luigidemasi commented on code in PR #149:
URL: https://github.com/apache/camel-kit/pull/149#discussion_r4479796663
##########
kit/camel-kit-core/src/main/java/org/apache/camel/kit/generator/OpenCodeGenerator.java:
##########
@@ -30,12 +37,36 @@ public void generate(InitContext ctx) throws Exception {
Map<String, Object> data = new HashMap<>(
Map.of(
"COMMAND_PREFIX", ctx.commandPrefix()));
- // AGENTS.md already generated by the shared generator flow.
+
+ List<String> mcpServers = readMcpServerNames(ctx);
+ StringBuilder denials = new StringBuilder();
+ for (String server : mcpServers) {
+ denials.append(" ").append(server).append("_*: deny\n");
+ }
+ data.put("MCP_TOOL_DENIALS", denials.toString());
// OpenCode-specific: generate agent definitions
generateAgents(ctx, data);
}
+ private List<String> readMcpServerNames(InitContext ctx) throws
IOException {
+ Path configFile =
ctx.projectDir().resolve(ctx.agent().mcpConfigPath());
+ if (!Files.exists(configFile)) {
+ return List.of();
Review Comment:
[P1] Resolve the effective MCP configuration before generating denials
This reads only `opencode.json`, although `OpenCodeProjectConfig` and the
merger support three other project paths and deliberately put managed servers
in the highest-precedence existing file. With only `opencode.jsonc` or
`.opencode/opencode.jsonc`, this returns no names, removing even the bundled
server denials. Fresh/reinit generation reproduces the gap for every alternate
path; an actual OpenCode 2.2.5 child executes the preconfigured canary from
both JSONC locations. A server already configured globally before init also
executes. Please reuse the existing project-layer resolution and account for
inherited host configuration, or refuse native dispatch when its MCP boundary
cannot be established. Reading one install-time file does not cover the child's
effective MCP tools.
_AI-generated by Codex on behalf of @luigidemasi._
##########
kit/camel-kit-core/src/main/java/org/apache/camel/kit/generator/OpenCodeGenerator.java:
##########
@@ -30,12 +37,36 @@ public void generate(InitContext ctx) throws Exception {
Map<String, Object> data = new HashMap<>(
Map.of(
"COMMAND_PREFIX", ctx.commandPrefix()));
- // AGENTS.md already generated by the shared generator flow.
+
+ List<String> mcpServers = readMcpServerNames(ctx);
+ StringBuilder denials = new StringBuilder();
+ for (String server : mcpServers) {
+ denials.append(" ").append(server).append("_*: deny\n");
Review Comment:
[P1] Match the host's normalized MCP action names
OpenCode normalizes server names before constructing permission actions. A
valid configured server named `probe.local` produces `probe_local_mark`, but
this emits `probe.local_*: deny`, which does not match. I reproduced the
generated child invoking the canary and writing its marker on OpenCode 2.2.5;
changing only the denial to `probe_local_*` blocks the same call. Derive the
emitted keys from the actual host action identifiers, using the host's
normalization and safe YAML serialization, and cover a punctuation-containing
server name with a real-child test. Comparing the emitted string with the raw
config key cannot detect this bypass.
_AI-generated by Codex on behalf of @luigidemasi._
##########
kit/camel-kit-core/src/main/java/org/apache/camel/kit/generator/OpenCodeGenerator.java:
##########
@@ -30,12 +37,36 @@ public void generate(InitContext ctx) throws Exception {
Map<String, Object> data = new HashMap<>(
Map.of(
"COMMAND_PREFIX", ctx.commandPrefix()));
- // AGENTS.md already generated by the shared generator flow.
+
+ List<String> mcpServers = readMcpServerNames(ctx);
+ StringBuilder denials = new StringBuilder();
+ for (String server : mcpServers) {
Review Comment:
[P2] Keep MCP namespace rules from denying host permissions
An MCP server named `external` causes this loop to emit `external_*: deny`,
which also matches OpenCode's built-in `external_directory` permission. With
the parent explicitly allowing the external Ship state directory, the generated
child then fails to read the actual controller briefing with `Permission
denied: external_directory`. Changing only that rule to the exact
`external_mark` MCP action restores the briefing read. Please target MCP
actions without matching host permission names, and add this
authorized-external-state regression case; a valid server name currently breaks
native DISCOVERY.
_AI-generated by Codex on behalf of @luigidemasi._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
