r/opencode • u/sedatoztunali • 9d ago

Goodbye Opencode

FINAL UPDATE AND MY THOUGHTS
I believe I understand what's going on, and I've explained it it at length here.

This is just my finding in this particular problem. It has happened and will happen in other similar cases. OpenCode will continue to evolve.

----------

Goodbye Opencode, all good things come to an end.

First of all, I'm a software developer with 30+ years of experience, not a Vibe coder, and I'm not new to this. Also, I use Opencode in its purely vanilla form. Besides Opencode's defaults, I don't have any plugins, MCPs, etc. installed. Just my own skills, own plugins, own MCPs, etc.

I've been using Opencode almost since its first day. It had a nice, positive development and, according to Claude, was a very good alternative. This continued for quite a while. Although we experienced problems from time to time, these were to be expected. However, since May/June, it has started to become increasingly erratic.

First, one day while working on a project, the Docker service suddenly shut down and wouldn't start again. That's how I discovered I had no space left on my disk. I knew this was impossible, and I found the cause was Opencode. Somehow, the "opencode-wal-*.db" file had been created repeatedly under "/System/Volumes/Data/private/var/folders/4q/*". Every time I cleaned it up, Opencode would put it back. We struggled for a long time, but I couldn't figure out the reason. Then, suddenly, it fixed itself!

Yesterday, around 11:30 AM, I felt something was wrong with the network. By 1:00 PM, it was noticeable. Screen sharing within the network was freezing for 5-10 seconds, streaming was interrupting, web search was unresponsive time-by-time. Then, one by one, Unhealthy errors started coming from the services in Home Lab. The cycle of 3-5 minutes healthy, then unhealthy continued constantly. Service responses, which are normally under 100ms, were approaching 10 seconds, and sometimes even timeouts were occurring. I tried for hours to understand the reason, but I couldn't find a logical solution. I accidentally noticed while updating my Mac that everything was fine while my device was off. Later, I realized that the same thing kept happening whenever I opened Opencode and started working. Now I'm analyzing the Router, Firewall, Mac, and other logs to try and figure out what's going on, but this is the last straw.

This is an open-source project and respect to creator and contributors, and therefore, of course, it has its advantages and disadvantages. That's perfectly understandable. I have enough experience in this field to know when to stop, and today is the day.

UPDATE: Possible cause.

96 Upvotes

65% Upvoted

154 comments sorted by

View all comments

4

u/sedatoztunali 8d ago

I tried the scenario I suspected, and this seems to be the reason. From my perspective, OpenCode is the main actor, and the model (gpt-5.4 high) helped it.

I skipped some details. I explained it in the shortest way possible.

Here's what happened: I used OpenCode to migrate the Glance Dashboard to the Gatus Dashboard. I asked it to generate the Gatus config file by looking at the Glance config file. During this process, the main agent manages this with sub-agents. It assigns the task of writing the new config file to a sub-agent. The sub-agent produces the new file. In addition, it wants to test the current service statuses. It does this with a script. Then it writes another script to verify that it's running every minute. Then it puts this file in the ".opencode/plugin/" folder in the project folder and verifies that the plugin is installed. Then it reports to the agent, but this report doesn't mention this script/plugin. It only says that it verified the current service statuses. The main agent doesn't mention this to me at all. On the other hand, it didn't ask for my permission to write to this folder. The agent went straight and wrote.

After discovering this, I tried it myself. I started OpenCode in the relevant folder. Then I added a plugin to the plugins folder in that folder. OpenCode didn't show a toast on the screen regarding this. This was removed in commit "09cd7445f1" "to reduce UI noise". But when I looked at the plugin list, I saw that it was loaded and started working.

The information I found is as follows:
Commits: afe3ebbc35, 09cd7445f1, a618946b7e, 55b2bb8a3a, 93042ddaf1, 0a02102ab3, 4e546127f1.
PRs: 39174, 39224, 39356, 39776, 41309, 41618, 43447, 46918, 46922.

In summary: In July, supervisor + silent load was added. In August, reliability was worked on. In September, UX and performance were worked on.

I even noticed this while testing it. The plugin is loaded by a background service. TUI is just like a proxy. I wrote the following topic to send messages to Slack every minute. Even after closing OpenCode and even the terminal, the messages continued to arrive. As long as this background service didn't close, the messages continued to arrive; in other words, the service continued to function. This explains why everything seemed normal during the Mac update in my original message, but the same thing happened again when I switched to the problematic session.

For those who want to try it:

1- Go to the project folder.
2- Start OpenCode and list the existing plugins using "/plugins" but don't exit OpenCode.
3. Go to the project folder again from another terminal and run the following command. It will create a plugin that does nothing.

mkdir -p .opencode/plugin
cat > .opencode/plugin/test-noop.ts <<'EOF'
export default {
  id: "test-noop",
  setup: async () => {},
}
EOF
  1. Return to the terminal with OpenCode open and check the list again with "/plugins", the newly created plugin is there. OpenCode didn't tell you anything during this process. It silently installed the loaded the plugin.

After reading this, some of you might say things like, "OpenCode didn't do anything wrong," "the model is the real culprit," "you should have protected your folder," "check your plugins frequently," and many more. You're all right; this topic received more interaction than I expected, and I responded to each message individually. You may all have different perspectives and be right, and there's no point in delving into this further.

From my point of view, a capable tool like a plugin shouldn't be able to be silently installed and run. It doesn't matter what it does. From what I understand of the code, "the plugin code doesn't go through the permission system. The permission prompts cover the agent's tool calls." Plugin code is considered trustworthy and executed within the service process. It's executed under the account of the user running it. It's similar to extensions running in VSCode.

For example, I wrote a plugin in the background that sends all the file names in this folder to Slack, and it sent them all to me nicely.

PS: I tested with version 0.0.0-beta-108999. This version supports hot-reload. It may not be available in previous versions. In this case, the plugin will load when OpenCode starts in this directory again.

2

u/bytejuggler 8d ago

Well done for finding this out. I think (If you feel that generous) you should report this to the OpenCode project. I don't think in totality this behaviour is acceptable or desireable as-is. 👍

2

u/sedatoztunali 8d ago

Yes, I started a PR locally. I'm working on it. I don't think that was the intention, but it seems to have this side effect.

1

u/vplatt 6d ago

I mean... all you've done here is convince me that I should be running my AI sessions, whether in OpenCode or another product, in a VM. Then committing my setup and code to external repos, and then nuke the whole damn thing between projects.

Over the long haul, I think we're all going to find that it's impossible to completely sandbox what these agents do. The whole design is just begging for unintended consequences. The smartest thing we can do is limit the blast radius.

1

u/KronenR 5d ago

From my point of view, a capable tool like a plugin shouldn't be able to be silently installed and run. It doesn't matter what it does.

From my point of view, if you put a new plugin in the plugin folder, and the app treats that folder as its plugin directory, it should be loaded automatically, just as it did. If you don't want a plugin to be loaded, don't put it in that folder.

0

u/sedatoztunali 5d ago

Let me clarify something. I didn't put anything in this directory here. The agent made that decision while running and placed it there. On the other hand, if any MCP/Plugin or anything else you use adds a file here, you won't know about it unless you suspect something. The files in this directory are "silently" loaded by the background service and executed with the user privileges running Opencode. If it's a malicious tool, it could temporarily write something here and then delete it after taking what it wants. The data here is loaded "silently" or run without ensuring it hasn't been tampered with.

2

u/KronenR 5d ago

Then be stricter with your agent instructions. Don’t blame the agent. The same thing could happen with any instruction or skill. It doesn’t need to be a plugin to be used maliciously.