@jini-ai/daemon 0.3.2 → 0.3.7

package/dist/agent-executor.d.ts

@@ -327,6 +327,15 @@ export interface AgentExecutorRunInput {
      * CLI session. Ignored by defs that don't declare `resumesSessionViaCli`.
      */
     readonly newSessionId?: string;
+    /**
+     * Forwarded verbatim to `RuntimeBuildOptions.disallowedTools` (see `@jini-ai/agent-runtime`'s
+     * `types.ts`) — Finding 2 of SEC-assistant-env-isolation-2026-09-07. A mechanism only: this
+     * package bakes in no opinion about which tools to name; the host decides. `undefined`/empty
+     * means no restriction, byte-identical to today's behavior.
+     */
+    readonly disallowedTools?: readonly string[];
+    /** Same mechanism as {@link disallowedTools}, forwarded to `RuntimeBuildOptions.allowedTools`. */
+    readonly allowedTools?: readonly string[];
 }
 export interface AgentExecutor {
     /**
@@ -736,6 +745,61 @@ export type PreparedCodexHome = {
     /** Recursively removes the staged directory — the live `auth.json` copy it may hold makes this a confidentiality cleanup, not just tidiness. Safe to call more than once. */
     readonly cleanup: () => Promise<void>;
 };
+/**
+ * Finding 1 of SEC-assistant-env-isolation-2026-09-07 — a staged, run-scoped `claude` CLI config
+ * directory, the `CLAUDE_CONFIG_DIR`-isolation analogue of {@link PreparedCodexHome} above.
+ *
+ * **The bug this closes:** `BASELINE_AGENT_ENV_KEYS` forwards `HOME` verbatim and neither this
+ * package nor `@jini-ai/agent-runtime` ever set `CLAUDE_CONFIG_DIR`, so a spawned `claude` child
+ * resolved its config (skills, plugins, agents, memory-path index, settings) from the OPERATOR's
+ * own real `$HOME/.claude` — a personal grant (including `Task`/`Edit`/`Write`/`Cron*`/worktree
+ * tools on this host) the host process never intended to hand the model.
+ */
+export type PreparedClaudeConfigDir = {
+    /** Absolute path to hand to the spawned child as its `CLAUDE_CONFIG_DIR` env var. */
+    readonly path: string;
+    /** Recursively removes the staged directory — it may hold a copied login credential (see {@link prepareClaudeConfigDirForRun}'s doc), the same confidentiality-cleanup duty as {@link PreparedCodexHome.cleanup}. Safe to call more than once. */
+    readonly cleanup: () => Promise<void>;
+};
+/** The Claude-config-dir mechanism's injectable filesystem seams, real by default — the directory-staging analogue of {@link CodexHomeSeams}, kept as its own small options bag (see {@link CreateAgentExecutorOptions.claudeConfigDirIsolation}) rather than folded into {@link McpJsonInjectionOptions}: isolating the operator's personal config is an env-hygiene concern independent of whether this host configured MCP federation at all, and must not be gated on that unrelated flag. */
+export interface ClaudeConfigDirSeams {
+    readonly mkdtemp: (prefix: string) => Promise<string>;
+    readonly readFile: (path: string) => Promise<string>;
+    readonly writeFile: (path: string, content: string) => Promise<void>;
+    readonly removeDir: (path: string) => Promise<void>;
+}
+/**
+ * `CreateAgentExecutorOptions.claudeConfigDirIsolation` — every field optional and real-filesystem
+ * by default, matching this file's standing "no real disk I/O by default in tests" convention (see
+ * `preparePromptFileForAgent`/`prepareAgentLogFile`'s identical shape). Unlike
+ * {@link McpJsonInjectionOptions}, this bag is never itself a gate: {@link
+ * prepareClaudeConfigDirIfNeeded} stages a scratch directory for every `claude`-def run regardless
+ * of whether a host supplies overrides here — this options bag only lets a test observe/replace the
+ * filesystem calls, the same way `preparePromptFileForAgent`'s own default does.
+ */
+export interface ClaudeConfigDirIsolationOptions {
+    /** @default the real `fs.promises.mkdtemp(path.join(os.tmpdir(), prefix))` */
+    readonly mkdtemp?: (prefix: string) => Promise<string>;
+    /** Reads the operator's real `.credentials.json`, if any — see {@link prepareClaudeConfigDirForRun}'s own doc. @default the real `fs.promises.readFile` (utf8) */
+    readonly readFile?: (path: string) => Promise<string>;
+    /** Writes the copied `.credentials.json` into the scratch directory. @default the real `fs.promises.writeFile` (utf8) */
+    readonly writeFile?: (path: string, content: string) => Promise<void>;
+    /** @default `fs.promises.rm(path, { recursive: true, force: true })` — already-gone is success, not an error. */
+    readonly removeDir?: (path: string) => Promise<void>;
+}
+/**
+ * Where `claude`'s own config resolution reads the operator's REAL config from, to seed a run's
+ * scratch copy — never where it writes. Mirrors {@link resolveSourceCodexHomeDir}'s exact reasoning
+ * and resolution order: `CLAUDE_CONFIG_DIR` is not in `BASELINE_AGENT_ENV_KEYS`, so a spawned child
+ * never inherits it anyway — the whole point is finding wherever the *operator's actual* Claude Code
+ * install lives, a host-machine fact resolved against the daemon HOST process's own environment.
+ * @param hostEnv - The daemon process's own environment.
+ * @returns `hostEnv.CLAUDE_CONFIG_DIR` when set to a non-blank value (matching Claude Code's own
+ * resolution order, confirmed against installed Claude Code 2.1.263), else the CLI's documented
+ * default, `~/.claude`.
+ * @complexity O(1).
+ */
+export declare function resolveSourceClaudeConfigDir(hostEnv: NodeJS.ProcessEnv): string;
 /**
  * Gap 4 of the run/chat orchestration Final Recommendation: what
  * `classifyFailure` (see `CreateAgentExecutorOptions.classifyFailure`) is
@@ -899,6 +963,39 @@ export interface CreateAgentExecutorOptions {
      * `command`/`daemonUrl` this package could assume on a caller's behalf.
      */
     readonly mcpJsonInjection?: McpJsonInjectionOptions;
+    /**
+     * Finding 1 of SEC-assistant-env-isolation-2026-09-07's injectable filesystem seams — see
+     * {@link ClaudeConfigDirIsolationOptions}'s own doc. This bag itself is still NOT a gate (supplying
+     * it only lets a test observe/replace the real filesystem calls); whether staging happens AT ALL is
+     * now {@link claudeConfigDirIsolationEnabled}'s job — see that field's doc for why the two were
+     * split apart instead of overloading this one's presence as the switch.
+     * @default the real `fs.promises.mkdtemp`/`readFile`/`rm` — no real disk I/O for every def other
+     * than `claude`, matching this factory's "no real filesystem by default in tests" convention.
+     */
+    readonly claudeConfigDirIsolation?: ClaudeConfigDirIsolationOptions;
+    /**
+     * The actual on/off switch for Finding 1's `CLAUDE_CONFIG_DIR` isolation (see
+     * {@link prepareClaudeConfigDirIfNeeded}'s doc for the staging behavior this gates). Split out as
+     * its own boolean rather than reusing {@link claudeConfigDirIsolation}'s presence, because that bag
+     * is a test-seam-injection convention shared with every other `*IsolationOptions`/`*Seams` field in
+     * this file (see `mcpJsonInjection`'s own "NOT a gate" precedent) — overloading it here would mean a
+     * host that only wants to override `mkdtemp` for a test silently also flips production behavior.
+     *
+     * @default `false`. This DEFAULTS OFF, which reopens the leak Finding 1 closed (the spawned
+     * `claude` child again reads the operator's real `~/.claude` — skills, plugins, memory index, and
+     * whatever tool grant that directory carries) — **not a regression discovered later, a deliberate
+     * rollback landed the same day as the isolation fix itself.** Reason: on macOS the Keychain login
+     * `claude auth status` reports is keyed to `CLAUDE_CONFIG_DIR` (see {@link
+     * prepareClaudeConfigDirForRun}'s doc), and no caller of this factory was passing a credential of
+     * its own (`AgentExecutorRunInput.credentialEnv`) when Finding 1 landed unconditionally — so every
+     * isolated child ran unauthenticated and the assistant reported "Not logged in" on its default
+     * runtime. A host that provisions a real `ANTHROPIC_API_KEY`/`CLAUDE_CODE_OAUTH_TOKEN` via
+     * `credentialEnv` (both outrank Keychain login in Claude Code's own auth precedence, so an isolated,
+     * still-logged-in child needs no access to the operator's personal Keychain entry at all) should
+     * flip this back on — the mechanism itself is unchanged and was already proven live
+     * (2026-09-07); only the default changed.
+     */
+    readonly claudeConfigDirIsolationEnabled?: boolean;
     /**
      * Ceiling on how many bytes of a `'until-close'` def's stdout this driver will hold in memory
      * before it stops accumulating and reports the shortfall — see
@@ -1024,7 +1121,7 @@ export declare function resolveMcpBridgeForRun(input: {
 export declare function computeChildEnv(spawnEnv: NodeJS.ProcessEnv, mcpBridge: McpBridgeDelivery | null, codexHomeDir?: string, systemPromptEnvOverrides?: Readonly<Record<string, string>>, stagedInstructionsFile?: {
     readonly varName: string;
     readonly path: string;
-}): NodeJS.ProcessEnv;
+}, claudeConfigDir?: string): NodeJS.ProcessEnv;
 /**
  * Phase 6b: the `RuntimeContext` `buildArgs` receives — `undefined` unless a file, bridge path, or
  * session id was staged. Pure.
@@ -1037,8 +1134,8 @@ export declare function computeChildEnv(spawnEnv: NodeJS.ProcessEnv, mcpBridge:
  * case for a resumed turn.
  */
 export declare function computeRuntimeContext(preparedPromptFile: PreparedPromptFile | null, preparedLogFile: PreparedAgentLogFile | null, mcpBridge: McpBridgeDelivery | null, resumeSessionId?: string | null, newSessionId?: string): RuntimeContext | undefined;
-/** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay at all (byte-identical to omitting the argument). Pure. */
-export declare function buildAgentBuildArgsOptions(input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode'>, systemPromptOverlay: string | null | undefined): RuntimeBuildOptions | undefined;
+/** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay/tool-restriction at all (byte-identical to omitting the argument). Pure. */
+export declare function buildAgentBuildArgsOptions(input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode' | 'disallowedTools' | 'allowedTools'>, systemPromptOverlay: string | null | undefined): RuntimeBuildOptions | undefined;
 /**
  * {@link resolveSystemPromptOverlayDelivery}'s decision, threaded out of that one resolver to every
  * channel that can actually carry the overlay to the CLI.
@@ -1218,6 +1315,39 @@ export declare function prepareCodexHomeIfNeeded(input: {
     readonly releaseStagedResources: () => Promise<void>;
     readonly failBeforeSpawn: FailBeforeSpawn;
 }): Promise<PreparedCodexHome | null>;
+/**
+ * Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stages this run's scratch
+ * `CLAUDE_CONFIG_DIR` directory, returning the prepared handle `cleanupStagedFiles` should later
+ * release (`null` for every def other than `claude` — see {@link prepareClaudeConfigDirForRun}'s
+ * own doc for why this is unconditional for `claude` runs, unlike {@link prepareCodexHomeIfNeeded}'s
+ * gate on a host-configured MCP bridge strategy).
+ *
+ * Gated on `def.id === 'claude'` directly rather than on `externalMcpInjection === 'claude-mcp-json'`
+ * (which `codebuddy` also declares): isolating the operator's personal `~/.claude` is specific to
+ * the real `claude` CLI's own config resolution, not to every def that happens to share its `.mcp.
+ * json` delivery shape. Matches the existing `USER`-for-claude-login special case already singled
+ * out by id in `BASELINE_AGENT_ENV_KEYS`'s own doc, a few hundred lines above.
+ *
+ * ALSO gated on `deps.enabled` (`CreateAgentExecutorOptions.claudeConfigDirIsolationEnabled`, default
+ * `false`) since this task's own fix — see that field's doc for why it defaults off (Keychain login
+ * is `CLAUDE_CONFIG_DIR`-keyed and no caller was supplying a credential when this was unconditional).
+ * `def.id === 'claude'` is still checked first and independently: a host that flips this flag on
+ * should not suddenly stage a directory for `codebuddy` or any other def.
+ * @param input.def - Used for both the `id` gate and the failure message.
+ * @param deps.enabled - The isolation on/off switch — see this function's own doc above.
+ * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceClaudeConfigDir} rather than read from a module-level `process.env`, matching {@link prepareCodexHomeIfNeeded}'s identical testability reasoning.
+ * @complexity O(1) plus {@link prepareClaudeConfigDirForRun}'s own cost.
+ */
+export declare function prepareClaudeConfigDirIfNeeded(input: {
+    readonly runId: string;
+    readonly def: RuntimeAgentDef;
+}, deps: {
+    readonly enabled: boolean;
+    readonly claudeConfigDirIsolation: ClaudeConfigDirIsolationOptions | undefined;
+    readonly hostEnv: NodeJS.ProcessEnv;
+    readonly releaseStagedResources: () => Promise<void>;
+    readonly failBeforeSpawn: FailBeforeSpawn;
+}): Promise<PreparedClaudeConfigDir | null>;
 /** Phase 11: post-`buildArgs` guard for argv-bound defs whose resolved binary is a Windows shim/.exe — a no-op off-Windows and for non-argv-bound defs. */
 export declare function guardWindowsCommandLineBudget(input: {
     readonly runId: string;

package/dist/agent-executor.js

@@ -825,6 +825,16 @@ function escapeTomlBasicString(value) {
 function tomlString(value) {
     return `"${escapeTomlBasicString(value)}"`;
 }
+/**
+ * Codex's per-tool deadline for the Jini bridge, in seconds: `@jini-ai/mcp`'s
+ * `DEFAULT_DELEGATED_TOOL_TIMEOUT_MS` (6 min, mirrored because this package does not depend on
+ * that one) plus 40 s. Codex's own default (60 s) is shorter than a delegated call parked on a
+ * human dialog, and when Codex abandons a call the dialog stayed answerable, so a late click ran
+ * an action the model had been told failed. Outlasting the bridge's deadline means the bridge
+ * times out first, drops its daemon request, and the daemon expires the dialog. Codex does not
+ * pass the parent env through to MCP servers, so the bridge under Codex always runs at its default.
+ */
+const CODEX_TOOL_TIMEOUT_SEC = 6 * 60 + 40;
 /**
  * Mechanism 5 of 5 — `'codex-toml'`'s serialization step. Builds the `[mcp_servers.jini]` TOML
  * table (plus, when the entry carries any env vars, a separate `[mcp_servers.jini.env]` table)
@@ -841,7 +851,8 @@ function tomlString(value) {
  */
 export function buildCodexMcpServerToml(entry) {
     const argsLiteral = entry.args.map(tomlString).join(', ');
-    const serverTable = `[mcp_servers.${JINI_MCP_SERVER_KEY}]\ncommand = ${tomlString(entry.command)}\nargs = [${argsLiteral}]\n`;
+    const serverTable = `[mcp_servers.${JINI_MCP_SERVER_KEY}]\ncommand = ${tomlString(entry.command)}\nargs = [${argsLiteral}]\n` +
+        `tool_timeout_sec = ${CODEX_TOOL_TIMEOUT_SEC}\n`;
     const envLines = Object.entries(entry.env)
         .filter((pair) => typeof pair[1] === 'string')
         .map(([key, value]) => `${key} = ${tomlString(value)}`);
@@ -849,6 +860,44 @@ export function buildCodexMcpServerToml(entry) {
         return serverTable;
     return `${serverTable}\n[mcp_servers.${JINI_MCP_SERVER_KEY}.env]\n${envLines.join('\n')}\n`;
 }
+/**
+ * Splits a TOML table header's dotted key into its individual segments, honoring quoted parts
+ * (`"basic"` or `'literal'`) that may themselves contain a literal `.` — a bare `.` only
+ * separates segments outside of quotes. Each segment is trimmed and, if quoted, unwrapped.
+ *
+ * Not a full TOML parser: it does not resolve escape sequences (`\"`, `\u...`) inside basic
+ * strings. That is deliberately out of scope — see {@link stripExistingJiniMcpServerTable}'s doc
+ * for why it is safe to skip for this specific comparison.
+ * @param rawKey - The raw text between a table header's `[` and `]`.
+ * @returns The dotted key's segments, dequoted and trimmed.
+ * @complexity O(n) in the length of `rawKey`.
+ */
+function splitTomlDottedKey(rawKey) {
+    const segments = [];
+    let current = '';
+    let quote = null;
+    for (const ch of rawKey) {
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                current += ch;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (ch === '.') {
+            segments.push(current.trim());
+            current = '';
+            continue;
+        }
+        current += ch;
+    }
+    segments.push(current.trim());
+    return segments;
+}
 /**
  * Removes any pre-existing `[mcp_servers.{@link JINI_MCP_SERVER_KEY}]` table — and its
  * `[mcp_servers.{@link JINI_MCP_SERVER_KEY}.*]` subtables (e.g. `.env`) — from a real Codex
@@ -856,10 +905,34 @@ export function buildCodexMcpServerToml(entry) {
  * without producing the duplicate TOML key Codex's parser rejects at startup.
  *
  * Line-oriented, not a real TOML parser (matching {@link buildCodexMcpServerToml}'s own
- * no-TOML-dependency constraint): a table header is any line that is, after trimming, exactly
- * `[...]`. Once such a header's key matches the jini table or one of its subtables, every following
- * line is dropped until the next table header (of any name) or EOF. Every other table, key, and
- * blank line is passed through untouched.
+ * no-TOML-dependency constraint), but wide enough to survive a hand-edited config, which is the
+ * scenario this whole function exists for. A table header line is recognized when, after
+ * trimming, it is `[<key>]` optionally followed only by a `# comment` (TOML's own grammar allows
+ * nothing else there) — so it tolerates leading indentation, whitespace inside the brackets, a
+ * trailing line comment, and a dotted key written with quoted segments (`["mcp_servers"."jini"]`),
+ * via {@link splitTomlDottedKey}. Once such a header's key matches the jini table or one of its
+ * subtables, every following line is dropped until the next table header (of any name) or EOF.
+ * Every other table, key, comment-only, and blank line is passed through untouched.
+ *
+ * Deliberately unhandled, and why it is safe to leave that way:
+ * - **Escape sequences inside quoted key segments** (e.g. a segment containing `\"`) — neither
+ *   `mcp_servers` nor {@link JINI_MCP_SERVER_KEY} ever needs escaping, and this driver's own
+ *   writer ({@link buildCodexMcpServerToml}) never emits a quoted form at all, so no real
+ *   `config.toml` this driver produced can exercise this gap; a hand-edit that goes out of its
+ *   way to escape a character inside a key that is supposed to spell "jini" would fail to match
+ *   and fall back to today's pre-fix behavior (append a duplicate) rather than silently doing
+ *   something worse.
+ * - **`[[array-of-tables]]` syntax** — Codex's schema has no array-of-tables shape for
+ *   `mcp_servers`, and the header regex's `[^[\]]+` capture cannot match a line starting with a
+ *   second `[`, so `[[mcp_servers.jini]]` is not recognized as a header before or after this fix
+ *   — unchanged, not a new gap.
+ * - **A single quoted segment that happens to spell the same characters with the dot included**
+ *   (e.g. `["mcp_servers.jini"]`, which in real TOML names one key literally containing a `.`,
+ *   not two nested tables) — this collapses to the same joined string as the real nested-table
+ *   spelling and is therefore treated as a match. This is a false positive in the conservative
+ *   direction the reported bug calls for: a missed detection duplicates a key and crashes Codex,
+ *   so on this axis over-matching a spelling nobody would plausibly hand-write for an MCP server
+ *   table is preferable to under-matching the real one.
  * @param existingRaw - The real Codex home's `config.toml` content, already known to be defined
  * (callers pass `''` for a missing file).
  * @returns `existingRaw` with any jini table/subtable removed.
@@ -870,9 +943,9 @@ function stripExistingJiniMcpServerTable(existingRaw) {
     const kept = [];
     let skipping = false;
     for (const line of existingRaw.split('\n')) {
-        const header = /^\s*\[([^[\]]+)\]\s*$/.exec(line);
+        const header = /^\s*\[([^[\]]+)\]\s*(#.*)?$/.exec(line);
         if (header) {
-            const key = (header[1] ?? '').trim();
+            const key = splitTomlDottedKey(header[1] ?? '').join('.');
             skipping = key === jiniTableKey || key.startsWith(`${jiniTableKey}.`);
             if (skipping)
                 continue;
@@ -1122,6 +1195,114 @@ async function prepareCodexHomeForRun(runId, entry, sourceCodexHomeDir, seams) {
         },
     };
 }
+function defaultMkdtempClaudeConfigDir(prefix) {
+    return fsPromises.mkdtemp(join(tmpdir(), prefix));
+}
+function defaultRemoveClaudeConfigDir(path) {
+    return fsPromises.rm(path, { recursive: true, force: true });
+}
+function resolveClaudeConfigDirSeams(options) {
+    return {
+        mkdtemp: options?.mkdtemp ?? defaultMkdtempClaudeConfigDir,
+        readFile: options?.readFile ?? defaultReadMcpJsonFile,
+        writeFile: options?.writeFile ?? defaultWriteMcpJsonFile,
+        removeDir: options?.removeDir ?? defaultRemoveClaudeConfigDir,
+    };
+}
+/**
+ * Where `claude`'s own config resolution reads the operator's REAL config from, to seed a run's
+ * scratch copy — never where it writes. Mirrors {@link resolveSourceCodexHomeDir}'s exact reasoning
+ * and resolution order: `CLAUDE_CONFIG_DIR` is not in `BASELINE_AGENT_ENV_KEYS`, so a spawned child
+ * never inherits it anyway — the whole point is finding wherever the *operator's actual* Claude Code
+ * install lives, a host-machine fact resolved against the daemon HOST process's own environment.
+ * @param hostEnv - The daemon process's own environment.
+ * @returns `hostEnv.CLAUDE_CONFIG_DIR` when set to a non-blank value (matching Claude Code's own
+ * resolution order, confirmed against installed Claude Code 2.1.263), else the CLI's documented
+ * default, `~/.claude`.
+ * @complexity O(1).
+ */
+export function resolveSourceClaudeConfigDir(hostEnv) {
+    const override = hostEnv.CLAUDE_CONFIG_DIR;
+    return override !== undefined && override.trim().length > 0 ? override : join(homedir(), '.claude');
+}
+/**
+ * Stages a fresh, randomly-named `CLAUDE_CONFIG_DIR` directory (same non-determinism requirement as
+ * {@link McpJsonInjectionOptions.mkdtemp}'s own doc — `os.tmpdir()` is a shared location on a
+ * multi-user host, so a guessable name is a real pre-plant/symlink target).
+ *
+ * **Deliberately empty by default** — unlike {@link prepareCodexHomeForRun}, which copies the real
+ * `config.toml` wholesale (Codex has no personal-data problem in that file), this directory gets
+ * NOTHING written into it beyond a best-effort copy of `.credentials.json` (see below). That is the
+ * fix: the operator's real `skills`/`plugins`/`agents`/`memory-path index`/`settings.json` must NOT
+ * carry over implicitly. `claude` runs correctly against a config directory holding nothing at all —
+ * it falls back to its own built-in defaults, not an error.
+ *
+ * **Login preservation, verified rather than assumed** (per this task's own instruction — "prove
+ * login still resolves; do not assume"): confirmed live (2026-09-07, installed Claude Code 2.1.263,
+ * macOS) that `claude auth status` reports `loggedIn: false` against ANY `CLAUDE_CONFIG_DIR` other
+ * than the operator's real one — including the real `HOME` with only `CLAUDE_CONFIG_DIR` swapped —
+ * and confirmed against Claude Code's own docs (code.claude.com/docs/en/authentication) why: "If
+ * you've set the CLAUDE_CONFIG_DIR environment variable, Claude Code keeps the .credentials.json
+ * file under that directory instead, including the file the macOS fallback writes, and keys the
+ * macOS Keychain entry to that directory too, so a session with a different CLAUDE_CONFIG_DIR reads
+ * a different entry." So a scratch directory is never logged in by default on ANY platform, not just
+ * the ones with no Keychain at all. This function only closes the *portable* case: when the source
+ * directory holds a file-based `.credentials.json` (Linux, Windows, or a Keychain-locked macOS
+ * fallback — none of which this function can distinguish, and does not need to), it is copied
+ * best-effort into the scratch directory, exactly `prepareCodexHomeForRun`'s `auth.json` copy. When
+ * it does not (a normal macOS Keychain-only install, confirmed the common case on this codebase's
+ * own dev machine), this function does NOT attempt to read the macOS Keychain itself — that would
+ * mean this daemon process extracting a live OAuth secret out of an OS-managed credential store into
+ * a plaintext file, a materially different and larger security surface than forwarding an
+ * already-resolved credential the host handed it (which `credentialEnv`/`ANTHROPIC_API_KEY` already
+ * does, safely, today — see `AgentExecutorRunInput.credentialEnv`'s own doc). In that case this
+ * mirrors `prepareCodexHomeForRun`'s own accepted outcome for a missing credential file verbatim:
+ * "the spawned CLI runs unauthenticated" is documented, existing, precedented behavior in this file,
+ * not a new failure mode invented here. A host that needs the isolated child to stay logged in on
+ * such an install must supply a credential explicitly via `AgentExecutorRunInput.credentialEnv`
+ * (`ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN` — both outrank Keychain-based subscription login
+ * in Claude Code's own auth precedence, so the isolated child authenticates without ever needing the
+ * operator's personal Keychain entry at all) — see this fix's own handoff report for the operational
+ * consequence on a host with no such credential configured yet.
+ *
+ * **Never touches the real config directory.** `sourceConfigDir` is read-only throughout.
+ * @param runId - Embedded in the temp-dir prefix for traceability, same sanitization discipline as {@link prepareCodexHomeForRun}'s `safeRunId`.
+ * @param sourceConfigDir - Where to read a possible real `.credentials.json` from — see {@link resolveSourceClaudeConfigDir}.
+ * @param seams - Injectable mkdtemp/readFile/writeFile/removeDir, real filesystem by default.
+ * @throws Whatever `mkdtemp` rejects with — the caller ({@link prepareClaudeConfigDirIfNeeded}) turns that into a pre-spawn `AGENT_SPAWN_FAILED` failure, matching {@link prepareCodexHomeForRun}'s own contract.
+ * @complexity O(1) plus one directory creation and up to one best-effort file read/write round trip.
+ */
+async function prepareClaudeConfigDirForRun(runId, sourceConfigDir, seams) {
+    const safeRunId = runId.replace(/[^A-Za-z0-9_-]/g, '-').slice(0, 80) || 'run';
+    const dir = await seams.mkdtemp(`jini-claude-config-${safeRunId}-`);
+    try {
+        const credentialsPath = join(sourceConfigDir, '.credentials.json');
+        let credentialsRaw;
+        try {
+            credentialsRaw = await seams.readFile(credentialsPath);
+        }
+        catch {
+            // No file-based credential to copy (the common macOS-Keychain-only case) — see this
+            // function's own doc for why that is an accepted, documented outcome, not a failure here.
+            credentialsRaw = undefined;
+        }
+        if (credentialsRaw !== undefined) {
+            await seams.writeFile(join(dir, '.credentials.json'), credentialsRaw);
+        }
+    }
+    catch (err) {
+        await seams.removeDir(dir).catch(() => {
+            // Best-effort only — the original error below is what the caller must see either way.
+        });
+        throw err;
+    }
+    return {
+        path: dir,
+        cleanup: async () => {
+            await seams.removeDir(dir);
+        },
+    };
+}
 /**
  * Default ceiling on the `'until-close'` stdout accumulator (see `RuntimeStdoutPolicy` in
  * `@jini-ai/agent-runtime`), in bytes of received UTF-8.
@@ -1303,6 +1484,13 @@ function wireChildLifecycle(ctx) {
             // `content` below already carries the whole raw output, a pre-existing, unrelated gap), so
             // there is no `remainder` to thread back in — only the extracted blocks are used here.
             let media = [];
+            // Suspend the slow-run watchdog for the duration of this daemon-awaited execution: the daemon
+            // knows exactly why the run is quiet here (it dispatched the tool itself and is waiting on it),
+            // so a legitimately long tool (an install, a build, a repo-wide scan) must not be mistaken for
+            // the CPU-starved-and-silent condition the watchdog exists to catch. Resumed in `finally` so a
+            // genuinely stalled stretch *after* this tool settles is still caught — see
+            // `RunLifecycle.suspendSlowRunNotice`'s own doc.
+            lifecycle.suspendSlowRunNotice(runId);
             try {
                 const result = await continuation.toolExecutor.execute(continuation.principal, run, toolUse.name, toolUse.input);
                 content = resultContent(result);
@@ -1313,6 +1501,9 @@ function wireChildLifecycle(ctx) {
                 content = errorMessage(error);
                 isError = true;
             }
+            finally {
+                lifecycle.resumeSlowRunNotice(runId);
+            }
             await lifecycle.emit(runId, {
                 event: 'agent',
                 data: {
@@ -1916,7 +2107,7 @@ export async function resolveMcpBridgeForRun(input, deps) {
  * @complexity O(1) plus `mergeEnvContentMcpConfig`'s and `mergeEnvContentInstructions`'s own `JSON.parse`/`JSON.stringify` cost.
  * @overallScore 100/100
  */
-export function computeChildEnv(spawnEnv, mcpBridge, codexHomeDir, systemPromptEnvOverrides, stagedInstructionsFile) {
+export function computeChildEnv(spawnEnv, mcpBridge, codexHomeDir, systemPromptEnvOverrides, stagedInstructionsFile, claudeConfigDir) {
     const envContentApplied = mcpBridge?.kind === 'env-content'
         ? {
             ...spawnEnv,
@@ -1936,7 +2127,12 @@ export function computeChildEnv(spawnEnv, mcpBridge, codexHomeDir, systemPromptE
             [stagedInstructionsFile.varName]: mergeEnvContentInstructions(envPassthroughApplied[stagedInstructionsFile.varName], stagedInstructionsFile.path),
         };
     const codexHomeApplied = codexHomeDir === undefined ? instructionsApplied : { ...instructionsApplied, CODEX_HOME: codexHomeDir };
-    return systemPromptEnvOverrides === undefined ? codexHomeApplied : { ...codexHomeApplied, ...systemPromptEnvOverrides };
+    // Finding 1 of SEC-assistant-env-isolation-2026-09-07: same "only set when staged" shape as
+    // codexHomeApplied above — mutually exclusive with it in practice (codexHomeDir is only ever set
+    // for a 'codex-toml' bridge, claudeConfigDir only ever for a `claude`-id run), so both existing
+    // side by side here is a documentation convenience, not a real collision risk.
+    const claudeConfigDirApplied = claudeConfigDir === undefined ? codexHomeApplied : { ...codexHomeApplied, CLAUDE_CONFIG_DIR: claudeConfigDir };
+    return systemPromptEnvOverrides === undefined ? claudeConfigDirApplied : { ...claudeConfigDirApplied, ...systemPromptEnvOverrides };
 }
 /**
  * Phase 6b: the `RuntimeContext` `buildArgs` receives — `undefined` unless a file, bridge path, or
@@ -1990,16 +2186,23 @@ function computeSystemPromptOverlay(promptAugmenter, agentId, runtimeContext) {
         turnIndex: runtimeContext?.hasPriorAssistantTurn ? 1 : 0,
     });
 }
-/** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay at all (byte-identical to omitting the argument). Pure. */
+/** Phase 9a: the def's `buildArgs` 4th argument — `undefined` when the run selects no model/reasoning/permissionMode/overlay/tool-restriction at all (byte-identical to omitting the argument). Pure. */
 export function buildAgentBuildArgsOptions(input, systemPromptOverlay) {
     const hasOverlay = systemPromptOverlay !== undefined && systemPromptOverlay !== null;
-    if (input.model === undefined && input.reasoning === undefined && input.permissionMode === undefined && !hasOverlay) {
+    if (input.model === undefined
+        && input.reasoning === undefined
+        && input.permissionMode === undefined
+        && input.disallowedTools === undefined
+        && input.allowedTools === undefined
+        && !hasOverlay) {
         return undefined;
     }
     return {
         ...(input.model !== undefined ? { model: input.model } : {}),
         ...(input.reasoning !== undefined ? { reasoning: input.reasoning } : {}),
         ...(input.permissionMode !== undefined ? { permissionMode: input.permissionMode } : {}),
+        ...(input.disallowedTools !== undefined ? { disallowedTools: input.disallowedTools } : {}),
+        ...(input.allowedTools !== undefined ? { allowedTools: input.allowedTools } : {}),
         ...(hasOverlay ? { systemPromptOverlay } : {}),
     };
 }
@@ -2210,6 +2413,41 @@ export async function prepareCodexHomeIfNeeded(input, deps) {
         return deps.failBeforeSpawn(input.runId, 'AGENT_SPAWN_FAILED', `AgentExecutor: could not stage a CODEX_HOME for agent "${input.def.id}": ${errorMessage(err)}`);
     }
 }
+/**
+ * Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stages this run's scratch
+ * `CLAUDE_CONFIG_DIR` directory, returning the prepared handle `cleanupStagedFiles` should later
+ * release (`null` for every def other than `claude` — see {@link prepareClaudeConfigDirForRun}'s
+ * own doc for why this is unconditional for `claude` runs, unlike {@link prepareCodexHomeIfNeeded}'s
+ * gate on a host-configured MCP bridge strategy).
+ *
+ * Gated on `def.id === 'claude'` directly rather than on `externalMcpInjection === 'claude-mcp-json'`
+ * (which `codebuddy` also declares): isolating the operator's personal `~/.claude` is specific to
+ * the real `claude` CLI's own config resolution, not to every def that happens to share its `.mcp.
+ * json` delivery shape. Matches the existing `USER`-for-claude-login special case already singled
+ * out by id in `BASELINE_AGENT_ENV_KEYS`'s own doc, a few hundred lines above.
+ *
+ * ALSO gated on `deps.enabled` (`CreateAgentExecutorOptions.claudeConfigDirIsolationEnabled`, default
+ * `false`) since this task's own fix — see that field's doc for why it defaults off (Keychain login
+ * is `CLAUDE_CONFIG_DIR`-keyed and no caller was supplying a credential when this was unconditional).
+ * `def.id === 'claude'` is still checked first and independently: a host that flips this flag on
+ * should not suddenly stage a directory for `codebuddy` or any other def.
+ * @param input.def - Used for both the `id` gate and the failure message.
+ * @param deps.enabled - The isolation on/off switch — see this function's own doc above.
+ * @param deps.hostEnv - The daemon's own environment, threaded through to {@link resolveSourceClaudeConfigDir} rather than read from a module-level `process.env`, matching {@link prepareCodexHomeIfNeeded}'s identical testability reasoning.
+ * @complexity O(1) plus {@link prepareClaudeConfigDirForRun}'s own cost.
+ */
+export async function prepareClaudeConfigDirIfNeeded(input, deps) {
+    if (input.def.id !== 'claude' || !deps.enabled) {
+        return null;
+    }
+    try {
+        return await prepareClaudeConfigDirForRun(input.runId, resolveSourceClaudeConfigDir(deps.hostEnv), resolveClaudeConfigDirSeams(deps.claudeConfigDirIsolation));
+    }
+    catch (err) {
+        await deps.releaseStagedResources();
+        return deps.failBeforeSpawn(input.runId, 'AGENT_SPAWN_FAILED', `AgentExecutor: could not stage a CLAUDE_CONFIG_DIR for agent "${input.def.id}": ${errorMessage(err)}`);
+    }
+}
 /** Phase 11: post-`buildArgs` guard for argv-bound defs whose resolved binary is a Windows shim/.exe — a no-op off-Windows and for non-argv-bound defs. */
 export async function guardWindowsCommandLineBudget(input, deps) {
     const windowsBudgetError = checkWindowsCmdShimCommandLineBudget(input.def, input.launchPath, input.args) ??
@@ -2350,6 +2588,8 @@ export function createAgentExecutor(options) {
     const continuation = options.continuation;
     const classifyFailure = options.classifyFailure;
     const mcpJsonInjection = options.mcpJsonInjection;
+    const claudeConfigDirIsolation = options.claudeConfigDirIsolation;
+    const claudeConfigDirIsolationEnabled = options.claudeConfigDirIsolationEnabled ?? false;
     const promptAugmenter = options.promptAugmenter;
     /**
      * Transitions `runId` to `'failed'` (idempotent, never resumable — no
@@ -2458,6 +2698,13 @@ export function createAgentExecutor(options) {
          * Only the `'codex-toml'` mechanism stages a directory at all.
          */
         let preparedCodexHome = null;
+        /**
+         * Set once `prepareClaudeConfigDirIfNeeded` has actually staged this run's scratch
+         * `CLAUDE_CONFIG_DIR`, so `cleanupStagedFiles` knows there is a directory (possibly holding a
+         * copied login credential) to remove. Cleared as it is consumed, matching `preparedCodexHome`'s
+         * identical single-removal discipline. Only a `claude`-id run stages a directory this way.
+         */
+        let preparedClaudeConfigDir = null;
         /**
          * Set once `prepareSystemPromptOverlayFileIfNeeded` has actually staged this run's overlay file
          * for a `'config-instructions-file'` def, so `cleanupStagedFiles` knows there is a temp
@@ -2481,6 +2728,11 @@ export function createAgentExecutor(options) {
                 preparedCodexHome = null;
                 await codexHomeToRemove.cleanup();
             }
+            if (preparedClaudeConfigDir) {
+                const claudeConfigDirToRemove = preparedClaudeConfigDir;
+                preparedClaudeConfigDir = null;
+                await claudeConfigDirToRemove.cleanup();
+            }
             if (preparedSystemPromptOverlayFile) {
                 const overlayFileToRemove = preparedSystemPromptOverlayFile;
                 preparedSystemPromptOverlayFile = null;
@@ -2537,6 +2789,19 @@ export function createAgentExecutor(options) {
         // so — unlike the `.mcp.json` staging above — this can run after `buildArgs` with no ordering
         // constraint of its own; it is placed here only to keep the two staging steps adjacent.
         preparedCodexHome = await prepareCodexHomeIfNeeded({ runId: input.runId, def, mcpBridge }, { mcpJsonInjection, hostEnv: process.env, releaseStagedResources, failBeforeSpawn });
+        // Finding 1 of SEC-assistant-env-isolation-2026-09-07's one effect — stage this run's scratch
+        // `CLAUDE_CONFIG_DIR` directory. Unconditional for a `claude`-id run (unlike CODEX_HOME above,
+        // this does not depend on `mcpJsonInjection` being configured at all — see
+        // `prepareClaudeConfigDirIfNeeded`'s own doc for why). Placed here only to stay adjacent to the
+        // other pre-`computeChildEnv` staging steps; `claude.ts`'s `buildArgs` needs no argv change for
+        // this (CLAUDE_CONFIG_DIR is an env var, not a flag), same as CODEX_HOME.
+        preparedClaudeConfigDir = await prepareClaudeConfigDirIfNeeded({ runId: input.runId, def }, {
+            enabled: claudeConfigDirIsolationEnabled,
+            claudeConfigDirIsolation,
+            hostEnv: process.env,
+            releaseStagedResources,
+            failBeforeSpawn,
+        });
         // `'config-instructions-file'`'s one effect — stage the overlay to a temp file so
         // `computeChildEnv` below has a real path to merge into that def's `instructions` array. A
         // no-op (`null`) for every other def/strategy or a run with no overlay at all. Independent of
@@ -2551,7 +2816,7 @@ export function createAgentExecutor(options) {
         // here ever read `childEnv`, so moving the call cost nothing.
         const childEnv = computeChildEnv(spawnEnv, mcpBridge, preparedCodexHome?.path, systemPromptEnvOverrides, preparedSystemPromptOverlayFile && def.systemPromptDelivery?.strategy === 'config-instructions-file'
             ? { varName: def.systemPromptDelivery.varName, path: preparedSystemPromptOverlayFile.path }
-            : undefined);
+            : undefined, preparedClaudeConfigDir?.path);
         // Post-buildArgs guard for argv-bound defs whose resolved binary is a
         // Windows .cmd/.bat shim or a direct .exe: a prompt under the raw byte
         // budget can still expand past CreateProcess's command-line cap once

package/dist/artifacts/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @module artifacts
+ *
+ * The generic artifact-store kernel port, ported from OD's
+ * `apps/daemon/src/artifacts/` (6 files). See `source-map.md` for full
+ * per-file provenance and the design decisions behind each generalization.
+ */
+export * from './manifest.js';
+export * from './store.js';
+export * from './publication-guard.js';
+export * from './runtime-compat.js';
+export * from './stub-guard.js';
+export * from './text-suppression.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/artifacts/index.js

@@ -0,0 +1,14 @@
+/**
+ * @module artifacts
+ *
+ * The generic artifact-store kernel port, ported from OD's
+ * `apps/daemon/src/artifacts/` (6 files). See `source-map.md` for full
+ * per-file provenance and the design decisions behind each generalization.
+ */
+export * from './manifest.js';
+export * from './store.js';
+export * from './publication-guard.js';
+export * from './runtime-compat.js';
+export * from './stub-guard.js';
+export * from './text-suppression.js';
+//# sourceMappingURL=index.js.map