feat(cli): disable nonessential traffic and remote settings by default

src/commands/login/login.tsx

@@ -40,7 +40,7 @@ export async function call(
           // Reset cost state when switching accounts
           resetCostState()
           // Refresh remotely managed settings after login (non-blocking)
-          void refreshRemoteManagedSettings()
+          // void refreshRemoteManagedSettings()
           // Refresh policy limits after login (non-blocking)
           void refreshPolicyLimits()
           // Clear user data cache BEFORE GrowthBook refresh so it picks up fresh credentials

src/components/LogoV2/LogoV2.tsx

@@ -150,7 +150,9 @@ export function LogoV2(): React.ReactNode {
       <>
         <CondensedLogo />
         <VoiceModeNotice />
+        {/* NOTE: Opus 1M merge notice disabled
         <Opus1mMergeNotice />
+        */}
         {ChannelsNoticeModule && <ChannelsNoticeModule.ChannelsNotice />}
         {isDebugMode() && (
           <Box paddingLeft={2} flexDirection="column">
@@ -251,7 +253,9 @@ export function LogoV2(): React.ReactNode {
           </Box>
         </OffscreenFreeze>
         <VoiceModeNotice />
+        {/* NOTE: Opus 1M merge notice disabled
         <Opus1mMergeNotice />
+        */}
         {ChannelsNoticeModule && <ChannelsNoticeModule.ChannelsNotice />}
         {showSandboxStatus && (
           <Box marginTop={1} flexDirection="column">
@@ -350,7 +354,9 @@ export function LogoV2(): React.ReactNode {
         </Box>
       </OffscreenFreeze>
       <VoiceModeNotice />
+      {/* NOTE: Opus 1M merge notice disabled
       <Opus1mMergeNotice />
+      */}
       {ChannelsNoticeModule && <ChannelsNoticeModule.ChannelsNotice />}
       {isDebugMode() && (
         <Box paddingLeft={2} flexDirection="column">

src/costrict/skill/codeReviewSecurity.ts

@@ -6,7 +6,7 @@ export function registerCodeReviewSecuritySkill(): void {
   const skillMd = files['SKILL.md'] ?? ''
 
   registerBundledSkill({
-    name: 'code-review-security',
+    name: 'strict-security-review',
     description: 'Systematic code security audit — identifies vulnerabilities like SQL injection, XSS, command injection, SSRF, etc.',
     whenToUse:
       'Use when the user requests a code audit, security audit, or vulnerability scan; or mentions /code-review-security, /audit, or wants a security check before deployment',

src/entrypoints/cli.tsx

@@ -15,6 +15,12 @@ if (typeof globalThis.MACRO === 'undefined') {
   }
 }
 
+// Default to disabling nonessential traffic to api.anthropic.com
+// (telemetry, GrowthBook, metrics, MCP registry, etc.)
+// Users can opt back in by setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=0
+// eslint-disable-next-line custom-rules/no-top-level-side-effects, custom-rules/no-process-env-top-level
+process.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC ??= '1'
+
 // Bugfix for corepack auto-pinning, which adds yarnpkg to peoples' package.jsons
 // eslint-disable-next-line custom-rules/no-top-level-side-effects
 process.env.COREPACK_ENABLE_AUTO_PIN = '0'

src/main.tsx

@@ -1324,7 +1324,7 @@ async function run(): Promise<CommanderCommand> {
 		// Fails open - if fetch fails, continues without remote settings
 		// Settings are applied via hot-reload when they arrive
 		// Must happen after init() to ensure config reading is allowed
-		void loadRemoteManagedSettings();
+		// void loadRemoteManagedSettings();
 		void loadPolicyLimits();
 
 		profileCheckpoint("preAction_after_remote_settings");
@@ -3451,7 +3451,7 @@ async function run(): Promise<CommanderCommand> {
 				if (onboardingShown) {
 					// Refresh auth-dependent services now that the user has logged in during onboarding.
 					// Keep in sync with the post-login logic in src/commands/login.tsx
-					void refreshRemoteManagedSettings();
+					// void refreshRemoteManagedSettings();
 					void refreshPolicyLimits();
 					// Clear user data cache BEFORE GrowthBook refresh so it picks up fresh credentials
 					resetUserCache();