OpenCode vs Kilo Code: Which One to Choose

Evidence: AGENTS.md describes a permission system (plan agent denies file edits by default, bash commands require confirmation), but lacks specific permission configuration details; SECURITY.md explicitly states no sandbox, permission system is a UX feature, not security isolation. User confirmation is mentioned for plan agent, but not detailed for all scenarios. Data flow transparency is detailed in CONTEXT.md (e.g., Session History, Context Source), but external data flow is not specified. Sensitive data handling is not explicitly mentioned. Dependency security: package.json has patchedDependencies and trustedDependencies, but no vulnerability scanning or audit evidence. External effects: SECURITY.md mentions server mode requires password, but not detailed. Rollback is not mentioned. Source attribution: README and CONTRIBUTING provide maintainer info, but publisher is unverified. Deductions: incomplete permission system description, user confirmation only partial, data flow transparency lacks external flow, sensitive data handling not explicit, dependency security lacks audit evidence, external effects limited, rollback missing, source attribution limited by unverified publisher.

Evidence shows: permission system exists but explicitly not a sandbox, only UX; --auto disables all prompts; SECURITY.md defines threat model but lacks data flow transparency; dependencies have overrides and patches but no vulnerability scan evidence; external effects include terminal and browser control but no rollback; source attribution via LICENSE and README fork statement. Deductions: permission system not security isolation, data flow not transparent, sensitive data handling not explicit, rollback missing.

Evidence: AGENTS.md and CONTEXT.md are internally consistent, with clear terminology and rules. Dependency availability: package.json lists many dependencies, but no availability guarantees or mirrors. Failure messages: CONTEXT.md describes error handling (e.g., SessionNotFoundError), but no user-friendly failure message examples. Deductions: dependency availability lacks guarantees, failure messages limited.

Evidence shows: package structure clear, tests exist but not executed; dependencies pinned with overrides and patches; failure messages not evident in source. Deductions: static review cannot verify tests, failure messages not provided.

Evidence: README in multiple languages provides installation and usage instructions, covering various platforms and package managers, broad audience. Capability boundaries are clearly described in AGENTS.md and CONTEXT.md (e.g., build vs plan agent permissions). Trigger precision: AGENTS.md provides specific commands and rules (e.g., branch naming, commit format). Environment fit: README provides multiple installation methods, CONTEXT.md describes PTY environment. Deductions: capability boundaries not covering all scenarios, trigger precision may be imprecise for some rules.

Evidence shows: multi-platform (VS Code, JetBrains, CLI), multiple agents and custom agents; capability boundaries listed in README; trigger precision not explicit; environment fit with install instructions. Deductions: trigger precision not explicit.

Evidence: Information architecture is clear, AGENTS.md, CONTEXT.md, CONTRIBUTING.md have distinct roles. Install notes are detailed in README, covering multiple platforms. Naming stability: AGENTS.md specifies branch and commit naming conventions. Examples and FAQ provided in README and CONTRIBUTING. Known limitations explicitly stated in SECURITY.md (e.g., no sandbox). License is MIT, clear. Versioning changelog not provided, but package.json has version info. Maintenance responsibility is clear in CONTRIBUTING. Deductions: versioning changelog missing, maintenance responsibility clear but publisher unverified.

Evidence shows: README structure clear, install notes detailed, naming stable, FAQ and known limitations (SECURITY.md), MIT license, version exists but no changelog, maintenance responsibility via CONTRIBUTING and RELEASING. Deductions: no changelog.

Evidence: Output usability: README provides clear installation and usage examples, CONTEXT.md defines terminology for understanding. Marginal value: as open-source coding agent, provides various features (e.g., agents, SDK). Cost-benefit: no performance or resource consumption data. Deductions: cost-benefit lacks data support.

Evidence shows: high output usability (multi-platform), high marginal value (500+ models), good cost-benefit (zero markup). Deductions: static review cannot verify actual effectiveness.

Evidence: Claim traceability: claims in README and CONTEXT.md are documented, but no test or verification evidence. Cross-source corroboration: multilingual READMEs are consistent, but no external verification. Fact-inference separation: documentation distinguishes description and design intent, but not explicitly labeled. Deductions: lack of test evidence, limited cross-source corroboration, fact-inference separation not explicit.

Evidence shows: README claims partially supported (e.g., fork), but lack independent verification; tests exist but not executed; facts and inferences not clearly separated. Deductions: lack independent verification, facts and inferences not separated.