Skip to content

fix(engines): claude defaults ship ultracode OFF and the keyword trigger off - #509

Merged
ralyodio merged 1 commit into
mainfrom
fix/ultracode-off-by-default
Sep 13, 2026
Merged

ralyodio merged 1 commit into
mainfrom
fix/ultracode-off-by-default

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

What

The claude engine's settings floor (moshcode install claude / moshcode engines defaults apply claude) now writes four values instead of three:

key before after
ultracode true false
workflowKeywordTriggerEnabled not set (Claude defaults it on) false
workflowSizeGuideline "small" "small"
env.CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS "4" "4"

Why

Ultracode on by default turned a herd of Fable sessions into a bill by the hour. With both the setting and the keyword trigger off, a workflow runs only when the operator asks for one in so many words; the word "ultracode" appearing in a prompt (including a prompt complaining about it) no longer flips that turn into a workflow. The two caps stay for the workflows that are asked for.

apply still only fills keys that are absent, so a box that already has ultracode: true keeps it until the file is edited by hand.

Tests

test/engine-settings.test.mjs: fixtures that meant "the operator overrode the default" now set ultracode: true (since false is the default they would otherwise read as unchanged), and the three-to-four counts are updated. 20/20 in the file. The full suite has the same 143 pre-existing failures as main (aliases, autosync, mirror-shell-capture, settings-sync, settings-sync-allowlist, tui), none in this area.

🤖 Generated with Claude Code

https://claude.ai/code/session_0138dZBCdJW73LJjT7kuZf8L

…ger off

Ultracode on by default turned a herd of sessions into a bill by the hour,
so the claude engine's settings floor now carries four values instead of
three: `ultracode: false`, `workflowKeywordTriggerEnabled: false` (the word
"ultracode" anywhere in a prompt no longer flips that turn into a workflow),
and the two caps as before (`workflowSizeGuideline: small`, four agents at
once). A workflow runs only when the operator asks for one in so many words.

`apply` still only fills keys that are absent, so a box that already has
`ultracode: true` keeps it until the file is edited. Tests updated: fixtures
that meant "the operator overrode the default" now set `ultracode: true`,
and the counts go from three defaults to four.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0138dZBCdJW73LJjT7kuZf8L
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

4 finding(s) in the 4 file(s) this pull request changes.

MEDIUM: 4

Severity Rule Location
MEDIUM sql-string-concatenation src/cli-schema.mjs:189
MEDIUM sql-string-concatenation src/cli-schema.mjs:561
MEDIUM sql-string-concatenation src/cli-schema.mjs:594
MEDIUM sql-string-concatenation src/cli-schema.mjs:701
89 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 71 | **LOW**: 10

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:258
HIGH sh-remote-script-execution install.sh:269
HIGH sh-remote-script-execution install.sh:275
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:974
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1044

…and 69 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 0384950 into main Sep 13, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant