opencode-reviewer 2.1.3 → 2.1.4

package/README.md

@@ -2,7 +2,7 @@
 
 Reviews pending permissions in the [OpenCode](https://github.com/anomalyco/opencode) sidebar using a separate LLM. Reviews
 native shell commands, file edits, skill loading, and external-directory access.
-MCP and custom-tool requests currently remain manual.
+MCP and custom tools share a tool-review category, with registered descriptions and JSON Schemas included when available.
 Supports streaming explanations, saved report history and stats, auto-approval, and Linux
 desktop notifications (Gnome) with distinct sounds.
 
@@ -19,6 +19,13 @@ each request's data and scope rather than allowing only specific host versions.
 
 ## Install and config
 
+Reviews send request data, the latest user prompt, and selected file snapshots,
+diffs, skill instructions or tool arguments to your configured endpoint **before
+permission approval**. Shell snapshots can follow symlinks outside the project;
+denying the command afterward cannot undo that disclosure. Use an endpoint you
+trust, and a local reviewer or a sandbox without accessible secrets when working
+with untrusted repositories.
+
 Add this entry to the global `~/.config/opencode/cli.json`, or
 `$XDG_CONFIG_HOME/opencode/cli.json` when `XDG_CONFIG_HOME` is set.
 There is no project-local CLI configuration. OpenCode loads the
@@ -40,9 +47,8 @@ There is no project-local CLI configuration. OpenCode loads the
         "reviewBash": true,
         "reviewEdits": true,
         "reviewSkills": true,
-        "reviewMcp": false,
-        "reviewCustomTools": false,
-        "reviewExternalDirectories": false,
+        "reviewTools": true,
+        "reviewExternalDirectories": true,
         "autoApprove": false,
         "fastMode": false,
         "extraCareful": true,
@@ -114,9 +120,8 @@ inclusive, fractions are invalid, and the maximum safe integer is
 | `reviewBash` | boolean | `true` | Review native `shell` permissions. The option keeps its existing name. |
 | `reviewEdits` | boolean | `true` | Review native `edit`, `write` and `patch` tools, which use the `edit` permission action. |
 | `reviewSkills` | boolean | `true` | Review native skill loading using the exact requested ID and full currently registered main instructions. Assumes the selected definition stays unchanged while permission is pending. Missing or ambiguous instructions remain manual. |
-| `reviewMcp` | boolean | `false` | MCP-review category switch. V2 MCP collection is currently unsupported; enabling this does not supply missing origin/catalog evidence or permit automatic approval. |
-| `reviewCustomTools` | boolean | `false` | Custom-tool review category switch. V2 custom-tool collection is currently unsupported; these requests remain manual. |
-| `reviewExternalDirectories` | boolean | `false` | Review directory access independently of operation-review switches. Directory approval can resume the operation without another prompt. |
+| `reviewTools` | boolean | `true` | Review other tools, including MCP and custom tools, using `TOOL-REVIEW-PROMPT.md`. Exact call linkage, arguments and permission scope are required. Descriptions and JSON Schemas are optional; missing evidence is explained to the LLM, which decides Safe/Unsafe. Safe reviews can use normal or fast automatic approval. |
+| `reviewExternalDirectories` | boolean | `true` | Review directory access independently of operation-review switches. Directory approval can resume the operation without another prompt. |
 | `autoApprove` | boolean | `false` | Allow Safe reviews once automatically. Normally waits for completion, validation and the countdown. Works throughout the current conversation, including subagent browsing and hidden/covered reports. Home, dashboards, unrelated conversations and native permission decision editing wait without cancellation. |
 | `fastMode` | boolean | `false` | Requires `autoApprove: true`. Approve an eligible, front-of-queue request as soon as a Safe rating is parsed, bypassing the countdown. Respects `stream`; with `stream: false`, waits for the complete validated response. Finish the report and save it in the background after approval. |
 | `extraCareful` | boolean | `true` | Include extra-careful guidance when `autoApprove` is enabled. Setting `false` omits that guidance without disabling automatic approval. |
@@ -169,9 +174,20 @@ or oversized main instructions remain manual. Supporting files and scripts are n
 inspected; their omission alone does not prevent review. Allowing a skill loads its
 instructions, not a blanket grant for later tool actions.
 
-MCP and custom-tool reviews remain unsupported in V2 because required origin and
-catalog evidence is unavailable. Their switches do not turn those requests into
-Safe ratings or automatic approvals.
+Tool reviews use the exact effective tool ID, captured arguments and pending
+permission scope. Current server-side registered names, descriptions and input
+JSON Schemas are included when available. Missing, duplicate, oversized,
+unreadable or unsupported definitions are omitted with factual reasons sent to
+the LLM. The LLM decides whether the remaining evidence justifies Safe or Unsafe;
+missing optional evidence does not itself force manual approval.
+
+This assumes any supplied definition stays unchanged while approval is pending
+and accurately describes behavior. The reviewer does not inspect executors or
+remote implementations, infer origin from names, or claim an invocation-time
+definition snapshot. Ambiguous call linkage still remains manual because the
+reviewer cannot identify the operation being approved. Saved reports use the tool
+category. All review categories default to enabled; `autoApprove` still defaults
+to false. `reviewTools` replaces `reviewMcp` and `reviewCustomTools`.
 
 Code Mode and its tool search stay enabled. Native tool calls can be reviewed when
 the reviewer can match them exactly to their permission requests. Nested calls

package/THIRD_PARTY_NOTICES.md

@@ -27,16 +27,16 @@ ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-# Bundled dependency: @opencode/theme 2.0.26
+# Bundled dependency: @opencode/theme 2.0.29
 
-https://github.com/anomalyco/opencode/tree/v2.0.26/packages/theme
+https://github.com/anomalyco/opencode/tree/v2.0.29/packages/theme
 
-The pinned theme syntax helper is bundled unchanged in the terminal payload.
+The source-fingerprinted theme syntax helper is bundled unchanged in the terminal payload.
 A build-time adapter replaces its public barrel with a syntax-only re-export;
 unused theme parsers, schemas and their Effect dependency are not bundled.
 Solid and OpenTUI remain host-provided external dependencies.
 
-License source: https://github.com/anomalyco/opencode/blob/v2.0.26/LICENSE
+License source: https://github.com/anomalyco/opencode/blob/v2.0.29/LICENSE
 
 ```text
 MIT License