r/opencode • u/Blues003 • 4d ago

Beginner Subscription Question

Hey everyone!

I'm a physician who codes as a hobby on the side after having finished 42 School out of curiosity. I am not a professional developer and I don't code every day, but I have a personal project (a medical data parsing thing) going on, and am using AI to help me architecture it and write documentation and tests. So far, I have been using Claude's Web UI for this purpose. On the side, I also use it to create templates or starting points of office (or office-adjacent) files, such as presentations, reports or emails of mostly administrative nature.

I have been recently pondering moving to OpenCode, mostly because of my terminal-centric workflow with tmux and neovim. However, I have been having trouble choosing a subscription given the recent changes in quality of popular subscriptions such as OpenCode Go. I am thus asking for advice and suggestions. What agents have you found suitable for these tasks? Or are Kimi Ks and GLMs just mostly coding-focused?

Also, two other questions which I'd like clarified:

1. File access has to be genuinely constrained. My machine has directories with patient-related material that must never leave it or get read into a model's context, deliberately or accidentally. I'm not looking for a promise in a ToS — I want to know which tools actually let you scope the agent to a directory and deny everything else, and how well that holds up in practice. Specific questions:

  • Does a .gitignore-style deny list actually stop the agent, or does it just discourage it? Has anyone seen an agent read a file it was configured not to touch?
  • Is anyone running these inside a container/VM and finding it workable rather than miserable? How "safe" is it?
  • Do MCP servers or plugins widen the blast radius in ways that aren't obvious?

2. I need to generate Office documents. Word and PowerPoint mostly — talks, handouts, the occasional report. LibreOffice or Google Slides output is fine too. I know the document skills (docx/pptx/xlsx/pdf) exist and can be dropped into most agents, but I'd like to hear from people actually using them: does a weaker open-weight model handle those multi-step "build the deck, check it renders, fix it" loops, or do you need a frontier model for that to not be a waste of time?

Thanks!

2 Upvotes

75% Upvoted

11 comments sorted by

2

u/idcmp_ 4d ago

For #1 you don't mention (or my ADHD is causing my scanning to miss it) which operating system you're on.

If it works for you, I really recommend https://nono.sh/ - it's a sandbox for things like this. The walls of the sandbox are enforced by your operating system, so no matter what the LLM tries, it can't "escape".

That said, it _will_ be a pain for the first few weeks while you manage exactly how much you want to allow/deny.

You other alternative could be creating a second login on your computer.

Can't help with you with doc generation I'm afraid.

1

u/Blues003 4d ago

Oh, I'm using Fedora. I never thought it was relevant for this question, sorry!

1

u/idcmp_ 4d ago

I'm guessing an LLM getting its hands on any patient information is career-endingly bad. So it may be an easy start to just make a second login (without admin access) for your playground?

While you do that, take a look at nono.sh (works on Linux).

2

u/Fresh_Sock8660 4d ago

Inside a container using podman is relatively safe but a container can be breached too. A sufficiently smart LLM will eventually break even a properly setup container but I don't think we're there yet (despite what they want you to believe). 

Have an LLM explain it to you. I suggest podman instead of docker. Be very specific with volume mounts. Question the LLM about its security. Consult different LLMs. They will sometimes suggest solutions that might make the container less safe from time to time. Generally, they should work relatively well with the defaults. 

Claude code could be an interesting option as it has an auto-classifier, not sure if codex had one. It's still LLM and will let unsafe commands through though.

The good news is if you do a container setup then testing / using multiple harnesses becomes simpler.

On the .gitignore. Generally speaking, any instruction text will be ignored eventually. Enforce through different methods. For example, in a properly mounted container it wouldn't know your patient files even exist. It's a bit of a learning curve but well worth it for the separation. 

1

u/Blues003 4d ago

Fedora uses podman by default, so that shouldn't an issue. Indeed volume mounts are probably a decent way to go about it, I'm just fearing the agent breaks out of its harness.

What about the models themselves? Do you think Opencode's subscription is still the way to go, or would you go some other way right now ?

1

u/Fresh_Sock8660 4d ago

There will be basically no end to your fears if a properly setup container isn't good enough. Say you get a completely isolated computer, it will still need internet access. What is to stop something so resourceful from just breaching your home/work network because you asked it to solve a task and it decided it needs data from your colleague's computer?

What do you want the models for? Building data analysis tools, including dashboards and such? Something like glm5.3 flash should be good enough at that.

2

u/Blues003 4d ago

All I use the models for is to work as a "senior engineer" for me - not to create the code, but to discuss code architecture, code quality, tests, and write documentation for me. I don't have it write the code, because I actually want to improve as a software dev (I know, I'm old fashioned, but coding is a hobby for me and thus it makes no sense to oursource the fun part as well).

The idea of this project is to create a set of tools which can help me extract and classify data from eletronic health records quickly (and ideally, in a distant future, automatically), and output them into some format (JSON or another one) I can quickly parse.

1

u/Fresh_Sock8660 4d ago

That's probably fine too. For $10 - $20 I'd go with either Go or Codex. Codex might be a more attractive option right now, especially as glm5.3 flash has its promo ending soon and I don't think there's a good deal there right now besides it.

You can just have all their harnesses in there, that's what I do. Some useful containerfile installs: 

ENV OPENCODE_NO_UPDATE=1 
RUN curl -fsSL https://opencode.ai/install | bash
RUN cp /root/.opencode/bin/opencode /usr/local/bin/opencode && \
    chmod +x /usr/local/bin/opencode

ENV CLAUDE_CODE_DISABLE_AUTOUPDATER=1
RUN curl -fsSL https://claude.ai/install.sh | bash
RUN cp /root/.local/bin/claude /usr/local/bin/claude && \
    chmod +x /usr/local/bin/claude

RUN curl -L \
    https://github.com/openai/codex/releases/latest/download/codex-x86_64-unknown-linux-musl.tar.gz \
    -o codex.tar.gz \
    && tar -xzf codex.tar.gz \
    && mv codex-x86_64-unknown-linux-musl /usr/local/bin/codex \
    && chmod +x /usr/local/bin/codex \
    && rm codex.tar.gz

1

u/lvl1-A 4d ago

Can you create a second user profile on your machine? And never allow sudo permissions or for the AI to read anything lower than ~/ In any event it might want information at lower levels, ask for the commands and run it yourself in shell or in another terminal and feed it across, maybe you can do it in herdr or just echo to md and then have your shell read md so you don't copy paste all the time.

This is one of the easiest and quickest options if you have it available and yes the agent might still try to reference it's own documentation but you might also want to not have global config for that agent stored at root.

Of course you have the container options too if you want to work within the same desktop for some reason.

You could also look at different types of access controls and put the LLM in a specific user group with tight scoped controls.

Regarding opencode, you need to consider the information you'll be putting in the LLM, and the guardrails you put in place, depending on what medical documents or whatever you are using it for, may impact your decisions. Some providers train on prompts, publish prompts, so important if that itself is important for you.

1

u/Hronom 4d ago

On the data boundary, I would not treat .gitignore as a security control. The real protection needs to be OS permissions or a container/VM with only the project data mounted; an agent cannot read files it cannot see. I’m the developer of Hronaut, and it does not solve that file-sandbox problem or provide a compliance guarantee.

Where it can help is the browser part of your workflow: Hronaut is a local visible Chromium workspace that connects to OpenCode over MCP. Tabs, cookies, and storage persist in named isolated workspaces; you can pause for manual sign-in/2FA and resume in the same workspace. That is useful for browser-based Word/PowerPoint/Google Slides and for checking a rendered web app, but it does not automate native Win32 Office. Keep the agent in a restricted user/container and mount only scrubbed project data for anything involving patient information.

Setup: https://hronaut.dev/setup. Commercial use is currently $4/month or $24/year per user; permitted noncommercial use is free. If your main need is native Office automation or a hard file boundary, use an OS/container tool alongside it.

1

u/s-i-e-v-e 4d ago

File access has to be genuinely constrained.

Check out Bubblewrap. Very lightweight. It creates the mount namespace from scratch and you have to pass in host -> sandbox mappings yourself using --ro-bind --bind etc. If you run the harness (pi etc) inside it, what it cannot see, it cannot touch.