@peakflo/agent-harness 0.2.10-rc.1 → 0.2.10-rc.2

package/README.md

@@ -52,6 +52,68 @@ Optional flags include `--health-port <port>`, `--runtime <desktop|self-hosted>`
 `--workspace-root <path>`, and `--github-proxy-port <port>`. Run
 `npx @peakflo/agent-harness@rc --help` for the full list.
 
+## Run after you close the terminal
+
+The background service supports macOS launchd user agents and Linux systemd
+user units. Windows background service setup is not supported yet.
+
+First, run `start` once in a terminal and finish sign-in. The runner saves its
+runner credential in the workspace with file mode 0600. Stop it with Ctrl-C.
+Install the package in a stable location before you install the service. For
+example:
+
+```sh
+npm install -g @peakflo/agent-harness@latest
+pf-agent-harness service install --control-plane https://api.peakflo.ai
+pf-agent-harness service status
+```
+
+For a self-hosted host, add `--runtime self-hosted`. If you used a custom
+`--workspace-root` for the first start, pass that same path to `service install`.
+Other `start` options can also follow `service install`. To enable vendor
+harnesses on this machine, pass `--vendor-harnesses codex,claude-code,cursor` or set
+`PF_VENDOR_HARNESSES` when you install. The service saves that choice as a
+start option. It does not save a token or copy the current environment.
+
+```sh
+pf-agent-harness service repair
+pf-agent-harness service uninstall
+```
+
+`install` checks that the health port is free before it starts a new service.
+Stop a manual runner before you install. `install` updates an existing service.
+`repair` writes the service file again with the current Node.js and harness
+paths, then restarts it. `uninstall` stops and removes the service and its
+settings. It keeps the runner credential so you
+can use the runner again. `status` shows running or stopped and the last exit
+error that the service manager reports.
+
+On macOS, the service file is in `~/Library/LaunchAgents`, and logs are in
+`~/.pf-agent-harness/logs`. On Linux, the unit is in
+`~/.config/systemd/user`; read its logs with
+`journalctl --user -u pf-agent-harness.service`. A Linux user service can stop
+when you log out. If it must run after logout, ask your system administrator to
+enable linger with `loginctl enable-linger $USER`. The installer does not run
+that command.
+
+On macOS, rotate the two log files in `~/.pf-agent-harness/logs` with your
+normal user log rotation tool. The service does not cap them. Stop the service
+before you remove or truncate them. After an npm or Node.js upgrade, run
+`pf-agent-harness service repair` so the service uses the new paths. If you
+installed the harness from npm's temporary `npx` cache or use an `nvm` Node.js
+path, `service install` shows a warning about this path.
+
+New service files start with `--service --stored-credential`. Older service
+files with only `--stored-credential` still work after an upgrade. Run
+`service repair` to update the file. The runner reads its saved credential
+from the workspace. If that credential is missing, expired, or
+rejected, start the runner once in a terminal to sign in again. The service
+file and the service settings contain no enrolment token or runner credential.
+It stops after an invalid option, a refused harness version, an unusable
+credential, or a local port conflict. Linux waits 30 seconds before it retries
+other failures. `service status` shows the last cause. A manual `start` refuses to
+run beside a live service with the same workspace or health port.
+
 ## Harnesses found on your machine
 
 On a desktop or self-hosted machine the runner looks for Codex (`codex`),
@@ -60,15 +122,26 @@ Claude Code (`claude`), Cursor (`cursor-agent`), Pi (`pi`) and OpenCode
 whether it is signed in, and the models it offers. Peakflo shows this list in
 the agent editor and in the chat details.
 
-**Which ones the runner can run.** Pi always. On a desktop or self-hosted
-machine also Codex, Claude Code and Cursor, each for as long as it is
-installed and signed in on that machine — the runner uses that sign-in, as you
-do when you run the tool yourself. An agent in Peakflo can then be given that
-harness and one of its models. OpenCode is listed and cannot be run yet. A
-cloud sandbox runs Pi only.
-
-- These turns use your own Codex, Claude or Cursor account. They do not go
-  through the Peakflo model gateway and are not metered by Peakflo.
+**Which ones the runner can run.** Pi always. After onboarding 0g adds personal
+tokens, a personal desktop or self-hosted runner can also run Codex, Claude Code
+and Cursor while each tool is installed and signed in on that machine. The
+runner uses that sign-in, as you do when you run the tool yourself. An agent in
+Peakflo can then be given that harness and one of its models. OpenCode is
+listed and cannot be run yet. A cloud sandbox runs Pi only.
+
+- These turns use a configured vendor account. Codex links only `auth.json`
+  into a private runner folder, so login refresh stays in sync. Codex keyring
+  and auto login are not supported in that folder; select file login or an API
+  key. Claude Code uses a private config folder. On macOS it keeps access to
+  the host login keychain. On Linux it links the owner's credential file into
+  that folder and uses the owner file as the secure storage path for refresh.
+  API-key turns use a separate folder with no subscription login link. Claude
+  Code 2.1.144 or newer is required for this login path.
+  Cursor keeps the host home folder on macOS for its login keychain. Its
+  other config roots are private, but Cursor can still read owner settings
+  under the home folder. On Linux, the private home folder cannot find a
+  Cursor subscription login; use an API key for Cursor turns there.
+  These turns do not go through the Peakflo model gateway.
 - When you sign out of a harness, or remove it, the runner stops taking work
   for it after its next check.
 - What the runner brings and what it expects, the same split as the 20x app:
@@ -108,6 +181,17 @@ or the content of credential files. Model names that look like an email
 address or a key are dropped; that check is a safety net, not a guarantee
 about what a third-party program prints.
 
+**Enabling vendor turns.** Discovery only reports Codex, Claude Code and
+Cursor. It does not let the runner take turns with them. To enable one or more,
+start the runner with `--vendor-harnesses codex,claude-code,cursor`, or set
+`PF_VENDOR_HARNESSES` to a comma-separated list. The default is empty. The
+control plane also requires a personal runner whose owner is the turn speaker.
+Admin-minted tokens always create shared runners, which cannot take vendor turns
+even when they have an owner and this flag. Vendor turns are unavailable until
+member-minted personal tokens ship in onboarding 0g. After that, each person
+must register their own personal runner with a token they minted. An existing
+shared runner must be replaced and any agent pins must use the new runner ID.
+
 **Turning it off.** Start with `--no-harness-discovery`, or set
 `PF_HARNESS_DISCOVERY=0`. The runner then starts none of these programs and
 reports no list. Running turns with Pi is not affected.
@@ -126,10 +210,22 @@ cannot be honoured exactly, the runner uses the stricter behaviour.
 | Don't ask for permission | Runs without asking                                                                           | Runs without asking                          | Runs without asking; each request Cursor raises is approved once          |
 
 Cursor is read-only in the asking modes because it asks only about commands
-that are not on the allow-list in its own settings (`~/.cursor/cli-config.json`).
-The runner does not read or change that file, so it cannot promise a question
-before each action. If Cursor will not accept the read-only mode, the turn is
-refused.
+that are not on its own allow-list. Cursor has no supported switch that
+proves all plugins and keychain state are isolated. If Cursor
+will not accept the read-only mode, the turn is refused.
+
+Every vendor turn gets only a selected child environment. Repository turns
+get a session GitHub sentinel and local proxy. Other turns get an empty `gh`
+login folder. Git uses no owner global configuration. Claude Code loads no
+user or project settings. Codex receives a private `CODEX_HOME` with login
+data only; owner MCP servers from `config.toml` are not copied. The default
+approval wait is 30 minutes. Set `CODING_AGENT_APPROVAL_TIMEOUT_MINUTES` on
+the runner to change it. An unanswered approval is denied and ends the turn.
+An unanswered agent question also closes after this limit. On desktop and
+self-hosted runners, the vendor CLI uses the same OS account as the owner.
+These environment and config rules stop default credential lookups. They are
+not a hard security boundary outside a sandbox: a process with that account's
+filesystem and keychain access can still read owner data directly.
 
 The runner never answers a request with "always allow", and does not offer
 that answer to the person approving: Codex and Cursor would save it as a

package/dist/adapters/acp-adapter.js

@@ -28,11 +28,10 @@ exports.AcpAdapter = exports.ACP_SESSION_START_TIMEOUT_MS = void 0;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const child_stream_guards_1 = require("../runtime/child-stream-guards");
-const fs_1 = require("fs");
-const os_1 = require("os");
 const path_1 = require("path");
 const util_1 = require("util");
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
+const vendor_environment_1 = require("./vendor-environment");
 const cursor_acp_1 = require("./cursor-acp");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 /**
@@ -183,7 +182,8 @@ class AcpAdapter {
                 env.CODEX_API_KEY = key;
             }
             env.NO_BROWSER = '1';
-            env.CODEX_HOME = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'codex-session-'));
+            env.CODEX_HOME = (0, vendor_environment_1.codexVendorConfigDir)(config, true);
+            (0, vendor_environment_1.isolateVendorHome)(env, env.CODEX_HOME);
             console.log(`[AcpAdapter/codex] Auth: API key (authMethod=${config.authMethod ?? 'legacy'}, isolated CODEX_HOME)`);
             return true;
         }
@@ -191,19 +191,22 @@ class AcpAdapter {
         // hijack auth away from the ChatGPT subscription in the default CODEX_HOME.
         delete env.OPENAI_API_KEY;
         delete env.CODEX_API_KEY;
-        // Pin CODEX_HOME to the same dir the `codex` CLI uses in a terminal, so
-        // codex-acp reads the exact subscription login the user already has. We only
-        // set it when not already provided (a user who runs `codex` with a custom
-        // CODEX_HOME will have it in their shell env, which we inherit and preserve).
-        if (!env.CODEX_HOME) {
-            env.CODEX_HOME = (0, path_1.join)((0, os_1.homedir)(), '.codex');
-        }
+        // Copy only the subscription login. Do not load the owner's config.toml,
+        // which can name MCP servers and rules outside this turn's lease.
+        env.CODEX_HOME = (0, vendor_environment_1.codexVendorConfigDir)(config, false);
+        (0, vendor_environment_1.isolateVendorHome)(env, env.CODEX_HOME);
         console.log(`[AcpAdapter/codex] Auth: ChatGPT subscription / Codex CLI login (authMethod=${config.authMethod ?? 'legacy'}, CODEX_HOME=${env.CODEX_HOME})`);
         return false;
     }
     configureCursorAuthEnv(env, config) {
         if (this.agentType !== 'cursor')
             return;
+        // Keep configuration roots private, but preserve the macOS login keychain.
+        // Cursor has no complete switch for owner settings under ~/.cursor.
+        (0, vendor_environment_1.isolateVendorHome)(env, (0, vendor_environment_1.vendorConfigDir)('cursor', config, '', []));
+        if (process.platform === 'darwin' && process.env.HOME) {
+            env.HOME = process.env.HOME;
+        }
         const explicitApiKey = config.apiKeys?.cursor;
         const useApiKey = config.authMethod === 'api_key'
             || (config.authMethod !== 'subscription' && !!explicitApiKey);
@@ -276,19 +279,12 @@ class AcpAdapter {
         const sessionId = config.taskId;
         console.log(`[AcpAdapter/${this.agentType}] Creating session ${sessionId}`);
         // Prepare environment with API keys
-        const env = {
-            ...process.env,
+        const env = (0, vendor_environment_1.vendorEnvironment)(config, {
+            ...(this.agentType === 'codex'
+                ? { OPENAI_API_KEY: process.env.OPENAI_API_KEY, CODEX_API_KEY: process.env.CODEX_API_KEY }
+                : { CURSOR_API_KEY: process.env.CURSOR_API_KEY }),
             ...this.agentConfig.env
-        };
-        if (config.apiKeys?.anthropic) {
-            env.ANTHROPIC_API_KEY = config.apiKeys.anthropic;
-        }
-        // Inject secret env vars directly into process environment
-        if (config.secretEnvVars && Object.keys(config.secretEnvVars).length > 0) {
-            for (const [key, value] of Object.entries(config.secretEnvVars)) {
-                env[key] = value;
-            }
-        }
+        });
         // Decide Codex auth (subscription vs API key) LAST so it is authoritative.
         // It must run after secret-env injection: a user secret named OPENAI_API_KEY /
         // CODEX_API_KEY would otherwise be re-added to env after subscription mode
@@ -437,19 +433,12 @@ class AcpAdapter {
             anthropicKeyLength: config.apiKeys?.anthropic?.length
         });
         // Prepare environment with API keys
-        const env = {
-            ...process.env,
+        const env = (0, vendor_environment_1.vendorEnvironment)(config, {
+            ...(this.agentType === 'codex'
+                ? { OPENAI_API_KEY: process.env.OPENAI_API_KEY, CODEX_API_KEY: process.env.CODEX_API_KEY }
+                : { CURSOR_API_KEY: process.env.CURSOR_API_KEY }),
             ...this.agentConfig.env
-        };
-        if (config.apiKeys?.anthropic) {
-            env.ANTHROPIC_API_KEY = config.apiKeys.anthropic;
-        }
-        // Inject secret env vars directly into process environment
-        if (config.secretEnvVars && Object.keys(config.secretEnvVars).length > 0) {
-            for (const [key, value] of Object.entries(config.secretEnvVars)) {
-                env[key] = value;
-            }
-        }
+        });
         // Decide Codex auth (subscription vs API key) LAST so it is authoritative —
         // see createSession for why this must run after secret-env injection.
         const codexUseApiKey = this.configureCodexAuthEnv(env, config);
@@ -1258,10 +1247,9 @@ class AcpAdapter {
             ? oneTimeOptions
             : allApprovalOptions;
         if (session.config.permissionMode === 'allow') {
-            // Cursor saves "allow always" as a standing rule in the runner owner's
-            // `~/.cursor/cli-config.json` (seen: one bypass turn added `Shell(echo)`
-            // and `Shell(cat)`), which would then also apply to turns that are meant
-            // to ask. Every request is approved once instead.
+            // Cursor saves "allow always" as a standing rule (seen: one bypass
+            // turn added Shell(echo) and Shell(cat)). That rule could affect later
+            // turns. Every request is approved once instead.
             if (this.agentType === 'cursor') {
                 const once = approvalOptions.find((option) => option.optionId === 'allow-once')
                     || approvalOptions.find((option) => option.kind === 'allow_once');

package/dist/adapters/claude-code-adapter.d.ts

@@ -8,15 +8,9 @@
  * - File-based session persistence (~/.claude/sessions/)
  * - Different message format (SDKMessage vs OpenCode messages)
  */
-/**
- * Extracted verbatim from 20x `src/main/adapters/claude-code-adapter.ts`.
- * CHANGED: nothing. The only import it has is `./coding-agent-adapter`, which
- * sits in the same directory here too. `@anthropic-ai/claude-agent-sdk` is an
- * optional dependency (dynamically imported) and is declared ambiently in
- * `./optional-agent-sdks.d.ts` so `tsc` succeeds when it is not installed.
- * Source formatting (no semicolons) preserved.
- */
 import type { CodingAgentAdapter, SessionConfig, SessionStatus, SessionMessage, MessagePart } from './coding-agent-adapter';
+export declare function assertClaudeIsolatedConfigVersion(version: string): void;
+export declare function verifyClaudeIsolatedConfigVersion(path: string): Promise<void>;
 export declare enum ClaudeSystemSubtype {
     INIT = "init",
     TASK_STARTED = "task_started",
@@ -35,6 +29,7 @@ export declare class ClaudeCodeAdapter implements CodingAgentAdapter {
     private sessions;
     private sdkLoading;
     private claudeExecutablePath;
+    private verifiedClaudeExecutablePath;
     /**
      * Callback set by agent-manager to trigger an immediate poll cycle
      * when new stream data is buffered.  Eliminates the up-to-2-second
@@ -51,12 +46,7 @@ export declare class ClaudeCodeAdapter implements CodingAgentAdapter {
      * (no shell: true). Resolve claude.cmd → the underlying cli.js path.
      */
     private resolveWindowsCmdToJs;
-    /**
-     * Build environment variables for Claude process
-     * Removes CLAUDECODE to prevent nested session errors.
-     * When secrets are configured, sets SHELL to the secret-shell.sh wrapper
-     * so every bash command fetches secrets from the broker transparently.
-     */
+    /** Build an isolated Claude process environment with the host keychain login. */
     private buildClaudeEnvironment;
     /**
      * Build PreToolUse hooks for secret injection.

package/dist/adapters/claude-code-adapter.js

@@ -44,11 +44,50 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClaudeCodeAdapter = exports.ClaudeSystemSubtype = void 0;
+exports.assertClaudeIsolatedConfigVersion = assertClaudeIsolatedConfigVersion;
+exports.verifyClaudeIsolatedConfigVersion = verifyClaudeIsolatedConfigVersion;
+/**
+ * Extracted verbatim from 20x `src/main/adapters/claude-code-adapter.ts`.
+ * CHANGED: nothing. The only import it has is `./coding-agent-adapter`, which
+ * sits in the same directory here too. `@anthropic-ai/claude-agent-sdk` is an
+ * optional dependency (dynamically imported) and is declared ambiently in
+ * `./optional-agent-sdks.d.ts` so `tsc` succeeds when it is not installed.
+ * Source formatting (no semicolons) preserved.
+ */
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
 const permission_mode_1 = require("../runtime/permission-mode");
+const vendor_environment_1 = require("./vendor-environment");
 let ClaudeAgentSDK = null;
 /** Module-level cache for the resolved Claude executable path (persists across adapter instances) */
 let resolvedClaudeExecutablePath = null;
+const MINIMUM_ISOLATED_CONFIG_VERSION = [2, 1, 144];
+function assertClaudeIsolatedConfigVersion(version) {
+    const match = version.match(/^(\d+)\.(\d+)\.(\d+)(?:\s|$)/);
+    const actual = match?.slice(1, 4).map(Number);
+    const firstDifference = actual?.findIndex((part, index) => part !== MINIMUM_ISOLATED_CONFIG_VERSION[index]);
+    const tooOld = actual && firstDifference !== undefined && firstDifference >= 0 &&
+        actual[firstDifference] < MINIMUM_ISOLATED_CONFIG_VERSION[firstDifference];
+    if (!actual || tooOld) {
+        throw new Error('Claude Code CLI is too old or its version cannot be checked for isolated config. Upgrade Claude Code to 2.1.144 or newer.');
+    }
+}
+async function verifyClaudeIsolatedConfigVersion(path) {
+    const { execFile } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
+    const { promisify } = await Promise.resolve().then(() => __importStar(require('node:util')));
+    const command = path.endsWith('.js') ? process.execPath : path;
+    const args = path.endsWith('.js') ? [path, '--version'] : ['--version'];
+    try {
+        const { stdout } = await promisify(execFile)(command, args, { timeout: 5_000 });
+        assertClaudeIsolatedConfigVersion(stdout.trim());
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('Upgrade Claude Code'))
+            throw error;
+        throw new Error('Claude Code CLI version could not be checked for isolated config. Upgrade Claude Code to 2.1.144 or newer.');
+    }
+}
 /** Maximum number of messages to keep in the buffer per session */
 const MAX_MESSAGE_BUFFER_SIZE = 500;
 var ClaudeSystemSubtype;
@@ -84,6 +123,7 @@ class ClaudeCodeAdapter {
     sessions = new Map();
     sdkLoading = null;
     claudeExecutablePath = null;
+    verifiedClaudeExecutablePath = null;
     /**
      * Callback set by agent-manager to trigger an immediate poll cycle
      * when new stream data is buffered.  Eliminates the up-to-2-second
@@ -215,16 +255,35 @@ class ClaudeCodeAdapter {
         // Fall back to original .cmd path
         return cmdPath;
     }
-    /**
-     * Build environment variables for Claude process
-     * Removes CLAUDECODE to prevent nested session errors.
-     * When secrets are configured, sets SHELL to the secret-shell.sh wrapper
-     * so every bash command fetches secrets from the broker transparently.
-     */
-    buildClaudeEnvironment() {
-        const env = { ...process.env };
-        // Remove CLAUDECODE to prevent nested session error
-        delete env.CLAUDECODE;
+    /** Build an isolated Claude process environment with the host keychain login. */
+    buildClaudeEnvironment(config) {
+        const useApiKey = config.authMethod === 'api_key';
+        const env = (0, vendor_environment_1.vendorEnvironment)(config, {
+            ANTHROPIC_API_KEY: useApiKey ? config.apiKeys?.anthropic ?? process.env.ANTHROPIC_API_KEY : undefined,
+            CLAUDE_CODE_OAUTH_TOKEN: useApiKey ? undefined : process.env.CLAUDE_CODE_OAUTH_TOKEN
+        });
+        if (useApiKey)
+            delete env.CLAUDE_CODE_OAUTH_TOKEN;
+        else
+            delete env.ANTHROPIC_API_KEY;
+        const ownerClaudeDir = (0, node_path_1.resolve)(process.env.CLAUDE_CONFIG_DIR || (0, node_path_1.join)((0, node_os_1.homedir)(), '.claude'));
+        env.CLAUDE_CONFIG_DIR = (0, vendor_environment_1.claudeVendorConfigDir)(config);
+        // On Linux, read and refresh the owner's credential file at its source.
+        // The private config also has a link for CLI paths that use that root.
+        // On macOS, an empty value selects the owner's original Keychain item.
+        env.CLAUDE_SECURESTORAGE_CONFIG_DIR = useApiKey
+            ? env.CLAUDE_CONFIG_DIR
+            : process.platform === 'linux' ? ownerClaudeDir : '';
+        // macOS needs the real HOME to find the login keychain. Linux can keep
+        // HOME private because the credential file is linked into this config.
+        if (useApiKey || process.platform === 'linux')
+            (0, vendor_environment_1.isolateVendorHome)(env, env.CLAUDE_CONFIG_DIR);
+        else {
+            if (process.env.HOME)
+                env.HOME = process.env.HOME;
+            if (process.env.USERPROFILE)
+                env.USERPROFILE = process.env.USERPROFILE;
+        }
         return env;
     }
     /**
@@ -234,7 +293,7 @@ class ClaudeCodeAdapter {
      * the output appear in conversation context.
      */
     buildSecretHooks(config) {
-        const secretEnvVars = config.secretEnvVars;
+        const secretEnvVars = Object.fromEntries(Object.entries(config.secretEnvVars ?? {}).filter(([key]) => (0, vendor_environment_1.allowedVendorSecretKey)(key)));
         if (!secretEnvVars || Object.keys(secretEnvVars).length === 0) {
             return undefined;
         }
@@ -339,12 +398,12 @@ class ClaudeCodeAdapter {
      * Cleans the session file by removing messages with empty text blocks
      * This prevents API errors when resuming sessions
      */
-    async cleanSessionFile(sessionId, workspaceDir) {
+    async cleanSessionFile(sessionId, config) {
         try {
             const { readFileSync, writeFileSync, existsSync } = await Promise.resolve().then(() => __importStar(require('fs')));
             const { join } = await Promise.resolve().then(() => __importStar(require('path')));
-            const { homedir } = await Promise.resolve().then(() => __importStar(require('os')));
-            const claudeDir = join(homedir(), '.claude', 'projects');
+            const workspaceDir = config.workspaceDir;
+            const claudeDir = join((0, vendor_environment_1.claudeVendorConfigDir)(config), 'projects');
             // Claude Code CLI encodes workspace paths by replacing all non-alphanumeric/non-hyphen chars with '-'
             const encodedWorkspace = workspaceDir.replace(/[^a-zA-Z0-9-]/g, '-');
             const sessionFile = join(claudeDir, encodedWorkspace, `${sessionId}.jsonl`);
@@ -400,20 +459,20 @@ class ClaudeCodeAdapter {
         if (!workspaceDir)
             return [];
         try {
-            return await this.loadSessionHistory(sessionId, workspaceDir);
+            return await this.loadSessionHistory(sessionId, config);
         }
         catch {
             return [];
         }
     }
-    async loadSessionHistory(sessionId, workspaceDir) {
+    async loadSessionHistory(sessionId, config) {
         try {
             const { readFileSync, existsSync } = await Promise.resolve().then(() => __importStar(require('fs')));
             const { join } = await Promise.resolve().then(() => __importStar(require('path')));
-            const { homedir } = await Promise.resolve().then(() => __importStar(require('os')));
-            // Session files are stored in: ~/.claude/projects/[encoded-workspace]/[sessionId].jsonl
+            const workspaceDir = config.workspaceDir;
+            // Session files are stored under the same runner config used by the CLI.
             // Claude Code CLI encodes workspace paths by replacing all non-alphanumeric/non-hyphen chars with '-'
-            const claudeDir = join(homedir(), '.claude', 'projects');
+            const claudeDir = join((0, vendor_environment_1.claudeVendorConfigDir)(config), 'projects');
             const encodedWorkspace = workspaceDir.replace(/[^a-zA-Z0-9-]/g, '-');
             const sessionFile = join(claudeDir, encodedWorkspace, `${sessionId}.jsonl`);
             console.log(`[ClaudeCodeAdapter] Loading session history from: ${sessionFile}`);
@@ -577,7 +636,7 @@ class ClaudeCodeAdapter {
             throw new Error('INCOMPATIBLE_SESSION_ID: This session was created with a different coding agent and cannot be resumed with Claude Code.');
         }
         // Clean session file to remove empty text blocks before resuming
-        await this.cleanSessionFile(sessionId, config.workspaceDir);
+        await this.cleanSessionFile(sessionId, config);
         // Create session state (idle until user sends a message)
         const session = {
             sessionId,
@@ -600,7 +659,7 @@ class ClaudeCodeAdapter {
         // The query will be started in sendPrompt with resume option
         console.log(`[ClaudeCodeAdapter] Session resumed: ${sessionId} (waiting for user prompt)`);
         // Load conversation history from session file
-        const messages = await this.loadSessionHistory(sessionId, config.workspaceDir);
+        const messages = await this.loadSessionHistory(sessionId, config);
         console.log(`[ClaudeCodeAdapter] Session loaded with ${messages.length} messages`);
         return messages;
     }
@@ -653,6 +712,10 @@ class ClaudeCodeAdapter {
         }
         // Find Claude executable
         const claudePath = await this.findClaudeExecutable();
+        if (this.verifiedClaudeExecutablePath !== claudePath) {
+            await verifyClaudeIsolatedConfigVersion(claudePath);
+            this.verifiedClaudeExecutablePath = claudePath;
+        }
         // Create new abort controller
         const abortController = new AbortController();
         session.abortController = abortController;
@@ -663,7 +726,8 @@ class ClaudeCodeAdapter {
         const options = {
             cwd: config.workspaceDir,
             pathToClaudeCodeExecutable: claudePath,
-            env: this.buildClaudeEnvironment(),
+            env: this.buildClaudeEnvironment(config),
+            settingSources: [],
             mcpServers: config.mcpServers,
             model: config.model,
             effort,

package/dist/adapters/codex-adapter.js

@@ -53,6 +53,7 @@ exports.CodexAdapter = exports.DEFAULT_CODEX_MODEL = void 0;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const child_stream_guards_1 = require("../runtime/child-stream-guards");
+const vendor_environment_1 = require("./vendor-environment");
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
 exports.DEFAULT_CODEX_MODEL = 'gpt-5.6-sol';
 class CodexAdapter {
@@ -132,10 +133,20 @@ class CodexAdapter {
     /**
      * Build environment variables for Codex process
      */
-    buildCodexEnvironment() {
-        const env = { ...process.env };
-        // Ensure API key is available
-        if (!env.OPENAI_API_KEY && !env.CODEX_API_KEY) {
+    buildCodexEnvironment(config) {
+        const useApiKey = config.authMethod === 'api_key' ||
+            (config.authMethod !== 'subscription' && !!config.apiKeys?.openai);
+        const env = (0, vendor_environment_1.vendorEnvironment)(config, {
+            OPENAI_API_KEY: config.apiKeys?.openai ?? process.env.OPENAI_API_KEY,
+            CODEX_API_KEY: config.apiKeys?.openai ?? process.env.CODEX_API_KEY
+        });
+        if (!useApiKey) {
+            delete env.OPENAI_API_KEY;
+            delete env.CODEX_API_KEY;
+        }
+        env.CODEX_HOME = (0, vendor_environment_1.codexVendorConfigDir)(config, useApiKey);
+        (0, vendor_environment_1.isolateVendorHome)(env, env.CODEX_HOME);
+        if (useApiKey && !env.OPENAI_API_KEY && !env.CODEX_API_KEY) {
             console.warn('[CodexAdapter] No OPENAI_API_KEY or CODEX_API_KEY found in environment');
         }
         return env;
@@ -162,7 +173,7 @@ class CodexAdapter {
         const codexProcess = (0, child_process_1.spawn)(this.codexExecutablePath, this.buildCodexArgs(config), {
             cwd: config.workspaceDir,
             stdio: ['pipe', 'pipe', 'pipe'],
-            env: this.buildCodexEnvironment(),
+            env: this.buildCodexEnvironment(config),
             ...(needsShell ? { shell: true } : {}),
         });
         // Every pipe needs an error listener before the first write. Codex can exit
@@ -235,7 +246,7 @@ class CodexAdapter {
         const codexProcess = (0, child_process_1.spawn)(this.codexExecutablePath, this.buildCodexArgs(config), {
             cwd: config.workspaceDir,
             stdio: ['pipe', 'pipe', 'pipe'],
-            env: this.buildCodexEnvironment(),
+            env: this.buildCodexEnvironment(config),
             ...(needsShellResume ? { shell: true } : {}),
         });
         // Every pipe needs an error listener before the first write. Codex can exit

package/dist/adapters/codex-app-server-adapter.js

@@ -54,11 +54,11 @@ exports.codexApprovalPolicy = codexApprovalPolicy;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const child_stream_guards_1 = require("../runtime/child-stream-guards");
-const os_1 = require("os");
 const path_1 = require("path");
 const util_1 = require("util");
 const coding_agent_adapter_1 = require("./coding-agent-adapter");
 const codex_approval_text_1 = require("./codex-approval-text");
+const vendor_environment_1 = require("./vendor-environment");
 const DEFAULT_CODEX_APP_SERVER_MODEL = 'gpt-5.5';
 /**
  * `thread/items/list` returns each item inside an envelope:
@@ -642,10 +642,10 @@ class CodexAppServerAdapter {
         return await execFileAsync(command, args, options);
     }
     buildEnvironment(config) {
-        const env = { ...process.env };
-        for (const [key, value] of Object.entries(config.secretEnvVars || {})) {
-            env[key] = value;
-        }
+        const env = (0, vendor_environment_1.vendorEnvironment)(config, {
+            OPENAI_API_KEY: config.apiKeys?.openai ?? process.env.OPENAI_API_KEY,
+            CODEX_API_KEY: config.apiKeys?.openai ?? process.env.CODEX_API_KEY
+        });
         const explicitApiKey = config.apiKeys?.openai;
         const useApiKey = config.authMethod === 'api_key' ? true
             : config.authMethod === 'subscription' ? false
@@ -657,7 +657,8 @@ class CodexAppServerAdapter {
                 env.CODEX_API_KEY = key;
             }
             env.NO_BROWSER = '1';
-            env.CODEX_HOME = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'codex-app-server-session-'));
+            env.CODEX_HOME = (0, vendor_environment_1.codexVendorConfigDir)(config, true);
+            (0, vendor_environment_1.isolateVendorHome)(env, env.CODEX_HOME);
             return {
                 env,
                 usesApiKey: true,
@@ -667,9 +668,8 @@ class CodexAppServerAdapter {
         if (!useApiKey) {
             delete env.OPENAI_API_KEY;
             delete env.CODEX_API_KEY;
-            if (!env.CODEX_HOME) {
-                env.CODEX_HOME = (0, path_1.join)((0, os_1.homedir)(), '.codex');
-            }
+            env.CODEX_HOME = (0, vendor_environment_1.codexVendorConfigDir)(config, false);
+            (0, vendor_environment_1.isolateVendorHome)(env, env.CODEX_HOME);
         }
         return {
             env,

package/dist/adapters/cursor-acp.d.ts

@@ -40,9 +40,8 @@ export type CursorMode = 'agent' | 'plan' | 'ask';
  * The Cursor mode a turn must run in.
  *
  * FAIL CLOSED. In its `agent` mode Cursor asks only about commands that are
- * not on the allow-list in the runner owner's `~/.cursor/cli-config.json`
- * (seen: "Not in allowlist: cat, echo"). The runner must not read or change
- * that list, so it cannot know which actions Cursor will run unasked, and a
+ * not on its own allow-list (seen: "Not in allowlist: cat, echo"). The runner
+ * cannot know which actions Cursor will run unasked, and a
  * permission mode that promises a question before EACH action cannot be
  * promised for Cursor. Every asking mode therefore runs
  * Cursor in one of its own read-only modes — stricter than what was asked for,

package/dist/adapters/cursor-acp.js

@@ -112,9 +112,8 @@ function resolveCursorModelValue(model, sessionResult) {
  * The Cursor mode a turn must run in.
  *
  * FAIL CLOSED. In its `agent` mode Cursor asks only about commands that are
- * not on the allow-list in the runner owner's `~/.cursor/cli-config.json`
- * (seen: "Not in allowlist: cat, echo"). The runner must not read or change
- * that list, so it cannot know which actions Cursor will run unasked, and a
+ * not on its own allow-list (seen: "Not in allowlist: cat, echo"). The runner
+ * cannot know which actions Cursor will run unasked, and a
  * permission mode that promises a question before EACH action cannot be
  * promised for Cursor. Every asking mode therefore runs
  * Cursor in one of its own read-only modes — stricter than what was asked for,