* unsloth start: keep the local subagent unattended and out of plan mode
The local subagent child could stall waiting on a permission prompt, and a
parent session in plan mode could still reach the editing agent.
- Drop human-blocking tools from the child so it runs unattended. The
read-only child also drops the file writers.
- Emit a PreToolUse hook that reads permission_mode itself and denies the
editing agent under plan mode, so routing holds when the model ignores
SKILL.md. Fails open, and is skipped under the WSL bridge where a Windows
interpreter path is not runnable in the distro.
* Make the read-only subagent actually read-only, and drop stale WSL gates
From the first review of this branch, which drove the real code against a fake
HOME holding a pre-existing Claude install and diffed the tree before and after.
No config, agent, MCP server or CLAUDE.md of the user's was touched in either
arm, and the session dir is removed on exit, Ctrl-C and exception.
Three real findings came out of it:
- The read-only child could still write. Plan mode routes Bash through a safety
classifier served by the same local model, so a small model saying yes is what
authorised the write; a child spawned with read_only created a file. Denying
Bash there makes the label true, at the cost of shell exploration while
planning. Read, Grep and Glob still cover the search it needs.
- A persisted plugin dir kept a plan_gate.py from an earlier Windows run, so a
later WSL run shipped a hooks.json naming an interpreter the distro cannot
execute. Hook errors do not block, so this only ever wasted a spawn, but it
accumulated and the branch had no test.
- The comment claimed the read-only child keeps ExitPlanMode "as Claude does
under plan mode". A --print child is never offered the plan or prompt tools at
all, so most of both deny lists is inert today. Kept as a guard against a
version that starts offering them, but the comment now says so.
Also covers "auto" in the gate's non-plan modes, which is a real permission_mode
and the one the child's own Bash classifier runs under.
* Stop the gate failing closed, and bound a wedged child
Second review of this branch, driving real claude 2.1.219 against a mock
endpoint rather than reading.
The gate could fail closed. If plan_gate.py went missing the interpreter exited
2, which Claude treats as a blocking hook error, so the editing tool was denied
in every mode rather than just plan. Running the script through runpy instead of
handing its path to the interpreter turns that into an ordinary traceback, which
is exit 1 and allows. Verified both exit codes directly.
The hook also had no timeout, so a hung one stalled the parent for as long as it
hung, measured past 400s. Bounded at 10s.
The real stall this branch is named for was untouched: run_local_agent polled
communicate() forever, so a local server that accepts and never answers left the
child and the parent blocked indefinitely, measured past 400s. Added a wall-clock
deadline that kills the child and says the server looks wedged.
UNSLOTH_CLAUDE_SUBAGENT_TIMEOUT overrides it, 0 restores the old behaviour.
Also corrected the plan-mode comment. Claude already refuses the editing tool in
plan mode on its own, since it advertises readOnlyHint false; what the hook adds
is a reason naming the read-only tool to call instead. The WSL comment had the
direction backwards: the gate is the Linux path, not the Windows one.
Tests: the hook command's quoting and its behaviour with the gate deleted, both
previously unguarded, plus the timeout and its env override.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* Keep the gate path out of the shell string
Codex review. The hook command is run by a shell, and the gate path was
interpolated into it, so a session-config root containing shell metacharacters
expanded before Python saw it. Verified on both: sh expands $(..), backticks and
$VAR; cmd expands %VAR%. In every case the path no longer resolves, the gate
exits 1, and because that intentionally fails open the routing message silently
stops appearing.
The path now travels as base64, whose alphabet has no metacharacter in either
shell. Parametrised over all four hostile forms, and the old interpolation makes
those tests fail.
One correction to the report: it says the editing agent becomes callable in plan
mode. It does not. Claude refuses that tool by itself, since it advertises
readOnlyHint false, which was checked earlier by deleting the hook entirely.
What a mangled path costs is the reason naming the read-only agent to call
instead, not the block.
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Lee Jackson <130007945+Imagineer99@users.noreply.github.com>
7a9749eb4f