Skip to content

feat(engines): claude ships settings defaults — ultracode on, small workflows, 4 agents at once - #500

Merged
ralyodio merged 1 commit into
mainfrom
worktree-claude-engine-defaults
Sep 13, 2026
Merged

ralyodio merged 1 commit into
mainfrom
worktree-claude-engine-defaults

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

What

An engine can now say how it would like to be configured. ENGINES.claude.settings.defaults carries three Claude Code settings, and moshcode merges them into ~/.claude/settings.json:

key value what it does
ultracode true every substantive prompt runs as a workflow of agents
workflowSizeGuideline "small" Claude's own advisory tier, fewer than 5 agents per workflow
env.CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS "4" the hard gate on how many run at once
  • moshcode install claude applies them after a successful install (silent when nothing changes).
  • moshcode engines defaults [status|apply|remove] [<engine>|all] [--dry-run] [--json] does it by hand, from the CLI and the pit.

Rules

Same three as herd hooks, because it is the same file:

  • Merge, never clobber. Apply only fills a hole. A key the operator set, even to the opposite value, stays; status reports it as "theirs", not a fault. A floor under a fresh install, not a policy over an old one.
  • Remove only what is still ours. A value changed since is theirs and stays. An env object we created goes when it is empty; one with sibling vars stays.
  • Refuse a file that does not parse. Overwriting it would take every hook, MCP server and preference with it.

Also

  • herd-hooks.mjs exports readJsonFile / writeJsonFile / existingMode so both installers share one write-then-rename path.
  • README: new section under the herd, and the command table regenerated from the schema.
  • test/engine-settings.test.mjs: 20 tests covering the spec values, merge, status, remove, and the verb.

Verified

  • node --test: 2929 tests, 0 failures (340 environment-gated skips).
  • Live: moshcode engines defaults reads the real settings file and reports all three in place; apply --dry-run reports nothing would change.

🤖 Generated with Claude Code

https://claude.ai/code/session_014HMV1QDcVY1xiaWWrZQM4S

…orkflows, 4 agents at once

An engine's `settings` spec in engines.mjs names the file it reads and the
keys moshcode wants in it. `moshcode install <engine>` applies them and
`moshcode engines defaults [status|apply|remove] [<engine>|all]` does it by
hand. Claude Code's are `ultracode: true` (every substantive prompt runs as a
workflow), `workflowSizeGuideline: "small"` (Claude's own advisory tier, fewer
than 5 agents) and `env.CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS: "4"` (the
hard gate on how many run at once).

Same three rules as the hooks installer, because it is the same file: merge
and never clobber (a key the operator set stays, even to the opposite value —
status reports it as "theirs", not a fault), remove only a value that is still
ours, refuse a file that does not parse. Nested defaults merge one leaf at a
time so sibling env vars are untouched.

herd-hooks.mjs exports its read/write/mode helpers so both installers share
one write-then-rename path. README carries the section and the regenerated
command table.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014HMV1QDcVY1xiaWWrZQM4S
Comment thread src/cli-schema.mjs
],
seeAlso: ["agents", "install"],
note: "`moshcode install <engine>` applies its defaults for you. the file is merged, never clobbered: "
+ "a key you already set — to anything — stays yours, and remove takes out only a value that is still ours.",
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

4 finding(s) in the 8 file(s) this pull request changes.

MEDIUM: 4

Severity Rule Location
MEDIUM sql-string-concatenation src/cli-schema.mjs:163
MEDIUM sql-string-concatenation src/cli-schema.mjs:535
MEDIUM sql-string-concatenation src/cli-schema.mjs:568
MEDIUM sql-string-concatenation src/cli-schema.mjs:675
89 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 71 | **LOW**: 10

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:202
HIGH sh-remote-script-execution install.sh:213
HIGH sh-remote-script-execution install.sh:219
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:974
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1044

…and 69 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio marked this pull request as ready for review September 13, 2026 05:14
@ralyodio
ralyodio merged commit 89e3890 into main Sep 13, 2026
6 checks passed
@ralyodio
ralyodio deleted the worktree-claude-engine-defaults branch September 13, 2026 05:14
@ralyodio ralyodio mentioned this pull request Sep 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants