IdeaWell

Project ideas from Hacker News discussions.

Annoying and alarming things about OpenCode

Original Article

Hacker News Discussion

šŸ“ Discussion Summary (Click to expand)

1. Security & Permission Gaps
Concerns that OpenCode runs arbitrary code with insufficient sandboxing, offering only primitive permission dialogs.

"There are confirmation dialogs in OpenCode. You can configure them using the permission config, same as Claude Code. Having said that, as a general rule, none of these harnesses are safe to run on your local file system."
ā€” InsideOutSanta

2. Cache Misses & Prompt Overhead
Frequent reā€‘evaluation of the system prompt (e.g., date changes at midnight) forces full reā€‘caching, causing noticeable delays.

"It felt unreasonable when I was using it at midnight and had to wait 10 minutes to refill the KV cache on my local GPU :)"
ā€” wren6991

3. Financial Drivers & Localā€‘Model Adoption
Many users stay on OpenCode only because of free quotas; when alternatives appear, they move to lighter, selfā€‘hosted options.

"Opencode offers free models with 200/requests over 5 hours. That's why I use it. It is the only reason I care about."
ā€” kristopolous

4. Project Stagnation & Maintainer Attitude
The repository accumulates hundreds of open issues, PRs linger unmerged, and maintainers appear dismissive of community contributions.

"There are a ton of super serious issues there. They are not getting fixed."
ā€” Tepix

šŸš€ Project Ideas

PromptCache Optimizer

Summary

  • Eliminates full filesystem scans and dateā€‘driven cache invalidation that cause repeated prompt regeneration.
  • Provides a persistent, sessionā€‘wide prompt cache that updates only when relevant AGENTS.md sections change.

Details

Key Value
Target Audience Engineers using local LLMs or remote agents who rely on OpenCodeā€‘style agents and experience cache misses.
Core Feature Automatic extraction of only modified files/sections from AGENTS.md and incremental cache refresh, plus configurable ā€œdateā€‘freezeā€ to prevent midnight invalidations.
Tech Stack Node.js backend, SQLite KV cache, Rustā€‘based WASM cache manager, integrates with any OpenAIā€‘compatible model endpoint (e.g., Ollama, LM Studio).
Difficulty Medium
Monetization Revenue-ready: $5/mo SaaS for hosted cache service, free tier for selfā€‘hosted use.

Notes

  • HN users complain about ā€œIt globs your filesystem and reā€‘reads AGENTS.md on every SSE turnā€ and ā€œPersonal favourite: it puts the current date in the turnā€‘0 system prompt and reā€‘evaluates every SSE turn.ā€ This project directly fixes those pain points.
  • The ability to keep longā€‘running sessions alive without cache thrash would appeal to power users and reduce token waste on hosted models.

SecureAgent Sandbox

Summary

  • Provides a pluggable, OSā€‘level sandbox that isolates AI coding agents from the host filesystem, network, and privileged operations.
  • Offers fineā€‘grained permission enforcement based on binary signatures rather than fragile regex allowā€‘lists.

Details

Key Value
Target Audience Securityā€‘conscious developers who run agents on local machines or CI pipelines.
Core Feature Wrapper binary that enforces W^X permissions, caps file writes, and validates executable signatures before execution.
Tech Stack Rust, landlock / seccomp filters, bubblewrap integration, JSON permission manifest.
Difficulty High
Monetization Hobby

Notes

  • Commenters repeatedly stress ā€œsandboxing should be a firstā€‘class integral part of every harnessā€ and criticize primitive textā€‘parsing allowlists. This tool addresses that by delivering robust, standardsā€‘based sandboxing that can be used with any agent (OpenCode, Pi, Claude Code, etc.).
  • Would spark discussion on secure LLMOps and could become a reference implementation for communityā€‘driven security hardening.

OpenInfer Hub

Summary

  • A communityā€‘driven, freeā€‘tier inference API that aggregates popular open models and offers generous request quotas similar to Opencodeā€™s historic free tier.
  • Includes easy integration with agent frameworks via a standardized API spec.

Details

Key Value
Target Audience Independent developers, hobbyists, and openā€‘source contributors lacking budget for paid LLM APIs.
Core Feature Unified REST endpoint with model selection, automatic quota sharing, and clientā€‘side caching to reduce redundant calls.
Tech Stack Python FastAPI, Dockerized model runners (vLLM, Text Generation Inference), Redis cache, Docker Compose for deployment.
Difficulty Low
Monetization Revenue-ready: $0.001 per 1k tokens for premium models, free tier capped at 100k tokens/month.

Notes

  • Users repeatedly lament ā€œthe only reason I use it is purely financialā€ and ā€œnone of them have those programs anymore.ā€ This service restores a free, reliable source of model access and encourages contributions back to the openā€‘source ecosystem.
  • Could generate lively discussion about sustainable funding models for openā€‘source AI infra and attract contributors looking for a ā€œfree tierā€ replacement for Opencode.

LSPRefactor Assistant

Summary

  • Replaces costly modelā€‘driven refactor operations with deterministic LSPā€‘based edits for common tasks (renames, imports, formatting).
  • Integrates seamlessly with AI agents to offload cheap syntactic transformations, preserving token budget.

Details

Key Value
Target Audience Developers using codeā€‘completion agents who want faster, cheaper refactor cycles.
Core Feature LSP client that performs symbolā€‘wide renames, import management, and codeā€‘style enforcement, invoked through a simple JSON RPC bridge from the agent.
Tech Stack TypeScript/Node for LSP server, Python/Go client bridge, VS Code extension (optional), OpenAPIā€‘compatible agent interface.
Difficulty Medium
Monetization Hobby

Notes

  • Discussion highlights ā€œIt's for using lsp to do things like symbol renames. It's cheaper to call an LSP server to do those kind of simple refactors than to spend tokens on the model doing it.ā€ This project implements that pattern, directly addressing token inefficiency and hallucination concerns raised in the thread.
  • Would be valuable for HN readers looking to improve agent performance without increasing API costs, and could spark conversation about best practices for hybrid LLMā€‘LSP workflows.

Read Later