@trops/dash-core 0.1.549 → 0.1.551

package/dist/electron/index.js

@@ -50404,6 +50404,109 @@ function resolveLockdownCwd({ cwd, disableTools = false } = {}) {
   return null;
 }
 
+/**
+ * Resolve the plugin directory the spawned CLI should look in.
+ *
+ * Same shape as resolveLockdownCwd. When in lockdown, point Claude
+ * Code at an empty scratch directory so plugin auto-discovery finds
+ * nothing — sealing the gap left by `--bare` (which strips CLAUDE.md
+ * and auto-memory but NOT user plugins under ~/.claude/plugins/).
+ * The Skill tool gets loaded from those plugins, which is how it
+ * survived the slice 17f flag set.
+ *
+ * Sibling of the scratch cwd dir — DIFFERENT name so plugin discovery
+ * doesn't pick up the cwd itself.
+ *
+ * @param {object}  opts
+ * @param {string=} opts.pluginDir
+ * @param {boolean=} opts.disableTools
+ * @returns {string|null}
+ */
+function resolveLockdownPluginDir({ pluginDir, disableTools = false } = {}) {
+  if (pluginDir) return pluginDir;
+  if (disableTools) {
+    const os = require$$2$1;
+    const path = require$$1$1;
+    return path.join(os.tmpdir(), "dash-widget-builder-cli-plugins");
+  }
+  return null;
+}
+
+/**
+ * Canonical denylist for the lockdown — every built-in tool name we
+ * know about, comma-separated (no whitespace) so the single arg is
+ * Windows-shell-safe. Adding a new built-in upstream means appending
+ * its name here; the flag is belt-and-suspenders alongside `--tools ""`,
+ * but it's the only layer that actually keeps the Skill tool from
+ * being callable when a user has plugins installed in
+ * ~/.claude/plugins/.
+ */
+const LOCKDOWN_DISALLOWED_TOOLS = [
+  "Skill",
+  "Bash",
+  "BashOutput",
+  "Read",
+  "Edit",
+  "Write",
+  "Glob",
+  "Grep",
+  "WebFetch",
+  "WebSearch",
+  "NotebookRead",
+  "NotebookEdit",
+  "Task",
+  "TodoWrite",
+  "KillBash",
+  "SlashCommand",
+].join(",");
+
+/**
+ * Path to the e2e-only argv capture file. Only written when
+ * `process.env.DASH_E2E === "1"` (set by `e2e/helpers/electron-app.js`
+ * for Playwright runs). Production launches never set it, so no
+ * diagnostic is written on a real user's machine.
+ *
+ * The capture deterministically pins the chain ChatCore → IPC →
+ * cliController. Slice 18a's diagnostic revealed that the chain
+ * silently dropped `replaceSystemPrompt` and `disableTools` for
+ * months. Without an argv assertion, the next break would be
+ * invisible until a user filed a bug. With it, the e2e test
+ * `widget-builder-cli-flow.spec.js` reads this file and asserts the
+ * full lockdown flag set is present — fails immediately if any flag
+ * goes missing.
+ */
+const E2E_LAST_SPAWN_LOG_PATH = (() => {
+  const os = require$$2$1;
+  const path = require$$1$1;
+  return path.join(os.tmpdir(), "dash-cli-last-spawn.e2e.json");
+})();
+
+/**
+ * Slice 18b — gated argv capture. No-op outside e2e mode.
+ *
+ * Captures argv only (NOT env values, NOT env keys — production users
+ * are protected by the env-var gate; we don't need the keys-only
+ * privacy hedge anymore since this never runs for them).
+ */
+function captureLastSpawnArgsForE2E({ args, disableTools = false } = {}) {
+  if (process.env.DASH_E2E !== "1") return;
+  try {
+    const fs = require("fs");
+    const payload = {
+      ts: Date.now(),
+      disableTools: disableTools === true,
+      args: Array.isArray(args) ? args.slice() : [],
+    };
+    fs.writeFileSync(
+      E2E_LAST_SPAWN_LOG_PATH,
+      JSON.stringify(payload, null, 2),
+      { encoding: "utf8" },
+    );
+  } catch (_e) {
+    // Capture must NEVER break the spawn.
+  }
+}
+
 /**
  * Build the argv array for spawning the Claude Code CLI.
  *
@@ -50464,6 +50567,17 @@ function buildClaudeCliArgs({
     // exactly our --system-prompt and nothing else.
     args.push("--bare");
     args.push("--strict-mcp-config");
+
+    // `--bare` strips CLAUDE.md and auto-memory but NOT user plugins
+    // (under ~/.claude/plugins/). The Skill TOOL gets loaded from
+    // those plugins, which is why it kept firing despite slices 17e
+    // and 17f. Two layers seal it:
+    //   1. --disallowed-tools denies every known built-in by name
+    //      (comma-separated, no whitespace, Windows-shell-safe).
+    //   2. --plugin-dir points at an empty scratch dir under
+    //      os.tmpdir() so plugin auto-discovery finds nothing.
+    args.push("--disallowed-tools", LOCKDOWN_DISALLOWED_TOOLS);
+    args.push("--plugin-dir", resolveLockdownPluginDir({ disableTools: true }));
   }
 
   if (model) {
@@ -50677,8 +50791,22 @@ const cliController$2 = {
         }
         spawnOpts.cwd = resolvedCwd;
       }
+      // The --plugin-dir argv we built above points at a scratch
+      // directory; create it on first run so the CLI doesn't error
+      // out trying to read a missing path.
+      if (disableTools) {
+        const fs = require("fs");
+        const lockdownPluginDir = resolveLockdownPluginDir({
+          disableTools: true,
+        });
+        if (lockdownPluginDir && !fs.existsSync(lockdownPluginDir)) {
+          fs.mkdirSync(lockdownPluginDir, { recursive: true });
+        }
+      }
       const spawnCmd = IS_WINDOWS ? windowsQuote(binaryPath) : binaryPath;
       const spawnArgs = IS_WINDOWS ? args.map(windowsQuote) : args;
+      // No-op outside e2e mode (gated on process.env.DASH_E2E === "1").
+      captureLastSpawnArgsForE2E({ args, disableTools });
       const child = spawn(spawnCmd, spawnArgs, spawnOpts);
 
       activeProcesses.set(requestId, child);
@@ -50998,6 +51126,9 @@ const cliController$2 = {
 cliController$3.exports = cliController$2;
 cliController$3.exports.buildClaudeCliArgs = buildClaudeCliArgs;
 cliController$3.exports.resolveLockdownCwd = resolveLockdownCwd;
+cliController$3.exports.resolveLockdownPluginDir = resolveLockdownPluginDir;
+cliController$3.exports.LOCKDOWN_DISALLOWED_TOOLS = LOCKDOWN_DISALLOWED_TOOLS;
+cliController$3.exports.E2E_LAST_SPAWN_LOG_PATH = E2E_LAST_SPAWN_LOG_PATH;
 
 var cliControllerExports = cliController$3.exports;