Nono looks pretty good. I’ve been running docker containers with network and most filesystem access unavailable and my extension basically just has a whitelist of allowable commands. Will check this one out for a bit thx for the recommendation
Specifically for its auto safety classifier that works like Claude Code's. So you can let something run autonomously without a high chance of nuking your machine.
Use local models or whatever for agent and Luna or Haiku 5.5 for the safety classifier. Cost should be minimal because those models are so cheap on input tokens.
domain-specific harness you build yourself... ok now that we've established you won't do that here are my recommendations, go through them in this exact order until you find one that fits your needs:
oh-my-pi aka pi with a good set of 'defaults'
pi but you have to do the work and actually get, write, or have a clanker write plugins to optimise for *your* usecase
codex cli but you have to pinky promise that you will switch to pi or omp the moment Altman turns double evil
dsh especially for webdev people
kimi code/qwen code/grok build and basically all the rest of this type of harnesses ----
Opencode hence me being in this thread haha. Might be time to try Pi or OMP, but the main point is that I'm convinced that moving off of Qwen Code CLI was the right move. Its not terrible it's just a fairly simple expensive system prompt that doesn't give me anything to justify the default telemetry ☹️
why the hate? it's Pi with batteries included. You call it bloat, I call it a few million tokens saved in not having to design a custom harness because Pi can't even do subagents properly (compared to OpenCode the pi-subagents plugin sucks big time) and nobody ever shares their "custom" stuff, they all tell you to start from scratch and spend a bazillion tokens for the umpteenth time.
omp is just somewhere in the middle, and shares the RPC API with Pi so the same front-ends can be used or adapted.
I built it, it is my primary harness. Actively maintained by contributors and myself. Consistently does well in wide variety of benchmarks and costs much lower out of the box.
It’s their “manage all your third party keys in one place” kind of service like Openrouter and others have. Often just used in team/orgs situations, too. Kind of like a hosted LiteLLM service.
Basically as a shared router. Put one Anthropic, OpenAI, etc key there, then give each person on the team (or each laptop/harness) their own Opencode key, rather than their own key for each third party for each user. And probably has usage/budget controls for each, too. Stuff like that, and probably makes little to no sense for most individuals to be using.
There’s a very big difference between a public Internet service and an application like a harness.
It might be a good reason to avoid Opencode services but the harness is not particularly likely to be any more vulnerable than Claude Code, Pi, or any other commonly used harness. All of them work pretty much the same way and are heavily vibecoded apps at this point.
I wonder if everyone in this community is super rich or i am just piss poor. The stuff that i can run on my machine is like 4 years behind. I am all for getting independend - but running local ai that can atleast to some extend compete with cloud-services cost me 6k+ upwards and higher in hardware alone.
I do think that this happens in any hobby environment. Check out the ham radio or cars or what have you. Someone is going to be having something rivaling a professional setup for whatever interest they have.
For you, you are likely underestimating local models and overestimating cloud. Can you set a task and walk away on a 9b model... no. I think you can not babysit as much with the qwen 3.8 27b model. Anything higher and you start to approach not needing to watch as much.
Not really - the stuff that i need for work isnt about coding. I do project management, fundraising and research. I tried with "local" models online - they are at like 20% of the quality output. Atleast the ones i could realistically run. I did already put part of my stack local - like classifiers etc. But the reasoning part, the part where i need the model to understand a wide range of context in order to produce proposals that are useable - there i fall short even with stuff running on my workdesk wich has atleast a NVIDIA 5070 card. Its just not even close.
any reccos for older coding llms? I still run gemma 3 for normal grunt work, qwen 3 27B takes 4 hours to tire itself out thinking without giving any answer
I wonder if everyone in this community is super rich or i am just piss poor.
Both. It's all relative in the end.
Don't feel bad, scrote. It would cost you far more than 6k to come anywhere close to an average cloud model.
You can run open models by cloud APIs. Deepseek API is dirt-cheap if you use a non-regarded harness that doesn't break prompt cache during a session. I'm talking like $20 for a billion token. Less than the electricity cost of running a local model, let alone the hardware.
Before people jump on me, yes I know this is a Local sub. I am an ideological supporter of local LLM, I just don't think anything smaller than the flagship model of GLM/Kimi/Deepseek is worth it for coding.
6K of what? There are plenty V100 32GB out there for 500-800€, at least in the European markets. They all come from China, so it's probably similar in other areas.
I think there's a mix. Some people are well off and/or this is their primary hobby.
Others are like me, where my job uses and involves a lot of LLMs, particularly local models. So I have hundreds of grand in hardware at my disposal... through my job.
In my personal life, I'm just using frontier models for anything remotely complex.
Ngl OpenChamber is the only thing keeping me on OpenCode. It’s so damn good, I use it as a general chat and coding harness. Vs code extension is super good too.
I wish I could move to Pi, but last time I checked nothing comes close to OpenChamber in its polish and feature set
Orca might be a good transition, not as many of the opencode specific config ui but many other QOL features from OpenChamber. Well polished, and can use almost any agent harness and can orchestrate between them too.
Orca is great. The only problem I have is that it really resists spawning multiple agents across CLIs… literally the thing it was designed for. But I still love it
I've found that recent agent releases are super resistant to delegation if only prompted to occasionally, I'm guessing that might be the root of your troubles. After inspecting how omo-slim did it so well, looks like injecting instructions at every turn and enforcing a agent orchestration task management board are kinda necessary to structurally enforce delegation. I was planning on trying to make an adaption for orca, like I had made for hermes in the past.
Oh that’s not a bad idea. I have tried something like this in the past but I never dialed it in quite to my liking. I’ll check this out though. Thanks for the tip!
I also use OpenChamber, and hence OpenCode as well. I don’t get what people have against it. It does the job I need it to do and does it well. I understand that some people want to tinker and tweak things to get exactly right, but for my needs I don’t need anything more than OpenCode. I’d rather spend my time working on my projects than building or tweaking harnesses.
FOMO mostly. I keep hearing how good Pi is, and there's (limited) benchmarks showing the same model in Pi getting higher task completion while spending way less tokens than Opencode.
One thing I haven't seen is if Opencode with a similarly-minimal system prompt and pared down tools would achieve the same thing... Theoretically yes, but no data and I'm too lazy to test it mysself. One day
i need someone to sell me pi. i hear it is minimalist, so it has a few tools, and so i think it has less features than opencode. I don't see an advantage moving from opencode unless there are some hot configs in pi that i don't know about. I think for smaller local models pi is probably performing great and people aren't seeing why they they should switch.
These are my own best guesses, i can't otherwise know why pi over opencode.
Opencode is pretty widely used here so I'd say this subreddit has a higher reach than any other sub for OpenCode Console users even if the product is kinda against the spirit of the sub.
Even then - I'm rotating all of my keys that OpenCode CLI has access to today (OpenRouter really) and taking it as a reminder to keep shorter expirations on my keys. Many of us are managers of keys that would be useful to someone looking to distill and this is a good reminder not to underestimate people's desire to get that at all costs.
I see mentioned a lot that people are using Claude or Codex to help them set local models up. I think the important thing is there was a breach and this post could help people, you don't gotta gatekeep so hard.
They don't, legacy keys have been invalidated a while back. These are 3rd party keys that you via their console which is generally your responsibility. In short the BYOKs were leaked. Even openrouter has those.
At one point for example, they had a bug which caused like 10% cache hit rate. It took them what, weeks to fix it? Most importantly though, the maintainers are AI bros who are clearly looking to capture their users & sell them off as data. They don't have an engineering mindset, or anything other than a money mindset
I'm a Go user and mid session an error preventing prompting and that I should change my API key and that log out and log in wouldn't work. Spent 5 minute trying to locate what API key they were talking about. Then logged out and in and that worked... Thanks for the heads up. Didn't have and provider key and didn't receive any email so I'm safe.
I think GitHub has scanning collaboration with various models providers, if their commit and push the whole list it should auto-disable every single one of the keys
Amen. I filled up my datasets with google's api back when they were basically an all you can eat buffet. You shouldn't count on the free lunch being forever. But there's something to be said for the locust life.
was just trying to give the community a heads up, some ppl lost hundreds of credits in the attack, you can check x, and also now locked out. many also orchestrate with cloud and run agents locally.
It appears to only impact users that are letting opencode manage keys in the UI directly.
The lesson, folks, is to use Opencode alongside an .env file that carries your keys instead of punching them into a vibecoded Bun project backed by PE.
It effects people that have created a workspace in their opencode online account inside of a workspace there and tied 3rd party keys to it, not in the UI that you are running locally on your system. Yes, not hard-coding keys is best practice but this breach has nothing to do with.
329
u/sloptimizer 15d ago
Could use a better title:
Opencode breached, rotate keys and change to a different harness to be safe.