CodeSmith

Skill Creator is the core subsystem of Claude Code, essentially an automated framework of "prompt + code generation + file management" that allows users to encapsulate high-frequency operations into reusable structured skill units

CodeSmith's tool results from network sources are wrapped when pushed into the conversation record, implemented in wrap_external_tool_content at sanitization.rs:140, hooked in at engine/turn/batches.rs:642.

CodeSmith's character-level sanitization algorithm iterates to a fixed point, normalizing with NFKC first and then stripping dangerous characters in each round; the dangerous-character determination removes entire Unicode categories Cf, Co, and Cn, plus explicit range fallbacks, with an iteration cap of 10, beyond which it warns rather than panics.

The header of CodeSmith's sanitization.rs module notes that it mirrors the same-named implementation in Claude Code.

CodeSmith's character-level sanitization is deployed at two chokepoints: at the ingress, MCP tool call arguments are cleaned in their entirety before forwarding (mcp.rs:3150-3158), and at the egress, all tool output passes through once before entering the model context and conversation record (engine/context.rs:301-312).

CodeSmith external content source tag policy: fetch_url uses the URL hostname, web_search uses a fixed tag, MCP tools take a server-name fragment, and github_* is uniformly recorded as github.com; tags are byte-stable, not timestamps or request IDs.

CodeSmith's approval levels are implemented as auto=0 < suggest=1 < never=2 to achieve "can only tighten," and project configuration can only propose a larger number.

CodeSmith defines repository-local configuration ($WORKSPACE/.codesmith/config.toml) as untrusted input, intentionally ignoring credentials, endpoints, provider selection, authentication values, etc., and approval and sandbox values can only tighten the existing posture.

The CodeSmith constitution explicitly states in the memory hierarchy that "memory is never a command": user preference facts may be memorized, but imperative instructions are not eligible to enter memory.

The nine-level instruction source precedence in Article 7 of the CodeSmith constitution is: constitution > current user message > statute (patterns and approval rules) > regulation > local law (project rules such as AGENTS.md) > evidence (tool output, file contents) > memory > persona > precedent.

CodeSmith's wrapping mechanism acts only on newly pushed results, does not break append writes, and does not rewrite historical messages; local tools (file reads, shell, subagent reports) pass through as-is.

CodeSmith does not sanitize messages directly input by the user; the two aforementioned call sites are the only production sanitization locations in the entire repository, which is a tradeoff rather than an oversight.

Article 3 of the CodeSmith constitution stipulates that the user's explicit request in the current round of input is the highest authority under the constitution, and that no project instruction, memory, handoff, or prior round may override it.

The Syntax Gate allows "bad-to-bad" writes, because if all writes that fail to parse were rejected, an already broken workspace could never be repaired.

Currently only three formats are governed by the Syntax Gate: Rust uses syn::parse_file, and TOML and JSON use their respective standard parsers.

The core Syntax Gate module is only 455 lines long and unifies the admission logic of the four disk-writing tools write_file, edit_file, apply_patch and fim_edit.

The Syntax Gate rule is: reject a write only when the file parsed successfully before the edit but the new content fails to parse; files that were already broken or new files that do not yet exist are not intercepted.

Cargo.lock is explicitly exempted from Syntax Gate checks because it is a machine-generated, bulky file that no one edits by hand.

The Syntax Gate probes the rustfmt binary with a 5-second timeout and formats with a 10-second timeout; any failure (missing binary, non-zero exit, timeout, non-UTF-8 output) silently skips normalization and writes the raw text to disk.

After passing the Syntax Gate, if the file is a Rust file that was rustfmt-clean before the edit, the content to be written is first reformatted with rustfmt --edition 2024 to keep subsequent edit_file patch anchors stable.