@jini-ai/daemon 0.3.2 → 0.3.6

package/dist/agent-executor.js

@@ -849,6 +849,44 @@ export function buildCodexMcpServerToml(entry) {
         return serverTable;
     return `${serverTable}\n[mcp_servers.${JINI_MCP_SERVER_KEY}.env]\n${envLines.join('\n')}\n`;
 }
+/**
+ * Splits a TOML table header's dotted key into its individual segments, honoring quoted parts
+ * (`"basic"` or `'literal'`) that may themselves contain a literal `.` — a bare `.` only
+ * separates segments outside of quotes. Each segment is trimmed and, if quoted, unwrapped.
+ *
+ * Not a full TOML parser: it does not resolve escape sequences (`\"`, `\u...`) inside basic
+ * strings. That is deliberately out of scope — see {@link stripExistingJiniMcpServerTable}'s doc
+ * for why it is safe to skip for this specific comparison.
+ * @param rawKey - The raw text between a table header's `[` and `]`.
+ * @returns The dotted key's segments, dequoted and trimmed.
+ * @complexity O(n) in the length of `rawKey`.
+ */
+function splitTomlDottedKey(rawKey) {
+    const segments = [];
+    let current = '';
+    let quote = null;
+    for (const ch of rawKey) {
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                current += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (ch === '.') {
+            segments.push(current.trim());
+            current = '';
+            continue;
+        }
+        current += ch;
+    }
+    segments.push(current.trim());
+    return segments;
+}
 /**
  * Removes any pre-existing `[mcp_servers.{@link JINI_MCP_SERVER_KEY}]` table — and its
  * `[mcp_servers.{@link JINI_MCP_SERVER_KEY}.*]` subtables (e.g. `.env`) — from a real Codex
@@ -856,10 +894,34 @@ export function buildCodexMcpServerToml(entry) {
  * without producing the duplicate TOML key Codex's parser rejects at startup.
  *
  * Line-oriented, not a real TOML parser (matching {@link buildCodexMcpServerToml}'s own
- * no-TOML-dependency constraint): a table header is any line that is, after trimming, exactly
- * `[...]`. Once such a header's key matches the jini table or one of its subtables, every following
- * line is dropped until the next table header (of any name) or EOF. Every other table, key, and
- * blank line is passed through untouched.
+ * no-TOML-dependency constraint), but wide enough to survive a hand-edited config, which is the
+ * scenario this whole function exists for. A table header line is recognized when, after
+ * trimming, it is `[<key>]` optionally followed only by a `# comment` (TOML's own grammar allows
+ * nothing else there) — so it tolerates leading indentation, whitespace inside the brackets, a
+ * trailing line comment, and a dotted key written with quoted segments (`["mcp_servers"."jini"]`),
+ * via {@link splitTomlDottedKey}. Once such a header's key matches the jini table or one of its
+ * subtables, every following line is dropped until the next table header (of any name) or EOF.
+ * Every other table, key, comment-only, and blank line is passed through untouched.
+ *
+ * Deliberately unhandled, and why it is safe to leave that way:
+ * - **Escape sequences inside quoted key segments** (e.g. a segment containing `\"`) — neither
+ *   `mcp_servers` nor {@link JINI_MCP_SERVER_KEY} ever needs escaping, and this driver's own
+ *   writer ({@link buildCodexMcpServerToml}) never emits a quoted form at all, so no real
+ *   `config.toml` this driver produced can exercise this gap; a hand-edit that goes out of its
+ *   way to escape a character inside a key that is supposed to spell "jini" would fail to match
+ *   and fall back to today's pre-fix behavior (append a duplicate) rather than silently doing
+ *   something worse.
+ * - **`[[array-of-tables]]` syntax** — Codex's schema has no array-of-tables shape for
+ *   `mcp_servers`, and the header regex's `[^[\]]+` capture cannot match a line starting with a
+ *   second `[`, so `[[mcp_servers.jini]]` is not recognized as a header before or after this fix
+ *   — unchanged, not a new gap.
+ * - **A single quoted segment that happens to spell the same characters with the dot included**
+ *   (e.g. `["mcp_servers.jini"]`, which in real TOML names one key literally containing a `.`,
+ *   not two nested tables) — this collapses to the same joined string as the real nested-table
+ *   spelling and is therefore treated as a match. This is a false positive in the conservative
+ *   direction the reported bug calls for: a missed detection duplicates a key and crashes Codex,
+ *   so on this axis over-matching a spelling nobody would plausibly hand-write for an MCP server
+ *   table is preferable to under-matching the real one.
  * @param existingRaw - The real Codex home's `config.toml` content, already known to be defined
  * (callers pass `''` for a missing file).
  * @returns `existingRaw` with any jini table/subtable removed.
@@ -870,9 +932,9 @@ function stripExistingJiniMcpServerTable(existingRaw) {
     const kept = [];
     let skipping = false;
     for (const line of existingRaw.split('\n')) {
-        const header = /^\s*\[([^[\]]+)\]\s*$/.exec(line);
+        const header = /^\s*\[([^[\]]+)\]\s*(#.*)?$/.exec(line);
         if (header) {
-            const key = (header[1] ?? '').trim();
+            const key = splitTomlDottedKey(header[1] ?? '').join('.');
             skipping = key === jiniTableKey || key.startsWith(`${jiniTableKey}.`);
             if (skipping)
                 continue;
@@ -1122,6 +1184,114 @@ async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams) {
         },
     };
 }
+function defaultMkdtempClaudeConfigDir(prefix) {
+    return fsPromises.mkdtemp(join(tmpdir(), prefix));
+}
+function defaultRemoveClaudeConfigDir(path) {
+    return fsPromises.rm(path, { recursive: true, force: true });
+}
+function resolveClaudeConfigDirSeams(options) {
+    return {
+        mkdtemp: options?.mkdtemp ?? defaultMkdtempClaudeConfigDir,
+        readFile: options?.readFile ?? defaultReadMcpJsonFile,
+        writeFile: options?.writeFile ?? defaultWriteMcpJsonFile,
+        removeDir: options?.removeDir ?? defaultRemoveClaudeConfigDir,
+    };
+}
+/**
+ * Where `claude`'s own config resolution reads the operator's REAL config from, to seed a run's
+ * scratch copy — never where it writes. Mirrors {@link resolveSourceCodexHomeDir}'s exact reasoning
+ * and resolution order: `CLAUDE_CONFIG_DIR` is not in `BASELINE_AGENT_ENV_KEYS`, so a spawned child
+ * never inherits it anyway — the whole point is finding wherever the *operator's actual* Claude Code
+ * install lives, a host-machine fact resolved against the daemon HOST process's own environment.
+ * @param hostEnv - The daemon process's own environment.
+ * @returns `hostEnv.CLAUDE_CONFIG_DIR` when set to a non-blank value (matching Claude Code's own
+ * resolution order, confirmed against installed Claude Code 2.1.263), else the CLI's documented
+ * default, `~/.claude`.
+ * @complexity O(1).
+ */
+export function resolveSourceClaudeConfigDir(hostEnv) {
+    const override = hostEnv.CLAUDE_CONFIG_DIR;
+    return override !== undefined && override.trim().length > 0 ? override : join(homedir(), '.claude');
+}
+/**
+ * Stages a fresh, randomly-named `CLAUDE_CONFIG_DIR` directory (same non-determinism requirement as
+ * {@link McpJsonInjectionOptions.mkdtemp}'s own doc — `os.tmpdir()` is a shared location on a
+ * multi-user host, so a guessable name is a real pre-plant/symlink target).
+ *
+ * **Deliberately empty by default** — unlike {@link prepareCodexHomeForRun}, which copies the real
+ * `config.toml` wholesale (Codex has no personal-data problem in that file), this directory gets
+ * NOTHING written into it beyond a best-effort copy of `.credentials.json` (see below). That is the
+ * fix: the operator's real `skills`/`plugins`/`agents`/`memory-path index`/`settings.json` must NOT
+ * carry over implicitly. `claude` runs correctly against a config directory holding nothing at all —
+ * it falls back to its own built-in defaults, not an error.
+ *
+ * **Login preservation, verified rather than assumed** (per this task's own instruction — "prove
+ * login still resolves; do not assume"): confirmed live (2026-09-07, installed Claude Code 2.1.263,
+ * macOS) that `claude auth status` reports `loggedIn: false` against ANY `CLAUDE_CONFIG_DIR` other
+ * than the operator's real one — including the real `HOME` with only `CLAUDE_CONFIG_DIR` swapped —
+ * and confirmed against Claude Code's own docs (code.claude.com/docs/en/authentication) why: "If
+ * you've set the CLAUDE_CONFIG_DIR environment variable, Claude Code keeps the .credentials.json
+ * file under that directory instead, including the file the macOS fallback writes, and keys the
+ * macOS Keychain entry to that directory too, so a session with a different CLAUDE_CONFIG_DIR reads
+ * a different entry." So a scratch directory is never logged in by default on ANY platform, not just
+ * the ones with no Keychain at all. This function only closes the *portable* case: when the source
+ * directory holds a file-based `.credentials.json` (Linux, Windows, or a Keychain-locked macOS
+ * fallback — none of which this function can distinguish, and does not need to), it is copied
+ * best-effort into the scratch directory, exactly `prepareCodexHomeForRun`'s `auth.json` copy. When
+ * it does not (a normal macOS Keychain-only install, confirmed the common case on this codebase's
+ * own dev machine), this function does NOT attempt to read the macOS Keychain itself — that would
+ * mean this daemon process extracting a live OAuth secret out of an OS-managed credential store into
+ * a plaintext file, a materially different and larger security surface than forwarding an
+ * already-resolved credential the host handed it (which `credentialEnv`/`ANTHROPIC_API_KEY` already
+ * does, safely, today — see `AgentExecutorRunInput.credentialEnv`'s own doc). In that case this
+ * mirrors `prepareCodexHomeForRun`'s own accepted outcome for a missing credential file verbatim:
+ * "the spawned CLI runs unauthenticated" is documented, existing, precedented behavior in this file,
+ * not a new failure mode invented here. A host that needs the isolated child to stay logged in on
+ * such an install must supply a credential explicitly via `AgentExecutorRunInput.credentialEnv`
+ * (`ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN` — both outrank Keychain-based subscription login
+ * in Claude Code's own auth precedence, so the isolated child authenticates without ever needing the
+ * operator's personal Keychain entry at all) — see this fix's own handoff report for the operational
+ * consequence on a host with no such credential configured yet.
+ *
+ * **Never touches the real config directory.** `sourceConfigDir` is read-only throughout.
+ * @param runId - Embedded in the temp-dir prefix for traceability, same sanitization discipline as {@link prepareCodexHomeForRun}'s `safeRunId`.
+ * @param sourceConfigDir - Where to read a possible real `.credentials.json` from — see {@link resolveSourceClaudeConfigDir}.
+ * @param seams - Injectable mkdtemp/readFile/writeFile/removeDir, real filesystem by default.
+ * @throws Whatever `mkdtemp` rejects with — the caller ({@link prepareClaudeConfigDirIfNeeded}) turns that into a pre-spawn `AGENT_SPAWN_FAILED` failure, matching {@link prepareCodexHomeForRun}'s own contract.
+ * @complexity O(1) plus one directory creation and up to one best-effort file read/write round trip.
+ */
+async function prepareClaudeConfigDirForRun(runId, sourceConfigDir, seams) {
+    const safeRunId = runId.replace(/[^A-Za-z0-9_-]/g, '-').slice(0, 80) || 'run';
+    const dir = await seams.mkdtemp(`jini-claude-config-${safeRunId}-`);
+    try {
+        const credentialsPath = join(sourceConfigDir, '.credentials.json');
+        let credentialsRaw;
+        try {
+            credentialsRaw = await seams.readFile(credentialsPath);
+        }
+        catch {
+            // No file-based credential to copy (the common macOS-Keychain-only case) — see this
+            // function's own doc for why that is an accepted, documented outcome, not a failure here.
+            credentialsRaw = undefined;
+        }
+        if (credentialsRaw !== undefined) {
+            await seams.writeFile(join(dir, '.credentials.json'), credentialsRaw);
+        }
+    }
+    catch (err) {
+        await seams.removeDir(dir).catch(() => {
+            // Best-effort only — the original error below is what the caller must see either way.
+        });
+        throw err;
+    }
+    return {
+        path: dir,
+        cleanup: async () => {
+            await seams.removeDir(dir);
+        },
+    };
+}
 /**
  * Default ceiling on the `'until-close'` stdout accumulator (see `RuntimeStdoutPolicy` in
  * `@jini-ai/agent-runtime`), in bytes of received UTF-8.
@@ -1303,6 +1473,13 @@ function wireChildLifecycle(ctx) {
             // `content` below already carries the whole raw output, a pre-existing, unrelated gap), so
             // there is no `remainder` to thread back in — only the extracted blocks are used here.
             let media = [];
+            // Suspend the slow-run watchdog for the duration of this daemon-awaited execution: the daemon
+            // knows exactly why the run is quiet here (it dispatched the tool itself and is waiting on it),
+            // so a legitimately long tool (an install, a build, a repo-wide scan) must not be mistaken for
+            // the CPU-starved-and-silent condition the watchdog exists to catch. Resumed in `finally` so a
+            // genuinely stalled stretch *after* this tool settles is still caught — see
+            // `RunLifecycle.suspendSlowRunNotice`'s own doc.
+            lifecycle.suspendSlowRunNotice(runId);
             try {
                 const result = await continuation.toolExecutor.execute(continuation.principal, run, toolUse.name, toolUse.input);
                 content = resultContent(result);
@@ -1313,6 +1490,9 @@ function wireChildLifecycle(ctx) {
                 content = errorMessage(error);
                 isError = true;
             }
+            finally {
+                lifecycle.resumeSlowRunNotice(runId);
+            }
             await lifecycle.emit(runId, {
                 event: 'agent',
                 data: {
@@ -1916,7 +2096,7 @@ export async function resolveMcpBridgeForRun(input, deps) {
  * @complexity O(1) plus `mergeEnvContentMcpConfig`'s and `mergeEnvContentInstructions`'s own `JSON.parse`/`JSON.stringify` cost.
  * @overallScore 100/100
  */
-export function computeChildEnv(spawnEnv, mcpBridge, codexHomeDir, systemPromptEnvOverrides, stagedInstructionsFile) {
+export function computeChildEnv(spawnEnv, mcpBridge, codexHomeDir, systemPromptEnvOverrides, stagedInstructionsFile, claudeConfigDir) {
     const envContentApplied = mcpBridge?.kind === 'env-content'
         ? {
             ...spawnEnv,
@@ -1936,7 +2116,12 @@ export function computeChildEnv(spawnEnv, mcpBridge, codexHomeDir, systemPromptE
             [stagedInstructionsFile.varName]: mergeEnvContentInstructions(envPassthroughApplied[stagedInstructionsFile.varName], stagedInstructionsFile.path),
         };
     const codexHomeApplied = codexHomeDir === undefined ? instructionsApplied : { ...instructionsApplied, CODEX_HOME: codexHomeDir };
-    return systemPromptEnvOverrides === undefined ? codexHomeApplied : { ...codexHomeApplied, ...systemPromptEnvOverrides };
+    // Finding 1 of SEC-assistant-env-isolation-2026-09-07: same "only set when staged" shape as
+    // codexHomeApplied above — mutually exclusive with it in practice (codexHomeDir is only ever set
+    // for a 'codex-toml' bridge, claudeConfigDir only ever for a `claude`-id run), so both existing
+    // side by side here is a documentation convenience, not a real collision risk.
+    const claudeConfigDirApplied = claudeConfigDir === undefined ? codexHomeApplied : { ...codexHomeApplied, CLAUDE_CONFIG_DIR: claudeConfigDir };
+    return systemPromptEnvOverrides === undefined ? claudeConfigDirApplied : { ...claudeConfigDirApplied, ...systemPromptEnvOverrides };
 }
 /**
  * Phase 6b: the `RuntimeContext` `buildArgs` receives — `undefined` unless a file, bridge path, or
@@ -1990,16 +2175,23 @@ function computeSystemPromptOverlay(promptAugmenter, agentId, runtimeContext) {
         turnIndex: runtimeContext?.hasPriorAssistantTurn ? 1 : 0,
     });
 }
-/** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay at all (byte-identical to omitting the argument). Pure. */
+/** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay/tool-restriction at all (byte-identical to omitting the argument). Pure. */
 export function buildAgentBuildArgsOptions(input, systemPromptOverlay) {
     const hasOverlay = systemPromptOverlay !== undefined && systemPromptOverlay !== null;
-    if (input.model === undefined && input.reasoning === undefined && input.permissionMode === undefined && !hasOverlay) {
+    if (input.model === undefined
+        && input.reasoning === undefined
+        && input.permissionMode === undefined
+        && input.disallowedTools === undefined
+        && input.allowedTools === undefined
+        && !hasOverlay) {
         return undefined;
     }
     return {
         ...(input.model !== undefined ? { model: input.model } : {}),
         ...(input.reasoning !== undefined ? { reasoning: input.reasoning } : {}),
         ...(input.permissionMode !== undefined ? { permissionMode: input.permissionMode } : {}),
+        ...(input.disallowedTools !== undefined ? { disallowedTools: input.disallowedTools } : {}),
+        ...(input.allowedTools !== undefined ? { allowedTools: input.allowedTools } : {}),
         ...(hasOverlay ? { systemPromptOverlay } : {}),
     };
 }
@@ -2210,6 +2402,41 @@ export async function prepareCodexHomeIfNeeded(input, deps) {
         return deps.failBeforeSpawn(input.runId, 'AGENT_SPAWN_FAILED', `AgentExecutor: could not stage a CODEX_HOME for agent "${input.def.id}": ${errorMessage(err)}`);
     }
 }
+/**
+ * Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stages this run's scratch
+ * `CLAUDE_CONFIG_DIR` directory, returning the prepared handle `cleanupStagedFiles` should later
+ * release (`null` for every def other than `claude` — see {@link prepareClaudeConfigDirForRun}'s
+ * own doc for why this is unconditional for `claude` runs, unlike {@link prepareCodexHomeIfNeeded}'s
+ * gate on a host-configured MCP bridge strategy).
+ *
+ * Gated on `def.id === 'claude'` directly rather than on `externalMcpInjection === 'claude-mcp-json'`
+ * (which `codebuddy` also declares): isolating the operator's personal `~/.claude` is specific to
+ * the real `claude` CLI's own config resolution, not to every def that happens to share its `.mcp.
+ * json` delivery shape. Matches the existing `USER`-for-claude-login special case already singled
+ * out by id in `BASELINE_AGENT_ENV_KEYS`'s own doc, a few hundred lines above.
+ *
+ * ALSO gated on `deps.enabled` (`CreateAgentExecutorOptions.claudeConfigDirIsolationEnabled`, default
+ * `false`) since this task's own fix — see that field's doc for why it defaults off (Keychain login
+ * is `CLAUDE_CONFIG_DIR`-keyed and no caller was supplying a credential when this was unconditional).
+ * `def.id === 'claude'` is still checked first and independently: a host that flips this flag on
+ * should not suddenly stage a directory for `codebuddy` or any other def.
+ * @param input.def - Used for both the `id` gate and the failure message.
+ * @param deps.enabled - The isolation on/off switch — see this function's own doc above.
+ * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceClaudeConfigDir} rather than read from a module-level `process.env`, matching {@link prepareCodexHomeIfNeeded}'s identical testability reasoning.
+ * @complexity O(1) plus {@link prepareClaudeConfigDirForRun}'s own cost.
+ */
+export async function prepareClaudeConfigDirIfNeeded(input, deps) {
+    if (input.def.id !== 'claude' || !deps.enabled) {
+        return null;
+    }
+    try {
+        return await prepareClaudeConfigDirForRun(input.runId, resolveSourceClaudeConfigDir(deps.hostEnv), resolveClaudeConfigDirSeams(deps.claudeConfigDirIsolation));
+    }
+    catch (err) {
+        await deps.releaseStagedResources();
+        return deps.failBeforeSpawn(input.runId, 'AGENT_SPAWN_FAILED', `AgentExecutor: could not stage a CLAUDE_CONFIG_DIR for agent "${input.def.id}": ${errorMessage(err)}`);
+    }
+}
 /** Phase 11: post-`buildArgs` guard for argv-bound defs whose resolved binary is a Windows shim/.exe — a no-op off-Windows and for non-argv-bound defs. */
 export async function guardWindowsCommandLineBudget(input, deps) {
     const windowsBudgetError = checkWindowsCmdShimCommandLineBudget(input.def, input.launchPath, input.args) ??
@@ -2350,6 +2577,8 @@ export function createAgentExecutor(options) {
     const continuation = options.continuation;
     const classifyFailure = options.classifyFailure;
     const mcpJsonInjection = options.mcpJsonInjection;
+    const claudeConfigDirIsolation = options.claudeConfigDirIsolation;
+    const claudeConfigDirIsolationEnabled = options.claudeConfigDirIsolationEnabled ?? false;
     const promptAugmenter = options.promptAugmenter;
     /**
      * Transitions `runId` to `'failed'` (idempotent, never resumable — no
@@ -2458,6 +2687,13 @@ export function createAgentExecutor(options) {
          * Only the `'codex-toml'` mechanism stages a directory at all.
          */
         let preparedCodexHome = null;
+        /**
+         * Set once `prepareClaudeConfigDirIfNeeded` has actually staged this run's scratch
+         * `CLAUDE_CONFIG_DIR`, so `cleanupStagedFiles` knows there is a directory (possibly holding a
+         * copied login credential) to remove. Cleared as it is consumed, matching `preparedCodexHome`'s
+         * identical single-removal discipline. Only a `claude`-id run stages a directory this way.
+         */
+        let preparedClaudeConfigDir = null;
         /**
          * Set once `prepareSystemPromptOverlayFileIfNeeded` has actually staged this run's overlay file
          * for a `'config-instructions-file'` def, so `cleanupStagedFiles` knows there is a temp
@@ -2481,6 +2717,11 @@ export function createAgentExecutor(options) {
                 preparedCodexHome = null;
                 await codexHomeToRemove.cleanup();
             }
+            if (preparedClaudeConfigDir) {
+                const claudeConfigDirToRemove = preparedClaudeConfigDir;
+                preparedClaudeConfigDir = null;
+                await claudeConfigDirToRemove.cleanup();
+            }
             if (preparedSystemPromptOverlayFile) {
                 const overlayFileToRemove = preparedSystemPromptOverlayFile;
                 preparedSystemPromptOverlayFile = null;
@@ -2537,6 +2778,19 @@ export function createAgentExecutor(options) {
         // so — unlike the `.mcp.json` staging above — this can run after `buildArgs` with no ordering
         // constraint of its own; it is placed here only to keep the two staging steps adjacent.
         preparedCodexHome = await prepareCodexHomeIfNeeded({ runId: input.runId, def, mcpBridge }, { mcpJsonInjection, hostEnv: process.env, releaseStagedResources, failBeforeSpawn });
+        // Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stage this run's scratch
+        // `CLAUDE_CONFIG_DIR` directory. Unconditional for a `claude`-id run (unlike CODEX_HOME above,
+        // this does not depend on `mcpJsonInjection` being configured at all — see
+        // `prepareClaudeConfigDirIfNeeded`'s own doc for why). Placed here only to stay adjacent to the
+        // other pre-`computeChildEnv` staging steps; `claude.ts`'s `buildArgs` needs no argv change for
+        // this (CLAUDE_CONFIG_DIR is an env var, not a flag), same as CODEX_HOME.
+        preparedClaudeConfigDir = await prepareClaudeConfigDirIfNeeded({ runId: input.runId, def }, {
+            enabled: claudeConfigDirIsolationEnabled,
+            claudeConfigDirIsolation,
+            hostEnv: process.env,
+            releaseStagedResources,
+            failBeforeSpawn,
+        });
         // `'config-instructions-file'`'s one effect — stage the overlay to a temp file so
         // `computeChildEnv` below has a real path to merge into that def's `instructions` array. A
         // no-op (`null`) for every other def/strategy or a run with no overlay at all. Independent of
@@ -2551,7 +2805,7 @@ export function createAgentExecutor(options) {
         // here ever read `childEnv`, so moving the call cost nothing.
         const childEnv = computeChildEnv(spawnEnv, mcpBridge, preparedCodexHome?.path, systemPromptEnvOverrides, preparedSystemPromptOverlayFile && def.systemPromptDelivery?.strategy === 'config-instructions-file'
             ? { varName: def.systemPromptDelivery.varName, path: preparedSystemPromptOverlayFile.path }
-            : undefined);
+            : undefined, preparedClaudeConfigDir?.path);
         // Post-buildArgs guard for argv-bound defs whose resolved binary is a
         // Windows .cmd/.bat shim or a direct .exe: a prompt under the raw byte
         // budget can still expand past CreateProcess's command-line cap once