opencode-reviewer 2.1.2 → 2.1.4

package/README.md

@@ -1,8 +1,8 @@
 # OpenCode Reviewer
 
 Reviews pending permissions in the [OpenCode](https://github.com/anomalyco/opencode) sidebar using a separate LLM. Reviews
-native shell commands, file edits, and external-directory access. Skill, MCP and
-custom-tool requests currently remain manual.
+native shell commands, file edits, skill loading, and external-directory access.
+MCP and custom tools share a tool-review category, with registered descriptions and JSON Schemas included when available.
 Supports streaming explanations, saved report history and stats, auto-approval, and Linux
 desktop notifications (Gnome) with distinct sounds.
 
@@ -19,6 +19,13 @@ each request's data and scope rather than allowing only specific host versions.
 
 ## Install and config
 
+Reviews send request data, the latest user prompt, and selected file snapshots,
+diffs, skill instructions or tool arguments to your configured endpoint **before
+permission approval**. Shell snapshots can follow symlinks outside the project;
+denying the command afterward cannot undo that disclosure. Use an endpoint you
+trust, and a local reviewer or a sandbox without accessible secrets when working
+with untrusted repositories.
+
 Add this entry to the global `~/.config/opencode/cli.json`, or
 `$XDG_CONFIG_HOME/opencode/cli.json` when `XDG_CONFIG_HOME` is set.
 There is no project-local CLI configuration. OpenCode loads the
@@ -40,9 +47,8 @@ There is no project-local CLI configuration. OpenCode loads the
         "reviewBash": true,
         "reviewEdits": true,
         "reviewSkills": true,
-        "reviewMcp": false,
-        "reviewCustomTools": false,
-        "reviewExternalDirectories": false,
+        "reviewTools": true,
+        "reviewExternalDirectories": true,
         "autoApprove": false,
         "fastMode": false,
         "extraCareful": true,
@@ -113,10 +119,9 @@ inclusive, fractions are invalid, and the maximum safe integer is
 | `stream` | boolean | `false` | Request SSE and show provisional rating/text updates. Normal automatic approval waits for a completed, validated report; fast mode can approve on an early Safe rating. Approval rules are described below. |
 | `reviewBash` | boolean | `true` | Review native `shell` permissions. The option keeps its existing name. |
 | `reviewEdits` | boolean | `true` | Review native `edit`, `write` and `patch` tools, which use the `edit` permission action. |
-| `reviewSkills` | boolean | `true` | Skill-review category switch. Exact mandatory skill instructions are currently unavailable to the V2 collector, so these requests remain manual. |
-| `reviewMcp` | boolean | `false` | MCP-review category switch. V2 MCP collection is currently unsupported; enabling this does not supply missing origin/catalog evidence or permit automatic approval. |
-| `reviewCustomTools` | boolean | `false` | Custom-tool review category switch. V2 custom-tool collection is currently unsupported; these requests remain manual. |
-| `reviewExternalDirectories` | boolean | `false` | Review directory access independently of operation-review switches. Directory approval can resume the operation without another prompt. |
+| `reviewSkills` | boolean | `true` | Review native skill loading using the exact requested ID and full currently registered main instructions. Assumes the selected definition stays unchanged while permission is pending. Missing or ambiguous instructions remain manual. |
+| `reviewTools` | boolean | `true` | Review other tools, including MCP and custom tools, using `TOOL-REVIEW-PROMPT.md`. Exact call linkage, arguments and permission scope are required. Descriptions and JSON Schemas are optional; missing evidence is explained to the LLM, which decides Safe/Unsafe. Safe reviews can use normal or fast automatic approval. |
+| `reviewExternalDirectories` | boolean | `true` | Review directory access independently of operation-review switches. Directory approval can resume the operation without another prompt. |
 | `autoApprove` | boolean | `false` | Allow Safe reviews once automatically. Normally waits for completion, validation and the countdown. Works throughout the current conversation, including subagent browsing and hidden/covered reports. Home, dashboards, unrelated conversations and native permission decision editing wait without cancellation. |
 | `fastMode` | boolean | `false` | Requires `autoApprove: true`. Approve an eligible, front-of-queue request as soon as a Safe rating is parsed, bypassing the countdown. Respects `stream`; with `stream: false`, waits for the complete validated response. Finish the report and save it in the background after approval. |
 | `extraCareful` | boolean | `true` | Include extra-careful guidance when `autoApprove` is enabled. Setting `false` omits that guidance without disabling automatic approval. |
@@ -161,10 +166,28 @@ The plugin doesn't enable mouse tracking or reveal a hidden sidebar unless you
 click an approval notification; it checks that the sidebar is absent from the main
 conversation before showing it. Hidden automatic reports are saved normally.
 
-The skill, MCP and custom-tool options are still present, but these reviews aren't
-supported in V2. The reviewer can't get the required skill instructions or verify
-the source and catalog information for MCP and custom tools. Those requests need
-manual approval; they aren't rated Safe.
+Skill reviews use the full main instructions from the server's current registered
+skill definition, not a fresh `SKILL.md` read or an invocation-time snapshot. This
+assumes that the selected definition stays unchanged while its permission is pending.
+The exact skill ID, native call and permission scope must match. Missing, ambiguous
+or oversized main instructions remain manual. Supporting files and scripts are not
+inspected; their omission alone does not prevent review. Allowing a skill loads its
+instructions, not a blanket grant for later tool actions.
+
+Tool reviews use the exact effective tool ID, captured arguments and pending
+permission scope. Current server-side registered names, descriptions and input
+JSON Schemas are included when available. Missing, duplicate, oversized,
+unreadable or unsupported definitions are omitted with factual reasons sent to
+the LLM. The LLM decides whether the remaining evidence justifies Safe or Unsafe;
+missing optional evidence does not itself force manual approval.
+
+This assumes any supplied definition stays unchanged while approval is pending
+and accurately describes behavior. The reviewer does not inspect executors or
+remote implementations, infer origin from names, or claim an invocation-time
+definition snapshot. Ambiguous call linkage still remains manual because the
+reviewer cannot identify the operation being approved. Saved reports use the tool
+category. All review categories default to enabled; `autoApprove` still defaults
+to false. `reviewTools` replaces `reviewMcp` and `reviewCustomTools`.
 
 Code Mode and its tool search stay enabled. Native tool calls can be reviewed when
 the reviewer can match them exactly to their permission requests. Nested calls
@@ -230,8 +253,9 @@ controls remain available. Already-approved fast-mode reports finish in the back
 The commands remain available when review configuration or the companion is unavailable;
 they save the preference without starting reviews.
 
-At startup, the reviewer retries timed-out or not-yet-available companion handshakes
-for up to 10 seconds. If it remains unavailable, history and notifications still work;
+At startup, the reviewer waits for the connected server event stream before its first
+companion handshake. Connection waiting and retries for timed-out or not-yet-available
+handshakes share one 10-second budget. If it remains unavailable, history and notifications still work;
 reload the plugin to try again. Invalid handshake data is not retried.
 
 If the server reconnects or the companion is replaced, reviews and auto-approval
@@ -242,6 +266,8 @@ from the old connection separate from the new one.
 
 Use `/reviewer-history` or **Reviewer: Report history** in the command palette to
 open the newest saved report for the current conversation and its descendants.
+**Alt+H** toggles report history from the main conversation. Its shortcut can be
+remapped with `keybinds["reviewer.history.toggle"]` in global `cli.json`.
 Left/Right or the arrow buttons select older/newer entries; Up/Down and
 PageUp/PageDown scroll. Close or Escape closes history. Repeating the command
 returns to the newest report. History remains available with review disabled or
@@ -320,7 +346,7 @@ received usage from unsuccessful or interrupted reviews, which do not count as
 completed reviews. Averages include measured reviews only.
 
 Reviews send the pending request, latest user prompt, project context, and relevant
-file snapshots, diffs, or tool arguments to your endpoint before approval. Shell
+file snapshots, diffs, registered skill instructions, or tool arguments to your endpoint before approval. Shell
 file snapshots can follow symlinks outside the project. Missing evidence is noted
 in the report; ratings are advice based on the supplied evidence.
 </details>
@@ -438,12 +464,15 @@ Disable overlapping notification plugins to avoid duplicate alerts.
 Use Node.js 24.15.0+ within 24.x, or 22.22.2+ within 22.x, and npm.
 Run `npm ci --ignore-scripts`, then `npm run check` for typechecking, source tests,
 pure-helper tests and the build. `npm run test:helpers` runs the helper checks
-without building or starting OpenCode. Pull-request CI checks both Node versions
-and runs a separate representative Linux fixture profile on stock OpenCode
-2.0.26 and 2.0.27.
-After building, run `node scripts/test-runtime.mjs --profile ci` for that same
+without building or starting OpenCode. Pushing a version tag runs verification
+and publication in one workflow: source tests, helper tests, reproducible builds
+and archive checks must pass before the exact verified archive is published.
+The manual **Extended host checks** workflow tests Node 22/24 and the real Linux
+TUI on the newest stable OpenCode V2. These timing-sensitive host fixtures are
+not an automatic release prerequisite.
+After building, run `node scripts/test-runtime.mjs --profile v2-acceptance` for that same
 profile. Use `node scripts/test-runtime.mjs --list` for the complete runtime
-inventory or `node scripts/test-runtime.mjs --plan --profile ci` for a
+inventory or `node scripts/test-runtime.mjs --plan --profile v2-acceptance` for a
 host-independent plan. Profiles select documented scenario/flag combinations;
 interactive desktop checks have separate prerequisites.
 See [AGENTS.md](https://github.com/mightykatun/opencode-reviewer/blob/main/AGENTS.md)

package/THIRD_PARTY_NOTICES.md

@@ -27,16 +27,16 @@ ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-# Bundled dependency: @opencode/theme 2.0.26
+# Bundled dependency: @opencode/theme 2.0.29
 
-https://github.com/anomalyco/opencode/tree/v2.0.26/packages/theme
+https://github.com/anomalyco/opencode/tree/v2.0.29/packages/theme
 
-The pinned theme syntax helper is bundled unchanged in the terminal payload.
+The source-fingerprinted theme syntax helper is bundled unchanged in the terminal payload.
 A build-time adapter replaces its public barrel with a syntax-only re-export;
 unused theme parsers, schemas and their Effect dependency are not bundled.
 Solid and OpenTUI remain host-provided external dependencies.
 
-License source: https://github.com/anomalyco/opencode/blob/v2.0.26/LICENSE
+License source: https://github.com/anomalyco/opencode/blob/v2.0.29/LICENSE
 
 ```text
 MIT License