Commit 95834d68aa475a8afe4b2b14eaedffb35b590dab | the-knife

author	Maxwell Young <maxtheyoung@gmail.com> 2026-09-08 08:50:58+10:00
committer	GitHub <noreply@github.com> 2026-09-07 15:50:58-07:00
log	95834d68aa475a8afe4b2b14eaedffb35b590dab
tree	a7120d5cbff9d716d8fb6d7273c890ba66aa1b3b
parent	dadba6d95d2c4515956a6c7fef184378987e13b7
signature	Signed by PGP key B5690EEEBB952194

fix(server): disable executable capabilities in Claude metadata generation (#4169)

2 files changed, 109 insertions(+), 30 deletions(-)

apps
- server
  - src
    textGeneration
    ClaudeTextGeneration.test.ts
    ClaudeTextGeneration.ts

apps/server/src/textGeneration/ClaudeTextGeneration.test.ts+82-19

 @@ -41,13 +41,37 @@ function makeFakeClaudeBinary(dir: string) {
       name: "claude",
       platform,
       source: [
-        'const args = process.argv.slice(2).join(" ");',
+        "const argv = process.argv.slice(2);",
+        'const args = argv.join(" ");',
+        'const { realpathSync } = await import("node:fs");',
         "",
         "function fail(message, code) {",
         '  process.stderr.write(message + "\\n");',
         "  process.exit(code);",
         "}",
         "",
+        'const toolsIndex = argv.indexOf("--tools");',
+        'if (toolsIndex === -1 || argv[toolsIndex + 1] !== "") {',
+        '  fail("text generation must receive an explicit empty tool set", 6);',
+        "}",
+        'if (argv.includes("--dangerously-skip-permissions")) {',
+        '  fail("text generation must not bypass permissions", 7);',
+        "}",
+        'if (!argv.includes("--disable-slash-commands")) {',
+        '  fail("text generation must disable skills", 8);',
+        "}",
+        'if (!argv.includes("--strict-mcp-config")) {',
+        '  fail("text generation must not load configured MCP servers", 9);',
+        "}",
+        'const settingsIndex = argv.indexOf("--settings");',
+        "if (settingsIndex === -1 || JSON.parse(argv[settingsIndex + 1]).disableAllHooks !== true) {",
+        '  fail("text generation must disable hooks", 10);',
+        "}",
+        "const cwdMustNotBe = process.env.T3_FAKE_CLAUDE_CWD_MUST_NOT_BE;",
+        "if (cwdMustNotBe && realpathSync(process.cwd()) === realpathSync(cwdMustNotBe)) {",
+        '  fail("text generation ran in the project directory", 11);',
+        "}",
+        "",
         'let stdinContent = "";',
         "if (!process.stdin.isTTY) {",
         "  const chunks = [];",
 @@ -100,6 +124,7 @@ function withFakeClaudeEnv<A, E, R>(
     argsMustNotContain?: string;
     stdinMustContain?: string;
     configDirMustBe?: string;
+    cwdMustNotBe?: string;
     claudeConfig?: Partial<ClaudeSettings>;
   },
   effectFn: (textGeneration: TextGeneration.TextGeneration["Service"]) => Effect.Effect<A, E, R>,
 @@ -117,6 +142,7 @@ function withFakeClaudeEnv<A, E, R>(
     const previousArgsMustNotContain = process.env.T3_FAKE_CLAUDE_ARGS_MUST_NOT_CONTAIN;
     const previousStdinMustContain = process.env.T3_FAKE_CLAUDE_STDIN_MUST_CONTAIN;
     const previousConfigDirMustBe = process.env.T3_FAKE_CLAUDE_CONFIG_DIR_MUST_BE;
+    const previousCwdMustNotBe = process.env.T3_FAKE_CLAUDE_CWD_MUST_NOT_BE;
     yield* Effect.acquireRelease(
       Effect.sync(() => {
 @@ -153,6 +179,12 @@ function withFakeClaudeEnv<A, E, R>(
           delete process.env.T3_FAKE_CLAUDE_STDIN_MUST_CONTAIN;
         }
+        if (input.cwdMustNotBe !== undefined) {
+          process.env.T3_FAKE_CLAUDE_CWD_MUST_NOT_BE = input.cwdMustNotBe;
+        } else {
+          delete process.env.T3_FAKE_CLAUDE_CWD_MUST_NOT_BE;
+        }
         if (input.configDirMustBe !== undefined) {
           process.env.T3_FAKE_CLAUDE_CONFIG_DIR_MUST_BE = input.configDirMustBe;
         } else {
 @@ -199,6 +231,12 @@ function withFakeClaudeEnv<A, E, R>(
             process.env.T3_FAKE_CLAUDE_STDIN_MUST_CONTAIN = previousStdinMustContain;
           }
+          if (previousCwdMustNotBe === undefined) {
+            delete process.env.T3_FAKE_CLAUDE_CWD_MUST_NOT_BE;
+          } else {
+            process.env.T3_FAKE_CLAUDE_CWD_MUST_NOT_BE = previousCwdMustNotBe;
+          }
           if (previousConfigDirMustBe === undefined) {
             delete process.env.T3_FAKE_CLAUDE_CONFIG_DIR_MUST_BE;
           } else {
 @@ -227,7 +265,7 @@ it.layer(ClaudeTextGenerationTestLayer)("ClaudeTextGeneration", (it) => {
             body: "",
           },
         }),
-        argsMustContain: '--settings {"alwaysThinkingEnabled":false}',
+        argsMustContain: '--settings {"disableAllHooks":true,"alwaysThinkingEnabled":false}',
         argsMustNotContain: "--effort",
       },
       (textGeneration) =>
 @@ -263,7 +301,7 @@ it.layer(ClaudeTextGenerationTestLayer)("ClaudeTextGeneration", (it) => {
             body: "",
           },
         }),
-        argsMustContain: `--model ${SYNTHETIC_CLAUDE_COLLIDING_ALIAS} --dangerously-skip-permissions`,
+        argsMustContain: `--model ${SYNTHETIC_CLAUDE_COLLIDING_ALIAS} --settings`,
         claudeConfig: { customModels: [SYNTHETIC_CLAUDE_COLLIDING_ALIAS] },
       },
       (textGeneration) =>
 @@ -302,7 +340,7 @@ it.layer(ClaudeTextGenerationTestLayer)("ClaudeTextGeneration", (it) => {
               body: "Body",
             },
           }),
-          argsMustContain: `--model ${SYNTHETIC_CLAUDE_CAPABLE_MODEL}[expanded] --effort max --settings {"fastMode":true} --dangerously-skip-permissions`,
+          argsMustContain: `--model ${SYNTHETIC_CLAUDE_CAPABLE_MODEL}[expanded] --effort max --settings {"disableAllHooks":true,"fastMode":true}`,
           claudeConfig: { customModels: [SYNTHETIC_CLAUDE_COLLIDING_ALIAS] },
         },
         (textGeneration) =>
 @@ -331,33 +369,58 @@ it.layer(ClaudeTextGenerationTestLayer)("ClaudeTextGeneration", (it) => {
       ),
   );
-  it.effect("generates thread titles through the Claude provider", () =>
+  it.effect(
+    "generates thread titles outside the project with tools, skills, and hooks disabled",
+    () =>
+      withFakeClaudeEnv(
+        {
+          output: JSON.stringify({
+            structured_output: {
+              title:
+                '  "Reconnect failures after restart because the session state does not recover"  ',
+            },
+          }),
+          cwdMustNotBe: process.cwd(),
+          stdinMustContain: "/call-script",
+        },
+        (textGeneration) =>
+          Effect.gen(function* () {
+            const generated = yield* textGeneration.generateThreadTitle({
+              cwd: process.cwd(),
+              message: "/call-script",
+              modelSelection: {
+                instanceId: ProviderInstanceId.make("claudeAgent"),
+                model: SYNTHETIC_CLAUDE_STANDARD_MODEL,
+              },
+            });
+            expect(generated.title).toBe(
+              sanitizeThreadTitle(
+                '"Reconnect failures after restart because the session state does not recover"',
+              ),
+            );
+          }),
+      ),
+  );
+  it.effect("generates branch names from skill prompts without executable capabilities", () =>
     withFakeClaudeEnv(
       {
-        output: JSON.stringify({
+        output: JSON.stringify({ structured_output: { branch: "call-script" } }),
-          structured_output: {
+        stdinMustContain: "/call-script",
-            title:
-              '  "Reconnect failures after restart because the session state does not recover"  ',
-          },
-        }),
-        stdinMustContain: "Please investigate reconnect failures after restarting the session.",
       },
       (textGeneration) =>
         Effect.gen(function* () {
-          const generated = yield* textGeneration.generateThreadTitle({
+          const generated = yield* textGeneration.generateBranchName({
             cwd: process.cwd(),
-            message: "Please investigate reconnect failures after restarting the session.",
+            message: "/call-script",
             modelSelection: {
               instanceId: ProviderInstanceId.make("claudeAgent"),
               model: SYNTHETIC_CLAUDE_STANDARD_MODEL,
             },
           });
-          expect(generated.title).toBe(
+          expect(generated.branch).toBe("call-script");
-            sanitizeThreadTitle(
-              '"Reconnect failures after restart because the session state does not recover"',
-            ),
-          );
         }),
     ),
   );

apps/server/src/textGeneration/ClaudeTextGeneration.ts+27-11

 @@ -8,6 +8,7 @@
  * @module ClaudeTextGeneration
  */
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
 @@ -75,6 +76,7 @@ export const makeClaudeTextGeneration = Effect.fn("makeClaudeTextGeneration")(fu
   modelCatalog: Effect.Effect<ClaudeModelCatalog> = Effect.succeed(BUNDLED_CLAUDE_MODEL_CATALOG),
 ) {
   const commandSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const fileSystem = yield* FileSystem.FileSystem;
   const claudeEnvironment = yield* makeClaudeEnvironment(claudeSettings, environment);
   const scopedModelCatalog = modelCatalog.pipe(
     Effect.map((catalog) => scopeClaudeModelCatalog(catalog, claudeSettings.customModels)),
 @@ -171,20 +173,29 @@ export const makeClaudeTextGeneration = Effect.fn("makeClaudeTextGeneration")(fu
     const fastMode =
       fastModeDescriptor?.type === "boolean" ? fastModeDescriptor.currentValue : undefined;
     const settings = {
+      disableAllHooks: true,
       ...(typeof thinking === "boolean" ? { alwaysThinkingEnabled: thinking } : {}),
       ...(fastMode ? { fastMode: true } : {}),
       ...(ultracode ? { ultracode: true } : {}),
     };
-    const settingsJson =
+    const settingsJson = yield* encodeJsonForOperation(
-      Object.keys(settings).length > 0
+      operation,
-        ? yield* encodeJsonForOperation(
+      settings,
-            operation,
+      "Failed to encode Claude CLI settings.",
-            settings,
+    );
-            "Failed to encode Claude CLI settings.",
-          )
-        : undefined;
     const runClaudeCommand = Effect.fn("runClaudeJson.runClaudeCommand")(function* () {
+      // Titles need only the supplied prompt, not configuration from the checkout.
+      const workingDirectory =
+        operation === "generateThreadTitle"
+          ? yield* fileSystem
+              .makeTempDirectoryScoped({ prefix: "t3code-claude-title-" })
+              .pipe(
+                Effect.mapError((cause) =>
+                  normalizeCliError("claude", operation, cause, "Failed to create title directory"),
+                ),
+              )
+          : cwd;
       const spawnCommand = yield* resolveSpawnCommand(
         claudeSettings.binaryPath || "claude",
         [
 @@ -196,14 +207,19 @@ export const makeClaudeTextGeneration = Effect.fn("makeClaudeTextGeneration")(fu
           "--model",
           resolveClaudeCatalogApiModelId(catalog, resolvedModelSelection),
           ...(cliEffort ? ["--effort", cliEffort] : []),
-          ...(settingsJson ? ["--settings", settingsJson] : []),
+          "--settings",
-          "--dangerously-skip-permissions",
+          settingsJson,
+          // Metadata prompts need no executable capabilities, even when they contain a skill name.
+          "--tools",
+          "",
+          "--disable-slash-commands",
+          "--strict-mcp-config",
         ],
         { env: claudeEnvironment },
       );
       const command = ChildProcess.make(spawnCommand.command, spawnCommand.args, {
         env: claudeEnvironment,
-        cwd,
+        cwd: workingDirectory,
         shell: spawnCommand.shell,
         stdin: {
           stream: Stream.encodeText(Stream.make(prompt)),