Major security regression merged into OpenCode V2

4 days ago (github.com)

This fundamentally breaks our security posture capability for harness configuration, ending our ability to prevent company policy breaking changes by man, machine, or third party repo.

We may be a minority in using /etc/opencode in this way, but it has shaken my trust that they understand security in the Ai era or the needs of enterprise users.

  • Why are you still using opencode after the main LLM providers released their own harnesses? Inertia?

    • I use open weights and harnesses not tied to a single vendor, I definitely do not touch anything the two US Big Ai labs puts out. I'm not interested in handing power and control of humans most significant technology to the same class of people that brought us the technologies that created our mess of a digital ecosystem.

      I switched to pi while I go refresh my personal/custom harness, though that may be a bit off, there are more important things to work (and burn tokens) on

      https://github.com/hofstadter-io/hof/tree/_next/lib/agent

      1 reply →