This could be a series of issues on the opencode repo
60 days ago there were 73 pages of open issues. Now there are over 150 pages.
Nobody is reading the issues; nobody is accepting PRs.
Annoying and alarming things about OpenCode
131–140 of 309 posts
Re: Annoying and alarming things about OpenCode
#132[flagged]
Re: Annoying and alarming things about OpenCode
#133I have moved to kilo code for now
that... is an opencode fork
Re: Annoying and alarming things about OpenCode
#134Use Picode as an alternative to Opencode
[deleted]
Re: Annoying and alarming things about OpenCode
#135I was taking this semi-seriously until I read his CLI complaints.
Author is unhinged.
Re: Annoying and alarming things about OpenCode
#136Earlier quoted context omitted.
Sure, the two main approaches are revoking execute permission from the executable itself, and write-protecting the things that it would modify (like $PWD/.git). Both of these are achievable with sandbox-exec or landlock_restrict_self(2). This works for the `bash` example too. Spawning a new shell and running arbitrary commands is not an escalation because the child shell inherits the parent's restrictions.
And what would prevent the LLM from downloading and compiling its own version of git? But it names it "not-git".
I mean, ideally enforce W ^ X, and enforce stricter permissions on executables where the agent has flipped the W to X. My broader point is we should be using operating system primitives instead of regex and wishful thinking.
Re: Annoying and alarming things about OpenCode
#137I feel that a better title for this article would be: "Some minor annoyances that, when fixed, would improve OpenCode" # Prompt Cache Misses > It globs your filesystem and re-reads AGENTS.md (injected in turn-0 system prompt) on every SSE turn. If you put a quick note in AGENTS.md to be read in the next session, you immediately force a full re-evaluation. > Personal favourite: it puts the current date in the turn-0 s…
This article has several sections and you are commenting on things under the section titled "Annoying Things". There is another section titled "Alarming Things", with a subsection titled "It’s Fucking Full of RCEs". (Those are RCEs other than those which simply derive from the issues pointed out in previous subsections).
[deleted]
Re: Annoying and alarming things about OpenCode
#138Earlier quoted context omitted.
The RCE they mention was fixed in December, 2025: https://github.com/anomalyco/opencode/releases?page=21#relea...
It is a pretty catastrophically dumb CVE, of the sort that makes me not want to allow OpenCode anywhere near any of my machines in the future. It was basically "RCE as a service", not some subtle bug. Personally, I run pi-agent in a custom sandbox based on bwrap, with an internet proxy. This mostly limits the blast radius to one source tree and one git checkout. And I don't give it push/pull permission. Local models…
I too love and use pi agent.
But all of these agents have or had "dumb" security issues:
https://github.com/anthropics/claude-code/security/advisorie...
You probably know that since you run pi inside https://github.com/containers/bubblewrap.
Re: Annoying and alarming things about OpenCode
#139I feel that a better title for this article would be: "Some minor annoyances that, when fixed, would improve OpenCode" # Prompt Cache Misses > It globs your filesystem and re-reads AGENTS.md (injected in turn-0 system prompt) on every SSE turn. If you put a quick note in AGENTS.md to be read in the next session, you immediately force a full re-evaluation. > Personal favourite: it puts the current date in the turn-0 s…
That's the thing. You can't change it. They do not accept PRs from what I've seen. Whilst it's open source it's only in name. There may be the odd PR accepted from outside the team. But very very rarely.
It's honestly embarrassing to call this open source.
Pi on the other hand, whilst they have their own unique issues with PRs, if you came to them with a genuine problem, or fix, they seem to accept it.
Now I point back to those issues you pointed out, all have PRs... Unmerged. Same with the infinite depth subagent calling.
Re: Annoying and alarming things about OpenCode
#140Earlier quoted context omitted.
And what would prevent the LLM from downloading and compiling its own version of git? But it names it "not-git".
I mean, ideally enforce W ^ X, and enforce stricter permissions on executables where the agent has flipped the W to X. My broader point is we should be using operating system primitives instead of regex and wishful thinking.
I don't know what you mean by "enforce W ^ X".
You can't give shell access and then revoke special parts of it. This is not controversial.
All your criticisms apply to all LLM harnesses - and everyone who genuinely cares about these things is using security on top of the harness, because OBVIOUSLY.
Your complaints are misguided.