@jini-ai/daemon 0.3.1 → 0.3.6

package/dist/agent-executor.js

@@ -849,31 +849,123 @@ export function buildCodexMcpServerToml(entry) {
         return serverTable;
     return `${serverTable}\n[mcp_servers.${JINI_MCP_SERVER_KEY}.env]\n${envLines.join('\n')}\n`;
 }
+/**
+ * Splits a TOML table header's dotted key into its individual segments, honoring quoted parts
+ * (`"basic"` or `'literal'`) that may themselves contain a literal `.` — a bare `.` only
+ * separates segments outside of quotes. Each segment is trimmed and, if quoted, unwrapped.
+ *
+ * Not a full TOML parser: it does not resolve escape sequences (`\"`, `\u...`) inside basic
+ * strings. That is deliberately out of scope — see {@link stripExistingJiniMcpServerTable}'s doc
+ * for why it is safe to skip for this specific comparison.
+ * @param rawKey - The raw text between a table header's `[` and `]`.
+ * @returns The dotted key's segments, dequoted and trimmed.
+ * @complexity O(n) in the length of `rawKey`.
+ */
+function splitTomlDottedKey(rawKey) {
+    const segments = [];
+    let current = '';
+    let quote = null;
+    for (const ch of rawKey) {
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                current += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (ch === '.') {
+            segments.push(current.trim());
+            current = '';
+            continue;
+        }
+        current += ch;
+    }
+    segments.push(current.trim());
+    return segments;
+}
+/**
+ * Removes any pre-existing `[mcp_servers.{@link JINI_MCP_SERVER_KEY}]` table — and its
+ * `[mcp_servers.{@link JINI_MCP_SERVER_KEY}.*]` subtables (e.g. `.env`) — from a real Codex
+ * `config.toml`'s raw text, so {@link buildCodexHomeConfigToml} can append this run's own table
+ * without producing the duplicate TOML key Codex's parser rejects at startup.
+ *
+ * Line-oriented, not a real TOML parser (matching {@link buildCodexMcpServerToml}'s own
+ * no-TOML-dependency constraint), but wide enough to survive a hand-edited config, which is the
+ * scenario this whole function exists for. A table header line is recognized when, after
+ * trimming, it is `[<key>]` optionally followed only by a `# comment` (TOML's own grammar allows
+ * nothing else there) — so it tolerates leading indentation, whitespace inside the brackets, a
+ * trailing line comment, and a dotted key written with quoted segments (`["mcp_servers"."jini"]`),
+ * via {@link splitTomlDottedKey}. Once such a header's key matches the jini table or one of its
+ * subtables, every following line is dropped until the next table header (of any name) or EOF.
+ * Every other table, key, comment-only, and blank line is passed through untouched.
+ *
+ * Deliberately unhandled, and why it is safe to leave that way:
+ * - **Escape sequences inside quoted key segments** (e.g. a segment containing `\"`) — neither
+ *   `mcp_servers` nor {@link JINI_MCP_SERVER_KEY} ever needs escaping, and this driver's own
+ *   writer ({@link buildCodexMcpServerToml}) never emits a quoted form at all, so no real
+ *   `config.toml` this driver produced can exercise this gap; a hand-edit that goes out of its
+ *   way to escape a character inside a key that is supposed to spell "jini" would fail to match
+ *   and fall back to today's pre-fix behavior (append a duplicate) rather than silently doing
+ *   something worse.
+ * - **`[[array-of-tables]]` syntax** — Codex's schema has no array-of-tables shape for
+ *   `mcp_servers`, and the header regex's `[^[\]]+` capture cannot match a line starting with a
+ *   second `[`, so `[[mcp_servers.jini]]` is not recognized as a header before or after this fix
+ *   — unchanged, not a new gap.
+ * - **A single quoted segment that happens to spell the same characters with the dot included**
+ *   (e.g. `["mcp_servers.jini"]`, which in real TOML names one key literally containing a `.`,
+ *   not two nested tables) — this collapses to the same joined string as the real nested-table
+ *   spelling and is therefore treated as a match. This is a false positive in the conservative
+ *   direction the reported bug calls for: a missed detection duplicates a key and crashes Codex,
+ *   so on this axis over-matching a spelling nobody would plausibly hand-write for an MCP server
+ *   table is preferable to under-matching the real one.
+ * @param existingRaw - The real Codex home's `config.toml` content, already known to be defined
+ * (callers pass `''` for a missing file).
+ * @returns `existingRaw` with any jini table/subtable removed.
+ * @complexity O(n) in the number of lines.
+ */
+function stripExistingJiniMcpServerTable(existingRaw) {
+    const jiniTableKey = `mcp_servers.${JINI_MCP_SERVER_KEY}`;
+    const kept = [];
+    let skipping = false;
+    for (const line of existingRaw.split('\n')) {
+        const header = /^\s*\[([^[\]]+)\]\s*(#.*)?$/.exec(line);
+        if (header) {
+            const key = splitTomlDottedKey(header[1] ?? '').join('.');
+            skipping = key === jiniTableKey || key.startsWith(`${jiniTableKey}.`);
+            if (skipping)
+                continue;
+        }
+        if (!skipping)
+            kept.push(line);
+    }
+    return kept.join('\n');
+}
 /**
  * Builds the full `config.toml` a run's scratch `CODEX_HOME` gets: the real Codex home's own
- * config, verbatim, with this run's `[mcp_servers.jini]` table appended.
- *
- * **Append-only by design, not a parse-and-merge.** `mergeMcpJsonContent`/`mergeEnvContentMcpConfig`
- * above can safely parse-merge-reserialize because their formats have a JS-native parser
- * (`JSON.parse`); this driver has no TOML parser in its dependency graph (see
- * `buildCodexMcpServerToml`'s doc), and every other setting a real Codex install carries — model
- * choice, sandbox policy, the trusted-project list, the operator's own other MCP servers — must
- * survive a spawn byte-for-byte. Appending preserves all of it; the one failure mode this trades
- * away is a PRE-EXISTING `[mcp_servers.jini]` table in the operator's own config, which would
- * produce a duplicate TOML key Codex rejects at startup. Accepted as vanishingly unlikely — `jini`
- * is this integration's own reserved server name (see {@link JINI_MCP_SERVER_KEY}), never suggested
- * to an operator for their own config — rather than solved with a full TOML parser for one
- * collision case.
+ * config, with any pre-existing `[mcp_servers.jini]` table removed (see
+ * {@link stripExistingJiniMcpServerTable}), then this run's own table appended.
+ *
+ * **Append-only by design, not a parse-and-merge, for everything but the jini table itself.**
+ * `mergeMcpJsonContent`/`mergeEnvContentMcpConfig` above can safely parse-merge-reserialize because
+ * their formats have a JS-native parser (`JSON.parse`); this driver has no general TOML parser in
+ * its dependency graph (see `buildCodexMcpServerToml`'s doc), and every other setting a real Codex
+ * install carries — model choice, sandbox policy, the trusted-project list, the operator's own
+ * other MCP servers — must survive a spawn byte-for-byte. Only the one table this driver itself
+ * owns (`jini` is this integration's own reserved server name — see {@link JINI_MCP_SERVER_KEY}) is
+ * ever removed, via the narrow line-oriented scan above, never a full TOML parse.
  * @param existingRaw - The real Codex home's `config.toml` content, or `undefined` when it does not
  * exist (a fresh Codex install — degrades to "start from just this run's block", matching
  * {@link mergeMcpJsonContent}'s own "missing file" handling).
  * @param entry - The shared bridge entry.
  * @returns The full text to write to the scratch `CODEX_HOME`'s `config.toml`.
  * @complexity O(n) in the existing config's length.
- * @overallScore 100/100
  */
 export function buildCodexHomeConfigToml(existingRaw, entry) {
-    const base = existingRaw ?? '';
+    const base = stripExistingJiniMcpServerTable(existingRaw ?? '');
     const separator = base.length === 0 ? '' : base.endsWith('\n') ? '\n' : '\n\n';
     return `${base}${separator}${buildCodexMcpServerToml(entry)}`;
 }
@@ -1092,6 +1184,114 @@ async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams) {
         },
     };
 }
+function defaultMkdtempClaudeConfigDir(prefix) {
+    return fsPromises.mkdtemp(join(tmpdir(), prefix));
+}
+function defaultRemoveClaudeConfigDir(path) {
+    return fsPromises.rm(path, { recursive: true, force: true });
+}
+function resolveClaudeConfigDirSeams(options) {
+    return {
+        mkdtemp: options?.mkdtemp ?? defaultMkdtempClaudeConfigDir,
+        readFile: options?.readFile ?? defaultReadMcpJsonFile,
+        writeFile: options?.writeFile ?? defaultWriteMcpJsonFile,
+        removeDir: options?.removeDir ?? defaultRemoveClaudeConfigDir,
+    };
+}
+/**
+ * Where `claude`'s own config resolution reads the operator's REAL config from, to seed a run's
+ * scratch copy — never where it writes. Mirrors {@link resolveSourceCodexHomeDir}'s exact reasoning
+ * and resolution order: `CLAUDE_CONFIG_DIR` is not in `BASELINE_AGENT_ENV_KEYS`, so a spawned child
+ * never inherits it anyway — the whole point is finding wherever the *operator's actual* Claude Code
+ * install lives, a host-machine fact resolved against the daemon HOST process's own environment.
+ * @param hostEnv - The daemon process's own environment.
+ * @returns `hostEnv.CLAUDE_CONFIG_DIR` when set to a non-blank value (matching Claude Code's own
+ * resolution order, confirmed against installed Claude Code 2.1.263), else the CLI's documented
+ * default, `~/.claude`.
+ * @complexity O(1).
+ */
+export function resolveSourceClaudeConfigDir(hostEnv) {
+    const override = hostEnv.CLAUDE_CONFIG_DIR;
+    return override !== undefined && override.trim().length > 0 ? override : join(homedir(), '.claude');
+}
+/**
+ * Stages a fresh, randomly-named `CLAUDE_CONFIG_DIR` directory (same non-determinism requirement as
+ * {@link McpJsonInjectionOptions.mkdtemp}'s own doc — `os.tmpdir()` is a shared location on a
+ * multi-user host, so a guessable name is a real pre-plant/symlink target).
+ *
+ * **Deliberately empty by default** — unlike {@link prepareCodexHomeForRun}, which copies the real
+ * `config.toml` wholesale (Codex has no personal-data problem in that file), this directory gets
+ * NOTHING written into it beyond a best-effort copy of `.credentials.json` (see below). That is the
+ * fix: the operator's real `skills`/`plugins`/`agents`/`memory-path index`/`settings.json` must NOT
+ * carry over implicitly. `claude` runs correctly against a config directory holding nothing at all —
+ * it falls back to its own built-in defaults, not an error.
+ *
+ * **Login preservation, verified rather than assumed** (per this task's own instruction — "prove
+ * login still resolves; do not assume"): confirmed live (2026-09-07, installed Claude Code 2.1.263,
+ * macOS) that `claude auth status` reports `loggedIn: false` against ANY `CLAUDE_CONFIG_DIR` other
+ * than the operator's real one — including the real `HOME` with only `CLAUDE_CONFIG_DIR` swapped —
+ * and confirmed against Claude Code's own docs (code.claude.com/docs/en/authentication) why: "If
+ * you've set the CLAUDE_CONFIG_DIR environment variable, Claude Code keeps the .credentials.json
+ * file under that directory instead, including the file the macOS fallback writes, and keys the
+ * macOS Keychain entry to that directory too, so a session with a different CLAUDE_CONFIG_DIR reads
+ * a different entry." So a scratch directory is never logged in by default on ANY platform, not just
+ * the ones with no Keychain at all. This function only closes the *portable* case: when the source
+ * directory holds a file-based `.credentials.json` (Linux, Windows, or a Keychain-locked macOS
+ * fallback — none of which this function can distinguish, and does not need to), it is copied
+ * best-effort into the scratch directory, exactly `prepareCodexHomeForRun`'s `auth.json` copy. When
+ * it does not (a normal macOS Keychain-only install, confirmed the common case on this codebase's
+ * own dev machine), this function does NOT attempt to read the macOS Keychain itself — that would
+ * mean this daemon process extracting a live OAuth secret out of an OS-managed credential store into
+ * a plaintext file, a materially different and larger security surface than forwarding an
+ * already-resolved credential the host handed it (which `credentialEnv`/`ANTHROPIC_API_KEY` already
+ * does, safely, today — see `AgentExecutorRunInput.credentialEnv`'s own doc). In that case this
+ * mirrors `prepareCodexHomeForRun`'s own accepted outcome for a missing credential file verbatim:
+ * "the spawned CLI runs unauthenticated" is documented, existing, precedented behavior in this file,
+ * not a new failure mode invented here. A host that needs the isolated child to stay logged in on
+ * such an install must supply a credential explicitly via `AgentExecutorRunInput.credentialEnv`
+ * (`ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN` — both outrank Keychain-based subscription login
+ * in Claude Code's own auth precedence, so the isolated child authenticates without ever needing the
+ * operator's personal Keychain entry at all) — see this fix's own handoff report for the operational
+ * consequence on a host with no such credential configured yet.
+ *
+ * **Never touches the real config directory.** `sourceConfigDir` is read-only throughout.
+ * @param runId - Embedded in the temp-dir prefix for traceability, same sanitization discipline as {@link prepareCodexHomeForRun}'s `safeRunId`.
+ * @param sourceConfigDir - Where to read a possible real `.credentials.json` from — see {@link resolveSourceClaudeConfigDir}.
+ * @param seams - Injectable mkdtemp/readFile/writeFile/removeDir, real filesystem by default.
+ * @throws Whatever `mkdtemp` rejects with — the caller ({@link prepareClaudeConfigDirIfNeeded}) turns that into a pre-spawn `AGENT_SPAWN_FAILED` failure, matching {@link prepareCodexHomeForRun}'s own contract.
+ * @complexity O(1) plus one directory creation and up to one best-effort file read/write round trip.
+ */
+async function prepareClaudeConfigDirForRun(runId, sourceConfigDir, seams) {
+    const safeRunId = runId.replace(/[^A-Za-z0-9_-]/g, '-').slice(0, 80) || 'run';
+    const dir = await seams.mkdtemp(`jini-claude-config-${safeRunId}-`);
+    try {
+        const credentialsPath = join(sourceConfigDir, '.credentials.json');
+        let credentialsRaw;
+        try {
+            credentialsRaw = await seams.readFile(credentialsPath);
+        }
+        catch {
+            // No file-based credential to copy (the common macOS-Keychain-only case) — see this
+            // function's own doc for why that is an accepted, documented outcome, not a failure here.
+            credentialsRaw = undefined;
+        }
+        if (credentialsRaw !== undefined) {
+            await seams.writeFile(join(dir, '.credentials.json'), credentialsRaw);
+        }
+    }
+    catch (err) {
+        await seams.removeDir(dir).catch(() => {
+            // Best-effort only — the original error below is what the caller must see either way.
+        });
+        throw err;
+    }
+    return {
+        path: dir,
+        cleanup: async () => {
+            await seams.removeDir(dir);
+        },
+    };
+}
 /**
  * Default ceiling on the `'until-close'` stdout accumulator (see `RuntimeStdoutPolicy` in
  * `@jini-ai/agent-runtime`), in bytes of received UTF-8.
@@ -1273,6 +1473,13 @@ function wireChildLifecycle(ctx) {
             // `content` below already carries the whole raw output, a pre-existing, unrelated gap), so
             // there is no `remainder` to thread back in — only the extracted blocks are used here.
             let media = [];
+            // Suspend the slow-run watchdog for the duration of this daemon-awaited execution: the daemon
+            // knows exactly why the run is quiet here (it dispatched the tool itself and is waiting on it),
+            // so a legitimately long tool (an install, a build, a repo-wide scan) must not be mistaken for
+            // the CPU-starved-and-silent condition the watchdog exists to catch. Resumed in `finally` so a
+            // genuinely stalled stretch *after* this tool settles is still caught — see
+            // `RunLifecycle.suspendSlowRunNotice`'s own doc.
+            lifecycle.suspendSlowRunNotice(runId);
             try {
                 const result = await continuation.toolExecutor.execute(continuation.principal, run, toolUse.name, toolUse.input);
                 content = resultContent(result);
@@ -1283,6 +1490,9 @@ function wireChildLifecycle(ctx) {
                 content = errorMessage(error);
                 isError = true;
             }
+            finally {
+                lifecycle.resumeSlowRunNotice(runId);
+            }
             await lifecycle.emit(runId, {
                 event: 'agent',
                 data: {
@@ -1886,7 +2096,7 @@ export async function resolveMcpBridgeForRun(input, deps) {
  * @complexity O(1) plus `mergeEnvContentMcpConfig`'s and `mergeEnvContentInstructions`'s own `JSON.parse`/`JSON.stringify` cost.
  * @overallScore 100/100
  */
-export function computeChildEnv(spawnEnv, mcpBridge, codexHomeDir, systemPromptEnvOverrides, stagedInstructionsFile) {
+export function computeChildEnv(spawnEnv, mcpBridge, codexHomeDir, systemPromptEnvOverrides, stagedInstructionsFile, claudeConfigDir) {
     const envContentApplied = mcpBridge?.kind === 'env-content'
         ? {
             ...spawnEnv,
@@ -1906,7 +2116,12 @@ export function computeChildEnv(spawnEnv, mcpBridge, codexHomeDir, systemPromptE
             [stagedInstructionsFile.varName]: mergeEnvContentInstructions(envPassthroughApplied[stagedInstructionsFile.varName], stagedInstructionsFile.path),
         };
     const codexHomeApplied = codexHomeDir === undefined ? instructionsApplied : { ...instructionsApplied, CODEX_HOME: codexHomeDir };
-    return systemPromptEnvOverrides === undefined ? codexHomeApplied : { ...codexHomeApplied, ...systemPromptEnvOverrides };
+    // Finding 1 of SEC-assistant-env-isolation-2026-09-07: same "only set when staged" shape as
+    // codexHomeApplied above — mutually exclusive with it in practice (codexHomeDir is only ever set
+    // for a 'codex-toml' bridge, claudeConfigDir only ever for a `claude`-id run), so both existing
+    // side by side here is a documentation convenience, not a real collision risk.
+    const claudeConfigDirApplied = claudeConfigDir === undefined ? codexHomeApplied : { ...codexHomeApplied, CLAUDE_CONFIG_DIR: claudeConfigDir };
+    return systemPromptEnvOverrides === undefined ? claudeConfigDirApplied : { ...claudeConfigDirApplied, ...systemPromptEnvOverrides };
 }
 /**
  * Phase 6b: the `RuntimeContext` `buildArgs` receives — `undefined` unless a file, bridge path, or
@@ -1960,16 +2175,23 @@ function computeSystemPromptOverlay(promptAugmenter, agentId, runtimeContext) {
         turnIndex: runtimeContext?.hasPriorAssistantTurn ? 1 : 0,
     });
 }
-/** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay at all (byte-identical to omitting the argument). Pure. */
+/** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay/tool-restriction at all (byte-identical to omitting the argument). Pure. */
 export function buildAgentBuildArgsOptions(input, systemPromptOverlay) {
     const hasOverlay = systemPromptOverlay !== undefined && systemPromptOverlay !== null;
-    if (input.model === undefined && input.reasoning === undefined && input.permissionMode === undefined && !hasOverlay) {
+    if (input.model === undefined
+        && input.reasoning === undefined
+        && input.permissionMode === undefined
+        && input.disallowedTools === undefined
+        && input.allowedTools === undefined
+        && !hasOverlay) {
         return undefined;
     }
     return {
         ...(input.model !== undefined ? { model: input.model } : {}),
         ...(input.reasoning !== undefined ? { reasoning: input.reasoning } : {}),
         ...(input.permissionMode !== undefined ? { permissionMode: input.permissionMode } : {}),
+        ...(input.disallowedTools !== undefined ? { disallowedTools: input.disallowedTools } : {}),
+        ...(input.allowedTools !== undefined ? { allowedTools: input.allowedTools } : {}),
         ...(hasOverlay ? { systemPromptOverlay } : {}),
     };
 }
@@ -2008,16 +2230,18 @@ export function buildAgentBuildArgsOptions(input, systemPromptOverlay) {
  * @param input.prompt - The composed prompt `buildArgs` would otherwise receive verbatim.
  * @param input.resumeSessionId - This run's `RuntimeContext.resumeSessionId`; presence means an
  * existing session is being continued, not created.
- * @returns The (possibly prefixed) prompt to hand `buildArgs`, any extra argv to append to
- * whatever `buildArgs` itself returns, and any env var overrides to merge into the spawn env
- * (`{}` for every strategy but `'env-var'`).
+ * @returns A {@link SystemPromptOverlayDelivery}: the prefix this run's prompt text must carry
+ * (`''` unless the fallback applies), that prefix already applied to `input.prompt`, any extra argv
+ * to append to whatever `buildArgs` itself returns, and any env var overrides to merge into the
+ * spawn env (`{}` for every strategy but `'env-var'`). Every one of `run()`'s four prompt
+ * transports consumes this same result — see the interface's own no-double-delivery note.
  * @complexity O(n) in the overlay/prompt lengths — string concatenation only, no I/O.
  * @overallScore 100/100
  */
 export function resolveSystemPromptOverlayDelivery(input) {
     const { defId, systemPromptDelivery, resumesSessionViaCli, resumesSessionViaAcpLoad, overlay, prompt, resumeSessionId } = input;
     if (typeof overlay !== 'string' || overlay.length === 0) {
-        return { prompt, extraArgs: [], envOverrides: {} };
+        return { promptPrefix: '', prompt, extraArgs: [], envOverrides: {} };
     }
     if (systemPromptDelivery?.strategy === 'append-flag') {
         const capabilityKey = systemPromptDelivery.capabilityKey;
@@ -2028,14 +2252,14 @@ export function resolveSystemPromptOverlayDelivery(input) {
         // (e.g. `pi`'s existing `--append-system-prompt`, trusted unconditionally) always passes, same
         // as an absent key.
         const capabilityOk = capabilityKey === undefined || agentCapabilities.get(defId)?.[capabilityKey] !== false;
-        return { prompt, extraArgs: capabilityOk ? [systemPromptDelivery.flag, overlay] : [], envOverrides: {} };
+        return { promptPrefix: '', prompt, extraArgs: capabilityOk ? [systemPromptDelivery.flag, overlay] : [], envOverrides: {} };
     }
     if (systemPromptDelivery?.strategy === 'env-var') {
         // No capability gate, unlike `'append-flag'`: an unrecognized env var is inert to a CLI (it
         // simply never reads it), never a fatal "unknown option" exit — there is no equivalent hazard
         // to probe-gate against here. Set verbatim, not merged with any existing value — a dedicated
         // single-purpose var, not a shared config channel (see this field's own `types.ts` doc).
-        return { prompt, extraArgs: [], envOverrides: { [systemPromptDelivery.varName]: overlay } };
+        return { promptPrefix: '', prompt, extraArgs: [], envOverrides: { [systemPromptDelivery.varName]: overlay } };
     }
     if (systemPromptDelivery?.strategy === 'config-instructions-file') {
         // Delivered elsewhere, not here: unlike `'append-flag'`/`'env-var'`, this mechanism needs real
@@ -2047,13 +2271,13 @@ export function resolveSystemPromptOverlayDelivery(input) {
         // This branch's only job is to make sure the universal prefix fallback below does NOT ALSO run
         // for a def that already has this strategy declared — the same "no double delivery" concern
         // `imageDelivery`'s doc calls out for its own native-vs-fallback split.
-        return { prompt, extraArgs: [], envOverrides: {} };
+        return { promptPrefix: '', prompt, extraArgs: [], envOverrides: {} };
     }
     const isContinuingExistingSession = (resumesSessionViaCli === true || resumesSessionViaAcpLoad === true) &&
         typeof resumeSessionId === 'string' &&
         resumeSessionId.length > 0;
     if (isContinuingExistingSession) {
-        return { prompt, extraArgs: [], envOverrides: {} };
+        return { promptPrefix: '', prompt, extraArgs: [], envOverrides: {} };
     }
     // KNOWN TRADE-OFF, deliberate: for a resume-capable def with no `'append-flag'`/`'env-var'`
     // mechanism yet (`codex`, `codebuddy`, `opencode`, `amr` — all four presently on this fallback),
@@ -2070,22 +2294,22 @@ export function resolveSystemPromptOverlayDelivery(input) {
     // is part of what a resumed session replays), which removes this limitation entirely for that
     // def. See `reasonix.ts`'s and `opencode.ts`'s module docs for the two already-identified,
     // not-yet-wired native mechanisms.
-    return { prompt: `${overlay}\n\n---\n\n${prompt}`, extraArgs: [], envOverrides: {} };
+    const promptPrefix = `${overlay}\n\n---\n\n`;
+    return { promptPrefix, prompt: `${promptPrefix}${prompt}`, extraArgs: [], envOverrides: {} };
 }
-/** Phase 9b: calls the def's `buildArgs`, releasing staged resources and failing the run on a throw. */
+/**
+ * Phase 9b: calls the def's `buildArgs`, releasing staged resources and failing the run on a throw.
+ *
+ * @param input.overlayDelivery - This run's already-resolved overlay decision, computed once in
+ * `run()` rather than here. It is resolved upstream because `buildArgs` is only ONE of the four
+ * channels that can carry the prompt: the staged prompt file is written *before* this function
+ * runs, and stdin/ACP/pi-rpc send theirs *after* spawn. A decision made inside this function could
+ * therefore only ever reach the 7 defs whose `buildArgs` reads its first argument at all — the
+ * other 17 declare it `_prompt` and discard it, which is exactly how the overlay used to go missing.
+ */
 export async function buildRunArgs(input, deps) {
     try {
-        // Resolved before `buildArgs` runs so a def with no declared `systemPromptDelivery` sees the
-        // overlay already prefixed into `prompt` — see `resolveSystemPromptOverlayDelivery`'s own doc.
-        const delivery = resolveSystemPromptOverlayDelivery({
-            defId: input.def.id,
-            systemPromptDelivery: input.def.systemPromptDelivery,
-            resumesSessionViaCli: input.def.resumesSessionViaCli,
-            resumesSessionViaAcpLoad: input.def.resumesSessionViaAcpLoad,
-            overlay: input.systemPromptOverlay,
-            prompt: input.imageDelivery.prompt,
-            resumeSessionId: input.runtimeContext?.resumeSessionId,
-        });
+        const delivery = input.overlayDelivery;
         const args = input.def.buildArgs(delivery.prompt, [...(input.imagePaths ?? [])], input.imageDelivery.extraAllowedDirs === undefined ? undefined : [...input.imageDelivery.extraAllowedDirs], buildAgentBuildArgsOptions(input.runInput, input.systemPromptOverlay), input.runtimeContext);
         // `'append-flag'` delivery's extra argv (empty for every other def/strategy) is appended after
         // whatever the def's own `buildArgs` returned — safe because it is only ever non-empty for a
@@ -2178,6 +2402,41 @@ export async function prepareCodexHomeIfNeeded(input, deps) {
         return deps.failBeforeSpawn(input.runId, 'AGENT_SPAWN_FAILED', `AgentExecutor: could not stage a CODEX_HOME for agent "${input.def.id}": ${errorMessage(err)}`);
     }
 }
+/**
+ * Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stages this run's scratch
+ * `CLAUDE_CONFIG_DIR` directory, returning the prepared handle `cleanupStagedFiles` should later
+ * release (`null` for every def other than `claude` — see {@link prepareClaudeConfigDirForRun}'s
+ * own doc for why this is unconditional for `claude` runs, unlike {@link prepareCodexHomeIfNeeded}'s
+ * gate on a host-configured MCP bridge strategy).
+ *
+ * Gated on `def.id === 'claude'` directly rather than on `externalMcpInjection === 'claude-mcp-json'`
+ * (which `codebuddy` also declares): isolating the operator's personal `~/.claude` is specific to
+ * the real `claude` CLI's own config resolution, not to every def that happens to share its `.mcp.
+ * json` delivery shape. Matches the existing `USER`-for-claude-login special case already singled
+ * out by id in `BASELINE_AGENT_ENV_KEYS`'s own doc, a few hundred lines above.
+ *
+ * ALSO gated on `deps.enabled` (`CreateAgentExecutorOptions.claudeConfigDirIsolationEnabled`, default
+ * `false`) since this task's own fix — see that field's doc for why it defaults off (Keychain login
+ * is `CLAUDE_CONFIG_DIR`-keyed and no caller was supplying a credential when this was unconditional).
+ * `def.id === 'claude'` is still checked first and independently: a host that flips this flag on
+ * should not suddenly stage a directory for `codebuddy` or any other def.
+ * @param input.def - Used for both the `id` gate and the failure message.
+ * @param deps.enabled - The isolation on/off switch — see this function's own doc above.
+ * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceClaudeConfigDir} rather than read from a module-level `process.env`, matching {@link prepareCodexHomeIfNeeded}'s identical testability reasoning.
+ * @complexity O(1) plus {@link prepareClaudeConfigDirForRun}'s own cost.
+ */
+export async function prepareClaudeConfigDirIfNeeded(input, deps) {
+    if (input.def.id !== 'claude' || !deps.enabled) {
+        return null;
+    }
+    try {
+        return await prepareClaudeConfigDirForRun(input.runId, resolveSourceClaudeConfigDir(deps.hostEnv), resolveClaudeConfigDirSeams(deps.claudeConfigDirIsolation));
+    }
+    catch (err) {
+        await deps.releaseStagedResources();
+        return deps.failBeforeSpawn(input.runId, 'AGENT_SPAWN_FAILED', `AgentExecutor: could not stage a CLAUDE_CONFIG_DIR for agent "${input.def.id}": ${errorMessage(err)}`);
+    }
+}
 /** Phase 11: post-`buildArgs` guard for argv-bound defs whose resolved binary is a Windows shim/.exe — a no-op off-Windows and for non-argv-bound defs. */
 export async function guardWindowsCommandLineBudget(input, deps) {
     const windowsBudgetError = checkWindowsCmdShimCommandLineBudget(input.def, input.launchPath, input.args) ??
@@ -2318,6 +2577,8 @@ export function createAgentExecutor(options) {
     const continuation = options.continuation;
     const classifyFailure = options.classifyFailure;
     const mcpJsonInjection = options.mcpJsonInjection;
+    const claudeConfigDirIsolation = options.claudeConfigDirIsolation;
+    const claudeConfigDirIsolationEnabled = options.claudeConfigDirIsolationEnabled ?? false;
     const promptAugmenter = options.promptAugmenter;
     /**
      * Transitions `runId` to `'failed'` (idempotent, never resumable — no
@@ -2359,13 +2620,46 @@ export function createAgentExecutor(options) {
         // defs' own native protocol already delivers the image and must never also get this
         // treatment (the double-delivery hazard this mechanism exists to avoid).
         const imageDelivery = await resolveImageDeliveryAndArgvBudget({ runId: input.runId, def, prompt: input.prompt, imagePaths: input.imagePaths, extraAllowedDirs: input.extraAllowedDirs }, { failBeforeSpawn });
+        // Phase 8, hoisted deliberately above EVERY step that writes or sends the prompt. Four
+        // different channels carry a prompt in this driver, and they do not all run at the same point:
+        // the `promptViaFile` staging below writes its file BEFORE `buildArgs`, `buildArgs` itself runs
+        // mid-`run()`, and stdin/ACP/pi-rpc all send theirs AFTER spawn. Resolving the overlay once,
+        // here, is what lets all four consume the same decision; resolving it later (as this used to,
+        // inside `buildRunArgs`) could only ever reach `buildArgs`, so the 17 defs that discard that
+        // argument, plus grok-build's staged file, silently received no overlay at all.
+        //
+        // `computeSystemPromptOverlay`'s third argument is the pre-staging `RuntimeContext`: it reads
+        // only `hasPriorAssistantTurn`, which `computeRuntimeContext` never populates from any of the
+        // staged-file/MCP inputs added to the fuller context built further down, so nothing between
+        // here and there can change the overlay this returns. Passing the narrower context makes that
+        // independence explicit rather than relying on the ordering staying lucky.
+        //
+        // `turnIndex` is a coarse 0/1 proxy (no exact turn counter exists on this driver) — sufficient
+        // because every `PromptAugmenter.systemOverlay()` implementation this seam has today wants the
+        // same overlay on every turn, not a first-turn-only one; a caller that needs finer-grained turn
+        // numbering can track it itself and ignore this arg.
+        const preStagingRuntimeContext = computeRuntimeContext(null, null, null, input.resumeSessionId, input.newSessionId);
+        const systemPromptOverlay = computeSystemPromptOverlay(promptAugmenter, def.id, preStagingRuntimeContext);
+        const overlayDelivery = resolveSystemPromptOverlayDelivery({
+            defId: def.id,
+            systemPromptDelivery: def.systemPromptDelivery,
+            resumesSessionViaCli: def.resumesSessionViaCli,
+            resumesSessionViaAcpLoad: def.resumesSessionViaAcpLoad,
+            overlay: systemPromptOverlay,
+            prompt: imageDelivery.prompt,
+            resumeSessionId: preStagingRuntimeContext?.resumeSessionId,
+        });
         const resolvedEnv = resolveRunEnv(input, process.env);
         const launch = await resolveLaunch({ runId: input.runId, def, resolvedEnv }, { resolveAgentLaunch: resolveAgentLaunchFn, failBeforeSpawn });
         const spawnEnv = applyAgentLaunchEnvFn({ ...resolvedEnv }, launch);
         // Stage a promptViaFile def's (grok-build) prompt to a temp file before buildArgs runs — its
         // buildArgs throws without runtimeContext.promptFilePath. A no-op (returns null) for every
         // def without promptViaFile: true (preparePromptFileForAgent's own guard).
-        const preparedPromptFile = await stagePromptFile({ runId: input.runId, def, prompt: imageDelivery.prompt }, { preparePromptFileForAgent: preparePromptFileForAgentFn, failBeforeSpawn });
+        //
+        // `overlayDelivery.prompt`, not `imageDelivery.prompt`: for a `promptViaFile` def this file IS
+        // the prompt transport — its `buildArgs` declares `_prompt` and passes only the path — so the
+        // overlay has to be in the bytes written here or the CLI never sees it at all.
+        const preparedPromptFile = await stagePromptFile({ runId: input.runId, def, prompt: overlayDelivery.prompt }, { preparePromptFileForAgent: preparePromptFileForAgentFn, failBeforeSpawn });
         // Stage a needsAgentLogFile def's (antigravity) diagnostic-log path, on the same terms and at
         // the same point as the prompt file above: before buildArgs, since buildArgs is what turns the
         // path into a `--log-file <path>` argument. A no-op (returns null) for every def without
@@ -2393,6 +2687,13 @@ export function createAgentExecutor(options) {
          * Only the `'codex-toml'` mechanism stages a directory at all.
          */
         let preparedCodexHome = null;
+        /**
+         * Set once `prepareClaudeConfigDirIfNeeded` has actually staged this run's scratch
+         * `CLAUDE_CONFIG_DIR`, so `cleanupStagedFiles` knows there is a directory (possibly holding a
+         * copied login credential) to remove. Cleared as it is consumed, matching `preparedCodexHome`'s
+         * identical single-removal discipline. Only a `claude`-id run stages a directory this way.
+         */
+        let preparedClaudeConfigDir = null;
         /**
          * Set once `prepareSystemPromptOverlayFileIfNeeded` has actually staged this run's overlay file
          * for a `'config-instructions-file'` def, so `cleanupStagedFiles` knows there is a temp
@@ -2416,6 +2717,11 @@ export function createAgentExecutor(options) {
                 preparedCodexHome = null;
                 await codexHomeToRemove.cleanup();
             }
+            if (preparedClaudeConfigDir) {
+                const claudeConfigDirToRemove = preparedClaudeConfigDir;
+                preparedClaudeConfigDir = null;
+                await claudeConfigDirToRemove.cleanup();
+            }
             if (preparedSystemPromptOverlayFile) {
                 const overlayFileToRemove = preparedSystemPromptOverlayFile;
                 preparedSystemPromptOverlayFile = null;
@@ -2452,12 +2758,6 @@ export function createAgentExecutor(options) {
             releaseRuntimeLock();
             await cleanupStagedFiles();
         };
-        // Computed once per `run()`, not per-token/per-event: a system-prompt overlay is a spawn-time
-        // CLI arg, not something that varies mid-run. `turnIndex` is a coarse 0/1 proxy (no exact turn
-        // counter exists on this driver) — sufficient because every `PromptAugmenter.systemOverlay()`
-        // implementation this seam has today wants the same overlay on every turn, not a first-turn-only
-        // one; a caller that needs finer-grained turn numbering can track it itself and ignore this arg.
-        const systemPromptOverlay = computeSystemPromptOverlay(promptAugmenter, def.id, runtimeContext);
         // Guarded, like every other step between staging and spawn: a `runtimeLock` def's `buildArgs` is
         // guarded precisely *because* it performs real filesystem writes (antigravity writes its model
         // choice into a shared settings file), so EACCES on a read-only home, ENOSPC, or a malformed
@@ -2465,7 +2765,7 @@ export function createAgentExecutor(options) {
         // `Error` — breaking this driver's "never a bare throw, always an `AgentExecutorError`" contract
         // — and left the run `'running'` forever while still holding the process-global mutex and both
         // staged files, so no later run of that def could ever acquire the lock either.
-        const { args, envOverrides: systemPromptEnvOverrides } = await buildRunArgs({ runId: input.runId, def, imageDelivery, imagePaths: input.imagePaths, runInput: input, systemPromptOverlay, runtimeContext }, { releaseStagedResources, failBeforeSpawn });
+        const { args, envOverrides: systemPromptEnvOverrides } = await buildRunArgs({ runId: input.runId, def, imageDelivery, imagePaths: input.imagePaths, runInput: input, systemPromptOverlay, overlayDelivery, runtimeContext }, { releaseStagedResources, failBeforeSpawn });
         // Mechanism 1 of 5's one effect — stage this run's own MCP config file (run-scoped, see
         // `mcpJsonPathForRun`) before spawn so the `--mcp-config <path>` argv buildArgs just produced
         // points at a real file. Skipped entirely for the other four mechanisms and whenever no bridge
@@ -2478,6 +2778,19 @@ export function createAgentExecutor(options) {
         // so — unlike the `.mcp.json` staging above — this can run after `buildArgs` with no ordering
         // constraint of its own; it is placed here only to keep the two staging steps adjacent.
         preparedCodexHome = await prepareCodexHomeIfNeeded({ runId: input.runId, def, mcpBridge }, { mcpJsonInjection, hostEnv: process.env, releaseStagedResources, failBeforeSpawn });
+        // Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stage this run's scratch
+        // `CLAUDE_CONFIG_DIR` directory. Unconditional for a `claude`-id run (unlike CODEX_HOME above,
+        // this does not depend on `mcpJsonInjection` being configured at all — see
+        // `prepareClaudeConfigDirIfNeeded`'s own doc for why). Placed here only to stay adjacent to the
+        // other pre-`computeChildEnv` staging steps; `claude.ts`'s `buildArgs` needs no argv change for
+        // this (CLAUDE_CONFIG_DIR is an env var, not a flag), same as CODEX_HOME.
+        preparedClaudeConfigDir = await prepareClaudeConfigDirIfNeeded({ runId: input.runId, def }, {
+            enabled: claudeConfigDirIsolationEnabled,
+            claudeConfigDirIsolation,
+            hostEnv: process.env,
+            releaseStagedResources,
+            failBeforeSpawn,
+        });
         // `'config-instructions-file'`'s one effect — stage the overlay to a temp file so
         // `computeChildEnv` below has a real path to merge into that def's `instructions` array. A
         // no-op (`null`) for every other def/strategy or a run with no overlay at all. Independent of
@@ -2492,7 +2805,7 @@ export function createAgentExecutor(options) {
         // here ever read `childEnv`, so moving the call cost nothing.
         const childEnv = computeChildEnv(spawnEnv, mcpBridge, preparedCodexHome?.path, systemPromptEnvOverrides, preparedSystemPromptOverlayFile && def.systemPromptDelivery?.strategy === 'config-instructions-file'
             ? { varName: def.systemPromptDelivery.varName, path: preparedSystemPromptOverlayFile.path }
-            : undefined);
+            : undefined, preparedClaudeConfigDir?.path);
         // Post-buildArgs guard for argv-bound defs whose resolved binary is a
         // Windows .cmd/.bat shim or a direct .exe: a prompt under the raw byte
         // budget can still expand past CreateProcess's command-line cap once
@@ -2545,7 +2858,14 @@ export function createAgentExecutor(options) {
                 runId: input.runId,
                 agentId: def.id,
                 child,
-                prompt: input.prompt,
+                // `overlayDelivery.promptPrefix` applied to `input.prompt`, NOT `overlayDelivery.prompt`:
+                // this call site deliberately sends the raw input prompt rather than the image-delivery
+                // rewrite (see `resolveImageDeliveryAndArgvBudget`'s call site above — an ACP def delivers
+                // images natively and must never also get `'prompt-path'`'s appended paths), and the prefix
+                // is the part of the overlay decision that applies to whatever prompt text a transport was
+                // already sending. `''` for `reasonix` (env-var) and any resumed ACP session, so those keep
+                // sending byte-identical text and never receive the overlay twice.
+                prompt: `${overlayDelivery.promptPrefix}${input.prompt}`,
                 cwd: input.cwd,
                 model: input.model,
                 imagePaths: input.imagePaths ?? [],
@@ -2572,7 +2892,10 @@ export function createAgentExecutor(options) {
                 runId: input.runId,
                 agentId: def.id,
                 child,
-                prompt: input.prompt,
+                // Same reasoning as the ACP call site above. `pi` declares an `'append-flag'` strategy,
+                // so its prefix is `''` and this stays byte-identical to the raw prompt — the overlay
+                // rides `--append-system-prompt` instead, exactly once.
+                prompt: `${overlayDelivery.promptPrefix}${input.prompt}`,
                 cwd: input.cwd,
                 model: input.model,
                 imagePaths: input.imagePaths ?? [],
@@ -2592,7 +2915,17 @@ export function createAgentExecutor(options) {
             });
             return;
         }
-        writePromptToStdin(def, child, imageDelivery.prompt, stdinHandle);
+        // The overlay reaches stdin only for a def that declares stdin as its prompt transport. The
+        // four `plain`-format defs that do not (`aider`/`antigravity`/`deepseek` put the prompt in
+        // argv, `grok-build` in a staged file) are still written to and closed here exactly as before,
+        // because this driver always spawns with `stdio: ['pipe','pipe','pipe']` and their CLIs need
+        // the EOF — but their prompt already carried the overlay through argv or the staged file, so
+        // sending the overlaid text here too would deliver it twice. This is the one place the
+        // resolver's own `''`-prefix rule is not sufficient on its own: those four defs are on the
+        // fallback strategy, so their prefix is genuinely non-empty; what makes stdin the wrong
+        // channel for them is the def's declared transport, not the strategy.
+        const stdinPrompt = def.promptViaStdin === true ? overlayDelivery.prompt : imageDelivery.prompt;
+        writePromptToStdin(def, child, stdinPrompt, stdinHandle);
     }
     return { run };
 }