Review: 405e96b

[github-actions]

Code Review

Automated review of the last commit on dev.

Review Output

## Code Review — last commit on `dev`

### Bugs / regressions

1. **Hardcoded machine-specific plugin path** — `cli.json:18`: `"package": "/home/samarth/repos/tps-oc2/src/index.tsx"`. Absolute path to a repo that isn't part of this dotfiles repo. This breaks on any other machine and fails plugin loading if `~/repos/tps-oc2` is missing or moved. This repo's own AGENTS.md flags `/home/samarth` paths as a portability gotcha (config.fish) — this adds a second, worse instance (a bare source file used as a plugin). Commit the plugin or drop it.

2. **Onboarding hints silently re-enabled** — the old `cli.json` had `"hints": {"onboarding": false}`, which is gone in the reorganized config. Users will now get onboarding prompts again on next launch. Likely an accidental drop during the reorg, not intentional.

3. **Postgres + vision MCP servers disabled** — `opencode.jsonc:44-68`. Both are commented out, so `postgres-mcp` (DB access) and the vision server are gone. If any workflow or session relied on those tools, they break without warning. Fine if intentional, but the change isn't documented anywhere. Note the postgres server was already running in `--access-mode=restricted` (safe), so there's no security gain here.

### Security

4. **Third-party remote MCP enabled by default** — `opencode.jsonc:39-43`: `indeed` remote server is `enabled: true`. URL is the official Indeed endpoint (docs.indeed.com/mcp, beta, OAuth) so no hardcoded secret or phishing domain — but it's a beta third-party server that will now be connected and invoked during normal dev sessions. Worth confirming intent; consider `"enabled": false` until you actually need it.

5. **Debug interface enabled in a committed config** — `cli.json:52-56`: `"devtools": true` opens opencode's devtools in a config that gets shared/committed. Devtools exposes a debug RPC surface that shouldn't be on in a "production" dotfiles config. Recommend `devtools: false`.

### Performance

6. **Per-turn debug telemetry** — `cli.json:54-55` (`turn_tokens`, `timing`) adds per-turn instrumentation overhead to every session. Minor, but it's unconditionally on for all projects via the shared config.

### Non-issues (checked)

- `opencode.jsonc` is syntactically valid JSONC — the comment block after `"indeed"` parses fine (comments/trailing commas are legal), no missing comma.
- Deleting `agents/git.md` and `agents/subagent.md` is safe — no references to either agent exist anywhere in the repo.
- The new `swarm.md` agent has no config problems.

**Top fix:** item 1 (the `/home/samarth/repos/tps-oc2/...` absolute plugin path) is the only real breakage; 2–6 are behavior/security/perf regressions worth a second look.

---

Generated by OpenCode Review