Where people largely landed was narrower than the post's title. Most agreed the "alarming" part is real at the category level. These harnesses are not trustworthy security boundaries, and anyone running them on a real workstation should assume they can read, write, exfiltrate, and execute far beyond what the UI implies. Several people said they already run OpenCode,
Pi, or Claude Code inside
Bubblewrap,
sandbox-exec,
Flatpak, VMs, or separate users for exactly that reason. The more technical back-and-forth sharpened the key distinction: command allowlists based on parsing shell text may steer model behavior, but they are not meaningful confinement. If you care about safety, you need operating system primitives that constrain binaries, files, network access, credentials, and the execution chain itself.
On OpenCode specifically, comments gave the post partial credit but not a clean conviction. Multiple users said the cache invalidation complaints matched their experience and were the reason they switched to Pi, especially with local models where
prefill latency is visible and token waste is expensive. Others pushed back that some examples were overblown or already fixed, including disabled tool-call pruning and planned V2 changes to avoid prompt-cache busting when instructions change. OpenCode developers jumped in to say those fixes are in beta. At the same time, users piled on with practical gripes that made the broader architectural critique feel credible: broken or buggy autocompact, high memory and CPU use for a terminal app, background package downloads, rough issue triage, and defaults like cloud-generated session titles that violate local-only expectations.
The biggest split was simple. A lot of people still said OpenCode is the most productive harness they've used, sometimes by far. For them, ugly code, high RAM use, or internal prompt weirdness is secondary to whether the agent gets real work done. That camp mostly reads the article as an attack on the whole agentic CLI pattern dressed up as an OpenCode review. The opposing camp took the internals as a trust signal in themselves. If a tool mutates system prompts every turn, breaks cache locality, embeds arbitrary style rules, and keeps accreting TypeScript and dependencies, they see that as evidence the rest of the stack will also be careless. Pi emerged as the most common alternative, with
Codex,
Oh My Pi, Maki,
Aider, and a few Rust projects also mentioned. But even many critics conceded there is no obviously clean replacement yet. The practical consensus was not "switch to X and you're safe." It was "all of these tools are dangerous, OpenCode is just making the danger easier to notice."
wren.wtf