debugging: probe disallowed-tools MCP pattern and large-heap converter #7593

Activity

1. kyle-sexton

   added

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 16, 2026
2. kyle-sexton

   added the

   Task

   issue type on Oct 16, 2026
3. kyle-sexton

   added a parent issue on Oct 16, 2026

   • testing: one named tool per job for browser and profiling #7580
4. kyle-sexton

   set

   Work status

   to

   needs-spec

   on Oct 16, 2026
5. github-actions commented on Oct 16, 2026

   

   github-actionsBot

   on Oct 16, 2026 – with GitHub Actions

   Contributor

   More actions

   Thanks for the report. Automated triage handed this issue to a maintainer.

   Proposed work class: work-class: read-only
   Basis: automated intake triage; a maintainer confirms or changes it.

   _{Automated triage. A maintainer reviews it.}
6. kyle-sexton

   added

   needs-specNeeds a Brief or plan before anyone can build it.Needs a Brief or plan before anyone can build it.

   on Oct 16, 2026
7. kyle-sexton commented on Oct 16, 2026

   

   kyle-sexton

   on Oct 16, 2026

   MemberAuthor

   More actions

   Probe result: a skill's disallowed-tools entry naming an MCP server-wide pattern removes that server's tools. A tool from another server stays allowed.

   • Claude Code 2.1.301, 2026-10-16, headless claude -p --plugin-dir <throwaway plugin> --output-format stream-json --verbose --model sonnet.
   • Docs read: Skills: frontmatter reference says disallowed-tools removes the listed tools from Claude's pool while the skill is active, and the restriction clears on the next message. Permissions: MCP says mcp__<server> and mcp__<server>__* both match every tool from that server. The skills page does not say that disallowed-tools accepts this rule syntax. This probe checks that.
   • Server under test: context7, which is user-scoped and showed connected in every run. Control tool: mcp__ref__ref_search_documentation.
   • All three runs passed the same --allowedTools covering both tools and ToolSearch. Each prompt asked for one mcp__context7__resolve-library-id call and one ref call.

   Run	Skill disallowed-tools	context7 tools in init tool list	context7 call	ref call (control)
   Baseline (no skill)	none	both present	ran, returned results	ran
   block-star	mcp__context7__*	none	not attempted: ToolSearch select: returned only the ref tool	ran
   block-bare	mcp__context7	none	denied: <tool_use_error>Error: No such tool available: mcp__context7__resolve-library-id</tool_use_error>	ran

   permission_denials was empty in every run. The tools were removed from the pool, so no permission rule was involved. The model was told the context7 server had "disconnected", but the init event still showed the server connected.

   Caveat: stream-json does not echo the slash-command expansion. The evidence that the skill took effect is the difference between runs: the only change from the baseline is the /probe7593:block-* prefix, and only those runs lose the context7 tools.

   Probe artifacts stay untracked under .work/poteto-review/probes/7593/: the plugin, the three run-*.jsonl streams and summarize.jq. git status --porcelain plugins/ is empty.
8. kyle-sexton commented on Oct 16, 2026

   

   kyle-sexton

   on Oct 16, 2026

   MemberAuthor

   More actions

   Probe result: analyze-profile's trace_to_sqlite.py converted a 510.9 MiB heap snapshot (cap: 512 MiB) in 59 s wall time with a peak RSS of 3.73 GiB.

   • Date: 2026-10-16. Host: WSL2 Linux, 24 CPUs, 39 GiB RAM, Python 3.14.8, Node v24.21.0.

   • Input: a V8 .heapsnapshot written by v8.writeHeapSnapshot() after allocating 2,000,000 linked objects. Size: 535,749,748 bytes (510.9 MiB). The converter's MAX_INPUT_BYTES is 536,870,912.

   • Command, with paths relative to the repo root:

     /usr/bin/time -v python3 plugins/debugging/skills/analyze-profile/scripts/trace_to_sqlite.py \
       --in .work/poteto-review/probes/7593/big.heapsnapshot \
       --out .work/poteto-review/probes/7593/big.sqlite

   • Result: exit 0, {"format": "heapsnapshot", "tables": {"nodes": 8057330, "edges": 22246947, ...}}. The SQLite output was 1,292,222,464 bytes (1.2 GiB).

   • /usr/bin/time -v: elapsed 0:59.10, user 54.10 s, system 4.69 s, maximum resident set size 3,911,012 kB (3.73 GiB, about 7.3x the input size).

   The peak memory comes from read_json, which reads the whole file into memory and then calls json.loads, so the full Python object graph is in memory at once. A CI runner needs about 4 GiB free for a heap at the cap.

   The heap and SQLite files were deleted after the run. git status --porcelain plugins/ is empty.
9. kyle-sexton

   closed this as completedon Oct 16, 2026