@parall/daemon 1.42.0 → 1.43.0

package/dist/clip-runtime/hub-client.d.ts

@@ -7,7 +7,7 @@
  * it reads its binding via GetBindings, then passes clip_token straight to
  * Invoke(clip_name="browser", ...). The hub verifies the signed token, resolves
  * the bound BrowserProfile's host machine (B), and forwards the InvokeCommand
- * there. See docs/engineering-design/browser-profile-clip-integration.md §11.3.
+ * there. See docs/archive/engineering-design/browser-profile-clip-integration.md §11.3.
  *
  * Protocol (same Connect envelope framing as clip-provider.ts):
  *   POST /clip.v1.ClipHubService/GetBindings   (unary)

package/dist/clip-runtime/hub-client.js

@@ -7,7 +7,7 @@
  * it reads its binding via GetBindings, then passes clip_token straight to
  * Invoke(clip_name="browser", ...). The hub verifies the signed token, resolves
  * the bound BrowserProfile's host machine (B), and forwards the InvokeCommand
- * there. See docs/engineering-design/browser-profile-clip-integration.md §11.3.
+ * there. See docs/archive/engineering-design/browser-profile-clip-integration.md §11.3.
  *
  * Protocol (same Connect envelope framing as clip-provider.ts):
  *   POST /clip.v1.ClipHubService/GetBindings   (unary)

package/dist/clip-runtime/process-manager.d.ts

@@ -95,7 +95,7 @@ export declare class ClipProcessManager {
      * (GetBindings), then forward the invoke through the hub (Invoke) to the bound
      * BrowserProfile's host. No local shortcut, no fallback — unbound is rejected.
      * The execution daemon never verifies clip_token; the hub does.
-     * See docs/engineering-design/browser-profile-clip-integration.md §11.3.
+     * See docs/archive/engineering-design/browser-profile-clip-integration.md §11.3.
      */
     private invokeDependency;
     /**
@@ -103,7 +103,7 @@ export declare class ClipProcessManager {
      * synthetic "browser" clip). The hub forwards clip_token as the PLAINTEXT
      * browser_profile_id, which the host daemon uses directly as the bb-browser
      * account. Only daemons that host BrowserProfiles register this capability.
-     * See docs/engineering-design/browser-profile-clip-integration.md §11.2.
+     * See docs/archive/engineering-design/browser-profile-clip-integration.md §11.2.
      */
     invokeBrowserCapability(clipToken: string, command: string, input: unknown): Promise<unknown>;
     private setStatus;

package/dist/clip-runtime/process-manager.js

@@ -417,7 +417,7 @@ export class ClipProcessManager {
      * (GetBindings), then forward the invoke through the hub (Invoke) to the bound
      * BrowserProfile's host. No local shortcut, no fallback — unbound is rejected.
      * The execution daemon never verifies clip_token; the hub does.
-     * See docs/engineering-design/browser-profile-clip-integration.md §11.3.
+     * See docs/archive/engineering-design/browser-profile-clip-integration.md §11.3.
      */
     async invokeDependency(clipName, command, input, context) {
         if (!isBrowserDependencyName(clipName)) {
@@ -459,7 +459,7 @@ export class ClipProcessManager {
      * synthetic "browser" clip). The hub forwards clip_token as the PLAINTEXT
      * browser_profile_id, which the host daemon uses directly as the bb-browser
      * account. Only daemons that host BrowserProfiles register this capability.
-     * See docs/engineering-design/browser-profile-clip-integration.md §11.2.
+     * See docs/archive/engineering-design/browser-profile-clip-integration.md §11.2.
      */
     async invokeBrowserCapability(clipToken, command, input) {
         if (!this.browserProfileManager) {

package/dist/config.d.ts

@@ -63,6 +63,13 @@ export type ClaudeDaemonConfig = {
      * 60s; 0 = confirm immediately on the first machine.hello.
      */
     updateConfirmDelayMs: number;
+    /**
+     * Machine-level kill switch for per-agent HOME isolation
+     * (PRLL_DAEMON_HOME_ISOLATION=0). When true, every agent spawns with the
+     * legacy shared-HOME behavior regardless of its daemon_config.home_isolation
+     * — an instant local rollback that needs no server round-trip.
+     */
+    homeIsolationDisabled: boolean;
 };
 export declare function daemonConfigPath(env?: NodeJS.ProcessEnv): string;
 export declare function resolveClaudeDaemonConfig(env?: NodeJS.ProcessEnv): ClaudeDaemonConfig;
@@ -78,6 +85,8 @@ export declare function sharedClaudeCredentialsFileFor(rootClaudeHome: string):
 export declare function agentClaudeCredentialsFileFor(agentClaudeHome: string): string;
 /** Per-agent workspace dir where the agent runs git commands. */
 export declare function agentWorkspaceDirFor(rootStateDir: string, agentId: string): string;
+/** Per-agent fake HOME for local credential isolation (home-isolation.ts). */
+export declare function agentHomeDirFor(rootStateDir: string, agentId: string): string;
 /**
  * Whether manual CLI update verifies the Ed25519 bundle signature. Supervised
  * daemon self-update is always fail-closed; this resolver is only a LOCAL-DEV

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAe,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAuBF,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,kBAAkB,CA8DpB;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEzF;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAMR"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAe,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,2GAA2G;IAC3G,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;CAChC,CAAC;AAuBF,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAyBD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,kBAAkB,CA+DpB;AASD,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;mEAEmE;AACnE,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEzF;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CAMR"}

package/dist/config.js

@@ -94,6 +94,7 @@ export function resolveClaudeDaemonConfig(env = process.env) {
         updateIntervalMs: parseMsAllowZero(env.PRLL_DAEMON_UPDATE_INTERVAL_MS, 6 * 60 * 60_000),
         updateDisabled: env.PRLL_DAEMON_UPDATE_DISABLED === 'true' || !!env.KUBERNETES_SERVICE_HOST,
         updateConfirmDelayMs: parseMsAllowZero(env.PRLL_DAEMON_UPDATE_CONFIRM_DELAY_MS?.trim() || undefined, 60_000),
+        homeIsolationDisabled: env.PRLL_DAEMON_HOME_ISOLATION?.trim() === '0',
     };
 }
 function assertSafeAgentId(agentId) {
@@ -124,6 +125,10 @@ export function agentClaudeCredentialsFileFor(agentClaudeHome) {
 export function agentWorkspaceDirFor(rootStateDir, agentId) {
     return path.join(rootStateDir, 'agents', assertSafeAgentId(agentId), 'workspace');
 }
+/** Per-agent fake HOME for local credential isolation (home-isolation.ts). */
+export function agentHomeDirFor(rootStateDir, agentId) {
+    return path.join(rootStateDir, 'agents', assertSafeAgentId(agentId), 'home');
+}
 /**
  * Whether manual CLI update verifies the Ed25519 bundle signature. Supervised
  * daemon self-update is always fail-closed; this resolver is only a LOCAL-DEV

package/dist/home-isolation.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Per-agent HOME isolation for local (BYOC) daemon machines.
+ *
+ * A spawned agent gets a fake HOME at `<stateDir>/home` so third-party CLI
+ * credentials it writes while working (gh / aws / npm / docker / kubectl …)
+ * land in a per-agent directory instead of the operator's real $HOME. Runtime
+ * login state stays SHARED with the operator through an explicit passthrough
+ * list:
+ *
+ *   .claude            → <claudeStateRoot>/.claude        (settings + Linux OAuth file)
+ *   .claude.json       → <claudeStateRoot>/.claude.json   (Claude Code global state)
+ *   Library/Keychains  → <systemHome>/Library/Keychains   (macOS only — the Security
+ *                        framework locates the login keychain via $HOME, so without
+ *                        this link the whole Keychain, and Claude's OAuth token with
+ *                        it, disappears from the child's view)
+ *
+ * Codex needs no link: the supervisor points runtime_auth children at the
+ * operator's real ~/.codex via CODEX_HOME (runtimes.ts). ssh needs none
+ * either — OpenSSH resolves ~ via getpwuid(), not $HOME, so it always sees
+ * the real ~/.ssh regardless of the fake HOME.
+ *
+ * Directory-level symlinks are deliberate: CLIs that rewrite files via
+ * temp-file + atomic rename do so INSIDE the real directory, so the links
+ * can't be silently replaced. For the one file-level link (.claude.json,
+ * in-place writes as of Claude Code 2.1.x) `ensureLink` self-heals on every
+ * child start: if a rename ever swaps the symlink for a regular file, the
+ * file is preserved aside and the link rebuilt.
+ *
+ * This module is NOT a security boundary — it prevents accidental credential
+ * cross-writes, not malicious absolute-path access. K8s daemons never come
+ * through here (single-tenant pods use the per-agent claude-home branch with
+ * ensureSharedCredentialLink below).
+ */
+interface Log {
+    info(msg: string): void;
+    warn(msg: string): void;
+}
+export interface IsolatedHomeSpec {
+    /** The fake HOME to build, `<stateDir>/home`. */
+    homeDir: string;
+    /** Where the shared Claude state actually lives (rootClaudeHome). */
+    claudeStateRoot: string;
+    /** The operator's real OS home (Keychain location on macOS). */
+    systemHome: string;
+    /** Git identity written to a per-agent .gitconfig (created once, never overwritten). */
+    gitUserName: string;
+    gitUserEmail: string;
+}
+/**
+ * Build the fake HOME. Throws only when the HOME directory itself cannot be
+ * created (nothing to isolate into); individual passthrough links and the
+ * gitconfig are SOFT failures collected into the return value — the caller
+ * decides whether the failed surface is load-bearing for this agent's
+ * runtime + LLM source (e.g. a broken Claude link only matters for
+ * claude-code on runtime_auth; a parall-source agent runs fine in a fake
+ * HOME with no links, exactly like a hosted K8s pod).
+ */
+export declare function ensureIsolatedHome(spec: IsolatedHomeSpec, agentId: string, log: Log, platform?: NodeJS.Platform): string[];
+/**
+ * K8s branch: each agent has an isolated claude home, but all of them share
+ * one runtime-auth OAuth credential file. Link the agent's
+ * `.claude/.credentials.json` back to the shared copy under rootClaudeHome.
+ * (Moved verbatim from DaemonSupervisor; local isolation above does not use
+ * this — its directory-level .claude link already carries the credential.)
+ */
+export declare function ensureSharedCredentialLink(rootClaudeHome: string, agentClaudeHome: string, agentId: string, log: Log): void;
+export {};
+//# sourceMappingURL=home-isolation.d.ts.map

package/dist/home-isolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-isolation.d.ts","sourceRoot":"","sources":["../src/home-isolation.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,UAAU,GAAG;IACX,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,GAAG,EACR,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,EAAE,CA0DV;AAiDD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,GAAG,GACP,IAAI,CA6BN"}

package/dist/home-isolation.js

@@ -0,0 +1,130 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { agentClaudeCredentialsFileFor, sharedClaudeCredentialsFileFor } from './config.js';
+/**
+ * Build the fake HOME. Throws only when the HOME directory itself cannot be
+ * created (nothing to isolate into); individual passthrough links and the
+ * gitconfig are SOFT failures collected into the return value — the caller
+ * decides whether the failed surface is load-bearing for this agent's
+ * runtime + LLM source (e.g. a broken Claude link only matters for
+ * claude-code on runtime_auth; a parall-source agent runs fine in a fake
+ * HOME with no links, exactly like a hosted K8s pod).
+ */
+export function ensureIsolatedHome(spec, agentId, log, platform = process.platform) {
+    fs.mkdirSync(spec.homeDir, { recursive: true });
+    const failures = [];
+    const attempt = (label, fn) => {
+        try {
+            fn();
+        }
+        catch (err) {
+            failures.push(`${label}: ${String(err)}`);
+        }
+    };
+    // The .claude link is directory-level: a dangling directory symlink cannot
+    // be mkdir'd through (unlike the .claude.json FILE link, which writes can
+    // create through), so materialize the real target first — a fresh host
+    // where the operator never ran Claude would otherwise strand the child on
+    // ENOENT when it tries to create session state under ~/.claude/.
+    attempt('.claude link', () => {
+        fs.mkdirSync(path.join(spec.claudeStateRoot, '.claude'), { recursive: true });
+        ensureLink(path.join(spec.homeDir, '.claude'), path.join(spec.claudeStateRoot, '.claude'), agentId, log);
+    });
+    attempt('.claude.json link', () => ensureLink(path.join(spec.homeDir, '.claude.json'), path.join(spec.claudeStateRoot, '.claude.json'), agentId, log));
+    if (platform === 'darwin') {
+        attempt('Library/Keychains link', () => {
+            fs.mkdirSync(path.join(spec.homeDir, 'Library'), { recursive: true });
+            ensureLink(path.join(spec.homeDir, 'Library', 'Keychains'), path.join(spec.systemHome, 'Library', 'Keychains'), agentId, log);
+        });
+    }
+    attempt('.gitconfig', () => {
+        const gitconfig = path.join(spec.homeDir, '.gitconfig');
+        if (!fs.existsSync(gitconfig)) {
+            fs.writeFileSync(gitconfig, `[user]\n\tname = ${gitConfigValue(spec.gitUserName)}\n\temail = ${gitConfigValue(spec.gitUserEmail)}\n`, { mode: 0o644 });
+            log.info(`agent ${agentId}: wrote per-agent .gitconfig (${spec.gitUserName})`);
+        }
+    });
+    return failures;
+}
+/**
+ * Serialize a git-config value: flatten line/tab control chars onto one ini line, then
+ * always double-quote with backslash/quote escaping — display names may
+ * legally carry `"` or `\`, which an unquoted value turns into `bad config
+ * line` for every git command in the isolated HOME.
+ */
+function gitConfigValue(value) {
+    const flat = value.replace(/[\r\n\t]+/g, ' ').trim();
+    return `"${flat.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+/**
+ * Idempotent passthrough link with self-healing:
+ *  - missing → create (a dangling link is fine — e.g. .claude.json before the
+ *    operator's first Claude run; writes through it create the real file)
+ *  - correct symlink → no-op
+ *  - wrong-target symlink → relink
+ *  - regular file/dir squatting on the link name (an atomic-rename swap or a
+ *    stray write) → preserve it aside, relink, warn. Never delete user data.
+ */
+function ensureLink(linkPath, target, agentId, log) {
+    let existing;
+    try {
+        existing = fs.lstatSync(linkPath);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+    if (existing) {
+        if (existing.isSymbolicLink()) {
+            const current = fs.readlinkSync(linkPath);
+            if (path.resolve(path.dirname(linkPath), current) === path.resolve(target))
+                return;
+            fs.unlinkSync(linkPath);
+            log.info(`agent ${agentId}: relinking ${linkPath} → ${target}`);
+        }
+        else {
+            const preserved = `${linkPath}.pre-isolation.${Date.now()}`;
+            fs.renameSync(linkPath, preserved);
+            log.warn(`agent ${agentId}: ${linkPath} was a real ${existing.isDirectory() ? 'directory' : 'file'}, ` +
+                `not the expected passthrough symlink — preserved at ${preserved} and relinked`);
+        }
+    }
+    fs.symlinkSync(target, linkPath);
+}
+/**
+ * K8s branch: each agent has an isolated claude home, but all of them share
+ * one runtime-auth OAuth credential file. Link the agent's
+ * `.claude/.credentials.json` back to the shared copy under rootClaudeHome.
+ * (Moved verbatim from DaemonSupervisor; local isolation above does not use
+ * this — its directory-level .claude link already carries the credential.)
+ */
+export function ensureSharedCredentialLink(rootClaudeHome, agentClaudeHome, agentId, log) {
+    const sharedCredentials = path.resolve(sharedClaudeCredentialsFileFor(rootClaudeHome));
+    const agentCredentials = agentClaudeCredentialsFileFor(agentClaudeHome);
+    const agentCredentialsDir = path.dirname(agentCredentials);
+    fs.mkdirSync(path.dirname(sharedCredentials), { recursive: true });
+    fs.mkdirSync(agentCredentialsDir, { recursive: true });
+    try {
+        const existing = fs.lstatSync(agentCredentials);
+        if (existing.isSymbolicLink()) {
+            const currentTarget = fs.readlinkSync(agentCredentials);
+            if (path.resolve(agentCredentialsDir, currentTarget) === sharedCredentials) {
+                return;
+            }
+            fs.unlinkSync(agentCredentials);
+        }
+        else if (existing.isDirectory()) {
+            log.warn(`agent ${agentId}: credential path is a directory, cannot link ${agentCredentials}`);
+            return;
+        }
+        else {
+            fs.unlinkSync(agentCredentials);
+        }
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            throw err;
+        }
+    }
+    fs.symlinkSync(sharedCredentials, agentCredentials);
+}

package/dist/runtimes.d.ts

@@ -11,6 +11,13 @@ export interface AgentDirs {
     stateDir: string;
     workspaceDir: string;
     claudeHome: string;
+    /**
+     * Per-agent fake HOME (local credential isolation, home-isolation.ts).
+     * Unset = legacy shared-HOME behavior and all K8s daemons. When set, the
+     * child's $HOME points here so third-party CLI credentials it writes stay
+     * per-agent; runtime login state is passed back through explicit links.
+     */
+    homeDir?: string;
 }
 /**
  * Resolve a runtime adapter, preferring overlay bundle paths when available.

package/dist/runtimes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtimes.d.ts","sourceRoot":"","sources":["../src/runtimes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,YAAY,EAAE,cAAc,EAAE,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,CACN,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,EACf,EAAE,CAAC,EAAE,cAAc,GAClB,MAAM,CAAC,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAuED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAerE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAInD"}
+{"version":3,"file":"runtimes.d.ts","sourceRoot":"","sources":["../src/runtimes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAa,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,YAAY,EAAE,cAAc,EAAE,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,CACN,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,EACf,EAAE,CAAC,EAAE,cAAc,GAClB,MAAM,CAAC,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAqGD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAerE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAInD"}

package/dist/runtimes.js

@@ -1,6 +1,7 @@
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
-import { clearAllProviderCreds } from '@parall/agent-core';
+import { clearAllProviderCreds, llmSource } from '@parall/agent-core';
 import { resolveBundleDir } from './config.js';
 export { clearAllProviderCreds };
 function buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
@@ -14,6 +15,12 @@ function buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
     env.PRLL_WORKSPACE_DIR = dirs.workspaceDir;
     if (pc)
         env.PRLL_PROVIDER_CONFIG = JSON.stringify(pc);
+    // HOME isolation happens HERE and nowhere earlier: runtime binary
+    // resolution (applyRuntimeBinaryEnv) must see the operator's real HOME to
+    // derive nvm/Homebrew/pnpm paths, so the supervisor applies it to baseEnv
+    // BEFORE buildEnv. Do not hoist this assignment above that call site.
+    if (dirs.homeDir)
+        env.HOME = dirs.homeDir;
     delete env.PRLL_DAEMON_MODE;
     return env;
 }
@@ -31,7 +38,33 @@ const codexAdapter = {
     args: [],
     buildEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
         const env = buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc);
-        env.PRLL_CODEX_HOME = path.join(dirs.stateDir, '.codex');
+        // CODEX_HOME placement: shared with the operator ONLY for local
+        // runtime_auth agents — they need the credential `codex login` writes to
+        // CODEX_HOME / ~/.codex (a headless child cannot log in itself; an
+        // isolated home strands them in a permanent 401 loop), and they never
+        // write the [model_providers.parall] block. Every other source keeps the
+        // isolated per-agent home: a parall-mode bridge rewrites that provider
+        // block with ITS OWN api_url and threads select the provider by fixed
+        // name, so through a shared config.toml a staging daemon's rewrite would
+        // route a coexisting prod agent's traffic (and its agk_ key) to the
+        // staging endpoint. K8s daemons always isolate, mirroring the Claude
+        // home policy (supervisor spawnAgentOnce).
+        if (baseEnv.KUBERNETES_SERVICE_HOST || llmSource(pc) !== 'runtime_auth') {
+            env.PRLL_CODEX_HOME = path.join(dirs.stateDir, '.codex');
+        }
+        else if (dirs.homeDir && !env.CODEX_HOME) {
+            // runtime_auth + isolated HOME: the bridge's fallback is $HOME/.codex,
+            // which under the fake HOME would strand the child in a 401 loop.
+            // Point CODEX_HOME at the operator's real ~/.codex (where `codex login`
+            // writes) — baseEnv.HOME is still the daemon's real HOME here, the fake
+            // HOME was applied to env only. Operator overrides win over this
+            // default: an exported CODEX_HOME (already in env via baseEnv) skips
+            // this branch, and an exported PRLL_CODEX_HOME rides through untouched
+            // and outranks CODEX_HOME in the bridge's resolution — the same
+            // explicit-redirect contract the shared-HOME runtime_auth path has
+            // always honored.
+            env.CODEX_HOME = path.join(baseEnv.HOME || os.homedir(), '.codex');
+        }
         return env;
     },
 };

package/dist/supervisor.d.ts

@@ -179,6 +179,14 @@ export declare class DaemonSupervisor {
     private clearAgentConfigRefreshRetry;
     private restartChildNow;
     private spawnAgent;
+    /**
+     * Local credential isolation (home-isolation.ts): per-agent opt-in via
+     * daemon_config.home_isolation (unset = legacy shared HOME for existing
+     * agents), machine-level kill switch PRLL_DAEMON_HOME_ISOLATION=0. K8s
+     * pods never take this path — they keep the isolated claude-home +
+     * shared-credential-link branch in spawnAgentOnce.
+     */
+    private buildHomeIsolationSpec;
     private spawnAgentOnce;
     private startChild;
     /**
@@ -188,6 +196,5 @@ export declare class DaemonSupervisor {
      * may start a replacement child immediately after awaiting.
      */
     private terminateChild;
-    private ensureSharedCredentialLink;
 }
 //# sourceMappingURL=supervisor.d.ts.map

package/dist/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAgBL,KAAK,YAAY,EAElB,MAAM,aAAa,CAAC;AAUrB,OAAO,EAKL,KAAK,kBAAkB,EAExB,MAAM,aAAa,CAAC;AAUrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAsBvE;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAyB5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAyEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IA1EtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAM3D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAoC;IAM3E,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAA6B;IAC1E,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAqC;IACnF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAKrD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAQ1D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IAC1D,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,gBAAgB,CAAoB;IAG5C,OAAO,CAAC,sBAAsB,CAAQ;IAItC,OAAO,CAAC,sBAAsB,CAAuB;IAGrD,OAAO,CAAC,uBAAuB,CAAuB;IACtD,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAA8B;IAI7C,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,kBAAkB,CAAmC;IAC7D,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,kBAAkB,CAA+B;IACzD,OAAO,CAAC,qBAAqB,CAA8B;IAI3D,OAAO,CAAC,gBAAgB,CAAkC;IAC1D,OAAO,CAAC,kBAAkB,CAA+B;IACzD,OAAO,CAAC,qBAAqB,CAA8B;IAE3D,OAAO,CAAC,gBAAgB,CAAyC;IAIjE,OAAO,CAAC,SAAS,CAA0B;IAC3C,OAAO,CAAC,YAAY,CAAuB;gBAGxB,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa;IAGrC,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAIxC;wFACoF;IACpF,aAAa,CAAC,IAAI,EAAE,uBAAuB,GAAG,IAAI;IAIlD,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkN7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YA8Db,kBAAkB;YAwClB,aAAa;YA6Eb,gBAAgB;YAiBhB,wBAAwB;IAiMtC;;;;;;;;;OASG;YACW,0BAA0B;IAkBxC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YA6CX,kBAAkB;YAqBlB,mBAAmB;YAgBnB,mBAAmB;YAqBnB,sBAAsB;YAwBtB,6BAA6B;IA6E3C,OAAO,CAAC,8BAA8B;IAkCtC,OAAO,CAAC,uBAAuB;IA4B/B,OAAO,CAAC,2BAA2B;IAYnC;;;;;OAKG;YACW,0BAA0B;IAiCxC,OAAO,CAAC,2BAA2B;YAIrB,cAAc;YAId,qBAAqB;YAgBrB,wBAAwB;IAoDtC,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,sBAAsB;IAM9B;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IA0B/B,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,uBAAuB;IAyB/B,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,mBAAmB;YAab,mBAAmB;IAyCjC,OAAO,CAAC,wBAAwB;YAelB,6BAA6B;IAqC3C,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,wBAAwB;YAUlB,oBAAoB;IAmClC;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;;;OAQG;YACW,sBAAsB;YA4CtB,kBAAkB;IAahC;;;;;;;;;OASG;YACW,wBAAwB;IAwDtC;;;;;;;OAOG;YACW,qBAAqB;IAcnC,OAAO,CAAC,+BAA+B;IAYvC,OAAO,CAAC,4BAA4B;YAQtB,eAAe;YAgDf,UAAU;YA+BV,cAAc;IAkE5B,OAAO,CAAC,UAAU;IA0HlB;;;;;OAKG;YACW,cAAc;IAyB5B,OAAO,CAAC,0BAA0B;CAkCnC"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAgBL,KAAK,YAAY,EAElB,MAAM,aAAa,CAAC;AAUrB,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AAerB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAsBvE;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3E;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC;AA4B5B;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAyEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IA1EtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiC;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAM3D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAoC;IAM3E,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAA6B;IAC1E,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAqC;IACnF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAKrD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAQ1D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAyB;IAC1D,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,gBAAgB,CAAoB;IAG5C,OAAO,CAAC,sBAAsB,CAAQ;IAItC,OAAO,CAAC,sBAAsB,CAAuB;IAGrD,OAAO,CAAC,uBAAuB,CAAuB;IACtD,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAA8B;IAI7C,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,kBAAkB,CAAmC;IAC7D,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,kBAAkB,CAA+B;IACzD,OAAO,CAAC,qBAAqB,CAA8B;IAI3D,OAAO,CAAC,gBAAgB,CAAkC;IAC1D,OAAO,CAAC,kBAAkB,CAA+B;IACzD,OAAO,CAAC,qBAAqB,CAA8B;IAE3D,OAAO,CAAC,gBAAgB,CAAyC;IAIjE,OAAO,CAAC,SAAS,CAA0B;IAC3C,OAAO,CAAC,YAAY,CAAuB;gBAGxB,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,aAAa;IAGrC,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAIxC;wFACoF;IACpF,aAAa,CAAC,IAAI,EAAE,uBAAuB,GAAG,IAAI;IAIlD,yEAAyE;IACnE,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkN7C,sEAAsE;IAChE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YA8Db,kBAAkB;YAwClB,aAAa;YAsGb,gBAAgB;YAiBhB,wBAAwB;IAiMtC;;;;;;;;;OASG;YACW,0BAA0B;IAkBxC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YA6CX,kBAAkB;YAqBlB,mBAAmB;YAgBnB,mBAAmB;YAqBnB,sBAAsB;YAwBtB,6BAA6B;IA6E3C,OAAO,CAAC,8BAA8B;IAkCtC,OAAO,CAAC,uBAAuB;IA4B/B,OAAO,CAAC,2BAA2B;IAYnC;;;;;OAKG;YACW,0BAA0B;IAiCxC,OAAO,CAAC,2BAA2B;YAIrB,cAAc;YAId,qBAAqB;YAgBrB,wBAAwB;IAoDtC,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,sBAAsB;IAM9B;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IA0B/B,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,uBAAuB;IAyB/B,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,mBAAmB;YAab,mBAAmB;IAyCjC,OAAO,CAAC,wBAAwB;YAelB,6BAA6B;IAqC3C,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,wBAAwB;YAUlB,oBAAoB;IAmClC;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;;;OAQG;YACW,sBAAsB;YA4CtB,kBAAkB;IAahC;;;;;;;;;OASG;YACW,wBAAwB;IAwDtC;;;;;;;OAOG;YACW,qBAAqB;IAcnC,OAAO,CAAC,+BAA+B;IAYvC,OAAO,CAAC,4BAA4B;YAQtB,eAAe;YAgDf,UAAU;IA+BxB;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;YAgBhB,cAAc;IAoE5B,OAAO,CAAC,UAAU;IAiKlB;;;;;OAKG;YACW,cAAc;CAwB7B"}

package/dist/supervisor.js

@@ -1,13 +1,15 @@
 import { spawn } from 'node:child_process';
 import * as fs from 'node:fs';
+import * as os from 'node:os';
 import * as path from 'node:path';
-import { effectiveLLMSourceExplicit } from '@parall/agent-core';
+import { effectiveLLMSourceExplicit, llmSource } from '@parall/agent-core';
 import { ParallWs, } from '@parall/sdk';
 import { installClip, parseSource } from './clip-runtime/clip-installer.js';
 import { parseIpcCommands } from './clip-runtime/manifest.js';
 import { BrowserProfilePool, ClipProcessManager, ClipProvider, HubClient, } from './clip-runtime/index.js';
-import { agentClaudeCredentialsFileFor, agentClaudeHomeFor, agentStateDirFor, agentWorkspaceDirFor, sharedClaudeCredentialsFileFor, } from './config.js';
+import { agentClaudeHomeFor, agentHomeDirFor, agentStateDirFor, agentWorkspaceDirFor, } from './config.js';
 import { listDirectory } from './filesystem.js';
+import { ensureIsolatedHome, ensureSharedCredentialLink, } from './home-isolation.js';
 import { assertAgentKey, getRuntimeAdapter } from './runtimes.js';
 import { applyRuntimeBinaryEnv } from './runtime-bin-resolver.js';
 import { detectedRuntimesEqual, detectRuntimes, summarizeDetectedRuntimes, } from './runtime-detector.js';
@@ -442,6 +444,28 @@ export class DaemonSupervisor {
                 await this.spawnAgent(userId, orgId, a);
             }
             else {
+                // Catch up on a home_isolation flip missed while the WS was down
+                // (machine.workspace.setup.requested is delivered live only). The
+                // isolation spec lives on ChildState, so a plain child respawn would
+                // keep the stale mode — rebuild the state from the fresh entry, the
+                // same terminate+spawn shape as handleWorkspaceSetupRequested.
+                const isolationChanged = !existing.shuttingDown &&
+                    !!existing.homeIsolation !== !!this.buildHomeIsolationSpec(a, userId);
+                if (isolationChanged) {
+                    this.log.info(`agent ${userId}: home isolation changed while disconnected — rebuilding child`);
+                    existing.shuttingDown = true;
+                    if (existing.restartTimer) {
+                        clearTimeout(existing.restartTimer);
+                        existing.restartTimer = null;
+                    }
+                    await this.terminateChild(existing);
+                    this.children.delete(userId);
+                    const orgId = this.machineOrgId;
+                    if (orgId) {
+                        await this.spawnAgent(userId, orgId, a);
+                    }
+                    continue;
+                }
                 // Catch up on per-agent provider_config changes missed while the WS
                 // was down (machine.agent_config.updated is delivered live only):
                 // refresh the cache, and respawn a live child when the stored config
@@ -1581,6 +1605,28 @@ export class DaemonSupervisor {
             });
         }
     }
+    /**
+     * Local credential isolation (home-isolation.ts): per-agent opt-in via
+     * daemon_config.home_isolation (unset = legacy shared HOME for existing
+     * agents), machine-level kill switch PRLL_DAEMON_HOME_ISOLATION=0. K8s
+     * pods never take this path — they keep the isolated claude-home +
+     * shared-credential-link branch in spawnAgentOnce.
+     */
+    buildHomeIsolationSpec(attached, agentId) {
+        if (process.env.KUBERNETES_SERVICE_HOST)
+            return undefined;
+        if (this.config.homeIsolationDisabled)
+            return undefined;
+        if (attached.daemon_config?.home_isolation !== true)
+            return undefined;
+        return {
+            homeDir: agentHomeDirFor(this.config.rootStateDir, agentId),
+            claudeStateRoot: this.config.rootClaudeHome,
+            systemHome: os.homedir(),
+            gitUserName: attached.user?.display_name?.trim() || agentId,
+            gitUserEmail: `${agentId}@noreply.parall.com`,
+        };
+    }
     async spawnAgentOnce(agentId, orgId, attached) {
         let credential;
         try {
@@ -1593,14 +1639,15 @@ export class DaemonSupervisor {
         const stateDir = agentStateDirFor(this.config.rootStateDir, agentId);
         const defaultWorkspaceDir = agentWorkspaceDirFor(this.config.rootStateDir, agentId);
         const isK8s = !!process.env.KUBERNETES_SERVICE_HOST;
+        const homeIsolation = this.buildHomeIsolationSpec(attached, agentId);
         const claudeHome = isK8s
             ? agentClaudeHomeFor(this.config.rootClaudeHome, agentId)
-            : this.config.rootClaudeHome;
+            : (homeIsolation?.homeDir ?? this.config.rootClaudeHome);
         try {
             fs.mkdirSync(stateDir, { recursive: true });
             if (isK8s) {
                 fs.mkdirSync(claudeHome, { recursive: true });
-                this.ensureSharedCredentialLink(claudeHome, agentId);
+                ensureSharedCredentialLink(this.config.rootClaudeHome, claudeHome, agentId, this.log);
             }
         }
         catch (err) {
@@ -1635,6 +1682,7 @@ export class DaemonSupervisor {
             // resolved at startChild time (see resolveProviderConfig) so a respawn
             // after a machine llm_source change picks up the new source.
             providerConfig: attached.provider_config,
+            homeIsolation,
             child: null,
             credential,
             restartAttempts: 0,
@@ -1660,26 +1708,60 @@ export class DaemonSupervisor {
             return;
         }
         assertAgentKey(state.credential.api_key);
-        const adapter = getRuntimeAdapter(state.runtimeType);
-        const dirs = {
-            stateDir: agentStateDirFor(this.config.rootStateDir, state.agentId),
-            workspaceDir: state.workspacePath,
-            claudeHome: state.claudeHome,
-        };
-        let baseEnv = { ...process.env, PRLL_API_URL: this.config.apiUrl };
-        if (this.machineId)
-            baseEnv.PRLL_MACHINE_ID = this.machineId;
-        baseEnv = applyRuntimeBinaryEnv(state.runtimeType, baseEnv, this.log);
         // An explicit per-agent provider_config (llm_source or BYO creds) wins;
         // otherwise defer to the CURRENT machine-level llm_source. The server sends
         // an empty `{}` for self-hosted agents (per-agent provider_config is
         // rejected there), and `{} ?? machineLlmSource` would keep the `{}` and
         // resolve to "parall", silently shadowing the machine's choice — so check
         // for an explicit signal. Resolved here (not at spawn) so a respawn after a
-        // machine llm_source change applies the new source without a full restart.
+        // machine llm_source change applies the new source without a full restart —
+        // and BEFORE isolation setup, so the fallback decision below can consult it.
         const effectiveProviderConfig = effectiveLLMSourceExplicit(state.providerConfig)
             ? state.providerConfig
             : { llm_source: this.machineLlmSource };
+        // Re-run isolation setup on every (re)start so a passthrough link broken
+        // mid-lifetime heals before the next child sees the fake HOME.
+        let isolation = state.homeIsolation;
+        if (isolation) {
+            try {
+                const failures = ensureIsolatedHome(isolation, state.agentId, this.log);
+                if (failures.length > 0) {
+                    // Only claude-code on runtime_auth NEEDS the passthrough links (the
+                    // operator's shared login). Every other runtime × source combo runs
+                    // fine in a bare fake HOME — exactly like a hosted K8s pod — so a
+                    // link failure (e.g. Windows without symlink privileges) must not
+                    // cost those agents their credential isolation too.
+                    const needsPassthrough = state.runtimeType === 'claude-code' &&
+                        llmSource(effectiveProviderConfig) === 'runtime_auth';
+                    if (needsPassthrough) {
+                        this.log.warn(`agent ${state.agentId}: home isolation passthrough failed (${failures.join('; ')}) — falling back to the shared HOME for this spawn so the runtime keeps its login`);
+                        isolation = undefined;
+                    }
+                    else {
+                        this.log.warn(`agent ${state.agentId}: home isolation passthrough incomplete (${failures.join('; ')}) — keeping the fake HOME (this runtime/source does not need the shared-login links)`);
+                    }
+                }
+            }
+            catch (err) {
+                // Hard failure: the fake HOME itself could not be created — nothing
+                // to isolate into; fall back to the shared HOME for this spawn.
+                this.log.warn(`agent ${state.agentId}: home isolation setup failed — falling back to the shared HOME for this spawn: ${String(err)}`);
+                isolation = undefined;
+            }
+        }
+        const adapter = getRuntimeAdapter(state.runtimeType);
+        const dirs = {
+            stateDir: agentStateDirFor(this.config.rootStateDir, state.agentId),
+            workspaceDir: state.workspacePath,
+            // Only the isolation-fallback case replaces claudeHome: K8s (isolation
+            // never set) and legacy-shared children keep their state.claudeHome.
+            claudeHome: state.homeIsolation && !isolation ? this.config.rootClaudeHome : state.claudeHome,
+            homeDir: isolation?.homeDir,
+        };
+        let baseEnv = { ...process.env, PRLL_API_URL: this.config.apiUrl };
+        if (this.machineId)
+            baseEnv.PRLL_MACHINE_ID = this.machineId;
+        baseEnv = applyRuntimeBinaryEnv(state.runtimeType, baseEnv, this.log);
         const env = adapter.buildEnv(baseEnv, state.agentId, state.orgId, state.credential.api_key, dirs, effectiveProviderConfig);
         const spawnCmd = adapter.args.length > 0 ? `${adapter.bin} ${adapter.args.join(' ')}` : adapter.bin;
         this.log.info(`spawning agent ${state.agentId} runtime=${state.runtimeType} cmd=${spawnCmd} (attempt ${state.restartAttempts + 1})`);
@@ -1774,34 +1856,4 @@ export class DaemonSupervisor {
             child.once('exit', () => clearTimeout(hardKill));
         });
     }
-    ensureSharedCredentialLink(agentClaudeHome, agentId) {
-        const sharedCredentials = path.resolve(sharedClaudeCredentialsFileFor(this.config.rootClaudeHome));
-        const agentCredentials = agentClaudeCredentialsFileFor(agentClaudeHome);
-        const agentCredentialsDir = path.dirname(agentCredentials);
-        fs.mkdirSync(path.dirname(sharedCredentials), { recursive: true });
-        fs.mkdirSync(agentCredentialsDir, { recursive: true });
-        try {
-            const existing = fs.lstatSync(agentCredentials);
-            if (existing.isSymbolicLink()) {
-                const currentTarget = fs.readlinkSync(agentCredentials);
-                if (path.resolve(agentCredentialsDir, currentTarget) === sharedCredentials) {
-                    return;
-                }
-                fs.unlinkSync(agentCredentials);
-            }
-            else if (existing.isDirectory()) {
-                this.log.warn(`agent ${agentId}: credential path is a directory, cannot link ${agentCredentials}`);
-                return;
-            }
-            else {
-                fs.unlinkSync(agentCredentials);
-            }
-        }
-        catch (err) {
-            if (err.code !== 'ENOENT') {
-                throw err;
-            }
-        }
-        fs.symlinkSync(sharedCredentials, agentCredentials);
-    }
 }