[codex] disable tools for Claude text generation

[maxwellyoung]

Fixes #3594.

What Changed

• remove --dangerously-skip-permissions from Claude CLI text-generation subprocesses
• start background structured generation with an explicit empty tool set and slash commands disabled
• add regression coverage that preserves the empty --tools argument and rejects the permission-bypass flag

Why

Claude-backed title and branch generation receives the first user message. When that message is a skill invocation such as /call-script, the background claude -p process could resolve and execute the skill with full tool access while the actual conversation executed it separately.

Title, branch, commit, and PR metadata generation only need structured model output. They all share the same spawn path, so removing executable capabilities there makes the entire background text-generation boundary side-effect free without changing normal Claude conversation behavior.

UI Changes

None. This is a server-side subprocess capability restriction.

Verification

• vp check (passes with 10 existing warnings outside this diff)
• vp run typecheck
• ClaudeTextGeneration.test.ts: 5 passed
• resource-capped vp test --maxWorkers=4: 608 files and 4,823 tests passed; 2 files and 7 tests skipped by the existing suite
• git diff --check

Checklist

• This PR is small and focused
• I explained what changed and why
• Screenshots are not applicable because there is no UI change
• Video is not applicable because there is no animation or interaction change

---

Note

Medium Risk
Narrows subprocess capabilities on a security-sensitive boundary (background Claude CLI) but is a focused spawn-arg change with regression tests and no UI impact.

Overview
Locks down background Claude claude -p subprocesses used for structured metadata (titles, branches, commits, PR text) so they cannot run skills or tools.

The spawn args drop --dangerously-skip-permissions and add an explicit empty --tools value plus --disable-slash-commands, so a first user message like /call-script cannot be executed again with full capabilities while the main conversation runs it separately.

Tests extend the fake Claude harness to assert per-argument argv (including the empty --tools token) and add a thread-title regression that requires those flags and forbids the permission-bypass flag.

^{Reviewed by Cursor Bugbot for commit 42a6417. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Disable tools for Claude CLI structured text generation calls

Replaces --dangerously-skip-permissions with --tools '' and --disable-slash-commands when spawning the Claude CLI for structured JSON generation (e.g. thread title generation), ensuring background generation calls do not inherit executable skills or tools.

Test coverage is extended in ClaudeTextGeneration.test.ts to assert the new flags are present and --dangerously-skip-permissions is absent from the spawned argv.

^{Macroscope summarized 42a6417.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: d61a436e-a41f-4cf4-97ad-958145989afd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR changes the security/permission model for Claude CLI invocation, replacing --dangerously-skip-permissions with explicit tool disabling. Security-sensitive changes affecting capability controls warrant human review regardless of intent.

^{You can customize Macroscope's approvability policy. Learn more.}