Comment by verdverm
5 days ago
To me, there are more annoyances in V2, so many that I've switched harnesses to Pi (for now?). I think the hot-reload is another security misalignment. An agent should not be able to modify plugins and have that immediately reloaded for availability.
Stellar example of how one person's security vulnerability is another person's most important feature...
when you experience a loss of control with an agent, you might see things differently
Security misalignments OpenCode has a good few of (it used to have more).
I think the benefits of this one vastly outweigh the risks since it enables the self-modification Pi (!) became famous for.
These debates should be settled with an opinionated default, and a toggle.
This right here.
There does not seem to be a flag for this, not finding any configuration options yet either, and there is the shared server aspect now too.
I switched to Pi last week, have not seen anything about self modification, but have seen a lot about security, the minimalism and customization by user are closest in common selling points from exiting users
you cannot have both and be serious about security
to be clear, I'm talking about hot reload, agent can manipulate its own environment in real time, that's asking for trouble, put some controls on that or reap the consequences from loss of control
Unless I’m out of the loop, Pi can self modify in the sense that plugins are just code it can edit. It doesn’t live reload that I’m aware of.
Pi’s whole UI is customizable, so a lot of people were having their agents build their own interfaces.
The distinction is probably irrelevant for most people. I secure the whole thing in a container, because I lack the willpower to audit a bajillion lines of LLM code just inside the harness.
10 replies →
> you cannot have both and be serious about security
Why not? I think DSH does this pretty well with an agent preset that exposes the tools required for the agent to modify the harness.
It's kind of like how the kernel can expose interfaces to allow userspace to load kernel modules at runtime: you "just" have to control which processes can use them.
Between that, and a couple of extra injected bwrap args to make my SSH keys and LLM API credentials unreadable from the agent's shell by default, I'm pretty comfortable using the harness outside of a VM for most things.
3 replies →
> have not seen anything about self modification
It was the big selling point of the harness a couple months ago.
1 reply →
I tried switching to Pi twice. Both times it seemed agents go crazy with tools on Pi and do stupid things right out of the gate, (like get `find` syntax wrong, seriously who [what] does that??). Plus things I appreciate in opencode (even if they were buggy in 1.x) like "prompt for perms tool-by-tool in this session" seem to only be available in Pi by writing your own extension, and now I'm wasting time debugging my extension with an AI that gets tools wrong and constantly wants to search `/` for no good reason.
Then I upgraded OpenCode to 2.0 and pretty much all the bugs vanished. I still wish there was a happy medium between "parse tool calls for perms" (which fails all the time if the tool call is long/complex enough) and a full-on sandbox, but otherwise 2.0 is really solid.
DeepSeek Harness allows the user/agent to build its own plug-ins and run them without restart, mostly. Pi and OpenCode were then influenced to do the same in their respective new versions. I don't know which has the better implementation.
DeepSeek does. The entire thing is composed on plugins, using a framework called Cordis. Everything is a plugin. All the tools, the models, plan mode, file system access, everything. You can change anything anywhere, even reconfiguring active plugins deep internally. Cordis provides an effect system so everything can be rewound on uninstall time. This is how people run local models or just other major models, just by writing a new plugin to talk to whatever instead of the deepseek api. The agent loop itself is a plugin and can be swapped out.
https://github.com/cordiverse/cordis
From what I read, OpenCode V2’s design is similar. It’s built around Effect, which seems to be gaining steam as a framework for building correct software.
Cordis also looks interesting as an alternative, but appears more bound to DSH rather than a more general thing (which I prefer).
1 reply →
you dont need to build a plugin to use local models with DSH. you can configure models and providers freely by default.
Yes, that’s the thing I had mainly been looking at as an alternative. It probably has a better culture around extensions, but also seemed a good bit more DIY, especially to get it working with a good UI.
I do not see where Pi does any automatic hot-reloading, though I believe there is a /reload command one has to run that can do this. Still new to Pi, if you have a link, I'd be appreciative.
This is all a stopgap until I have some time to go back to my personal/custom harness.
Do the plugins let you modify the UI? Got any favorites?
yes you can modify ui and everything else. i have a few dsh- plugins on my github (in profile), but i havent found any external ones yet
Just curious, what other annoyances do you have with V2?
1. Running background code on my machine is something that gets an immediate removal from me.
2. opencode 2.0 does not exists. I mean it: there is no release[1] and per their own instructions, `npm i -g @opencode/cli@latest` does not install opencode 2.0.
3. `Error: @opencode/cli's postinstall script was not run.` Not even running postinstall.js can fix that, neither on linux nor macos. And even if it works, in a couple of days or on the next upgrade it will fail again.
[1] https://github.com/anomalyco/opencode/releases
They are pretty clownish on some things and that is one of them. They HAVE at some point started versioning their docker images at least, big win.
Fun fact: The npm release does not contain the code, it is downloaded by the postinsta script. Galaxy brain.
1 reply →
Try this:
- the tabs, extra keystrokes for common tasks, other UX related things
- several poor security mistakes or choices that broke my trust
- trying to be closer to an IDE, all these harnesses want to be the interface to rule them all, that's not what I want in my harness
- doing things that another tool, which is harness independent, should own (multiple async/parallel agents)
- too much change dropped at once, so many breaking changes, several I cannot migrate at work without impacting the devs I support
> several poor security mistakes
I heard it from someone as well, but I cannot find the link or specific details.
Can someone summarise what are the security issues related to using opencode?
Do these issues still exist, especially in V2 ?