[BUG] --safe-mode and --disable-slash-commands do not remove skill/agent attachments from the actual API request

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Related to: #60251 (closed/locked, but the underlying issue persists as of Claude Code 2.1.261/2.1.263)

Both --safe-mode and --disable-slash-commands are documented to disable skills (safe-mode's help text explicitly lists "skills" among customizations disabled). In practice, neither flag removes the skill_listing or agent_listing_delta attachments from the actual request sent to the model.

Additional finding beyond #60251: the same bug also affects --safe-mode, which documents itself as disabling "skills" among other customizations, but likewise leaves the skill_listing attachment fully present in the request (confirmed via direct JSONL inspection — attachment content and size unchanged, input_tokens nearly identical to an unflagged baseline).

### What Should Happen?

These flags should remove the skill/agent attachment payload from the request, consistent with their documented behavior.

### Error Messages/Logs

```shell
See attached logs in addition information.

Only a log line (Sending N skills via attachment) is suppressed under --disable-slash-commands; the underlying attachment is unaffected under either flag.
Note: --bare does successfully remove both attachments, but as an undocumented side effect, it also disables all Agent-tool delegation (/plan, Explore, general-purpose subagents all fail/no-op) — which is a separate, larger scope than --safe-mode's stated behavior.
```

### Steps to Reproduce

The attached settings.json file goes in ~/.claude folder. export ANTHROPIC_BASE_URL=http://localhost:11434. MacBook Air 2025 32GB. Used with glm-4.7-flash in ollama version 0.33.3

[test_all_flags.sh](https://github.com/user-attachments/files/31878045/test_all_flags.sh)
[settings.json](https://github.com/user-attachments/files/31877828/settings.json)
Run this in command line or test_all_flags.sh:
cat > ~/claude-minimal-test/test_all_flags.sh << 'SCRIPT'
#!/bin/bash
LOGDIR=~/claude-minimal-test/flag_test_logs_$(date +%Y%m%d_%H%M%S)
mkdir -p "$LOGDIR"
echo "Output: $LOGDIR"

run_test() {
local name="$1"
shift
echo "=== Running: $name ===" >&2
echo "Say exactly: Hello World" | claude "$@" --print --debug-file "$LOGDIR/$name.log" > /dev/null 2>&1
# Capture the most recent session JSONL right after this run
LATEST_JSONL=$(ls -t ~/.claude/projects/-Users-creence-claude-minimal-test/*.jsonl 2>/dev/null | head -1)
cp "$LATEST_JSONL" "$LOGDIR/$name.jsonl" 2>/dev/null
}

ollama run glm-4.7-flash "warmup" > /dev/null 2>&1

run_test "01_baseline" --model glm-4.7-flash
run_test "02_safe_mode" --model glm-4.7-flash --safe-mode
run_test "03_disable_slash_commands" --model glm-4.7-flash --disable-slash-commands
run_test "04_exclude_dynamic_system_prompt" --model glm-4.7-flash --exclude-dynamic-system-prompt-sections
run_test "05_bare_mode" --model glm-4.7-flash --bare

echo ""
echo "############ SUMMARY: timing/tokens from debug logs ############"
for f in "$LOGDIR"/*.log; do
name=$(basename "$f" .log)
line=$(grep -E "turn 1 end" "$f" | tail -1)
skills=$(grep -c "skills via attachment" "$f")
echo "$name | skills_logged=$skills | $line"
done

echo ""
echo "############ SUMMARY: JSONL attachment inspection ############"
python3 - "$LOGDIR" <<'PY'
import json, sys, glob, os

logdir = sys.argv[1]
for jsonl_path in sorted(glob.glob(os.path.join(logdir, "*.jsonl"))):
name = os.path.basename(jsonl_path).replace(".jsonl", "")
print(f"\n--- {name} ---")
if os.path.getsize(jsonl_path) == 0:
print(" (empty or missing)")
continue
for line in open(jsonl_path):
try:
x = json.loads(line)
except:
continue
if "attachment" in x:
a = x["attachment"]
print(f" attachment type={a.get('type')} bytes={len(json.dumps(a))}")
if "message" in x and "usage" in x.get("message", {}):
u = x["message"]["usage"]
print(f" usage: input={u.get('input_tokens')} cache_read={u.get('cache_read_input_tokens')} output={u.get('output_tokens')}")
PY

echo ""
echo "Full logs and JSONL copies saved in: $LOGDIR"
SCRIPT
chmod +x ~/claude-minimal-test/test_all_flags.sh
~/claude-minimal-test/test_all_flags.sh

### Claude Model

Other

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.263 (Claude Code)

### Platform

Other

### Operating System

macOS

### Terminal/Shell

Terminal.app (macOS)

### Additional Information

The settings.json file goes in ~/.claude folder and was attached in the steps to reproduce. export ANTHROPIC_BASE_URL=http://localhost:11434.

[05_bare_mode.log](https://github.com/user-attachments/files/31878381/05_bare_mode.log)
[04_exclude_dynamic_system_prompt.log](https://github.com/user-attachments/files/31878382/04_exclude_dynamic_system_prompt.log)
[03_disable_slash_commands.log](https://github.com/user-attachments/files/31878379/03_disable_slash_commands.log)
[02_safe_mode.log](https://github.com/user-attachments/files/31878383/02_safe_mode.log)
[01_baseline.log](https://github.com/user-attachments/files/31878380/01_baseline.log)

Start by running test_all_flags.sh with the attached settings.json, then inspect the copied JSONL files and debug logs for skill_listing and agent_listing_delta attachments under --safe-mode and --disable-slash-commands. Compare them with the baseline and --bare runs. Done means both documented flags remove the relevant attachments without disabling the broader agent behavior noted for --bare.

Vom Indexierungsmodell aus dem Issue-Text verfasst.