From 49ec57a2265bf197217ed15db7b5a89db763b629 Mon Sep 17 00:00:00 2001
From: Askhz <1361267452@qq.com>
Date: Fri, 10 Apr 2026 14:50:27 +0800
Subject: [PATCH] feat(cli): disable nonessential traffic and remote settings
 by default

---
 src/commands/login/login.tsx             | 2 +-
 src/components/LogoV2/LogoV2.tsx         | 6 ++++++
 src/costrict/skill/codeReviewSecurity.ts | 2 +-
 src/entrypoints/cli.tsx                  | 6 ++++++
 src/main.tsx                             | 4 ++--
 5 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/commands/login/login.tsx b/src/commands/login/login.tsx
index b4329fe62..d81ed2d24 100644
--- a/src/commands/login/login.tsx
+++ b/src/commands/login/login.tsx
@@ -40,7 +40,7 @@ export async function call(
           // Reset cost state when switching accounts
           resetCostState()
           // Refresh remotely managed settings after login (non-blocking)
-          void refreshRemoteManagedSettings()
+          // void refreshRemoteManagedSettings()
           // Refresh policy limits after login (non-blocking)
           void refreshPolicyLimits()
           // Clear user data cache BEFORE GrowthBook refresh so it picks up fresh credentials
diff --git a/src/components/LogoV2/LogoV2.tsx b/src/components/LogoV2/LogoV2.tsx
index 7ae609bed..2c998a224 100644
--- a/src/components/LogoV2/LogoV2.tsx
+++ b/src/components/LogoV2/LogoV2.tsx
@@ -150,7 +150,9 @@ export function LogoV2(): React.ReactNode {
       <>
         <CondensedLogo />
         <VoiceModeNotice />
+        {/* NOTE: Opus 1M merge notice disabled
         <Opus1mMergeNotice />
+        */}
         {ChannelsNoticeModule && <ChannelsNoticeModule.ChannelsNotice />}
         {isDebugMode() && (
           <Box paddingLeft={2} flexDirection="column">
@@ -251,7 +253,9 @@ export function LogoV2(): React.ReactNode {
           </Box>
         </OffscreenFreeze>
         <VoiceModeNotice />
+        {/* NOTE: Opus 1M merge notice disabled
         <Opus1mMergeNotice />
+        */}
         {ChannelsNoticeModule && <ChannelsNoticeModule.ChannelsNotice />}
         {showSandboxStatus && (
           <Box marginTop={1} flexDirection="column">
@@ -350,7 +354,9 @@ export function LogoV2(): React.ReactNode {
         </Box>
       </OffscreenFreeze>
       <VoiceModeNotice />
+      {/* NOTE: Opus 1M merge notice disabled
       <Opus1mMergeNotice />
+      */}
       {ChannelsNoticeModule && <ChannelsNoticeModule.ChannelsNotice />}
       {isDebugMode() && (
         <Box paddingLeft={2} flexDirection="column">
diff --git a/src/costrict/skill/codeReviewSecurity.ts b/src/costrict/skill/codeReviewSecurity.ts
index 819b43bcd..6a569f77f 100644
--- a/src/costrict/skill/codeReviewSecurity.ts
+++ b/src/costrict/skill/codeReviewSecurity.ts
@@ -6,7 +6,7 @@ export function registerCodeReviewSecuritySkill(): void {
   const skillMd = files['SKILL.md'] ?? ''
 
   registerBundledSkill({
-    name: 'code-review-security',
+    name: 'strict-security-review',
     description: 'Systematic code security audit — identifies vulnerabilities like SQL injection, XSS, command injection, SSRF, etc.',
     whenToUse:
       'Use when the user requests a code audit, security audit, or vulnerability scan; or mentions /code-review-security, /audit, or wants a security check before deployment',
diff --git a/src/entrypoints/cli.tsx b/src/entrypoints/cli.tsx
index 55f6f5b80..23ccea918 100644
--- a/src/entrypoints/cli.tsx
+++ b/src/entrypoints/cli.tsx
@@ -15,6 +15,12 @@ if (typeof globalThis.MACRO === 'undefined') {
   }
 }
 
+// Default to disabling nonessential traffic to api.anthropic.com
+// (telemetry, GrowthBook, metrics, MCP registry, etc.)
+// Users can opt back in by setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=0
+// eslint-disable-next-line custom-rules/no-top-level-side-effects, custom-rules/no-process-env-top-level
+process.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC ??= '1'
+
 // Bugfix for corepack auto-pinning, which adds yarnpkg to peoples' package.jsons
 // eslint-disable-next-line custom-rules/no-top-level-side-effects
 process.env.COREPACK_ENABLE_AUTO_PIN = '0'
diff --git a/src/main.tsx b/src/main.tsx
index 9a107f8df..8e937f2ad 100644
--- a/src/main.tsx
+++ b/src/main.tsx
@@ -1324,7 +1324,7 @@ async function run(): Promise<CommanderCommand> {
 		// Fails open - if fetch fails, continues without remote settings
 		// Settings are applied via hot-reload when they arrive
 		// Must happen after init() to ensure config reading is allowed
-		void loadRemoteManagedSettings();
+		// void loadRemoteManagedSettings();
 		void loadPolicyLimits();
 
 		profileCheckpoint("preAction_after_remote_settings");
@@ -3451,7 +3451,7 @@ async function run(): Promise<CommanderCommand> {
 				if (onboardingShown) {
 					// Refresh auth-dependent services now that the user has logged in during onboarding.
 					// Keep in sync with the post-login logic in src/commands/login.tsx
-					void refreshRemoteManagedSettings();
+					// void refreshRemoteManagedSettings();
 					void refreshPolicyLimits();
 					// Clear user data cache BEFORE GrowthBook refresh so it picks up fresh credentials
 					resetUserCache();