The opencode review branch parsed output without classify_route_output,
so a terminal 529 left PROVIDER_OUTCOME=ok and skipped the required
same-route retry; run the shared classifier first in both review scripts.
The write-capable eval cell now also sets OPENCODE_DISABLE_PROJECT_CONFIG
so a fixture's .opencode/{plugins,agents} cannot contaminate the eval
before wrapPrompt applies.
Claude-Session: https://claude.ai/code/session_01EoF39fuXHnmWDVzkBADnzo
- ce-pov apply_model_override now admits opencode provider/model tokens,
so a resolved same-family override reaches the adapter instead of
exiting 2 (code-review already handled this).
- cross-model-review launch-contract placeholders in ce-code-review and
ce-doc-review now admit opencode, matching the route table so a literal
agent does not reject the resolved target pre-launch.
- Document the opencode code-review read posture honestly: an enumerated
capability denylist with project config disabled, and the operator-owned
global-config residual it does not cover.
Claude-Session: https://claude.ai/code/session_01EoF39fuXHnmWDVzkBADnzo
A reviewed repo's .opencode/{plugin,agent} directories load as trusted
runtime and can run host shell or override the global deny overlay, so
the read-only peer was a host RCE (reproduced live: a planted
.opencode/plugin ran shell despite edit/bash denied). Set
OPENCODE_DISABLE_PROJECT_CONFIG=1 on every review/POV route and the
eval-cell read-only arm; verified reads still work with it set.
Claude-Session: https://claude.ai/code/session_01EoF39fuXHnmWDVzkBADnzo
The read-only overlay now also denies webfetch and task (live-tested:
reads survive, fetch and delegation are gone; a wildcard deny was
rejected because it removes read tools too). Eval cells scrub every
inherited harness-attestation marker, not just CLAUDECODE, so a child
cell launched from Codex or Grok attests as itself.
Claude-Session: https://claude.ai/code/session_01EoF39fuXHnmWDVzkBADnzo
The eval cell's read-only arm only omitted --auto, which is not
read-only under OpenCode's permissive defaults; it now injects the same
deny overlay the peer adapters use. cross-model-execution's allowlist
sentence still excluded opencode while the route token admitted it.
Claude-Session: https://claude.ai/code/session_01EoF39fuXHnmWDVzkBADnzo
CROSS_MODEL_EFFORT_OVERRIDE for opencode now allows the effort keys from
the models.dev catalog (none, minimal, low, medium, high, xhigh, max,
default), not only the --help examples.
Operators can set cross_model_peer and work_engine harness to opencode.
Review and POV run `opencode run` with OPENCODE_CONFIG_CONTENT denying
edit and bash. Work uses --auto. Output is parsed as OpenCode NDJSON
text events, not grok or Cursor envelopes.
Trevin Chow