@cleocode/caamp 2026.5.15 → 2026.5.17

package/dist/{chunk-SHOXU2YA.js → chunk-S3PLNL6K.js}

@@ -583,6 +583,7 @@ import {
 import { homedir as homedir2 } from "os";
 import { basename as basename2, dirname as dirname2, extname, join as join5 } from "path";
 import { parseDocument, validateDocument } from "@cleocode/cant";
+import { provisionIsolatedShell } from "@cleocode/contracts";
 
 // src/core/harness/scope.ts
 import { homedir } from "os";
@@ -949,13 +950,19 @@ ${MARKER_END}`;
     }
     const startedAt = /* @__PURE__ */ new Date();
     const startedAtIso = startedAt.toISOString();
-    const worktreeCwd = opts.worktree?.path;
-    const worktreeEnv = opts.worktree !== void 0 ? {
-      CLEO_WORKTREE_ROOT: opts.worktree.path,
-      CLEO_WORKTREE_BRANCH: opts.worktree.branch,
-      CLEO_PROJECT_HASH: opts.worktree.projectHash
-    } : {};
-    const resolvedCwd = worktreeCwd ?? opts.cwd ?? task.cwd ?? process.cwd();
+    let isolatedCwd;
+    let isolatedEnv = {};
+    if (opts.worktree !== void 0) {
+      const isolation = provisionIsolatedShell({
+        worktreePath: opts.worktree.path,
+        branch: opts.worktree.branch,
+        role: "worker",
+        projectHash: opts.worktree.projectHash
+      });
+      isolatedCwd = isolation.cwd;
+      isolatedEnv = isolation.env;
+    }
+    const resolvedCwd = isolatedCwd ?? opts.cwd ?? task.cwd ?? process.cwd();
     const sessionHeader = {
       type: "session",
       version: 3,
@@ -971,8 +978,8 @@ ${MARKER_END}`;
     const baseArgs = cmd.slice(1);
     const args = [...baseArgs, task.prompt];
     const child = spawn(program, args, {
-      cwd: worktreeCwd ?? opts.cwd ?? task.cwd,
-      env: { ...process.env, ...worktreeEnv, ...task.env, ...opts.env },
+      cwd: isolatedCwd ?? opts.cwd ?? task.cwd,
+      env: { ...process.env, ...isolatedEnv, ...task.env, ...opts.env },
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdoutAccum = "";
@@ -4715,4 +4722,4 @@ export {
   discoverSkillsMulti,
   validateSkill
 };
-//# sourceMappingURL=chunk-SHOXU2YA.js.map
+//# sourceMappingURL=chunk-S3PLNL6K.js.map