opencode-raven 2.3.3 → 2.3.5

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 2.3.5
+
+### Changed
+- OpenCode 2 now auto-approves any otherwise-asking permission inside Raven Search and Raven MCP, including skill loading, instead of maintaining a tool allowlist. Explicit denials, edit and nested-delegation restrictions, and other agents' permissions remain unchanged.
+- Documented that Raven's unattended execution is trusted rather than read-only: shell commands and MCP tools can modify the system or external services.
+
+## 2.3.4
+
+### Fixed
+- Raven Search and MCP follow-ups now validate against the calling session's project instead of the plugin's loading project, avoiding incorrect ownership rejections in OpenCode 2 while preserving parent-session and agent checks.
+
 ## 2.3.3
 
 ### Fixed

package/README.md

@@ -138,7 +138,7 @@ Under the hood, Raven registers two public delegation tools and one internal bri
 | `raven_mcp` | Creates or resumes a Raven MCP session for online research using built-in web tools, global or on-demand MCPs, and local retrieval tools when needed for context. No MCP is required. |
 | `raven_mcp_bridge` | Internal bridge used only by the Raven MCP agent. |
 
-On OpenCode V2, Raven auto-approves permission checks for the public `raven_seek` and `raven_mcp` delegation tools instead of prompting on every call. Inside either Raven agent, it also auto-approves `webfetch`, `websearch`, `fetch`, and tools belonging to enabled globally configured MCP servers. Explicit deny rules still apply. These execution-time approvals do not add a blanket agent permission or change the main agent's tool permissions, model request, or access restrictions on the internal MCP bridge.
+On OpenCode V2, Raven auto-approves permission checks for the public `raven_seek` and `raven_mcp` delegation tools instead of prompting on every call. Inside either Raven agent, any permission check that would otherwise ask is automatically approved, including skill loading and MCP calls. Explicit deny rules still apply. These execution-time approvals do not add a blanket agent permission or change the main agent's tool permissions, model request, or access restrictions on the internal MCP bridge.
 
 For a related follow-up, the main agent can reuse the ID returned by the earlier call:
 
@@ -288,7 +288,7 @@ Raven is optimized for autonomous retrieval:
 
 - Raven Search has read, search, unrestricted shell, external-directory, and globally configured MCP access without normal permission prompts.
 - Raven MCP has the same retrieval access as Raven Search, plus the internal on-demand MCP bridge. It can use built-in web tools without an MCP and inspect local files for research context.
-- Both agents deny edit tools and nested delegation, but shell access is not a read-only sandbox and can modify the system.
+- Both agents deny edit tools and nested delegation, but shell access is not a read-only sandbox and can modify the system. MCP tools may also modify external systems; V2 auto-approval trusts the Raven agents rather than enforcing read-only execution.
 - Queries are sent to Raven's configured model provider.
 - Remote MCP requests are sent to their services; local MCP entries launch local commands and inherit environment values.
 - Startup performs an npm update check and probes enabled on-demand MCPs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-raven",
-  "version": "2.3.3",
+  "version": "2.3.5",
   "description": "Context-saving search and on-demand MCP routing for OpenCode through focused Raven agents.",
   "main": "./index.ts",
   "exports": {

package/raven-core.ts

@@ -1756,17 +1756,20 @@ Then restart opencode for the model change to take effect. If the task can be co
     return kind === "mcp" ? "Raven MCP" : "Raven Seek"
   }
 
-  async function rootSessionId(sessionId: string, signal?: AbortSignal): Promise<string> {
-    let current = sessionId
-    const seen = new Set<string>()
-    while (!seen.has(current)) {
-      seen.add(current)
-      const response = await client.session.get({ path: { id: current }, signal })
-      const session = (response as any)?.data ?? response
-      if (!session?.parentID) return current
-      current = session.parentID
-    }
-    return sessionId
+  async function rootSessionScope(sessionId: string, signal?: AbortSignal): Promise<{ rootId: string; projectID: string }> {
+    let current = sessionId
+    let projectID = input.project.id
+    const seen = new Set<string>()
+    while (!seen.has(current)) {
+      seen.add(current)
+      const response = await client.session.get({ path: { id: current }, signal })
+      const session = (response as any)?.data ?? response
+      // V2's plugin loading project can differ from the calling session's project.
+      if (current === sessionId) projectID = session?.projectID ?? projectID
+      if (!session?.parentID) return { rootId: current, projectID }
+      current = session.parentID
+    }
+    return { rootId: sessionId, projectID }
   }
 
   async function syncCreatedSession(sessionId: string, title: string, signal?: AbortSignal) {
@@ -1803,9 +1806,9 @@ Then restart opencode for the model change to take effect. If the task can be co
         return { title, output: "Cannot resume Raven: sessionId must not be empty." }
       }
 
-      let rootId = context.sessionID
-      try {
-        rootId = await rootSessionId(context.sessionID, context.abort)
+      let scope = { rootId: context.sessionID, projectID: input.project.id }
+      try {
+        scope = await rootSessionScope(context.sessionID, context.abort)
       } catch (error) {
         if (context.abort.aborted) throw error
         // Falling back preserves delegation if an older OpenCode build cannot read the caller session.
@@ -1826,8 +1829,8 @@ Then restart opencode for the model change to take effect. If the task can be co
         if (!existingSession?.id || existingSession.id !== requestedSessionId) {
           return { title, output: `Cannot resume Raven session ${requestedSessionId}: the session was not found or could not be read.` }
         }
-        const validParent = existingSession.parentID === rootId || existingSession.parentID === context.sessionID
-        if (!validParent || existingSession.projectID !== input.project.id) {
+        const validParent = existingSession.parentID === scope.rootId || existingSession.parentID === context.sessionID
+        if (!validParent || existingSession.projectID !== scope.projectID) {
           return { title, output: "Cannot resume Raven: sessionId is not part of this main session's Raven tree." }
         }
 
@@ -1859,7 +1862,7 @@ Then restart opencode for the model change to take effect. If the task can be co
         const sessionTitle = `${toolName}: ${args.query.slice(0, 80)}`
         const session = await client.session.create({
           body: {
-            parentID: rootId,
+            parentID: scope.rootId,
             title: sessionTitle,
             ...(host === "v2" ? { agent } : {}),
           },
@@ -2124,9 +2127,9 @@ Then restart opencode for the model change to take effect. If the task can be co
               return { title: "Raven Seek", output: "Cannot resume Raven: sessionId must not be empty." }
             }
 
-            let rootId = context.sessionID
-            try {
-              rootId = await rootSessionId(context.sessionID, context.abort)
+            let scope = { rootId: context.sessionID, projectID: input.project.id }
+            try {
+              scope = await rootSessionScope(context.sessionID, context.abort)
             } catch (error) {
               if (context.abort.aborted) throw error
             }
@@ -2145,7 +2148,7 @@ Then restart opencode for the model change to take effect. If the task can be co
               if (!existingSession?.id || existingSession.id !== requestedSessionId) {
                 return { title: "Raven Seek", output: `Cannot resume Raven session ${requestedSessionId}: the session was not found or could not be read.` }
               }
-              if ((existingSession.parentID !== rootId && existingSession.parentID !== context.sessionID) || existingSession.projectID !== input.project.id) {
+              if ((existingSession.parentID !== scope.rootId && existingSession.parentID !== context.sessionID) || existingSession.projectID !== scope.projectID) {
                 return { title: "Raven Seek", output: "Cannot resume Raven: sessionId is not a Raven child of this main session." }
               }
 
@@ -2177,7 +2180,7 @@ Then restart opencode for the model change to take effect. If the task can be co
               const sessionTitle = `raven_seek: ${args.query.slice(0, 80)}`
               const session = await client.session.create({
                 body: {
-                    parentID: rootId,
+                    parentID: scope.rootId,
                     title: sessionTitle,
                     ...(host === "v2" ? { agent: "raven" } : {}),
                 },

package/v2.ts

@@ -58,7 +58,6 @@ export async function setupRaven(ctx: Context): Promise<Plugin.Cleanup> {
   const background = backgroundDelegations(ctx, controller.signal)
   const location = { directory: ctx.location.directory }
   const agents: Record<string, AgentDefinition> = {}
-  const globalMcpToolPrefixes = new Set<string>()
   const activeSessions = new Set<string>()
   let emitNotice: (notice: z.infer<typeof RavenRpc.events.notice.schema>) => Promise<void> = async () => {}
   let runtime: Runtime | undefined
@@ -199,8 +198,6 @@ export async function setupRaven(ctx: Context): Promise<Plugin.Cleanup> {
     registrations.push(await ctx.mcp.transform((editor) => {
       const names = editor.list().filter(([, server]) => !server.disabled).map(([name]) => name)
       raven.globalMcpRouting(names)
-      globalMcpToolPrefixes.clear()
-      for (const name of names) globalMcpToolPrefixes.add(`${name.replace(/[^a-zA-Z0-9_-]/g, "_")}_`)
     }))
 
     async function executeCommand(raw: string) {
@@ -215,17 +212,11 @@ export async function setupRaven(ctx: Context): Promise<Plugin.Cleanup> {
     registrations.push(rpc)
     emitNotice = (notice) => rpc.events.emit("notice", notice)
 
-    // Approve specific retrieval actions at execution time, not by adding a
-    // blanket agent allow rule that changes Raven's entire tool policy.
-    // Explicit configured denials are final and do not invoke this hook.
+    // Approve Raven's asks at execution time; explicit denials remain final.
     registrations.push(await ctx.permission.hook("evaluate", (event) => {
       if (event.effect !== "ask") return
       const delegation = event.action === "raven_seek" || event.action === "raven_mcp"
-      const retrieval = (event.agent === "raven" || event.agent === "raven-mcp") && (
-        event.action === "webfetch" || event.action === "websearch" || event.action === "fetch"
-        || [...globalMcpToolPrefixes].some((prefix) => event.action.startsWith(prefix))
-      )
-      if (delegation || retrieval) {
+      if (delegation || event.agent === "raven" || event.agent === "raven-mcp") {
         event.effect = "allow"
       }
     }))