@parall/daemon 1.42.1 → 1.43.0

package/bundle/parall-daemon.js

@@ -122,63 +122,6 @@ var init_lane_key = __esm({
   }
 });
 
-// ts/agent-core/dist/session-state.js
-var init_session_state = __esm({
-  "ts/agent-core/dist/session-state.js"() {
-    "use strict";
-  }
-});
-
-// ts/agent-core/dist/routing.js
-var init_routing = __esm({
-  "ts/agent-core/dist/routing.js"() {
-    "use strict";
-  }
-});
-
-// ts/agent-core/dist/event-format.js
-var init_event_format = __esm({
-  "ts/agent-core/dist/event-format.js"() {
-    "use strict";
-  }
-});
-
-// ts/agent-core/dist/prompt-fragments.js
-var init_prompt_fragments = __esm({
-  "ts/agent-core/dist/prompt-fragments.js"() {
-    "use strict";
-  }
-});
-
-// ts/agent-core/dist/bridge-workspace.js
-var init_bridge_workspace = __esm({
-  "ts/agent-core/dist/bridge-workspace.js"() {
-    "use strict";
-  }
-});
-
-// ts/agent-core/dist/dispatch-adapter.js
-var init_dispatch_adapter = __esm({
-  "ts/agent-core/dist/dispatch-adapter.js"() {
-    "use strict";
-  }
-});
-
-// ts/agent-core/dist/logger.js
-function createLogger(prefix) {
-  return {
-    info: (msg) => console.log(`${(/* @__PURE__ */ new Date()).toISOString()} [${prefix}] ${msg}`),
-    warn: (msg) => console.warn(`${(/* @__PURE__ */ new Date()).toISOString()} [${prefix}] ${msg}`),
-    error: (msg) => console.error(`${(/* @__PURE__ */ new Date()).toISOString()} [${prefix}] ${msg}`),
-    child: (sub) => createLogger(`${prefix}:${sub}`)
-  };
-}
-var init_logger = __esm({
-  "ts/agent-core/dist/logger.js"() {
-    "use strict";
-  }
-});
-
 // ts/sdk/dist/types.js
 var init_types2 = __esm({
   "ts/sdk/dist/types.js"() {
@@ -672,6 +615,7 @@ var init_client = __esm({
       setTokens;
       refreshPromise = null;
       swimlaneName;
+      getFeatureFlagOverrides;
       /** Auth endpoints excluded from automatic 401 refresh to prevent recursion. */
       static AUTH_PATHS = /* @__PURE__ */ new Set([
         "/auth/login",
@@ -702,7 +646,7 @@ var init_client = __esm({
         return apiError;
       }
       /** Build headers common to all requests (auth, swimlane). */
-      buildHeaders(extra) {
+      buildHeaders(path19, extra) {
         const headers = {
           "Content-Type": "application/json",
           ...extra
@@ -713,6 +657,11 @@ var init_client = __esm({
         if (this.swimlaneName) {
           headers["X-Prll-Swimlane"] = this.swimlaneName;
         }
+        if (path19.startsWith(API_BASE)) {
+          const overrides = this.getFeatureFlagOverrides?.();
+          if (overrides)
+            headers["X-Prll-FF-Override"] = overrides;
+        }
         return headers;
       }
       constructor(options = {}) {
@@ -723,6 +672,7 @@ var init_client = __esm({
         this.getRefreshToken = options.getRefreshToken;
         this.setTokens = options.setTokens;
         this.swimlaneName = options.swimlaneName;
+        this.getFeatureFlagOverrides = options.getFeatureFlagOverrides;
       }
       /**
        * Pick the origin for a request path: wiki-service base for `/wiki/v1`
@@ -730,8 +680,8 @@ var init_client = __esm({
        * is authoritative, so wiki vs api routing can't drift from how a caller
        * happens to invoke the client.
        */
-      baseUrlFor(path18) {
-        return path18.startsWith(WIKI_BASE) ? this.wikiBaseUrl : this.baseUrl;
+      baseUrlFor(path19) {
+        return path19.startsWith(WIKI_BASE) ? this.wikiBaseUrl : this.baseUrl;
       }
       setToken(token) {
         this.token = token;
@@ -758,10 +708,10 @@ var init_client = __esm({
        * REFRESH_THRESHOLD_S, refresh it **before** sending the request.
        * No-op when the token is still fresh, missing, or un-parseable.
        */
-      async ensureFreshToken(path18) {
+      async ensureFreshToken(path19) {
         if (!this.token || !this.getRefreshToken)
           return;
-        const pathSuffix = path18.replace(/^\/api\/v1/, "");
+        const pathSuffix = path19.replace(/^\/api\/v1/, "");
         if (_ParallClient.AUTH_PATHS.has(pathSuffix))
           return;
         const exp = _ParallClient.decodeJwtExp(this.token);
@@ -793,11 +743,11 @@ var init_client = __esm({
           this.refreshPromise = null;
         }
       }
-      async request(method, path18, body, query, retried = false, opts) {
+      async request(method, path19, body, query, retried = false, opts) {
         if (!retried) {
-          await this.ensureFreshToken(path18);
+          await this.ensureFreshToken(path19);
         }
-        let url = `${this.baseUrlFor(path18)}${path18}`;
+        let url = `${this.baseUrlFor(path19)}${path19}`;
         if (query) {
           const params = new URLSearchParams();
           for (const [key, value] of Object.entries(query)) {
@@ -809,7 +759,7 @@ var init_client = __esm({
           if (qs)
             url += `?${qs}`;
         }
-        const headers = this.buildHeaders();
+        const headers = this.buildHeaders(path19);
         const timeoutSignal = AbortSignal.timeout(opts?.timeoutMs ?? 15e3);
         const signal = opts?.signal ? AbortSignal.any([opts.signal, timeoutSignal]) : timeoutSignal;
         let res;
@@ -827,12 +777,12 @@ var init_client = __esm({
           throw _ParallClient.normalizeFetchError(err);
         }
         if (res.status === 401) {
-          const pathSuffix = path18.replace(/^\/api\/v1/, "");
+          const pathSuffix = path19.replace(/^\/api\/v1/, "");
           const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
           if (!retried && !isAuthPath && this.getRefreshToken) {
             const refreshed = await this.tryRefresh();
             if (refreshed) {
-              return this.request(method, path18, body, query, true, opts);
+              return this.request(method, path19, body, query, true, opts);
             }
           }
           if (this.onTokenExpired && !isAuthPath) {
@@ -862,15 +812,15 @@ var init_client = __esm({
        * hit the 100 MiB cap, so a longer 5-minute timeout is used so a
        * 50 MiB blob on a slow connection doesn't get chopped at 15 s.
        */
-      async multipartRequest(method, path18, body, retried = false) {
+      async multipartRequest(method, path19, body, retried = false) {
         if (!retried) {
-          await this.ensureFreshToken(path18);
+          await this.ensureFreshToken(path19);
         }
-        const { "Content-Type": _drop, ...headers } = this.buildHeaders();
+        const { "Content-Type": _drop, ...headers } = this.buildHeaders(path19);
         void _drop;
         let res;
         try {
-          res = await fetch(`${this.baseUrlFor(path18)}${path18}`, {
+          res = await fetch(`${this.baseUrlFor(path19)}${path19}`, {
             method,
             headers,
             body,
@@ -880,12 +830,12 @@ var init_client = __esm({
           throw _ParallClient.normalizeFetchError(err);
         }
         if (res.status === 401) {
-          const pathSuffix = path18.replace(/^\/api\/v1/, "");
+          const pathSuffix = path19.replace(/^\/api\/v1/, "");
           const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
           if (!retried && !isAuthPath && this.getRefreshToken) {
             const refreshed = await this.tryRefresh();
             if (refreshed) {
-              return this.multipartRequest(method, path18, body, true);
+              return this.multipartRequest(method, path19, body, true);
             }
           }
           if (this.onTokenExpired && !isAuthPath) {
@@ -1589,8 +1539,8 @@ var init_client = __esm({
       async requestMachineUpdate(orgId, machineId, mandatory = false) {
         await this.request("POST", ENDPOINTS.MACHINE_REQUEST_UPDATE(orgId, machineId), { mandatory });
       }
-      async browseMachineFilesystem(orgId, machineId, path18) {
-        return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path18 }, void 0, false, { timeoutMs: 15e3 });
+      async browseMachineFilesystem(orgId, machineId, path19) {
+        return this.request("POST", ENDPOINTS.MACHINE_BROWSE(orgId, machineId), { path: path19 }, void 0, false, { timeoutMs: 15e3 });
       }
       /** Create a new machine key. Returns the raw key string (shown once) + metadata. */
       async createMachineKey(orgId, machineId, name) {
@@ -1711,7 +1661,7 @@ var init_client = __esm({
         if (currentVersion !== void 0) {
           extra["If-None-Match"] = currentVersion;
         }
-        const headers = this.buildHeaders(extra);
+        const headers = this.buildHeaders(ENDPOINTS.PLATFORM_CONFIG, extra);
         let res;
         try {
           res = await fetch(url, {
@@ -2159,8 +2109,8 @@ var init_client = __esm({
       async deleteWikiRestriction(orgId, wikiId, restrictionId) {
         await this.request("DELETE", ENDPOINTS.WIKI_RESTRICTION(orgId, wikiId, restrictionId));
       }
-      async getWikiAccessStatus(orgId, wikiId, path18) {
-        return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path18 ? { path: path18 } : void 0);
+      async getWikiAccessStatus(orgId, wikiId, path19) {
+        return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path19 ? { path: path19 } : void 0);
       }
       async createWikiAccessRequest(orgId, wikiId, data) {
         await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data);
@@ -2169,14 +2119,14 @@ var init_client = __esm({
       async getWikiCommits(orgId, wikiId, params) {
         return this.request("GET", ENDPOINTS.WIKI_COMMITS(orgId, wikiId), void 0, params);
       }
-      async getWikiFileCommits(orgId, wikiId, path18, params) {
+      async getWikiFileCommits(orgId, wikiId, path19, params) {
         return this.request("GET", ENDPOINTS.WIKI_FILE_COMMITS(orgId, wikiId), void 0, {
-          path: path18,
+          path: path19,
           ...params
         });
       }
-      async getWikiBlame(orgId, wikiId, path18, ref) {
-        return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path18, ref });
+      async getWikiBlame(orgId, wikiId, path19, ref) {
+        return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path19, ref });
       }
       // ---- Wiki Operations (audit log) ----
       async getWikiOperations(orgId, wikiId, params) {
@@ -2824,10 +2774,69 @@ var init_lane_ledger = __esm({
 });
 
 // ts/agent-core/dist/gateway-lane-flow.js
+var TYPED_BACKOFF_CAP_MS;
 var init_gateway_lane_flow = __esm({
   "ts/agent-core/dist/gateway-lane-flow.js"() {
     "use strict";
     init_lane_ledger();
+    TYPED_BACKOFF_CAP_MS = 5 * 6e4;
+  }
+});
+
+// ts/agent-core/dist/session-state.js
+var init_session_state = __esm({
+  "ts/agent-core/dist/session-state.js"() {
+    "use strict";
+  }
+});
+
+// ts/agent-core/dist/routing.js
+var init_routing = __esm({
+  "ts/agent-core/dist/routing.js"() {
+    "use strict";
+  }
+});
+
+// ts/agent-core/dist/event-format.js
+var init_event_format = __esm({
+  "ts/agent-core/dist/event-format.js"() {
+    "use strict";
+  }
+});
+
+// ts/agent-core/dist/prompt-fragments.js
+var init_prompt_fragments = __esm({
+  "ts/agent-core/dist/prompt-fragments.js"() {
+    "use strict";
+  }
+});
+
+// ts/agent-core/dist/bridge-workspace.js
+var init_bridge_workspace = __esm({
+  "ts/agent-core/dist/bridge-workspace.js"() {
+    "use strict";
+  }
+});
+
+// ts/agent-core/dist/dispatch-adapter.js
+var init_dispatch_adapter = __esm({
+  "ts/agent-core/dist/dispatch-adapter.js"() {
+    "use strict";
+  }
+});
+
+// ts/agent-core/dist/logger.js
+function createLogger(prefix) {
+  return {
+    info: (msg) => console.log(`${(/* @__PURE__ */ new Date()).toISOString()} [${prefix}] ${msg}`),
+    warn: (msg) => console.warn(`${(/* @__PURE__ */ new Date()).toISOString()} [${prefix}] ${msg}`),
+    error: (msg) => console.error(`${(/* @__PURE__ */ new Date()).toISOString()} [${prefix}] ${msg}`),
+    child: (sub) => createLogger(`${prefix}:${sub}`)
+  };
+}
+var init_logger = __esm({
+  "ts/agent-core/dist/logger.js"() {
+    "use strict";
   }
 });
 
@@ -20510,9 +20519,9 @@ var require_getMachineId_linux = __commonJS({
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     async function getMachineId() {
       const paths = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
-      for (const path18 of paths) {
+      for (const path19 of paths) {
         try {
-          const result = await fs_1.promises.readFile(path18, { encoding: "utf8" });
+          const result = await fs_1.promises.readFile(path19, { encoding: "utf8" });
           return result.trim();
         } catch (e) {
           api_1.diag.debug(`error reading machine id: ${e}`);
@@ -20722,7 +20731,7 @@ var require_ProcessDetectorSync = __commonJS({
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     var semantic_conventions_1 = (init_esm2(), __toCommonJS(esm_exports2));
     var Resource_1 = require_Resource();
-    var os6 = __require("os");
+    var os8 = __require("os");
     var ProcessDetectorSync = class {
       detect(_config) {
         const attributes = {
@@ -20742,7 +20751,7 @@ var require_ProcessDetectorSync = __commonJS({
           attributes[semantic_conventions_1.SEMRESATTRS_PROCESS_COMMAND] = process.argv[1];
         }
         try {
-          const userInfo = os6.userInfo();
+          const userInfo = os8.userInfo();
           attributes[semantic_conventions_1.SEMRESATTRS_PROCESS_OWNER] = userInfo.username;
         } catch (e) {
           api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -23915,7 +23924,7 @@ function appendRootPathToUrlIfNeeded(url) {
     return void 0;
   }
 }
-function appendResourcePathToUrl(url, path18) {
+function appendResourcePathToUrl(url, path19) {
   try {
     new URL(url);
   } catch (_a) {
@@ -23925,11 +23934,11 @@ function appendResourcePathToUrl(url, path18) {
   if (!url.endsWith("/")) {
     url = url + "/";
   }
-  url += path18;
+  url += path19;
   try {
     new URL(url);
   } catch (_b) {
-    diag2.warn("Configuration: Provided URL appended with '" + path18 + "' is not a valid URL, using 'undefined' instead of '" + url + "'");
+    diag2.warn("Configuration: Provided URL appended with '" + path19 + "' is not a valid URL, using 'undefined' instead of '" + url + "'");
     return void 0;
   }
   return url;
@@ -29390,6 +29399,20 @@ var init_platform_config = __esm({
   }
 });
 
+// ts/agent-core/dist/channel-capability.js
+var init_channel_capability = __esm({
+  "ts/agent-core/dist/channel-capability.js"() {
+    "use strict";
+  }
+});
+
+// ts/agent-core/dist/channel-token.js
+var init_channel_token = __esm({
+  "ts/agent-core/dist/channel-token.js"() {
+    "use strict";
+  }
+});
+
 // ts/agent-core/dist/skills/parall-platform.js
 var init_parall_platform = __esm({
   "ts/agent-core/dist/skills/parall-platform.js"() {
@@ -29458,6 +29481,7 @@ var init_dist2 = __esm({
     init_provider_config();
     init_types();
     init_lane_key();
+    init_gateway_lane_flow();
     init_session_state();
     init_routing();
     init_event_format();
@@ -29467,6 +29491,8 @@ var init_dist2 = __esm({
     init_logger();
     init_gateway_base();
     init_platform_config();
+    init_channel_capability();
+    init_channel_token();
     init_skills();
     init_telemetry();
   }
@@ -29477,6 +29503,7 @@ var config_exports = {};
 __export(config_exports, {
   agentClaudeCredentialsFileFor: () => agentClaudeCredentialsFileFor,
   agentClaudeHomeFor: () => agentClaudeHomeFor,
+  agentHomeDirFor: () => agentHomeDirFor,
   agentStateDirFor: () => agentStateDirFor,
   agentWorkspaceDirFor: () => agentWorkspaceDirFor,
   daemonConfigDir: () => daemonConfigDir,
@@ -29563,7 +29590,8 @@ function resolveClaudeDaemonConfig(env = process.env) {
     updateCdnUrl: env.PRLL_DAEMON_UPDATE_CDN_URL?.trim() || ((env.PRLL_DAEMON_UPDATE_CHANNEL?.trim() ?? "production") === "staging" ? "https://releases.staging.prll.sh/daemon/staging" : "https://releases.parall.com/daemon/production"),
     updateIntervalMs: parseMsAllowZero(env.PRLL_DAEMON_UPDATE_INTERVAL_MS, 6 * 60 * 6e4),
     updateDisabled: env.PRLL_DAEMON_UPDATE_DISABLED === "true" || !!env.KUBERNETES_SERVICE_HOST,
-    updateConfirmDelayMs: parseMsAllowZero(env.PRLL_DAEMON_UPDATE_CONFIRM_DELAY_MS?.trim() || void 0, 6e4)
+    updateConfirmDelayMs: parseMsAllowZero(env.PRLL_DAEMON_UPDATE_CONFIRM_DELAY_MS?.trim() || void 0, 6e4),
+    homeIsolationDisabled: env.PRLL_DAEMON_HOME_ISOLATION?.trim() === "0"
   };
 }
 function assertSafeAgentId(agentId) {
@@ -29587,6 +29615,9 @@ function agentClaudeCredentialsFileFor(agentClaudeHome) {
 function agentWorkspaceDirFor(rootStateDir, agentId) {
   return path3.join(rootStateDir, "agents", assertSafeAgentId(agentId), "workspace");
 }
+function agentHomeDirFor(rootStateDir, agentId) {
+  return path3.join(rootStateDir, "agents", assertSafeAgentId(agentId), "home");
+}
 function resolveUpdateSigningEnabled(env = process.env) {
   return env.PRLL_DAEMON_SIGNING_DISABLED !== "1";
 }
@@ -31101,6 +31132,7 @@ var init_manifest = __esm({
 
 // ts/daemon/dist/runtimes.js
 import * as fs7 from "node:fs";
+import * as os4 from "node:os";
 import * as path9 from "node:path";
 function buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
   const env = { ...baseEnv };
@@ -31113,6 +31145,8 @@ function buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc) {
   env.PRLL_WORKSPACE_DIR = dirs.workspaceDir;
   if (pc)
     env.PRLL_PROVIDER_CONFIG = JSON.stringify(pc);
+  if (dirs.homeDir)
+    env.HOME = dirs.homeDir;
   delete env.PRLL_DAEMON_MODE;
   return env;
 }
@@ -31158,6 +31192,8 @@ var init_runtimes = __esm({
         const env = buildStandardEnv(baseEnv, agentId, orgId, apiKey, dirs, pc);
         if (baseEnv.KUBERNETES_SERVICE_HOST || llmSource(pc) !== "runtime_auth") {
           env.PRLL_CODEX_HOME = path9.join(dirs.stateDir, ".codex");
+        } else if (dirs.homeDir && !env.CODEX_HOME) {
+          env.CODEX_HOME = path9.join(baseEnv.HOME || os4.homedir(), ".codex");
         }
         return env;
       }
@@ -32408,7 +32444,7 @@ var init_process_manager = __esm({
        * (GetBindings), then forward the invoke through the hub (Invoke) to the bound
        * BrowserProfile's host. No local shortcut, no fallback — unbound is rejected.
        * The execution daemon never verifies clip_token; the hub does.
-       * See docs/engineering-design/browser-profile-clip-integration.md §11.3.
+       * See docs/archive/engineering-design/browser-profile-clip-integration.md §11.3.
        */
       async invokeDependency(clipName, command, input, context2) {
         if (!isBrowserDependencyName(clipName)) {
@@ -32441,7 +32477,7 @@ var init_process_manager = __esm({
        * synthetic "browser" clip). The hub forwards clip_token as the PLAINTEXT
        * browser_profile_id, which the host daemon uses directly as the bb-browser
        * account. Only daemons that host BrowserProfiles register this capability.
-       * See docs/engineering-design/browser-profile-clip-integration.md §11.2.
+       * See docs/archive/engineering-design/browser-profile-clip-integration.md §11.2.
        */
       async invokeBrowserCapability(clipToken, command, input) {
         if (!this.browserProfileManager) {
@@ -34796,7 +34832,7 @@ var init_clip_runtime = __esm({
 // ts/daemon/dist/filesystem.js
 import * as fs9 from "fs";
 import * as path13 from "path";
-import * as os4 from "os";
+import * as os5 from "os";
 function browseDenyReason(value) {
   const normalized = path13.resolve(value).split(path13.sep).join("/");
   if (normalized === "/")
@@ -34816,8 +34852,8 @@ function browseDenyReason(value) {
 }
 function syntheticRoots() {
   const roots = [];
-  const platform2 = os4.platform();
-  const candidates = platform2 === "darwin" ? ["/Users", os4.homedir()] : ["/home", os4.homedir()];
+  const platform2 = os5.platform();
+  const candidates = platform2 === "darwin" ? ["/Users", os5.homedir()] : ["/home", os5.homedir()];
   for (const dir of [...new Set(candidates)]) {
     try {
       fs9.accessSync(dir, fs9.constants.R_OK);
@@ -34913,11 +34949,108 @@ var init_filesystem = __esm({
   }
 });
 
-// ts/daemon/dist/runtime-bin-resolver.js
-import { execFileSync as execFileSync3 } from "node:child_process";
+// ts/daemon/dist/home-isolation.js
 import * as fs10 from "node:fs";
-import * as os5 from "node:os";
 import * as path14 from "node:path";
+function ensureIsolatedHome(spec, agentId, log2, platform2 = process.platform) {
+  fs10.mkdirSync(spec.homeDir, { recursive: true });
+  const failures = [];
+  const attempt = (label, fn) => {
+    try {
+      fn();
+    } catch (err) {
+      failures.push(`${label}: ${String(err)}`);
+    }
+  };
+  attempt(".claude link", () => {
+    fs10.mkdirSync(path14.join(spec.claudeStateRoot, ".claude"), { recursive: true });
+    ensureLink(path14.join(spec.homeDir, ".claude"), path14.join(spec.claudeStateRoot, ".claude"), agentId, log2);
+  });
+  attempt(".claude.json link", () => ensureLink(path14.join(spec.homeDir, ".claude.json"), path14.join(spec.claudeStateRoot, ".claude.json"), agentId, log2));
+  if (platform2 === "darwin") {
+    attempt("Library/Keychains link", () => {
+      fs10.mkdirSync(path14.join(spec.homeDir, "Library"), { recursive: true });
+      ensureLink(path14.join(spec.homeDir, "Library", "Keychains"), path14.join(spec.systemHome, "Library", "Keychains"), agentId, log2);
+    });
+  }
+  attempt(".gitconfig", () => {
+    const gitconfig = path14.join(spec.homeDir, ".gitconfig");
+    if (!fs10.existsSync(gitconfig)) {
+      fs10.writeFileSync(gitconfig, `[user]
+	name = ${gitConfigValue(spec.gitUserName)}
+	email = ${gitConfigValue(spec.gitUserEmail)}
+`, { mode: 420 });
+      log2.info(`agent ${agentId}: wrote per-agent .gitconfig (${spec.gitUserName})`);
+    }
+  });
+  return failures;
+}
+function gitConfigValue(value) {
+  const flat = value.replace(/[\r\n\t]+/g, " ").trim();
+  return `"${flat.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function ensureLink(linkPath, target, agentId, log2) {
+  let existing;
+  try {
+    existing = fs10.lstatSync(linkPath);
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      throw err;
+  }
+  if (existing) {
+    if (existing.isSymbolicLink()) {
+      const current = fs10.readlinkSync(linkPath);
+      if (path14.resolve(path14.dirname(linkPath), current) === path14.resolve(target))
+        return;
+      fs10.unlinkSync(linkPath);
+      log2.info(`agent ${agentId}: relinking ${linkPath} \u2192 ${target}`);
+    } else {
+      const preserved = `${linkPath}.pre-isolation.${Date.now()}`;
+      fs10.renameSync(linkPath, preserved);
+      log2.warn(`agent ${agentId}: ${linkPath} was a real ${existing.isDirectory() ? "directory" : "file"}, not the expected passthrough symlink \u2014 preserved at ${preserved} and relinked`);
+    }
+  }
+  fs10.symlinkSync(target, linkPath);
+}
+function ensureSharedCredentialLink(rootClaudeHome, agentClaudeHome, agentId, log2) {
+  const sharedCredentials = path14.resolve(sharedClaudeCredentialsFileFor(rootClaudeHome));
+  const agentCredentials = agentClaudeCredentialsFileFor(agentClaudeHome);
+  const agentCredentialsDir = path14.dirname(agentCredentials);
+  fs10.mkdirSync(path14.dirname(sharedCredentials), { recursive: true });
+  fs10.mkdirSync(agentCredentialsDir, { recursive: true });
+  try {
+    const existing = fs10.lstatSync(agentCredentials);
+    if (existing.isSymbolicLink()) {
+      const currentTarget = fs10.readlinkSync(agentCredentials);
+      if (path14.resolve(agentCredentialsDir, currentTarget) === sharedCredentials) {
+        return;
+      }
+      fs10.unlinkSync(agentCredentials);
+    } else if (existing.isDirectory()) {
+      log2.warn(`agent ${agentId}: credential path is a directory, cannot link ${agentCredentials}`);
+      return;
+    } else {
+      fs10.unlinkSync(agentCredentials);
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw err;
+    }
+  }
+  fs10.symlinkSync(sharedCredentials, agentCredentials);
+}
+var init_home_isolation = __esm({
+  "ts/daemon/dist/home-isolation.js"() {
+    "use strict";
+    init_config();
+  }
+});
+
+// ts/daemon/dist/runtime-bin-resolver.js
+import { execFileSync as execFileSync3 } from "node:child_process";
+import * as fs11 from "node:fs";
+import * as os6 from "node:os";
+import * as path15 from "node:path";
 function runtimeBinaryEnvVar(runtimeType) {
   return RUNTIME_BINARIES[runtimeType]?.envVar;
 }
@@ -34994,16 +35127,16 @@ function resolveRuntimeCommand(command, env, inheritedPath, primaryPath, fallbac
 function resolveDirectPath(command) {
   if (!command.includes("/") && !command.includes("\\"))
     return null;
-  const abs = path14.isAbsolute(command) ? command : path14.resolve(process.cwd(), command);
+  const abs = path15.isAbsolute(command) ? command : path15.resolve(process.cwd(), command);
   return isExecutable(abs) ? abs : null;
 }
 function resolveFromPath(command, pathValue, env) {
   if (!pathValue || command.includes("/") || command.includes("\\"))
     return null;
-  const dirs = pathValue.split(path14.delimiter).filter(Boolean);
+  const dirs = pathValue.split(path15.delimiter).filter(Boolean);
   for (const dir of dirs) {
     for (const file of commandCandidates(command, env)) {
-      const candidate = path14.join(dir, file);
+      const candidate = path15.join(dir, file);
       if (isExecutable(candidate))
         return { binaryPath: candidate, pathValue };
     }
@@ -35042,7 +35175,7 @@ __PRLL_PATH__%s
         if (line.startsWith("__PRLL_PATH__"))
           pathValue = line.slice("__PRLL_PATH__".length);
       }
-      if (path14.isAbsolute(binaryPath) && isExecutable(binaryPath)) {
+      if (path15.isAbsolute(binaryPath) && isExecutable(binaryPath)) {
         return { binaryPath, pathValue: pathValue || void 0 };
       }
     } catch {
@@ -35060,25 +35193,25 @@ function cachedCandidatePathPlan(env) {
   return value;
 }
 function candidatePathPlan(env) {
-  const home = env.HOME || os5.homedir();
+  const home = env.HOME || os6.homedir();
   const primaryDirs = [
     ...splitPath(env.PRLL_DAEMON_RUNTIME_PATH),
     ...splitPath(env.PRLL_DAEMON_EXTRA_PATH),
-    path14.dirname(process.execPath),
-    path14.join(path14.dirname(process.execPath), "bin"),
-    path14.resolve(path14.dirname(process.execPath), "..", "Resources", "bin"),
-    path14.join(home, ".local", "bin"),
-    path14.join(home, "bin"),
-    path14.join(home, ".npm-global", "bin"),
-    path14.join(home, "Library", "pnpm"),
-    path14.join(home, ".local", "share", "pnpm"),
-    path14.join(home, ".volta", "bin"),
-    path14.join(home, ".bun", "bin"),
-    path14.join(home, ".asdf", "shims"),
-    path14.join(home, ".local", "share", "mise", "shims"),
-    path14.join(home, ".mise", "shims"),
-    path14.join(home, ".fnm", "aliases", "default", "bin"),
-    path14.join(home, "Library", "Application Support", "fnm", "aliases", "default", "bin"),
+    path15.dirname(process.execPath),
+    path15.join(path15.dirname(process.execPath), "bin"),
+    path15.resolve(path15.dirname(process.execPath), "..", "Resources", "bin"),
+    path15.join(home, ".local", "bin"),
+    path15.join(home, "bin"),
+    path15.join(home, ".npm-global", "bin"),
+    path15.join(home, "Library", "pnpm"),
+    path15.join(home, ".local", "share", "pnpm"),
+    path15.join(home, ".volta", "bin"),
+    path15.join(home, ".bun", "bin"),
+    path15.join(home, ".asdf", "shims"),
+    path15.join(home, ".local", "share", "mise", "shims"),
+    path15.join(home, ".mise", "shims"),
+    path15.join(home, ".fnm", "aliases", "default", "bin"),
+    path15.join(home, "Library", "Application Support", "fnm", "aliases", "default", "bin"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     "/usr/bin",
@@ -35097,29 +35230,29 @@ function candidatePathPlan(env) {
   };
 }
 function nvmVersionBinDirs(home) {
-  const root = path14.join(home, ".nvm", "versions", "node");
+  const root = path15.join(home, ".nvm", "versions", "node");
   let versions;
   try {
-    versions = fs10.readdirSync(root);
+    versions = fs11.readdirSync(root);
   } catch {
     return [];
   }
-  return sortVersionNamesDesc(versions).map((version) => path14.join(root, version, "bin"));
+  return sortVersionNamesDesc(versions).map((version) => path15.join(root, version, "bin"));
 }
 function fnmVersionBinDirs(home) {
   const roots = [
-    path14.join(home, ".fnm", "node-versions"),
-    path14.join(home, "Library", "Application Support", "fnm", "node-versions")
+    path15.join(home, ".fnm", "node-versions"),
+    path15.join(home, "Library", "Application Support", "fnm", "node-versions")
   ];
   const dirs = [];
   for (const root of roots) {
     let versions;
     try {
-      versions = fs10.readdirSync(root);
+      versions = fs11.readdirSync(root);
     } catch {
       continue;
     }
-    dirs.push(...sortVersionNamesDesc(versions).map((version) => path14.join(root, version, "installation", "bin")));
+    dirs.push(...sortVersionNamesDesc(versions).map((version) => path15.join(root, version, "installation", "bin")));
   }
   return dirs;
 }
@@ -35141,13 +35274,13 @@ function parseVersionName(value) {
   return value.replace(/^v/i, "").split(".").map((part) => Number.parseInt(part, 10)).filter((part) => Number.isFinite(part));
 }
 function splitPath(value) {
-  return value?.split(path14.delimiter).filter(Boolean) ?? [];
+  return value?.split(path15.delimiter).filter(Boolean) ?? [];
 }
 function mergePath(prependDirs, existing) {
-  return unique([...prependDirs, ...splitPath(existing)]).join(path14.delimiter);
+  return unique([...prependDirs, ...splitPath(existing)]).join(path15.delimiter);
 }
 function anchorResolvedPath(pathValue, resolution) {
-  return mergePath([path14.dirname(resolution.binaryPath), ...splitPath(resolution.pathValue)], pathValue);
+  return mergePath([path15.dirname(resolution.binaryPath), ...splitPath(resolution.pathValue)], pathValue);
 }
 function commandCandidates(command, env) {
   if (process.platform !== "win32")
@@ -35173,10 +35306,10 @@ function setCachedResolution(cacheKey, value) {
 }
 function isExecutable(file) {
   try {
-    const stat = fs10.statSync(file);
+    const stat = fs11.statSync(file);
     if (!stat.isFile())
       return false;
-    fs10.accessSync(file, fs10.constants.X_OK);
+    fs11.accessSync(file, fs11.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -35184,7 +35317,7 @@ function isExecutable(file) {
 }
 function isDirectory(dir) {
   try {
-    return fs10.statSync(dir).isDirectory();
+    return fs11.statSync(dir).isDirectory();
   } catch {
     return false;
   }
@@ -35301,8 +35434,8 @@ var init_runtime_detector = __esm({
 // ts/daemon/dist/workspace.js
 import { spawn as spawn5 } from "node:child_process";
 import { createHash as createHash3 } from "node:crypto";
-import * as fs11 from "node:fs";
-import * as path15 from "node:path";
+import * as fs12 from "node:fs";
+import * as path16 from "node:path";
 async function prepareWorkspace(opts) {
   const prior = opts.attached.workspace_state;
   const plan = buildWorkspacePlan(opts.attached.daemon_config, opts.defaultWorkspaceDir, prior?.config_hash);
@@ -35417,7 +35550,7 @@ function resolveWorkspaceDir(workspace, defaultWorkspaceDir) {
 async function ensureWorkspace(plan, log2) {
   const ws = plan.workspace;
   if (ws.mode === "default") {
-    fs11.mkdirSync(plan.workspaceDir, { recursive: true });
+    fs12.mkdirSync(plan.workspaceDir, { recursive: true });
     assertWritableWorkspaceDir(plan.workspaceDir);
     return;
   }
@@ -35425,7 +35558,7 @@ async function ensureWorkspace(plan, log2) {
     assertSafeCustomWorkspacePath(plan);
     let st;
     try {
-      st = fs11.statSync(plan.workspaceDir);
+      st = fs12.statSync(plan.workspaceDir);
     } catch (err) {
       if (isNodeError(err) && err.code === "ENOENT") {
         throw new Error(`workspace path does not exist: ${plan.workspaceDir}`);
@@ -35435,7 +35568,7 @@ async function ensureWorkspace(plan, log2) {
     if (!st.isDirectory()) {
       throw new Error(`workspace path is not a directory: ${plan.workspaceDir}`);
     }
-    assertSafeCustomWorkspacePath(plan, fs11.realpathSync(plan.workspaceDir));
+    assertSafeCustomWorkspacePath(plan, fs12.realpathSync(plan.workspaceDir));
     assertWritableWorkspaceDir(plan.workspaceDir);
     return;
   }
@@ -35446,17 +35579,17 @@ async function ensureWorkspace(plan, log2) {
     if (plan.customWorkspaceField) {
       assertSafeCustomWorkspacePath(plan);
     }
-    if (!fs11.existsSync(plan.workspaceDir)) {
-      fs11.mkdirSync(path15.dirname(plan.workspaceDir), { recursive: true });
-      assertWritableWorkspaceDir(path15.dirname(plan.workspaceDir));
+    if (!fs12.existsSync(plan.workspaceDir)) {
+      fs12.mkdirSync(path16.dirname(plan.workspaceDir), { recursive: true });
+      assertWritableWorkspaceDir(path16.dirname(plan.workspaceDir));
       await runCommand("git", ["clone", remote, plan.workspaceDir], process.cwd());
     } else {
-      const st = fs11.statSync(plan.workspaceDir);
+      const st = fs12.statSync(plan.workspaceDir);
       if (!st.isDirectory()) {
         throw new Error(`workspace path is not a directory: ${plan.workspaceDir}`);
       }
       if (plan.customWorkspaceField) {
-        assertSafeCustomWorkspacePath(plan, fs11.realpathSync(plan.workspaceDir));
+        assertSafeCustomWorkspacePath(plan, fs12.realpathSync(plan.workspaceDir));
       }
       assertWritableWorkspaceDir(plan.workspaceDir);
       await ensureGitWorktree(plan.workspaceDir);
@@ -35480,13 +35613,13 @@ async function verifyExistingWorkspace(plan, log2) {
     if (plan.customWorkspaceField) {
       assertSafeCustomWorkspacePath(plan);
     }
-    const st = fs11.statSync(plan.workspaceDir);
+    const st = fs12.statSync(plan.workspaceDir);
     if (!st.isDirectory()) {
       log2.warn(`workspace ready state ignored: path is not a directory: ${plan.workspaceDir}`);
       return false;
     }
     if (plan.customWorkspaceField) {
-      assertSafeCustomWorkspacePath(plan, fs11.realpathSync(plan.workspaceDir));
+      assertSafeCustomWorkspacePath(plan, fs12.realpathSync(plan.workspaceDir));
     }
     assertWritableWorkspaceDir(plan.workspaceDir);
     if (plan.workspace.mode === "git") {
@@ -35630,10 +35763,10 @@ ${tail}`)));
   });
 }
 function requireAbsolute(value, field) {
-  if (!value || !path15.isAbsolute(value)) {
+  if (!value || !path16.isAbsolute(value)) {
     throw new Error(`${field} must be an absolute path`);
   }
-  return path15.resolve(value);
+  return path16.resolve(value);
 }
 function assertSafeCustomWorkspacePath(plan, candidate = plan.workspaceDir) {
   if (!plan.customWorkspaceField)
@@ -35643,17 +35776,17 @@ function assertSafeCustomWorkspacePath(plan, candidate = plan.workspaceDir) {
   if (reason) {
     throw new Error(`${plan.customWorkspaceField} must point to a project folder, not ${reason}: ${normalized}`);
   }
-  const defaultWorkspace = path15.resolve(plan.defaultWorkspaceDir);
+  const defaultWorkspace = path16.resolve(plan.defaultWorkspaceDir);
   if (isAncestorPath(normalized, defaultWorkspace) || normalized === defaultWorkspace) {
     throw new Error(`${plan.customWorkspaceField} must not point at daemon state directories: ${normalized}`);
   }
 }
 function assertWritableWorkspaceDir(dir) {
-  fs11.accessSync(dir, fs11.constants.R_OK | fs11.constants.W_OK | fs11.constants.X_OK);
-  const probe = path15.join(dir, `.parall-workspace-check-${process.pid}-${Date.now()}`);
-  const fd = fs11.openSync(probe, "wx", 384);
-  fs11.closeSync(fd);
-  fs11.unlinkSync(probe);
+  fs12.accessSync(dir, fs12.constants.R_OK | fs12.constants.W_OK | fs12.constants.X_OK);
+  const probe = path16.join(dir, `.parall-workspace-check-${process.pid}-${Date.now()}`);
+  const fd = fs12.openSync(probe, "wx", 384);
+  fs12.closeSync(fd);
+  fs12.unlinkSync(probe);
 }
 function workspacePathDenyReason(value) {
   if (value === "/")
@@ -35714,11 +35847,11 @@ function workspacePathDenyReason(value) {
   return "";
 }
 function isAncestorPath(parent, child) {
-  const relative2 = path15.relative(parent, child);
-  return relative2 !== "" && !relative2.startsWith("..") && !path15.isAbsolute(relative2);
+  const relative2 = path16.relative(parent, child);
+  return relative2 !== "" && !relative2.startsWith("..") && !path16.isAbsolute(relative2);
 }
 function toPolicyPath(value) {
-  return path15.resolve(value).split(path15.sep).join("/");
+  return path16.resolve(value).split(path16.sep).join("/");
 }
 function isNodeError(err) {
   return err instanceof Error && "code" in err;
@@ -35735,8 +35868,9 @@ var init_workspace = __esm({
 
 // ts/daemon/dist/supervisor.js
 import { spawn as spawn6 } from "node:child_process";
-import * as fs12 from "node:fs";
-import * as path16 from "node:path";
+import * as fs13 from "node:fs";
+import * as os7 from "node:os";
+import * as path17 from "node:path";
 function sleepCancellable(ms, signal) {
   if (signal.aborted)
     return Promise.resolve(false);
@@ -35763,6 +35897,7 @@ var init_supervisor = __esm({
     init_clip_runtime();
     init_config();
     init_filesystem();
+    init_home_isolation();
     init_runtimes();
     init_runtime_bin_resolver();
     init_runtime_detector();
@@ -35886,7 +36021,7 @@ var init_supervisor = __esm({
         this.migrateFlatLayout();
         if (process.env.PRLL_CLIP_RUNTIME_ENABLED === "true") {
           this.browserProfilePool = new BrowserProfilePool({
-            baseHomeDir: path16.join(this.config.rootStateDir, "bb-browser"),
+            baseHomeDir: path17.join(this.config.rootStateDir, "bb-browser"),
             log: this.log,
             reportStatus: (profileId, status, errorMsg, generation) => {
               this.client.reportBrowserProfileStatus(profileId, status, errorMsg, generation).catch((err) => this.log.warn(`browser profile status report failed: ${String(err)}`));
@@ -35894,8 +36029,8 @@ var init_supervisor = __esm({
             resolveProxy: (profileId) => this.resolveBrowserProfileProxy(profileId)
           });
           this.clipManager = new ClipProcessManager({
-            clipsDir: path16.join(this.config.rootStateDir, "clips"),
-            dataDir: path16.join(this.config.rootStateDir, "clip-data"),
+            clipsDir: path17.join(this.config.rootStateDir, "clips"),
+            dataDir: path17.join(this.config.rootStateDir, "clip-data"),
             browserProfileManager: this.browserProfilePool,
             // Execution side: nested browser dependency invokes resolve their
             // binding and route through the hub (no local shortcut).
@@ -36124,6 +36259,22 @@ var init_supervisor = __esm({
             }
             await this.spawnAgent(userId, orgId, a);
           } else {
+            const isolationChanged = !existing.shuttingDown && !!existing.homeIsolation !== !!this.buildHomeIsolationSpec(a, userId);
+            if (isolationChanged) {
+              this.log.info(`agent ${userId}: home isolation changed while disconnected \u2014 rebuilding child`);
+              existing.shuttingDown = true;
+              if (existing.restartTimer) {
+                clearTimeout(existing.restartTimer);
+                existing.restartTimer = null;
+              }
+              await this.terminateChild(existing);
+              this.children.delete(userId);
+              const orgId = this.machineOrgId;
+              if (orgId) {
+                await this.spawnAgent(userId, orgId, a);
+              }
+              continue;
+            }
             const configChanged = JSON.stringify(existing.providerConfig ?? null) !== JSON.stringify(a.provider_config ?? null);
             existing.providerConfig = a.provider_config;
             if (!existing.child && !existing.restartTimer && !existing.shuttingDown) {
@@ -36284,15 +36435,15 @@ var init_supervisor = __esm({
        */
       migrateFlatLayout() {
         const root = this.config.rootStateDir;
-        const agentsDir = path16.join(root, "agents");
-        const flatWorkspace = path16.join(root, "workspace");
-        if (!fs12.existsSync(flatWorkspace) || fs12.existsSync(agentsDir))
+        const agentsDir = path17.join(root, "agents");
+        const flatWorkspace = path17.join(root, "workspace");
+        if (!fs13.existsSync(flatWorkspace) || fs13.existsSync(agentsDir))
           return;
         let ownerAgentId;
-        const sessionsDir = path16.join(root, "sessions");
-        if (fs12.existsSync(sessionsDir)) {
+        const sessionsDir = path17.join(root, "sessions");
+        if (fs13.existsSync(sessionsDir)) {
           try {
-            for (const file of fs12.readdirSync(sessionsDir)) {
+            for (const file of fs13.readdirSync(sessionsDir)) {
               if (!file.endsWith(".json"))
                 continue;
               const decoded = Buffer.from(file.replace(".json", ""), "base64url").toString();
@@ -36306,13 +36457,13 @@ var init_supervisor = __esm({
           }
         }
         const targetId = ownerAgentId ?? "_orphan";
-        const targetDir = path16.join(agentsDir, targetId);
+        const targetDir = path17.join(agentsDir, targetId);
         try {
-          fs12.mkdirSync(targetDir, { recursive: true });
+          fs13.mkdirSync(targetDir, { recursive: true });
           for (const sub of ["workspace", "sessions", "dispatch-context"]) {
-            const src = path16.join(root, sub);
-            if (fs12.existsSync(src)) {
-              fs12.renameSync(src, path16.join(targetDir, sub));
+            const src = path17.join(root, sub);
+            if (fs13.existsSync(src)) {
+              fs13.renameSync(src, path17.join(targetDir, sub));
             }
           }
           this.log.info(`migrated legacy flat state \u2192 agents/${targetId}/`);
@@ -36603,7 +36754,7 @@ var init_supervisor = __esm({
         return this.runtimeDetectInFlight;
       }
       machineClipToConfig(clip) {
-        const clipPath = path16.join(this.config.rootStateDir, "clips", clip.alias);
+        const clipPath = path17.join(this.config.rootStateDir, "clips", clip.alias);
         return {
           clipId: clip.clip_id,
           name: clip.alias,
@@ -36669,7 +36820,7 @@ var init_supervisor = __esm({
         if (!sourceRef) {
           throw new Error(`registry clip "${config.name}" is missing source_ref`);
         }
-        const expectedPath = path16.join(this.config.rootStateDir, "clips", config.name);
+        const expectedPath = path17.join(this.config.rootStateDir, "clips", config.name);
         const localVersion = this.readInstalledClipVersion(expectedPath);
         if (localVersion && (!config.version || localVersion === config.version)) {
           return { ...config, path: expectedPath, source: expectedPath };
@@ -36687,7 +36838,7 @@ var init_supervisor = __esm({
         const result = await installClip({
           source,
           alias: config.name,
-          clipsDir: path16.join(this.config.rootStateDir, "clips"),
+          clipsDir: path17.join(this.config.rootStateDir, "clips"),
           registryUrl: process.env.PRLL_PINIX_REGISTRY_URL?.trim() || void 0
         });
         this.log.info(`clip ensured: ${result.alias} v${result.version} at ${result.path}`);
@@ -36702,7 +36853,7 @@ var init_supervisor = __esm({
       readInstalledClipVersion(dir) {
         for (const file of ["clip.json", "package.json"]) {
           try {
-            const raw = fs12.readFileSync(path16.join(dir, file), "utf-8");
+            const raw = fs13.readFileSync(path17.join(dir, file), "utf-8");
             const parsed = JSON.parse(raw);
             if (typeof parsed.version === "string" && parsed.version.trim()) {
               return parsed.version.trim();
@@ -37012,6 +37163,28 @@ var init_supervisor = __esm({
           });
         }
       }
+      /**
+       * Local credential isolation (home-isolation.ts): per-agent opt-in via
+       * daemon_config.home_isolation (unset = legacy shared HOME for existing
+       * agents), machine-level kill switch PRLL_DAEMON_HOME_ISOLATION=0. K8s
+       * pods never take this path — they keep the isolated claude-home +
+       * shared-credential-link branch in spawnAgentOnce.
+       */
+      buildHomeIsolationSpec(attached, agentId) {
+        if (process.env.KUBERNETES_SERVICE_HOST)
+          return void 0;
+        if (this.config.homeIsolationDisabled)
+          return void 0;
+        if (attached.daemon_config?.home_isolation !== true)
+          return void 0;
+        return {
+          homeDir: agentHomeDirFor(this.config.rootStateDir, agentId),
+          claudeStateRoot: this.config.rootClaudeHome,
+          systemHome: os7.homedir(),
+          gitUserName: attached.user?.display_name?.trim() || agentId,
+          gitUserEmail: `${agentId}@noreply.parall.com`
+        };
+      }
       async spawnAgentOnce(agentId, orgId, attached) {
         let credential;
         try {
@@ -37023,12 +37196,13 @@ var init_supervisor = __esm({
         const stateDir = agentStateDirFor(this.config.rootStateDir, agentId);
         const defaultWorkspaceDir = agentWorkspaceDirFor(this.config.rootStateDir, agentId);
         const isK8s = !!process.env.KUBERNETES_SERVICE_HOST;
-        const claudeHome = isK8s ? agentClaudeHomeFor(this.config.rootClaudeHome, agentId) : this.config.rootClaudeHome;
+        const homeIsolation = this.buildHomeIsolationSpec(attached, agentId);
+        const claudeHome = isK8s ? agentClaudeHomeFor(this.config.rootClaudeHome, agentId) : homeIsolation?.homeDir ?? this.config.rootClaudeHome;
         try {
-          fs12.mkdirSync(stateDir, { recursive: true });
+          fs13.mkdirSync(stateDir, { recursive: true });
           if (isK8s) {
-            fs12.mkdirSync(claudeHome, { recursive: true });
-            this.ensureSharedCredentialLink(claudeHome, agentId);
+            fs13.mkdirSync(claudeHome, { recursive: true });
+            ensureSharedCredentialLink(this.config.rootClaudeHome, claudeHome, agentId, this.log);
           }
         } catch (err) {
           this.log.warn(`mkdir agent dirs (${agentId}) failed: ${String(err)}`);
@@ -37061,6 +37235,7 @@ var init_supervisor = __esm({
           // resolved at startChild time (see resolveProviderConfig) so a respawn
           // after a machine llm_source change picks up the new source.
           providerConfig: attached.provider_config,
+          homeIsolation,
           child: null,
           credential,
           restartAttempts: 0,
@@ -37080,17 +37255,38 @@ var init_supervisor = __esm({
           return;
         }
         assertAgentKey(state.credential.api_key);
+        const effectiveProviderConfig = effectiveLLMSourceExplicit(state.providerConfig) ? state.providerConfig : { llm_source: this.machineLlmSource };
+        let isolation = state.homeIsolation;
+        if (isolation) {
+          try {
+            const failures = ensureIsolatedHome(isolation, state.agentId, this.log);
+            if (failures.length > 0) {
+              const needsPassthrough = state.runtimeType === "claude-code" && llmSource(effectiveProviderConfig) === "runtime_auth";
+              if (needsPassthrough) {
+                this.log.warn(`agent ${state.agentId}: home isolation passthrough failed (${failures.join("; ")}) \u2014 falling back to the shared HOME for this spawn so the runtime keeps its login`);
+                isolation = void 0;
+              } else {
+                this.log.warn(`agent ${state.agentId}: home isolation passthrough incomplete (${failures.join("; ")}) \u2014 keeping the fake HOME (this runtime/source does not need the shared-login links)`);
+              }
+            }
+          } catch (err) {
+            this.log.warn(`agent ${state.agentId}: home isolation setup failed \u2014 falling back to the shared HOME for this spawn: ${String(err)}`);
+            isolation = void 0;
+          }
+        }
         const adapter = getRuntimeAdapter(state.runtimeType);
         const dirs = {
           stateDir: agentStateDirFor(this.config.rootStateDir, state.agentId),
           workspaceDir: state.workspacePath,
-          claudeHome: state.claudeHome
+          // Only the isolation-fallback case replaces claudeHome: K8s (isolation
+          // never set) and legacy-shared children keep their state.claudeHome.
+          claudeHome: state.homeIsolation && !isolation ? this.config.rootClaudeHome : state.claudeHome,
+          homeDir: isolation?.homeDir
         };
         let baseEnv = { ...process.env, PRLL_API_URL: this.config.apiUrl };
         if (this.machineId)
           baseEnv.PRLL_MACHINE_ID = this.machineId;
         baseEnv = applyRuntimeBinaryEnv(state.runtimeType, baseEnv, this.log);
-        const effectiveProviderConfig = effectiveLLMSourceExplicit(state.providerConfig) ? state.providerConfig : { llm_source: this.machineLlmSource };
         const env = adapter.buildEnv(baseEnv, state.agentId, state.orgId, state.credential.api_key, dirs, effectiveProviderConfig);
         const spawnCmd = adapter.args.length > 0 ? `${adapter.bin} ${adapter.args.join(" ")}` : adapter.bin;
         this.log.info(`spawning agent ${state.agentId} runtime=${state.runtimeType} cmd=${spawnCmd} (attempt ${state.restartAttempts + 1})`);
@@ -37173,33 +37369,6 @@ var init_supervisor = __esm({
           child.once("exit", () => clearTimeout(hardKill));
         });
       }
-      ensureSharedCredentialLink(agentClaudeHome, agentId) {
-        const sharedCredentials = path16.resolve(sharedClaudeCredentialsFileFor(this.config.rootClaudeHome));
-        const agentCredentials = agentClaudeCredentialsFileFor(agentClaudeHome);
-        const agentCredentialsDir = path16.dirname(agentCredentials);
-        fs12.mkdirSync(path16.dirname(sharedCredentials), { recursive: true });
-        fs12.mkdirSync(agentCredentialsDir, { recursive: true });
-        try {
-          const existing = fs12.lstatSync(agentCredentials);
-          if (existing.isSymbolicLink()) {
-            const currentTarget = fs12.readlinkSync(agentCredentials);
-            if (path16.resolve(agentCredentialsDir, currentTarget) === sharedCredentials) {
-              return;
-            }
-            fs12.unlinkSync(agentCredentials);
-          } else if (existing.isDirectory()) {
-            this.log.warn(`agent ${agentId}: credential path is a directory, cannot link ${agentCredentials}`);
-            return;
-          } else {
-            fs12.unlinkSync(agentCredentials);
-          }
-        } catch (err) {
-          if (err.code !== "ENOENT") {
-            throw err;
-          }
-        }
-        fs12.symlinkSync(sharedCredentials, agentCredentials);
-      }
     };
   }
 });
@@ -37405,8 +37574,8 @@ var init_daemon_main = __esm({
 // ts/daemon/dist/index.js
 init_daemon_paths();
 init_daemon_update_mode();
-import * as fs13 from "node:fs";
-import * as path17 from "node:path";
+import * as fs14 from "node:fs";
+import * as path18 from "node:path";
 var UPDATE_EXIT_CODE2 = 42;
 function formatError2(reason) {
   if (reason instanceof Error) {
@@ -37422,7 +37591,7 @@ function errnoCode(err) {
 }
 function clearRunningMarker(markerPath) {
   try {
-    fs13.unlinkSync(markerPath);
+    fs14.unlinkSync(markerPath);
   } catch (err) {
     if (errnoCode(err) === "ENOENT")
       return;
@@ -37431,15 +37600,15 @@ function clearRunningMarker(markerPath) {
 }
 function prepareDaemonBootstrap(env = process.env, args = process.argv.slice(2)) {
   const bundleDir = resolveBundleDir(env);
-  const runningMarker = path17.join(bundleDir, "daemon-running");
+  const runningMarker = path18.join(bundleDir, "daemon-running");
   const lifecycleMarkerEnabled = args.length === 0 && !isSelfUpdateDisabledByEnv(env) && isSelfUpdateManaged(bundleDir, env);
   if (!lifecycleMarkerEnabled) {
     return { lifecycleMarkerEnabled: false, runningMarker, uncleanPrevExit: false };
   }
-  const uncleanPrevExit = fs13.existsSync(runningMarker);
+  const uncleanPrevExit = fs14.existsSync(runningMarker);
   try {
-    fs13.mkdirSync(bundleDir, { recursive: true });
-    fs13.writeFileSync(runningMarker, String(process.pid));
+    fs14.mkdirSync(bundleDir, { recursive: true });
+    fs14.writeFileSync(runningMarker, String(process.pid));
   } catch (err) {
     console.warn(`failed to write daemon running marker: ${formatError2(err)}`);
   }