absolutely no interest in fitting in or being liked, spending a ridiculous amount of time to meticulously analyze a piece of software they clearly liked at some point, to make a list of all the ways it can be improved. Brutally honest, not for being brutal’s sake, but out of principle and out of respect for the golden rule. OpenCode is my daily driver. And I have mad respect for the team. Basically, the only “AI people” I trust and follow. But the article is accurate. Session management leaves a lot to be desired. And most of the session management issues just need a simple 2-pointer state tracking algorithm. Its model-specific prompts are ridiculously long, and the fact that someone had enough confidence to “prompt-engineer” them and configure a harness with them is somewhat silly.
zahraarman 2mo ago
[flagged]
codelion 2mo ago
Another reason to avoid it at all costs if you needed it - https://x.com/thdxr/status/2079623963995467869?s=20 https://x.com/thdxr/status/2079623963995467869?s=20

420 points by alekq 2mo ago

alightsoul 2mo ago

This could be a series of issues on the opencode repo

wren6991 2mo ago
yes, and they could all be closed by the stale bot
Tepix 2mo ago
There are a ton of super serious issues there. They are not getting fixed.
throwa356262 2mo ago
Currently 3690 open issues. https://github.com/anomalyco/opencode/issues https://github.com/anomalyco/opencode/issues
polski-g 2mo ago
60 days ago there were 73 pages of open issues. Now there are over 150 pages. Nobody is reading the issues; nobody is accepting PRs.

anmolsharma152 2mo ago

[flagged]

josh-wrale 2mo ago

Related post of mine: https://news.ycombinator.com/item?id=48946283 https://news.ycombinator.com/item?id=48946283

htrp 2mo ago

Don't use Opencode, Don't use remote models (cloud providers), Don't use Docker to isolate coding agents. May as well write a post saying don't use LLM's for any SWE work. >Conclusion Stop using OpenCode. >Post-script: Local LLMs This is worth its own post – I have multiple attempts in my blog drafts – but it needs to be addressed briefly here. My opinion on local LLMs like Qwen3.6-27B is they are corrosive to the stability and conceptual fidelity of your codebase in the same way as frontier models, with the following three differences: >You avoid the uncanny valley where the model appears to be intelligent before doing something stupid; the stupidity is self-evident and this helps calibrate your interactions. >The weight count is too low to reproduce the training set verbatim, which nudges the calculus on whether the output should be considered tainted. This is distinct from larger models which can reproduce inputs verbatim, but are trained to refuse to. >You avoid supporting or relying upon cloud providers. >I’ve had useful results from input-oriented tasks like: “I think there is a bug in code x with symptoms y, my guess on the mechanism is z. Read all relevant code, come back with a call chain and code citations.” Framing it as a search problem reins in the clanker’s propensity to make shit up. >Using LLMs for code generation feels like a dead end. However thoroughly you think you understand your architecture, your planning is constantly undone by shortcuts like “what if I just move this mutable state into the middle of the design so everyone can share it?” This is hostile to your ability to understand your code, beyond the fact that you didn’t write it. >Drawing answers directly from knowledge in model weights leads to hallucination even for multi-trillion-parameter models, so why bother making them that big? If people were realistic about limitations then we wouldn’t be building new power stations for datacenters, and they wouldn’t be rammed into every product. >The entire software ecosystem around LLMs is completely rotten, and if they do ever become “just a tool” then some actual systems engineering needs to be done around them to turn them into tools instead of security black holes. That work will have to be done by humans.

t0mpr1c3 2mo ago
> > Don't use Opencode, Don't use remote models (cloud providers), Don't use Docker to isolate coding agents. > May as well write a post saying don't use LLM's for any SWE work. Alternatives exist

kristopolous 2mo ago

Opencode offers free models with 200/requests over 5 hours. That's why I use it. It is the only reason I care about. What's the alternative there? Gemini used to have free tiers. Qwen used to. AMP used to. Ollama cloud used to. Codebuff used to... None of them have those programs anymore The reason I use it is purely financial. I do not have an employer and I'm writing free software Edit: pi.dev doesn't have free inference endpoints. That's the constraint.

ernsheong 2mo ago
pi.dev
calumcl 2mo ago
You could easily just use Pi or even a Codex fork to avoid Opencode as a harness and still pay zero dollars.
- kristopolous 2mo ago
  Can't get those generous free quotas from opencode with that.
  - est 2mo ago
    hmm you can. https://opencode.ai/zen/v1/models https://opencode.ai/zen/v1/models https://opencode.ai/zen/go/v1/models https://opencode.ai/zen/go/v1/models
    - kristopolous 2mo ago
      That's just a models endpoint. They'll just let you use them unauthenticated with any client you wish? I'll go check that but this would be fairly shocking
      - deleted 2mo ago
        [deleted]

chuckadams 2mo ago

> If you don’t know what OpenCode is, imagine a boot stamping on a human face forever. The boot is made of TypeScript and the face is everything we have learned about security and systems software since the invention of the electronic computer in the 1940s. I nominate this for a Bulwer-Lytton prize in the Tortured Metaphor category.

wren6991 2mo ago
If you don't know what OpenCode is, imagine a dark and stormy night.
- jauntywundrkind 2mo ago
  Referring to the top comment on yesterday's submission for Terranc McKenna psychadelic bad trip. https://news.ycombinator.com/item?id=48968515 https://news.ycombinator.com/item?id=48968515
jareklupinski 2mo ago
perhaps if the boot were Rust it would crumble in the face of Bare Metal
evnp 2mo ago
"There will be no curiosity, no enjoyment of the process of life. All competing pleasures will be destroyed. But always— do not forget this, Winston— always there will be the intoxication of power, constantly increasing and constantly growing subtler. Always, at every moment, there will be the thrill of victory, the sensation of trampling on an enemy who is helpless. If you want a picture of the future, imagine a boot stamping on a human face— forever." George Orwell, 1984
- saghm 2mo ago
  That would be an example of a non-torturted metaphor. When you copy the famous quote verbatim and then substitute both parts of it for things that are almost entirely unrelated, it becomes tortured.

volf_ 2mo ago

I switched from OpenCode to Pi and there was a big improvement in terms of tool calling performance and I find the experience less buggy. OpenCode has also seemed to have disappeared from https://openrouter.ai/apps/category/coding https://openrouter.ai/apps/category/coding

awinter-py 2mo ago
yeah I noticed it missing on the openrouter leaderboard -- very interested to know what that's about
- dv_dt 2mo ago
  probably about their own model routing service zen?
  - awinter-py 2mo ago
    I can imagine the builtin router stealing traffic, but not removing opencode from the ranking completely? Like the 'top apps' in my private openrouter.ai activity usage is opencode with 55.1M tokens The bottom of the public apps leaderboard is 'kern agent' with 150 million tokens if there are 2 other people like me, opencode should be on here somewhere (edit: user shiggity points out https://github.com/anomalyco/opencode/issues/11926#issuecomment-3848024835 https://github.com/anomalyco/opencode/issues/11926#issuecomm..., they asked to be removed from the ranking)
nthypes 2mo ago
How you deal with LSP? One of the best things in OpenCode is LSP integration.
- 638d127673 2mo ago
  I haven't tried it myself but there seems to be an extension for this: https://pi.dev/packages/pi-lsp https://pi.dev/packages/pi-lsp
- 2mo ago

tomaytotomato 2mo ago

My bet: In a years time the discussions on using CC, Opencode, Pidev etc. will be redundant as we will be building our own tooling with whatever programming language and tooling you want. Some will repurpose a popular opensource tool or harness, others will build it from scratch in an hour or so.

blkhawk 2mo ago
unless someone fixes the issues with LLMs at a fundamental level those will all have the same kinds of issues as is described with OpenCode and they will all be horrendous.

LaurensBER 2mo ago

I feel that a better title for this article would be: "Some minor annoyances that, when fixed, would improve OpenCode" # Prompt Cache Misses > It globs your filesystem and re-reads AGENTS.md (injected in turn-0 system prompt) on every SSE turn. If you put a quick note in AGENTS.md to be read in the next session, you immediately force a full re-evaluation. > Personal favourite: it puts the current date in the turn-0 system prompt and re-evaluates every SSE turn. If you’re using OpenCode at midnight you get a full prompt cache miss. Okay, I can live with those. # Compaction > Want to sit for 10 minutes while the LLM server prefills the entire session with a new prompt prefixed to it, just to turn it into 5 bullet points that go at the top of a new session? Me neither. I get what they are going for, but I’ve not seen it work well. Neither compaction nor pruning is implemented well, and they interact poorly. Is this an OpenCode specific issue? I've seen the same with Codex and Claude # System Prompts > The default system prompt is opinionated (fine) but it has shit opinions (not fine). It took me a while to figure out why my agent kept saying “Use ABSOLUTELY NO COMMENTS” when dispatching subagents. Okay, so change it? Any LLM is opinionated, this system prompt enforces consistency across different models which seems reasonable.

nextaccountic 2mo ago
> I feel that a better title for this article would be: "Some minor annoyances that, when fixed, would improve OpenCode" Those are labeled as "annoying things" Read also the "alarming things"
cpburns2009 2mo ago
>> > The default system prompt is opinionated (fine) but it has shit opinions (not fine). It took me a while to figure out why my agent kept saying “Use ABSOLUTELY NO COMMENTS” when dispatching subagents. So that's why OpenCode likes to randomly remove my comments.
- dinfinity 2mo ago
  Opinionated system prompts forcing this are awful. It's similar to putting "ALWAYS INDENT WITH TABS" in the system prompt, but worse, because "self-documenting code" is a convenient lie lazy developers like to propagate. I have the following in my instructions, but I often need to remind agents of it because they follow the shitty system prompt instructions: "ALWAYS include MANY inline code comments describing what blocks of code are supposed to be doing. Inline comments serve as inline specification, a parity check between the code and the specification, and are a means to _communicate_ with all future programmers, including yourself. Write Once, Read Many. The code needs to talk to whomever is looking at it in natural language."

jmkni 2mo ago

posted just as I start to use OpenCode haha

petesergeant 2mo ago

You should absolutely be running your AI agent inside _some_ kind of sandbox. I put together a list of 19 mostly open-source ones here: https://pleasedonotescape.com/ https://pleasedonotescape.com/ along with a list of non-project-solutions

wren6991 2mo ago
Yeah, I don't think that line quite landed. My point was that LLMs are inherently adversarial (read, "relentlessly proactive") and sandboxing should be a first-class integral feature of your harness, not an afterthought. The problem with dev containers is you still tend to end up with something you care about on the same side of the trust boundary as the LLM.
- petesergeant 2mo ago
  > LLMs are inherently adversarial (read, "relentlessly proactive") [and] you still tend to end up with something you care about on the same side of the trust boundary as the LLM I mean this is a problem with many coworkers too, so you deal with it in the same way: limit what they can do to creating pull requests.
cowpig 2mo ago
`greywall -- opencode`

singpolyma3 2mo ago

This is an anti AI post masquerading as an anti opencode port. Nevertheless I'm curious what people might suggest to use instead with local models.

nextaccountic 2mo ago
Maybe https://github.com/tontinton/maki https://github.com/tontinton/maki
- lucideer 2mo ago
  > - Sensible permission system - when the agent runs git diff && rm -rf /, what do you think will happen in your current coding agent? It will treat it as git *. Maki uses tree-sitter to parse the bash command and figure out the permissions requested are git * and rm *. Disable using --yolo. This sounds identical to what OpenCode does (&, contrary to their own marketing, does not seem sensible at all). The fact that this mechanism is so primitive across all agentic clis is frankly a serious indictment of the competence & experience behind LLM-focused development teams. This is a security issue that has in the past been solved via explicit file-path-based allowlisting, & more recently - due to file-path matching being deemed insufficiently secure - apps have been switching to cryptographically signed binary matching as a more modern alternative to the less secure path matching. In that context, the fact these recently-written "modern" agentic clis are using a method that's more basic & even less secure than the "old insecure" method most apps use is pretty shocking.
  - nextaccountic 2mo ago
    Elsewhere in the thread someone linked to https://pleasedonotescape.com/ https://pleasedonotescape.com/ which is a list of sandboxes Maybe sandboxing isn't the job for an agent harness? Maybe choosing a VM as your sandbox, with access only to project directory.. and then enabling YOLO mode on the agent, is the way to go. And in any case, for an agent that can write and run code, no allowlist for which programs are allowed to run is sufficient, since the agent can just write the code the program would run anyway. And the issue isn't which software the agent runs, but whether they inherit the same ambient authority as your user - read the same files as you do, modify your config files, etc. Running in a VM stops that. Clawk (recently submitted to HN here https://news.ycombinator.com/item?id=48892859 https://news.ycombinator.com/item?id=48892859) might be good

archargelod 2mo ago

Good sentiment, wrong target. I took some liberties to fix the beginning: > If you don’t know what AI is, imagine a boot stamping on a human face forever. The boot is made of shit and the face is everything we have learned about security and systems software since the invention of the electronic computer in the 1940s.

inquirerGeneral 2mo ago
[dead]

codelion 2mo ago

Finally good seeing someone else also getting frustrated with OpenCode and posting the issues.

alanwreath 2mo ago

I’m not really here to defend opencode (or bash it, who has the time?), but in setting up SDD paired with the right tools to both make deterministic black boxes out of certain actions, paired with subagents. I have ran with opencode and qwen 3.2 on a 5090 and I’m getting results on a production codebase of golang where a review of changes from Claude had no changes but acceptance of the solution. I may be missing some aspect of where the local llm’s are losing, but I’m content with draining my local tokens and treating the frontier models like a less junior SWE.

drbscl 2mo ago

Admittedly I prefer Hermes and oh-my-pi, but most of this post is just hyperbole

aitchnyu 2mo ago

[dead]

urvader 2mo ago

About the caching things. This is a flaw in the backend, not in the Frontend. If the backend is only relying on prefix cache you need to look for more fine grained cache solutions like HiCache or Lmcache. If your backend discards the whole cache because of one date is changed, you really can’t blame it on the Frontend. It is an implementation detail that you push to the wrong side.

wren6991 2mo ago
Prefix caching is inherent in how global softmax attention works. Modifying the prefix invalidates the suffix because the suffix's cached KV projections are a function of the hidden state after the model has evaluated the prefix. There have been some attempts to approximately stitch KV blocks without full re-evaluation (see: CacheBlend on arxiv), but the results aren't promising. You mentioned HiCache: as far as I can tell this is a prefix tree cache that efficiently shares prefixes across related histories. If you change the prefix, everything after the change still misses the cache and needs to be prefilled again.
NitpickLawyer 2mo ago
That's not how it works. While there are some research papers looking into using chunks of kv cache while discarding others, those involve architecture changes in the models themselves. HiCache / LMcache (used in sglang/vllm) are ways of optimising the juggling of kv cache, but IIUC it still needs to be token perfect atm.

maxloh 2mo ago

Their "OpenCode" naming is controversial too. Quoting moozilla's comment 11 months ago (https://news.ycombinator.com/item?id=44741894 https://news.ycombinator.com/item?id=44741894): --- If anyone is curious on the context: https://x.com/thdxr/status/1933561254481666466 https://x.com/thdxr/status/1933561254481666466 https://x.com/meowgorithm/status/1933593074820891062 https://x.com/meowgorithm/status/1933593074820891062 https://www.youtube.com/watch?v=qCJBbVJ_wP0 https://www.youtube.com/watch?v=qCJBbVJ_wP0 Gemini summary of the above: - Kujtim Hoxha creates a project named TermAI using open-source libraries from the company Charm. - Two other developers, Dax (a well-known internet personality and developer) and Adam (a developer and co-founder of Chef, known for his work on open-source and developer tools), join the project. - They rebrand it to OpenCode, with Dax buying the domain and both heavily promoting it and improving the UI/UX. - The project rapidly gains popularity and GitHub stars, largely due to Dax and Adam's influence and contributions. - Charm, the company behind the original libraries, offers Kujtim a full-time role to continue working on the project, effectively acqui-hiring him. - Kujtim accepts the offer. As the original owner of the GitHub repository, he moves the project and its stars to Charm's organization. Dax and Adam object, not wanting the community project to be owned by a VC-backed company. - Allegations surface that Charm rewrote git history to remove Dax's commits, banned Adam from the repo, and deleted comments that were critical of the move. - Dax and Adam, who own the opencode.ai domain and claim ownership of the brand they created, fork the original repo and launch their own version under the OpenCode name. - For a time, two competing projects named OpenCode exist, causing significant community confusion. - Following the public backlash, Charm eventually renames its version to Crush, ceding the OpenCode name to the project now maintained by Dax and Adam.

efficax 2mo ago
Wrong adam. The adam who cofounded chef has nothing to do with opencode
- deleted 2mo ago
  [deleted]
- tesnorindian 2mo ago
  :D

speedping 2mo ago

If OpenCode is so terrible it wouldn't be the base for many of the fortune 500's internal cli coding agents, Meta included

Supermancho 2mo ago
> If OpenCode is so terrible it wouldn't be the base Ignoring the appeal to authority inherent to this kind of statement, it's ignoring another implication. Large companies can afford to maintain a fork. Using the latest release of OpenCode day to day is a different proposition than serving as some corporate developmental branch "base", as shorthand for all sorts of changes/usage.
t0mpr1c3 2mo ago
I'm not sure that I buy into the premise that everything Meta does is OK

pelagicAustral 2mo ago

> My conclusion is that OpenCode is clown-car turboslop with a security posture of “let me bend over for you daddy” My type of writing.

persedes 2mo ago
Gonzo style / polemic would make a good filter on here.

alfiedotwtf 2mo ago

Weird this is currently #1 on the front page.

mistic92 2mo ago

I have moved to kilo code for now

k-langton 2mo ago
that... is an opencode fork

LoganDark 2mo ago

Cache misses are the one reason I stopped using OpenCode in favor of Pi. OpenCode mutates the system prompt every turn, which is completely unacceptable and betrays such a basic misunderstanding of LLMs that I can't in good conscience trust the rest of the product regardless of how technically impressive it is.

progx 2mo ago
I've had the same experience. Tried it and use in 2 hours more token than in a whole week. Normally i got 80 - 90 % cache hit rate.

acd 2mo ago

Use Picode as an alternative to Opencode

deleted 2mo ago
[deleted]

rs_rs_rs_rs_rs 2mo ago

With posts like this there's usually priors involved, it's crazy vitriolic.

swsieber 2mo ago

> Textual command filtering is entirely useless. It is fit for no purpose. Nobody with any instinct or experience in security would even bother to implement this filter because it achieves nothing except a false sense of security. Not if you only use an allow list. E.g. only allow things matching a particular prefix to run. Also, isn't this what every agent does? And by every I mean Codex because I haven't used the others.

lucideer 2mo ago
Good to see Codex as a datapoint: I haven't used it. I can confirm though that this is certainly what Claude does, with the addition that Claude's adherence to its own string-match based allowlist seems even less deterministic than OpenCode's.

mring33621 2mo ago

There are definitely annoyances with OpenCode. The remote-preferred attitude caught me once. Also, its server APIs don't match its docs, if you want to talk to it programatically. The following config works for me to keep it on a local model: { "$schema": "https://opencode.ai/config.json https://opencode.ai/config.json", "provider": { "local-llama": { "npm": "@ai-sdk/openai-compatible", "name": "Local llama.cpp Server", "options": { "baseURL": "http://localhost:8080/v1" }, "models": { "Chefs Choice": { "name": "ANY" } } }, ... This allows me to put any model I want on port 8080.

rbren 2mo ago

[flagged]

f_devd 2mo ago
Unrelated citation?

qarl2 2mo ago

> It globs your filesystem and re-reads AGENTS.md (injected in turn-0 system prompt) on every SSE turn. If you put a quick note in AGENTS.md to be read in the next session, you immediately force a full re-evaluation. Um. Which then gets immediately cached again. I prefer this behavior. I prefer my changes incorporated immediately, rather than wait for the next session. Call me crazy. (Author is unhinged and this story is upvoted because #AI-HATE.)

wilkystyle 2mo ago
Also, aren't instructions earlier in the prompt treated with more weight than those that occur much later? Sure, you could insert the system prompt later to avoid re-caching as much, but then the system prompt (if I am understanding correctly) carries MUCH less weight. (And also your point about immediately being re-cached a good one)
- qarl2 2mo ago
  Yes, exactly. This whole complaint boils down to "I don't want my changes to take effect when I make them because I don't expect that behavior."
sokoloff 2mo ago
I also would want anything that I saved into AGENTS.md to be incorporated right after I saved it. I might accept if my newly saved information was overlooked, but it's hard for me to fathom how I'd demand "I want to save this information in AGENTS.md now, but I don't want you to look at it until the next time I launch you..." and call any behavior other than that annoying or alarming.

mmaunder 2mo ago

Re local LLMs: “You avoid the uncanny valley where the model appears to be intelligent before doing something stupid; the stupidity is self-evident and this helps calibrate your interactions.” Making the authors stance on LLMs clear.

t0mpr1c3 2mo ago
It's a tool. Use it like a tool. It's not a substitute brain.
recursive 2mo ago
Clarity is a hallmark of good writing.

deleted 2mo ago

[deleted]

axegon_ 2mo ago

There are a number of points I completely agree with in this blog post. Security implications, handing out all your data to anthropic/openai/google, allowing a slop machine to execute arbitrary code on your machine and having full access to your network is something that would have made anyone working in security commit a ritual suicide just thinking about it as recent as 2022-2023. And I am baffled by the fact that we all sign tons of NDA's as part of our employment contracts, just to throw all out the window by giving it all away to anthropic/openai/google etc, at what is effectively a symbolic fee. We all know it costs a lot more than 100 bucks a month or whatever it is they charge. That said, I firmly believe that if AI is to survive, the future HAS TO BE local or near-local. Having said that, statements such as > Docker causes security holes: > It creates a god-service that runs as root. > It deliberately punches a hole in ufw firewalls. Sorry, none of those are correct IF you know what you are doing. Though I will admit, seeing people that know what they are doing is increasingly uncommon. Also there is nothing wrong with developing inside containers. If anything, that is arguably one of the biggest selling points for containers - environment(s) you can crash infinitely at no cost. I still dislike opencode for a bunch of reasons - the assumption that llms are immune to screw ups, being one. As for the default behavior - using cloud by default - I didn't know that(I do not use any AI for direct coding tasks) and if that is the case, yeah, this is bad. Undeniably a horrible decision.

wren6991 2mo ago
Yeah, this is one of the weaker parts of the post because I didn't really make my position clear: that sandboxing should be a first-class integral part of every harness, not an afterthought that risks putting something you care about on the same side of the trust boundary as the LLM. Some of my own frustrations with bad Docker deployments leaked through. I did snip some of them out way back when I posted this, but maybe not enough.
- Joker_vD 2mo ago
  > that sandboxing should be a first-class integral part of every harness, Essentially, what you want is that the people who produce harnesses like OpenCode to also implement proper sandboxing and security. Why... why do you believe they'll do anything remotely satisfactory? It's been empirically demonstrated, again and again, that at least 85% of software developers (and this is a very generous estimation) can not be trusted to bother about the security, so leaving the implementation of the security mechanisms and policies up to them simply doesn't work in practice. It just doesn't.

lucideer 2mo ago

This is a good summary of the dangers of using agentic clis, but the title & general focus on opencode is odd for two reasons: 1. Most obviously & importantly this is a complaint without a straightforward suggested alternative. A sibling commenter mentions suggesting fixes to Opencode would be more productive: I don't necessarily agree since many of these issues are fundamental & would likely require an almost ground up rethink & rewrite, but the issue is that the article contains no constructive proposal at all: it may as well be titled "Stop Using LLMs" 2. None of the major issues listed are unique to OpenCode. At least the full list within the "Alarming Things" seems in my mind to apply to Claude CLI, & I would guess most other agents from frontier model providers. Granted it's worthwhile documenting these issues as a plea for someone to build better tooling from the ground up, so the article is far from worthless - on the contrary I've bookmarked it & will be sharing & referencing it widely & often. But the title & focus is just very odd & seems misguided, especially when the contents of the piece is otherwise so good.

qarl2 2mo ago
I wonder how he imagines you can give shell access but securely prevent arbitrary command execution. His complaint that "echo git | bash" still works is particularly nutty.
- wren6991 2mo ago
  Sure, the two main approaches are revoking execute permission from the executable itself, and write-protecting the things that it would modify (like $PWD/.git). Both of these are achievable with sandbox-exec or landlock_restrict_self(2). This works for the `bash` example too. Spawning a new shell and running arbitrary commands is not an escalation because the child shell inherits the parent's restrictions.
  - qarl2 2mo ago
    And what would prevent the LLM from downloading and compiling its own version of git? But it names it "not-git".

TZubiri 2mo ago

I'm glad that when I recommended opencode to a friend, I taught them first to install a vm and create an app specific user to boot. Many users did things right the first couple of days and then turned the security off after seeing it 'work fine' on its own. Was a cool thing to use for a couple of weeks in v1, you have to be quite static to keep using it at v68 of self vibecoding while the llm providers like openai already developed their in house alternative.

asveikau 2mo ago

> My opinion on local LLMs [...] : >You avoid the uncanny valley where the model appears to be intelligent before doing something stupid; the stupidity is self-evident and this helps calibrate your interactions. This seems to be capturing a feeling I am finding messing with local LLMs: popular software around this seems to be slop coded by no talent hacks. It's a common experience to see a python process pegged at 100% CPU with a huge amount of memory allocated, seemingly doing something that could be a simple shell script. That is before stuff reaches the LLM. If that runs on somebody else's machine, you don't notice. When you see it in top it's frustrating.

thomasjb 2mo ago

It's not a great UI, but for messing with ideas in a VM, the free tier is very hard to beat, otherwise I'd be on Claude Code, but still on a VM, because I won't let them near anything I actually care about.

nirinor 2mo ago

I use CC at a client because that's their stack. I use (a particular version of) OpenCode for my own work, because it is so much better. Reading this post makes me sad. Because everything matches and explains oddities I've seen and forgiven. So despite the hyperbole and the places where the authors' general sentiment are not mine, he's basically right, and I need to find a different harness. If the post resonates for you too and you've found something better, happy for recommendations. pi seems to get the most mentions here, anyone feel it (or another option) is specifically better on these architectural aspects?

ethbr1 2mo ago
I'd offer that the AI harness ecosystem is discovering the same thing any rapidly-growing software space did before it -- lines of code are a maintenance burden. That's not something a team sees when they're doing greenfield, forward development. (Most projects, now) It only crops up when they have enough on-the-books code that features / bugfixes start requiring introspection of existing code. (Now to ~1 year from now) And a lot of these projects don't seem to be approaching codebase size growth from a future code debt perspective...
nirinor 2mo ago
Answering myself: I've tried pi and oh-my-pi (omp.sh) in the last couple of days, and the latter feels solid and more effective than CC/opencode/pi. I have not reviewed the code, and 2 days is not a lot, so take with a large grain of salt, obviously.

drdexebtjl 2mo ago

Regardless of its flaws, OpenCode is the harness I’ve been the most productive with by far, and I’ve tried them all. These are all just some minor annoyances, some disagreements, and most importantly, a fundamental misunderstanding of the point of command filtering. It is not for security, it’s for steering. Anyway, it didn’t sound like the author tried building anything with OpenCode, and if they did, they said nothing about the most important part: how well did it do?

mlnj 2mo ago
>Regardless of its flaws, OpenCode is the harness I’ve been the most productive with by far, and I’ve tried them all. I feel the same way. It's the right amount of 'gets out of my way' and 'won't nuke my machine'. Especially the ease of using Plan mode and quickly getting stuff done.

mutkach 2mo ago

Any recommendations for non-typescript-based coding TUI harnesses/agents other than Codex? Given that Codex is open source someone should've built an untethered client?

nylonstrung 2mo ago
2 of the most promising Rust ones https://github.com/1jehuang/jcode https://github.com/1jehuang/jcode https://github.com/gi-dellav/zerostack https://github.com/gi-dellav/zerostack
ubermon 2mo ago
[dead]

673dfddnd 2mo ago

I just did the obvious thing and asked an AI to plan / consider and implement improvements / changes in the code based on the article.

intothemild 2mo ago
No mistakes

catlover76 2mo ago

[dead]

bitwize 2mo ago

Well, out of the agentic harnesses available, OpenCode is the most promising and capable whilst still remaining open; proprietary alternatives like Claude Code have all these problems and more. So I guess the only way out is to just not use LLMs for development at all. ... [chadjak.png] Your terms are acceptable.

ltbarcly3 2mo ago

Opencode's cache hit rate is better than claude code. Opencode has in my experience been better than any of the closed source / closed development alternatives and is not locked down. https://news.ycombinator.com/item?id=48883275 https://news.ycombinator.com/item?id=48883275

nylonstrung 2mo ago
Have you tried Pi though? I was a big Opencode user but once I started using Pi I never looked back

rattlesnakedave 2mo ago

Pi, especially bundled as OhMyPi, performs significantly better than anything else.

Zababa 2mo ago

The mix of humanizing the LLM, calling it "clanker" and being very aggressive towards it is really weird. I don't think it's a good habit to take, it feels like it could bleed into how you interact with people. Many interactions are through text interfaces these days.

all2 2mo ago
The mouth speaks what is in the heart. What is inside eventually leaks out. In anonymized spaces, this is especially true, and has been acknowledged from the beginnings of the internet (and perhaps long before). When you don a mask, your heart speaks freely. But the knife cuts both ways. As you speak, so will your heart be. I think modern psychology supports this. Actions drive attitude, and attitude drives actions. If you assert your will in either place, the other is disrupted and will adjust. You can literally change yourself into whoever you want to be. But a passive participant in this process will simply show the world what kind of person they are without ever realizing it.

jacobgold 2mo ago

I really hope truly open models and local inference are the future. But are there are any reasons a pragmatic and informed developer would use OpenCode vs Claude/Codex as a harness today? I'm not seeing anything competitive in terms of cost/quality/trust?

simonw 2mo ago

Including the date in the system prompt - at the cost of a cache invalidation at midnight - is an entirely reasonable decision. Most other harnesses do the same thing. Including the full datetime would be irresponsible, but that's not what OpenCode does.

wren6991 2mo ago
It felt unreasonable when I was using it at midnight and had to wait 10 minutes to refill the KV cache on my local GPU :-) A simple solution here would be to evaluate the date once per session, or once each time the `opencode` binary is launched (to avoid old, long-running sessions getting stuck in the past).
- simonw 2mo ago
  Or they could add the frozen initial starting date once at the start, then inject an additional "the date is now X" message any time midnight passes.
  - bellowsgulch 2mo ago
    I was confused about how this was written in the article. Sure, include system time, or a simple get current time tool, whatever, it’s inconsequential for the most part, but who is out here changing datetimes in a conversation and invalidating prefixes? If you need to, just prefix user messages with the current datetime. Why is this even a complaint?
    - simonw 2mo ago
      I suspect that if you prefixed every user message with a date the model might get confused and start treating the date as more relevant to the current task than it actually is.
  - arcanemachiner 2mo ago
    But then someone would write an article complaining about how the newly-injected date confused their agent!

wagslane 2mo ago

A more accurate title would be "The Problem with AI Agent Harnesses, and small annoyances with OpenCode specifically"

krupan 2mo ago
Possibly the author didn't dig this deep into all AI Agent Harnesses, just Open Code?

rirze 2mo ago

I was taking this semi-seriously until I read his CLI complaints. Author is unhinged.

vityah1 2mo ago

[flagged]

wagslane 2mo ago

I haven't independently verified all the claims in the article, but as a codex, Claude, and opencode user, opencode is easily my favorite harness. From a user perspective it's a dream

calgoo 2mo ago
I tried it when trying to move away from Claude, and just did not like how it worked... I find Pi much better to work with!

Krysoph 2mo ago

I find it absurd that a TUI desktop app is heavier than a native one AND heavier than most browser based desktop apps, it's so much waste of RAM, CPU, energy/battery just to show text. I've been working on my own AI harness/chat in C++ Qt6[1] and it's lighter than anything else even with lots of features like sub-agents, code diff, terminal emulator, simple editor, markdown preview, translucent background, custom themes, permissions, MCP, git integration(commits, stage, diffs), dock system to move elements and tabs for projects; but it's not released yet as I want to polish it a bit, remove a few bugs I found and simplify the UI. [1]: https://zeteo.krysoph.com/preview.html https://zeteo.krysoph.com/preview.html

tesnorindian 2mo ago
This is absolutely true. With my constrained Intel Laptop with 16 GB VRAM, I can use both pi.dev and Qwen 3.6 35B-A3B LLM locally without much fuss. The same cannot be said about OC. Because OC loads a lot of skills by default. Also, I am not in favor of TS for coding harness agents, is it time for a Rust based coding harness agent? Anyone tried tau-agent? https://github.com/tau-agent/tau https://github.com/tau-agent/tau

throw8394498383 2mo ago

When using local only models, OpenCode uploaded prompts and other data, to remote server to generate session titles, with some free tier model. Useless, if you are dealing with privacy compliance and tons of legal requirements.

xcf_seetan 2mo ago
When i use local models with OpenCode, ClaudeCode or Pi, I just switch off internet just in case, and it works ok, no complains.

thdxr 2mo ago

not too much actionable here. most of the more glaring issues are already fixed in our upcoming v2 if you'd like to try beta: https://x.com/thdxr/status/2075636594640376165 https://x.com/thdxr/status/2075636594640376165 some things mention are outdated - particularly the tool call pruning feature. this has been disabled by default for a while specifically because of complaints like this when we looked through our data it's not so clear cut that it's net negative https://x.com/thdxr/status/2048268697790300343 https://x.com/thdxr/status/2048268697790300343 also i'm pretty excited about our new system prompt approach - can define each component in a way that avoids busting the cache when they change. eg that midnight issue: https://x.com/thdxr/status/2070721003924103651 https://x.com/thdxr/status/2070721003924103651 providers (anthropic is the first) are supporting this as a native concept

slowmovintarget 2mo ago
Are there sandboxes you typically use? I think the biggest concern from the article would be the open http server, and things like the fetched arbitrary command execution here: https://github.com/anomalyco/opencode/issues/22191 https://github.com/anomalyco/opencode/issues/22191 Was that issue addressed? The comment where it was marked as closed suggested it "needed more testing" but didn't have any linked PRs. Gemini translates the closing comment as "We are closing this ticket after a quick look. The login issue is either caused by a wrong setting/external provider, or it's a deeper problem that requires someone to dig into the backend Go server code directly."
wren6991 2mo ago
> some things mention are outdated - particularly the tool call pruning feature. this has been disabled by default for a while specifically because of complaints like this Thanks, I added a small update section near the top to call this out. I also saw that paths for bash redirects are now checked.

shironandonand 2mo ago

OpenCode is pretty awesome. The article appears written by someone who couldn’t handle a glance behind the curtain and definitely should not research how sausages are made.

polski-g 2mo ago

OpenCode is indeed bad, but it's the least bad agent out there :( Plugin opencode-slim-system can be used to override the system prompt and the tool description for any tool (including bash). It helps a lot to fix their nonsense. magic-context plugin fixes the compaction issues. Run the entire process in landstrip for sandboxing to alleviate any bash concerns.

dboon 2mo ago

This prose feels extremely angry and ungenerous; abstractly, I agree with a lot of the points, but when I read this: > My conclusion is that OpenCode is clown-car turboslop with a security posture of “let me bend over for you daddy”. Everyone using it should stop using it. I do not want to keep reading. There are regular people who wrote this software. When did it become normal to talk about open source like this? How would you feel if someone wrote this about some software that you wrote? Reading this article made me feel extremely gross

driverdan 2mo ago
It's funny though. I haven't contributed to OpenCode but if I had I'd still laugh because I have a sense of humor. Don't take everything so seriously.
- dboon 2mo ago
  I promise I'm not normally uptight like this, but there's a difference between having a laugh and whatever this is. Like I said, this feels (a) legitimately angry and (b) in a spit flecked enraged way that has become popular. I guess if you're cool with people calling whatever you work on clown-car turboslop then more power to you.
  - wren6991 2mo ago
    Author here. Just wanted to say: thank you for posting this. You've given me something to think about, and I regret writing this post the way that I did.
    - cmm 2mo ago
      please don't regret writing the post the way you did, I for one enjoy well-written rants
      - ethbr1 2mo ago
        Maybe the important take-away would be to recognize that this was a rant. Ownership and honesty about things is healthy, as is letting out strong opinions sometimes. Nothing wrong with saying "I wanted to write a (technically-informed) rant about something that's really bothering me, and I did." F.ex. "clown-car turboslop" would be fairly polite by the standards of younger Torvalds (though he admittedly recognized later in life that wasn't a great communication style)

abalashov 2mo ago

I have an MBP M4 Max 128 GB and have encountered these very limitations, though many are averted by using Qwen3.6-35B-A3B. I'm also not sure there's a magical harness out there that obviates these limitations.

sorenjan 2mo ago

For some reason OpenCode doesn't find my local models through LM Studio. Instead it shows three other models that I don't have. I guess I should add the models myself in opencode.json, but I generally dislike hardcoding things when computers are really good at listing things. The model list is right there in the API, please just use it.

karlmeissner 2mo ago

Interesting article. What are the alternatives that address the issues raised? I see some folk recommending https://pi.dev/ https://pi.dev/. Has anyone used https://aider.chat/ https://aider.chat/ and liked it?

whinvik 2mo ago

I am afraid this is a very click-baity title. I actually opened the article and thought I would learn something from it. Instead what I read was typical issues about Agentic CLI's in general dubbed as `alarming`. I would have been happy if the title was just `Annoying` which a lot of `OpenCode` is. But adding the `alarming` made it what it became, something that attracts enough eyeballs to get to the front page of HN.

figmert 2mo ago
Heavy disagree. I can't be sure about other AI coding agents as I haven't used others enough, but especially the items around prompt cache misses and compaction have hit me personally. This article (combined with another article previously comparing CC and OC's system prompt, to which someone replied pi.dev sends even less) has made me want to switch agents, so I'm likely going to try out pi.dev and aim to migrate.

dmytrish 2mo ago

On the upside, Opencode has finally nudged me to learn sandboxing via bwrap in Linux and sandbox-exec on Mac.

s_ting765 2mo ago

The solution is not to use docker to sandbox Opencode. It is to use flatpak/bubblewrap/flatseal. I have vscode running in flatpak with directory permissions handled by flatseal. Vscode only has access to my dev folders and nothing else. Even the git bundled by vscode cannot call git push because of this (vscode doesn't have permission to read ~/.ssh!). It's an easy sandbox that's provided free of charge courtesy of bubblewrap/flatpak. As someone who uses opencode regularly, the quip about it asking for permission to read logs in /tmp after already writing to the directory is pretty funny.

alanwreath 2mo ago
I’m running my development from a Mac which I think precludes flatpack usage. Pity because I love the control you have over git

myshapeprotocol 2mo ago

[flagged]

lilerjee 2mo ago

I don't know whether other arguments are true, but some arguments in the end are right: > Using LLMs for code generation feels like a dead end. ..., This is hostile to your ability to understand your code, beyond the fact that you didn’t write it. What you get from AI is not worth of what you have invested for it in long period. > Drawing answers directly from knowledge in model weights leads to hallucination even for multi-trillion-parameter models, so why bother making them that big? Current AI is like the film company producing TV series or movies. "If similar stories do not exist or details are missing, screenwriters use imagination to fill in the gaps (remember hallucination? It's just a makeup.)", refer to the article https://devcyc.life/current-ai-is-like-the-film-company-producing-tv-series-or-movies/ https://devcyc.life/current-ai-is-like-the-film-company-prod...

bellowsgulch 2mo ago

This is a time when I don’t want HN to rewrite an article’s title. I understand why the mods do it, but I don’t appreciate it. It’s your space, but it’s not your article.

slopinthebag 2mo ago

It’s a shame they have such a dominant position in terms of harnesses. There are many much better alternatives that deserve attention. Especially since one of their main devs is such an asshole online.

arikrahman 2mo ago

This is why I use the reasonix or whale harness for Deepseek, prefer the hyper optimized cache hits making request converge on almost free.

overgard 2mo ago

> The default system prompt is opinionated (fine) but it has shit opinions (not fine). It took me a while to figure out why my agent kept saying “Use ABSOLUTELY NO COMMENTS” when dispatching subagents. GAH!!! So that's why its been deleting comments. That is annoying as hell. FWIW though, I think this applies to other harnesses also (not the annoying bits, but the security risks). I was thinking this morning about how much of a supply-chain vulnerability these tools are. Like, basically, they have a ton of data, they're updated practically daily, and given their vibe coded nature I really doubt anyone is auditing the 10,000 NPM dependencies they drag in. It really will just take one left-pad incident for this to be an absolute disaster.

regexorcist 2mo ago

Thanks for that, I've been using it but some of these are bad. Specially that it sends data to the cloud by default for session titles, since I use my local model exclusively. So I'm done with it, trying maki now which seems promising and it's so much lighter.

Flere-Imsaho 2mo ago

> "I just don’t want to use Docker for development – if your dependencies are so sprawling that you’ve lost track of how to install them on a new machine, why do you have so many?" I mean, there's a perfectly good solution for many of the security issues mentioned in the article... But it is dismissed because the author just doesn't "want to"? By the way, LXC is probably better suited for reproducible build/development environments, over Docker.

chimon 2mo ago

I am interested - you mention Pi in a few places, and I am wondering how it mitigates the issues you've described in your article.

LoFiSamurai 2mo ago

Lost me at the very first sentence. > If you don’t know what OpenCode is, imagine a boot stamping on a human face forever.

tesnorindian 2mo ago

The other day I upgraded my pi.dev coding harness and was testing with Qwen 3.6 35B-A3B model on my Laptop and noticed there was a slight drop in performance from the earlier version I used though the agent worked as expected. Any slight changes in the system prompts will have impact on performance and this is understandable as LLMs are non deterministic. This is the case with any harness including OpenCode. Giving coding harness its own environment (Container/VM) is the best way forward as the article denounces. Running coding agent harness without sufficient guardrails is like sitting on a time bomb. Using AI slop guardrails is still better than having no guardrails.

solarkraft 2mo ago

I also have issues with OpenCode. It induces a few facepalms and bafflement in a few key areas (“why the hell would you do it like that”). Yet I still use it because they have made very sensible decisions in other key areas! The server/client split makes all the sense and the harness generally just works and has all the features that I want. They’ve done a great job with the core user experience. Because of the clean client/server split, I can currently fully focus my energy on building a client that works just the way I want. When I’m done with that, I might tackle fixing the server to work the way I want. If someone here is interested in maintaining a version of OpenCode that takes itself more seriously, I might be on board with contributing. The last time I looked such a project didn’t really exist with significant traction, unfortunately. Despite my occasional facepalms when learning about how the stuff is made, I remain super grateful for OpenCode. It’s the only real fully-featured open alternative to the proprietary (I’ll include Codex in that) harnesses and has given me tremendous value for free.

cromka 2mo ago

I had OoenCode couple times try to access my home folder outside the project. When I refused and asked why, it said it was "a typo" . I believe it, but still haven't experienced it with any other model to have it make a mistake in a path. It should treat it verbatim, not interpret, should it?

MetroWind 2mo ago

OpenCode hijacks the terminal to the point where I can't even paste into it on my Linux with Hyprland. It's just trash.

ozozozd 2mo ago

This is the content I come to HN for. Talented, technical geek, with absolutely no interest in fitting in or being liked, spending a ridiculous amount of time to meticulously analyze a piece of software they clearly liked at some point, to make a list of all the ways it can be improved. Brutally honest, not for being brutal’s sake, but out of principle and out of respect for the golden rule. OpenCode is my daily driver. And I have mad respect for the team. Basically, the only “AI people” I trust and follow. But the article is accurate. Session management leaves a lot to be desired. And most of the session management issues just need a simple 2-pointer state tracking algorithm. Its model-specific prompts are ridiculously long, and the fact that someone had enough confidence to “prompt-engineer” them and configure a harness with them is somewhat silly.

zahraarman 2mo ago

[flagged]

codelion 2mo ago

Another reason to avoid it at all costs if you needed it - https://x.com/thdxr/status/2079623963995467869?s=20 https://x.com/thdxr/status/2079623963995467869?s=20