opencode-raven 2.3.4 → 2.3.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.3.5
+
+### Changed
+- OpenCode 2 now auto-approves any otherwise-asking permission inside Raven Search and Raven MCP, including skill loading, instead of maintaining a tool allowlist. Explicit denials, edit and nested-delegation restrictions, and other agents' permissions remain unchanged.
+- Documented that Raven's unattended execution is trusted rather than read-only: shell commands and MCP tools can modify the system or external services.
+
 ## 2.3.4
 
 ### Fixed

package/README.md

@@ -138,7 +138,7 @@ Under the hood, Raven registers two public delegation tools and one internal bri
 | `raven_mcp` | Creates or resumes a Raven MCP session for online research using built-in web tools, global or on-demand MCPs, and local retrieval tools when needed for context. No MCP is required. |
 | `raven_mcp_bridge` | Internal bridge used only by the Raven MCP agent. |
 
-On OpenCode V2, Raven auto-approves permission checks for the public `raven_seek` and `raven_mcp` delegation tools instead of prompting on every call. Inside either Raven agent, it also auto-approves `webfetch`, `websearch`, `fetch`, and tools belonging to enabled globally configured MCP servers. Explicit deny rules still apply. These execution-time approvals do not add a blanket agent permission or change the main agent's tool permissions, model request, or access restrictions on the internal MCP bridge.
+On OpenCode V2, Raven auto-approves permission checks for the public `raven_seek` and `raven_mcp` delegation tools instead of prompting on every call. Inside either Raven agent, any permission check that would otherwise ask is automatically approved, including skill loading and MCP calls. Explicit deny rules still apply. These execution-time approvals do not add a blanket agent permission or change the main agent's tool permissions, model request, or access restrictions on the internal MCP bridge.
 
 For a related follow-up, the main agent can reuse the ID returned by the earlier call:
 
@@ -288,7 +288,7 @@ Raven is optimized for autonomous retrieval:
 
 - Raven Search has read, search, unrestricted shell, external-directory, and globally configured MCP access without normal permission prompts.
 - Raven MCP has the same retrieval access as Raven Search, plus the internal on-demand MCP bridge. It can use built-in web tools without an MCP and inspect local files for research context.
-- Both agents deny edit tools and nested delegation, but shell access is not a read-only sandbox and can modify the system.
+- Both agents deny edit tools and nested delegation, but shell access is not a read-only sandbox and can modify the system. MCP tools may also modify external systems; V2 auto-approval trusts the Raven agents rather than enforcing read-only execution.
 - Queries are sent to Raven's configured model provider.
 - Remote MCP requests are sent to their services; local MCP entries launch local commands and inherit environment values.
 - Startup performs an npm update check and probes enabled on-demand MCPs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-raven",
-  "version": "2.3.4",
+  "version": "2.3.5",
   "description": "Context-saving search and on-demand MCP routing for OpenCode through focused Raven agents.",
   "main": "./index.ts",
   "exports": {

package/v2.ts

@@ -58,7 +58,6 @@ export async function setupRaven(ctx: Context): Promise<Plugin.Cleanup> {
   const background = backgroundDelegations(ctx, controller.signal)
   const location = { directory: ctx.location.directory }
   const agents: Record<string, AgentDefinition> = {}
-  const globalMcpToolPrefixes = new Set<string>()
   const activeSessions = new Set<string>()
   let emitNotice: (notice: z.infer<typeof RavenRpc.events.notice.schema>) => Promise<void> = async () => {}
   let runtime: Runtime | undefined
@@ -199,8 +198,6 @@ export async function setupRaven(ctx: Context): Promise<Plugin.Cleanup> {
     registrations.push(await ctx.mcp.transform((editor) => {
       const names = editor.list().filter(([, server]) => !server.disabled).map(([name]) => name)
       raven.globalMcpRouting(names)
-      globalMcpToolPrefixes.clear()
-      for (const name of names) globalMcpToolPrefixes.add(`${name.replace(/[^a-zA-Z0-9_-]/g, "_")}_`)
     }))
 
     async function executeCommand(raw: string) {
@@ -215,17 +212,11 @@ export async function setupRaven(ctx: Context): Promise<Plugin.Cleanup> {
     registrations.push(rpc)
     emitNotice = (notice) => rpc.events.emit("notice", notice)
 
-    // Approve specific retrieval actions at execution time, not by adding a
-    // blanket agent allow rule that changes Raven's entire tool policy.
-    // Explicit configured denials are final and do not invoke this hook.
+    // Approve Raven's asks at execution time; explicit denials remain final.
     registrations.push(await ctx.permission.hook("evaluate", (event) => {
       if (event.effect !== "ask") return
       const delegation = event.action === "raven_seek" || event.action === "raven_mcp"
-      const retrieval = (event.agent === "raven" || event.agent === "raven-mcp") && (
-        event.action === "webfetch" || event.action === "websearch" || event.action === "fetch"
-        || [...globalMcpToolPrefixes].some((prefix) => event.action.startsWith(prefix))
-      )
-      if (delegation || retrieval) {
+      if (delegation || event.agent === "raven" || event.agent === "raven-mcp") {
         event.effect = "allow"
       }
     }))