@trops/dash-core 0.1.548 → 0.1.550

package/dist/electron/index.js

@@ -50404,6 +50404,62 @@ function resolveLockdownCwd({ cwd, disableTools = false } = {}) {
   return null;
 }
 
+/**
+ * Resolve the plugin directory the spawned CLI should look in.
+ *
+ * Same shape as resolveLockdownCwd. When in lockdown, point Claude
+ * Code at an empty scratch directory so plugin auto-discovery finds
+ * nothing — sealing the gap left by `--bare` (which strips CLAUDE.md
+ * and auto-memory but NOT user plugins under ~/.claude/plugins/).
+ * The Skill tool gets loaded from those plugins, which is how it
+ * survived the slice 17f flag set.
+ *
+ * Sibling of the scratch cwd dir — DIFFERENT name so plugin discovery
+ * doesn't pick up the cwd itself.
+ *
+ * @param {object}  opts
+ * @param {string=} opts.pluginDir
+ * @param {boolean=} opts.disableTools
+ * @returns {string|null}
+ */
+function resolveLockdownPluginDir({ pluginDir, disableTools = false } = {}) {
+  if (pluginDir) return pluginDir;
+  if (disableTools) {
+    const os = require$$2$1;
+    const path = require$$1$1;
+    return path.join(os.tmpdir(), "dash-widget-builder-cli-plugins");
+  }
+  return null;
+}
+
+/**
+ * Canonical denylist for the lockdown — every built-in tool name we
+ * know about, comma-separated (no whitespace) so the single arg is
+ * Windows-shell-safe. Adding a new built-in upstream means appending
+ * its name here; the flag is belt-and-suspenders alongside `--tools ""`,
+ * but it's the only layer that actually keeps the Skill tool from
+ * being callable when a user has plugins installed in
+ * ~/.claude/plugins/.
+ */
+const LOCKDOWN_DISALLOWED_TOOLS = [
+  "Skill",
+  "Bash",
+  "BashOutput",
+  "Read",
+  "Edit",
+  "Write",
+  "Glob",
+  "Grep",
+  "WebFetch",
+  "WebSearch",
+  "NotebookRead",
+  "NotebookEdit",
+  "Task",
+  "TodoWrite",
+  "KillBash",
+  "SlashCommand",
+].join(",");
+
 /**
  * Build the argv array for spawning the Claude Code CLI.
  *
@@ -50450,6 +50506,31 @@ function buildClaudeCliArgs({
     // Write — every built-in tool the AI might otherwise invoke from
     // inside the modal where only text + code-block output is wanted.
     args.push("--tools", "");
+
+    // `--tools ""` alone leaks ambient context: in 2.1.138 we saw the
+    // AI mention `mcp__dash__*` tool names by name, and the Skill
+    // tool kept firing despite the empty allowlist. The leak comes
+    // from outside cwd — global ~/.claude/CLAUDE.md, project memory
+    // under ~/.claude/projects/<key>/memory/, and user-installed
+    // skills. `--bare` is documented as "skip hooks, LSP, plugin
+    // sync, attribution, auto-memory, background prefetches, keychain
+    // reads, and CLAUDE.md auto-discovery." Combined with
+    // `--strict-mcp-config` (which suppresses every MCP server we
+    // don't explicitly pass via --mcp-config), the spawned CLI gets
+    // exactly our --system-prompt and nothing else.
+    args.push("--bare");
+    args.push("--strict-mcp-config");
+
+    // `--bare` strips CLAUDE.md and auto-memory but NOT user plugins
+    // (under ~/.claude/plugins/). The Skill TOOL gets loaded from
+    // those plugins, which is why it kept firing despite slices 17e
+    // and 17f. Two layers seal it:
+    //   1. --disallowed-tools denies every known built-in by name
+    //      (comma-separated, no whitespace, Windows-shell-safe).
+    //   2. --plugin-dir points at an empty scratch dir under
+    //      os.tmpdir() so plugin auto-discovery finds nothing.
+    args.push("--disallowed-tools", LOCKDOWN_DISALLOWED_TOOLS);
+    args.push("--plugin-dir", resolveLockdownPluginDir({ disableTools: true }));
   }
 
   if (model) {
@@ -50663,6 +50744,18 @@ const cliController$2 = {
         }
         spawnOpts.cwd = resolvedCwd;
       }
+      // The --plugin-dir argv we built above points at a scratch
+      // directory; create it on first run so the CLI doesn't error
+      // out trying to read a missing path.
+      if (disableTools) {
+        const fs = require("fs");
+        const lockdownPluginDir = resolveLockdownPluginDir({
+          disableTools: true,
+        });
+        if (lockdownPluginDir && !fs.existsSync(lockdownPluginDir)) {
+          fs.mkdirSync(lockdownPluginDir, { recursive: true });
+        }
+      }
       const spawnCmd = IS_WINDOWS ? windowsQuote(binaryPath) : binaryPath;
       const spawnArgs = IS_WINDOWS ? args.map(windowsQuote) : args;
       const child = spawn(spawnCmd, spawnArgs, spawnOpts);
@@ -50984,6 +51077,8 @@ const cliController$2 = {
 cliController$3.exports = cliController$2;
 cliController$3.exports.buildClaudeCliArgs = buildClaudeCliArgs;
 cliController$3.exports.resolveLockdownCwd = resolveLockdownCwd;
+cliController$3.exports.resolveLockdownPluginDir = resolveLockdownPluginDir;
+cliController$3.exports.LOCKDOWN_DISALLOWED_TOOLS = LOCKDOWN_DISALLOWED_TOOLS;
 
 var cliControllerExports = cliController$3.exports;