[
https://issues.apache.org/jira/browse/CAMEL-25443?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127030#comment-18127030
]
Claus Ibsen commented on CAMEL-25443:
-------------------------------------
Fixed in
https://github.com/apache/camel/commit/c754310d6f88194d967d78028498840f7a5f3a00
with the second option of the description: {{camel_eval_expression}} asks the
user first in the TUI when the language runs code (groovy, java/joor,
js/javascript, python, mvel, ognl, spel). Other languages, such as simple,
jsonpath and xpath, run without asking.
The TUI asks when the tool runs, so it applies to every caller alike: the AI
panel's own model, an ACP agent and an MCP client. While a tape records or
plays nothing asks. The {{READ_ONLY}} flag no longer decides whether a tool
asks: Camel TUI is a developer tool whose tools run without asking, apart from
the few calls listed under "Developer tools" in the security model (see
CAMEL-25441).
_Claude Code on behalf of Claus Ibsen_
> camel-jbang-plugin-tui - do not classify camel_eval_expression as read-only
> ---------------------------------------------------------------------------
>
> Key: CAMEL-25443
> URL: https://issues.apache.org/jira/browse/CAMEL-25443
> Project: Camel
> Issue Type: Improvement
> Components: camel-jbang
> Reporter: Andrea Cosentino
> Assignee: Claus Ibsen
> Priority: Minor
> Fix For: 4.24.0
>
>
> camel_eval_expression is currently in TuiToolRegistry.READ_ONLY_TOOLS
> (ToolDescriptor defaults readOnly=true and AuthoringTools does not override
> it), so the ACP permission handler auto-approves it without prompting.
> Because it evaluates expressions in any language and downloads the language's
> component on demand, it should not be treated as read-only / auto-approved.
> Mark it readOnly(false), or restrict silent handling to a set of
> non-scripting languages.
> Module: dsl/camel-jbang/camel-jbang-core (AuthoringTools),
> dsl/camel-jbang/camel-jbang-plugin-tui.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
