fix(server): disable executable capabilities in Claude metadata generation

[maxwellyoung]

Claude background title and branch generation receives the user's first prompt and currently starts with permission bypass. A skill invocation can therefore execute in the background as well as in the actual conversation.

Disable built-in tools, skills, configured MCP servers, and ordinary hooks for Claude metadata generation while retaining model options and account configuration. Run title generation in an automatically cleaned temporary directory. Port the existing PR to the current Node fake-CLI fixture and preserve the working-directory assertion requested from #8907.

Validation: 7 focused tests pass; they reject the original code and separately detect a project-cwd regression. Targeted lint, formatting, and server typecheck pass. Tests exercise the child-process launch contract on macOS; real Claude behavior and Windows execution remain unverified. Managed hooks and authentication helpers are not claimed to be isolated. Codex's existing read-only metadata path is unchanged.

Fixes #3594.

---

Note

Medium Risk
Changes subprocess security boundaries for all Claude text-generation paths; mis-flagged CLI args could break commit/PR/title/branch generation without affecting normal agent conversations.

Overview
Claude-backed metadata generation (thread titles, branch names, commits, PR copy) no longer spawns claude -p with --dangerously-skip-permissions. Every structured JSON run now passes an explicit empty --tools set, --disable-slash-commands, --strict-mcp-config, and --settings that always includes disableAllHooks: true, so prompts like /call-script cannot execute skills or load MCP/hooks in the background.

Thread title generation additionally runs the CLI from a scoped temp directory instead of the project checkout, so repo-local Claude config is not picked up for title-only prompts.

Tests extend the fake claude stub to fail on missing or wrong capability flags and add coverage for skill-style stdin on thread titles (outside repo cwd) and branch naming without executable capabilities; existing cases are updated to expect the new --settings shape.

^{Reviewed by Cursor Bugbot for commit e931000. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Remove permission bypass, tools, and slash commands from runClaudeCommand

• Claude CLI invocations in ClaudeTextGeneration.ts now pass an explicit empty tool set, disable slash commands, load configured MCP servers, and omit the permission-bypass argument
• runClaudeJson always sends JSON-encoded settings with hooks disabled, instead of conditionally omitting settings
• Thread-title operations run from a scoped temporary working directory instead of the caller-provided directory; directory-creation failures map to a normalized CLI error
• makeClaudeTextGeneration now requires the Effect FileSystem service as a dependency
• Tests in ClaudeTextGeneration.test.ts updated to assert the new restrictions, including a new branch-name generation test and a rewritten thread-title test that verifies execution outside the project directory
• Behavioral Change: all Claude CLI calls lose executable capabilities; any code path that relied on permission bypass or non-empty tools will now fail

^{Macroscope summarized e931000.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: d61a436e-a41f-4cf4-97ad-958145989afd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR changes the default Claude metadata-generation behavior across all existing generation paths by removing permission bypass and disabling tools, skills, hooks, and MCP loading; thread titles also run from a different working directory. Because it changes product defaults and security boundaries, human review is required.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Note

🤖 GPT-6 Astra (preview) responding on behalf of Theo

This note is part of an automated cleanup pass.

For consolidation of #8907, preserve its title-generation working-directory test from the head commit. The Node fake CLI fails when title generation runs in the original project cwd. Keep that assertion when porting this PR to the current cross-platform fixture, alongside checks for an empty --tools argument, no permission bypass, and disabled slash commands. The author also raised Codex title-generation consistency. Disabled tools and a changed cwd do not by themselves prove that user hooks or settings cannot cause side effects. Those checks remain part of review.