luigidemasi commented on code in PR #149:
URL: https://github.com/apache/camel-kit/pull/149#discussion_r4512924301
##########
docs/modules/ROOT/pages/ship.adoc:
##########
@@ -208,6 +208,18 @@ certification.
uses `fork` or `fork_turns`; dispatch is through the named-agent mechanism.
If `--backend qwen-native` is requested
and dispatch is unavailable the skill stops without starting a run.
Generated skill and worker assets verified on
Qwen Code 0.25.3 (parser/command-loader probe); live child execution
acceptance is pending.
+
+| OpenCode
+| `/camel-ship` command stub in `.opencode/commands/` that invokes the native
skill, which uses the `subagent` tool to
+ dispatch a `camel-ship-worker` child with explicit tool denials (`edit`,
`write`, `bash`, `notebook`, `subagent`,
+ `mcp`) and per-server glob denials for every MCP server enumerated from the
full effective configuration at init
+ time (project layers, ancestor dirs, global XDG config, `OPENCODE_CONFIG`,
`OPENCODE_CONFIG_CONTENT`,
+ `OPENCODE_CONFIG_DIR`, and platform managed config — `/etc/opencode` on
Linux, `/Library/Application Support/opencode`
+ on macOS, `%ProgramData%\opencode` on Windows). The worker is not generated
— and any existing one is removed — when
+ any config source contains an unresolved `{env:…}` or `{file:…}`
substitution, cannot be parsed, a server name
+ collides with a built-in permission prefix, or macOS MDM managed preferences
(`ai.opencode.managed.plist`) are
+ present. The worker inherits read access from the parent. If `--backend
opencode-native` is requested and dispatch
+ is unavailable the skill stops without starting a run. Verified on OpenCode
2.2.5 with 26 real host cases.
Review Comment:
[P2] Qualify the cleanup guarantee and acceptance evidence
The unconditional removal claim above is not true for the unchanged
implementation: duplicate-key root/nested project configs fail preflight and
preserve the old worker. The [26-case
review](https://github.com/apache/camel-kit/pull/149#pullrequestreview-5825430735)
reported callable-worker failures, and the [subsequent 28-case
review](https://github.com/apache/camel-kit/pull/149#pullrequestreview-5825950841)
still reproduced the duplicate-key bypass. Describing the paragraph as
verified without those qualifications overstates the result.
Please align this text and the PR's “Reviewer acceptance” item with the
actual evidence: distinguish the author's reported native pipeline acceptance
from reviewer boundary probes, retain the unresolved failure cases, and
identify Windows/macOS managed-config checks as generator probes with simulated
OS selection on Linux. Also remove or qualify the blanket removal guarantee
until the preflight finding is fixed.
_AI-generated by Codex on behalf of @luigidemasi._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
