@vanillagreen/pi-claude-bridge 1.6.2 → 1.9.0

package/src/bridge-state.ts

@@ -0,0 +1,136 @@
+import { type ExtensionAPI, type ExtensionUIContext } from "@earendil-works/pi-coding-agent";
+import { debug, diagDump, diagLogPath } from "./debug.js";
+import { type QueryContext } from "./query-state.js";
+import { summarizeMissingToolNames, type MissingToolResult } from "./tool-pairing-audit.js";
+
+export interface SessionState {
+	sessionId: string;
+	cursor: number;
+	cwd: string;
+	// Force the next syncSharedSession call down the REBUILD path. Set when
+	// pi has mutated its messages array out from under us (compact, tree
+	// navigation) or after an abort left the JSONL in an indeterminate state.
+	// REBUILD wipes and rewrites the file to match pi's current history.
+	needsRebuild?: boolean;
+	// Set ONLY after an abort. The killed CC subprocess may still be flushing
+	// a late "[Request interrupted by user]" record to the session JSONL.
+	// Reusing the same sessionId/path would race that orphan write into our
+	// fresh file and break CC's parent-uuid chain on the next resume. When
+	// this flag is set, REBUILD takes a fresh UUID and skips deleteSession
+	// so the orphan writes land on a dead inode. Compact/tree do NOT set
+	// this — there's no concurrent CC writer during those events, so
+	// in-place rebuild (preserve UUID, deleteSession + createSession) is safe.
+	forceRotate?: boolean;
+}
+
+// Shared mutable bridge state. Lives in its own module so the extracted
+// modules and index.ts observe the SAME state: ESM live bindings let every
+// importer READ these `let` bindings live, but only this module may assign
+// them — cross-module writes must go through the setters below.
+export let sharedSession: SessionState | null = null;
+export let extensionApi: ExtensionAPI | undefined;
+export let piUI: ExtensionUIContext | undefined;
+
+export function setSharedSession(next: SessionState | null): void {
+	sharedSession = next;
+}
+
+export function setExtensionApi(next: ExtensionAPI | undefined): void {
+	extensionApi = next;
+}
+
+export function setPiUI(next: ExtensionUIContext | undefined): void {
+	piUI = next;
+}
+
+export function safeNotify(message: string, level: "info" | "warning" | "error" = "warning"): void {
+	try { piUI?.notify(message, level); }
+	catch (error) { debug("notify failed:", error); }
+}
+
+export function argKeys(args: Record<string, unknown> | undefined): string[] {
+	return Object.keys(args ?? {}).sort();
+}
+
+export function safeToolCallSummary(calls: Array<{ id: string; toolName: string; arguments?: Record<string, unknown> }>): Array<{ id: string; toolName: string; argKeys: string[] }> {
+	return calls.map((call) => ({ id: call.id, toolName: call.toolName, argKeys: argKeys(call.arguments) }));
+}
+
+function compactToolNameSummary(names: Array<{ name: string; count: number }>, limit = 12): string[] {
+	const shown = names.slice(0, limit).map(({ name, count }) => count > 1 ? `${name}×${count}` : name);
+	if (names.length > limit) shown.push(`+${names.length - limit} more`);
+	return shown;
+}
+
+export function reportSyntheticToolResultRepair(missing: MissingToolResult[], context: Record<string, unknown>): void {
+	try {
+		if (missing.length === 0) return;
+		const toolNames = summarizeMissingToolNames(missing);
+		const toolNameSummary = compactToolNameSummary(toolNames);
+		const sampledToolCallIds = missing.slice(0, 50).map((item) => item.id);
+		diagDump("repair_tool_pairing_synthetic_results", {
+			count: missing.length,
+			toolNames,
+			sampledToolCallIds,
+			missing: missing.slice(0, 50),
+			...context,
+		});
+		safeNotify(
+			`Claude bridge: ${missing.length} missing tool result(s) repaired with "[no tool result recorded]"` +
+			`${toolNameSummary.length ? ` for ${toolNameSummary.join(", ")}` : ""}. ` +
+			`Real tool output was lost before Claude session import; see ${diagLogPath()}.`,
+			"error",
+		);
+	} catch (error) {
+		debug("reportSyntheticToolResultRepair failed:", error);
+	}
+}
+
+export function reportToolResultMismatch(queryCtx: QueryContext, reason: string, cwd: string | undefined, opts: { forceRotate?: boolean } = {}): boolean {
+	try {
+		if (queryCtx.reportedToolResultMismatch) return false;
+		const progress = queryCtx.toolResultProgress();
+		const hasMismatch = progress.expectedCount > 0
+			? progress.unresolvedIds.length > 0 || progress.waitingCount > 0 || progress.queuedCount > 0 || progress.unmatchedResultCount > 0
+			: progress.waitingCount > 0 || progress.queuedCount > 0 || progress.unmatchedResultCount > 0;
+		if (!hasMismatch) return false;
+		queryCtx.reportedToolResultMismatch = true;
+		if (sharedSession) {
+			sharedSession = { ...sharedSession, needsRebuild: true, ...(opts.forceRotate ? { forceRotate: true } : {}) };
+		}
+		const toolNameSummary = compactToolNameSummary(progress.toolNames);
+		diagDump("tool_result_delivery_mismatch", {
+			reason,
+			cwd,
+			progress,
+			activeQueryExists: queryCtx.activeQuery !== null,
+			sharedSession: sharedSession ? {
+				sessionId: sharedSession.sessionId.slice(0, 8),
+				cursor: sharedSession.cursor,
+				needsRebuild: sharedSession.needsRebuild === true,
+				forceRotate: sharedSession.forceRotate === true,
+			} : null,
+		});
+		safeNotify(
+			`Claude bridge: tool result delivery interrupted during ${reason}; ` +
+			`delivered ${progress.deliveredCount}/${progress.expectedCount}, resolved ${progress.resolvedCount}/${progress.expectedCount}, ` +
+			`waiting=${progress.waitingCount}, queued=${progress.queuedCount}, unmatched=${progress.unmatchedResultCount}` +
+			`${toolNameSummary.length ? `, tools=${toolNameSummary.join(", ")}` : ""}. ` +
+			`Claude session will rebuild before the next turn; see ${diagLogPath()}.`,
+			"error",
+		);
+		return true;
+	} catch (error) {
+		debug("reportToolResultMismatch failed:", error);
+		return false;
+	}
+}
+
+export function __testSetBridgeIntegrityState(state: { ui?: Pick<ExtensionUIContext, "notify"> | null; sharedSession?: SessionState | null }): void {
+	if ("ui" in state) piUI = state.ui as ExtensionUIContext | undefined;
+	if ("sharedSession" in state) sharedSession = state.sharedSession ?? null;
+}
+
+export function __testGetBridgeIntegrityState(): { sharedSession: SessionState | null } {
+	return { sharedSession };
+}

package/src/claude-executable.ts

@@ -0,0 +1,264 @@
+import { type SpawnOptions, type SpawnedProcess } from "@anthropic-ai/claude-agent-sdk";
+import { spawn as spawnProcess } from "child_process";
+import { accessSync, constants as fsConstants, readFileSync, realpathSync, statSync } from "fs";
+import { delimiter, join } from "path";
+import { isolatedFromEnv } from "./config.js";
+import { DEBUG, debug } from "./debug.js";
+
+function executableFromPath(name: string): string | undefined {
+	const paths = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+	for (const dir of paths) {
+		const candidate = join(dir, name);
+		try {
+			accessSync(candidate, fsConstants.X_OK);
+			return candidate;
+		} catch {
+			// keep searching
+		}
+	}
+	return undefined;
+}
+
+export function resolveClaudeExecutable(configured?: string): string | undefined {
+	const trimmed = configured?.trim();
+	if (trimmed) return trimmed;
+	// Isolated mode: never run whatever `claude` happens to be on $PATH — the
+	// host app either pins an executable in config or gets the SDK's bundled
+	// default, which ships inside the host bundle.
+	if (isolatedFromEnv()) return undefined;
+	return executableFromPath("claude") ?? executableFromPath("claude-code");
+}
+
+export type ClaudeExecutableFileType = "elf" | "mach-o" | "pe" | "shebang-script" | "empty" | "unknown";
+
+export interface ClaudeExecutablePreflightResult {
+	path: string;
+	realPath: string;
+	cwd: string;
+	realCwd: string;
+	fileType: ClaudeExecutableFileType;
+}
+
+function errnoValue(err: unknown): string | number | undefined {
+	return typeof (err as NodeJS.ErrnoException)?.errno === "number" ? (err as NodeJS.ErrnoException).errno : undefined;
+}
+
+function syscallValue(err: unknown): string | undefined {
+	return typeof (err as NodeJS.ErrnoException)?.syscall === "string" ? (err as NodeJS.ErrnoException).syscall : undefined;
+}
+
+function pathValue(err: unknown): string | undefined {
+	const value = (err as NodeJS.ErrnoException)?.path;
+	return typeof value === "string" ? value : undefined;
+}
+
+function codeValue(err: unknown, fallback: string): string {
+	const value = (err as NodeJS.ErrnoException)?.code;
+	return typeof value === "string" ? value : fallback;
+}
+
+function displayValue(value: unknown): string {
+	return value === undefined || value === null || value === "" ? "<none>" : String(value);
+}
+
+function makeClaudePreflightError(
+	summary: string,
+	details: { code: string; errno?: string | number; syscall?: string; path: string; cwd: string; fileType?: ClaudeExecutableFileType; realPath?: string; cause?: unknown },
+): Error & NodeJS.ErrnoException & { cwd: string; fileType?: ClaudeExecutableFileType; realPath?: string } {
+	const detail = [
+		`code=${details.code}`,
+		`errno=${displayValue(details.errno)}`,
+		`syscall=${displayValue(details.syscall)}`,
+		`path=${details.path}`,
+		`cwd=${details.cwd}`,
+		...(details.fileType ? [`fileType=${details.fileType}`] : []),
+		...(details.realPath ? [`realPath=${details.realPath}`] : []),
+	].join(" ");
+	const error = new Error(`${summary} (${detail})`) as Error & NodeJS.ErrnoException & { cwd: string; fileType?: ClaudeExecutableFileType; realPath?: string };
+	error.name = "ClaudeExecutablePreflightError";
+	error.code = details.code;
+	if (details.errno !== undefined) error.errno = typeof details.errno === "number" ? details.errno : Number(details.errno);
+	if (details.syscall) error.syscall = details.syscall;
+	error.path = details.path;
+	error.cwd = details.cwd;
+	if (details.fileType) error.fileType = details.fileType;
+	if (details.realPath) error.realPath = details.realPath;
+	if (details.cause !== undefined) (error as Error & { cause?: unknown }).cause = details.cause;
+	return error;
+}
+
+export function classifyClaudeExecutableBytes(bytes: Uint8Array): ClaudeExecutableFileType {
+	if (bytes.length === 0) return "empty";
+	if (bytes.length >= 2 && bytes[0] === 0x23 && bytes[1] === 0x21) return "shebang-script";
+	if (bytes.length >= 4 && bytes[0] === 0x7f && bytes[1] === 0x45 && bytes[2] === 0x4c && bytes[3] === 0x46) return "elf";
+	if (bytes.length >= 2 && bytes[0] === 0x4d && bytes[1] === 0x5a) return "pe";
+	if (bytes.length >= 4) {
+		const magic = bytes[0] * 0x1000000 + bytes[1] * 0x10000 + bytes[2] * 0x100 + bytes[3];
+		if (
+			magic === 0xfeedface ||
+			magic === 0xfeedfacf ||
+			magic === 0xcefaedfe ||
+			magic === 0xcffaedfe ||
+			magic === 0xcafebabe ||
+			magic === 0xbebafeca
+		) return "mach-o";
+	}
+	return "unknown";
+}
+
+export function preflightClaudeExecutable(path: string, cwd: string): ClaudeExecutablePreflightResult {
+	let realCwd: string;
+	try {
+		const cwdStat = statSync(cwd);
+		if (!cwdStat.isDirectory()) {
+			throw makeClaudePreflightError("Claude Code spawn cwd preflight failed: cwd is not a directory.", {
+				code: "ENOTDIR",
+				syscall: "chdir",
+				path: cwd,
+				cwd,
+			});
+		}
+		accessSync(cwd, fsConstants.X_OK);
+		realCwd = realpathSync(cwd);
+	} catch (err) {
+		if ((err as Error).name === "ClaudeExecutablePreflightError") throw err;
+		throw makeClaudePreflightError("Claude Code spawn cwd preflight failed: cwd is not reachable before spawning Claude Code.", {
+			code: codeValue(err, "EACCES"),
+			errno: errnoValue(err),
+			syscall: syscallValue(err),
+			path: pathValue(err) ?? cwd,
+			cwd,
+			cause: err,
+		});
+	}
+
+	let realPath: string;
+	try {
+		const stat = statSync(path);
+		if (!stat.isFile()) {
+			throw makeClaudePreflightError("Claude Code executable preflight failed: resolved path is not a file.", {
+				code: "EACCES",
+				syscall: "exec",
+				path,
+				cwd,
+			});
+		}
+		accessSync(path, fsConstants.X_OK);
+		realPath = realpathSync(path);
+	} catch (err) {
+		if ((err as Error).name === "ClaudeExecutablePreflightError") throw err;
+		throw makeClaudePreflightError("Claude Code executable preflight failed: cannot access resolved executable before spawning Claude Code.", {
+			code: codeValue(err, "ENOENT"),
+			errno: errnoValue(err),
+			syscall: syscallValue(err),
+			path: pathValue(err) ?? path,
+			cwd,
+			cause: err,
+		});
+	}
+
+	let fileType: ClaudeExecutableFileType;
+	try {
+		fileType = classifyClaudeExecutableBytes(readFileSync(realPath).subarray(0, 16));
+	} catch (err) {
+		throw makeClaudePreflightError("Claude Code executable preflight failed: cannot read executable header before spawning Claude Code.", {
+			code: codeValue(err, "EACCES"),
+			errno: errnoValue(err),
+			syscall: syscallValue(err),
+			path: pathValue(err) ?? realPath,
+			cwd,
+			realPath,
+			cause: err,
+		});
+	}
+
+	if (!["elf", "mach-o", "pe", "shebang-script"].includes(fileType)) {
+		throw makeClaudePreflightError("Claude Code executable preflight failed: executable header is not an ELF, Mach-O, PE, or shebang script.", {
+			code: "ENOEXEC",
+			syscall: "exec",
+			path,
+			cwd,
+			fileType,
+			realPath,
+		});
+	}
+
+	return { path, realPath, cwd, realCwd, fileType };
+}
+
+function envFlagEnabled(value: string | undefined): boolean {
+	return value === "1" || value?.toLowerCase() === "true";
+}
+
+export function wrapClaudeSpawnErrorForSdk(err: Error, options: SpawnOptions): Error & NodeJS.ErrnoException & { cwd: string; originalCode?: string; originalMessage?: string } {
+	const originalCode = codeValue(err, "SPAWN_ERROR");
+	const originalMessage = err.message;
+	const spawnPath = pathValue(err) ?? options.command;
+	const cwd = options.cwd ?? process.cwd();
+	const detail = [
+		`code=${originalCode}`,
+		`errno=${displayValue(errnoValue(err))}`,
+		`syscall=${displayValue(syscallValue(err))}`,
+		`path=${spawnPath}`,
+		`cwd=${cwd}`,
+		`command=${options.command}`,
+	].join(" ");
+	const wrapped = new Error(`Claude Code spawn failed: ${originalMessage} (${detail})`) as Error & NodeJS.ErrnoException & { cwd: string; originalCode?: string; originalMessage?: string };
+	wrapped.name = "ClaudeSpawnDiagnosticError";
+	// The SDK special-cases code === ENOENT and replaces the message with its
+	// generic "native binary not found" text. Preserve the original code in the
+	// message/originalCode while using a bridge code so the SDK surfaces context.
+	wrapped.code = originalCode === "ENOENT" ? "CLAUDE_BRIDGE_SPAWN_FAILED" : originalCode;
+	wrapped.originalCode = originalCode;
+	wrapped.originalMessage = originalMessage;
+	const errno = errnoValue(err);
+	if (errno !== undefined) wrapped.errno = typeof errno === "number" ? errno : Number(errno);
+	const syscall = syscallValue(err);
+	if (syscall) wrapped.syscall = syscall;
+	wrapped.path = spawnPath;
+	wrapped.cwd = cwd;
+	// Do not set `cause` here: the listener copies these structured fields back
+	// onto the original Error. A cause reference to that same object would become
+	// `err.cause === err`, making JSON.stringify throw on a circular structure.
+	// originalMessage plus code/errno/syscall/path/cwd preserve the useful data.
+	return wrapped;
+}
+
+export function spawnClaudeCodeWithDiagnostics(options: SpawnOptions): SpawnedProcess {
+	const pipeStderr = DEBUG || envFlagEnabled(options.env.DEBUG_CLAUDE_AGENT_SDK);
+	const child = spawnProcess(options.command, options.args, {
+		cwd: options.cwd,
+		env: options.env,
+		signal: options.signal,
+		stdio: ["pipe", "pipe", pipeStderr ? "pipe" : "ignore"],
+		windowsHide: true,
+	});
+	if (pipeStderr) {
+		child.stderr?.on("data", (data) => {
+			for (const line of data.toString().split(/\r?\n/)) {
+				if (line) debug(`[cli-stderr spawn] ${line}`);
+			}
+		});
+	}
+	child.prependListener("error", (err) => {
+		const originalStack = err.stack;
+		const wrapped = wrapClaudeSpawnErrorForSdk(err, options);
+		Object.assign(err, wrapped);
+		err.name = wrapped.name;
+		err.message = wrapped.message;
+		// Keep V8's stack from the actual Node spawn failure, not the wrapper
+		// construction site. Diagnostic fields above remain enumerable and
+		// JSON-serializable; stack stays the spawn-time breadcrumb for operators.
+		if (originalStack) err.stack = originalStack;
+	});
+	return {
+		stdin: child.stdin,
+		stdout: child.stdout,
+		get killed() { return child.killed; },
+		get exitCode() { return child.exitCode; },
+		kill: child.kill.bind(child),
+		on: child.on.bind(child),
+		once: child.once.bind(child),
+		off: child.off.bind(child),
+	};
+}

package/src/config.ts

@@ -1,6 +1,8 @@
 // User-facing extension config. Legacy config is loaded from
 // ~/.pi/agent/claude-bridge.json and .pi/claude-bridge.json. vstack extension
-// manager config is loaded from settings.json and overrides legacy files.
+// manager config is loaded from settings.json and overrides legacy files in
+// normal Pi sessions. Isolated embedding hosts consume only the authoritative
+// user claude-bridge.json and never read extension-manager settings.
 
 import type { SettingSource } from "@anthropic-ai/claude-agent-sdk";
 import { existsSync, readFileSync } from "fs";
@@ -13,6 +15,14 @@ export type BridgeEffortLevel = "low" | "medium" | "high" | "xhigh" | "max";
 
 const VALID_EFFORT_LEVELS = new Set<BridgeEffortLevel>(["low", "medium", "high", "xhigh", "max"]);
 
+/**
+ * Per-session control over claude.ai connector WRITE tools when connectors are
+ * enabled. `deny` (default) hides Gmail/Calendar/Drive mutating tools so
+ * connector chat sessions are read-only; `allow` exposes them (used only by the
+ * one-shot approved-write executor). Reads are always available.
+ */
+export type ConnectorWriteMode = "deny" | "allow";
+
 export interface Config {
 	enabled?: boolean;
 	/** Low-level Claude Agent SDK plumbing. Most users won't need these. */
@@ -28,6 +38,27 @@ export interface Config {
 		settingSources?: SettingSource[];
 		strictMcpConfig?: boolean;
 		pathToClaudeCodeExecutable?: string;
+		/**
+		 * Expose the authenticated Claude account's claude.ai cloud MCP
+		 * connectors (Gmail / Google Calendar / Google Drive, etc.) to the model.
+		 * Off by default so Pi owns tool execution and tokens stay lean. Also
+		 * settable via the CLAUDE_BRIDGE_ENABLE_CONNECTORS env var (env OR config
+		 * enables it). See docs/plans/claude-bridge-google-connectors.md.
+		 */
+		enableConnectors?: boolean;
+		/**
+		 * When connectors are enabled, whether their WRITE tools
+		 * (create/update/delete/label/etc.) are exposed. Defaults to `deny`
+		 * (read-only), enforced two ways: known write tools are removed from the
+		 * model's context (disallowedTools by exact id), and a PreToolUse hook
+		 * blocks any connector write tool by name prefix at call time (covers
+		 * future write tools). `allow` disables both — intended ONLY for a
+		 * one-shot approved-write executor process. Also settable via
+		 * CLAUDE_BRIDGE_CONNECTOR_WRITE=deny|allow (env wins over config). Any
+		 * value but exact `allow` is treated as `deny`. Ignored when connectors
+		 * are disabled.
+		 */
+		connectorWriteMode?: ConnectorWriteMode;
 	};
 	/** Extra Pi context forwarded to Claude Code on top of AGENTS.md + skills. */
 	promptContext?: {
@@ -46,10 +77,30 @@ function expandHome(input: string): string {
 	return input;
 }
 
-function piUserDir(): string {
+/**
+ * The Pi agent config dir: `PI_CODING_AGENT_DIR` when set, else `~/.pi/agent`.
+ * Every bridge default that used to hardcode `~/.pi/agent` routes through this
+ * so a host app that owns the agent dir owns those paths too.
+ */
+export function piUserDir(): string {
 	return resolve(expandHome(process.env.PI_CODING_AGENT_DIR?.trim() || "~/.pi/agent"));
 }
 
+/**
+ * Isolated mode (`CLAUDE_BRIDGE_ISOLATED=1`): a host app embedding the bridge
+ * declares that nothing outside its explicitly configured dirs may be read.
+ * Disables every cwd/home discovery fallback — all AGENTS.md discovery,
+ * extension-manager settings, project `.pi/` settings + claude-bridge.json,
+ * project APPEND_SYSTEM.md, and the `$PATH` claude executable search. Bridge
+ * configuration comes only from `piUserDir()/claude-bridge.json` and any
+ * explicitly configured executable path.
+ * Default (unset) behavior for normal pi CLI users is unchanged.
+ */
+export function isolatedFromEnv(): boolean {
+	const v = (process.env.CLAUDE_BRIDGE_ISOLATED ?? "").trim().toLowerCase();
+	return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+
 function asRecord(value: unknown): SettingsRecord | undefined {
 	return value && typeof value === "object" && !Array.isArray(value) ? value as SettingsRecord : undefined;
 }
@@ -93,6 +144,10 @@ function projectTrustRegistry(): ProjectTrustRegistry {
 
 export function recordProjectTrust(ctx: { cwd?: string; isProjectTrusted?: () => boolean }): void {
 	if (!ctx.cwd) return;
+	// Isolated mode never reads project config, so recording trust would only
+	// run the cwd-ancestor `.pi/settings.json` walk (a filesystem probe outside
+	// the host-owned dirs) for a result nothing consumes. Skip it entirely.
+	if (isolatedFromEnv()) return;
 	let trusted = true;
 	try {
 		trusted = ctx.isProjectTrusted?.() === true;
@@ -111,6 +166,10 @@ function projectSettingsTrusted(settingsPath: string): boolean {
 
 function settingsPaths(cwd: string): string[] {
 	const user = join(piUserDir(), "settings.json");
+	// An embedding host may have to share PI_CODING_AGENT_DIR with an in-process
+	// Pi SDK. In isolated mode, settings.json is therefore not authoritative and
+	// must not be consulted even at user scope.
+	if (isolatedFromEnv()) return [];
 	const project = projectSettingsPath(cwd);
 	return projectSettingsTrusted(project) ? [user, project] : [user];
 }
@@ -155,6 +214,13 @@ function hasOwn(raw: SettingsRecord, key: string): boolean {
 	return Object.prototype.hasOwnProperty.call(raw, key);
 }
 
+export function normalizeConnectorWriteMode(value: unknown): ConnectorWriteMode | undefined {
+	if (typeof value !== "string") return undefined;
+	const normalized = value.trim().toLowerCase();
+	if (normalized === "deny" || normalized === "allow") return normalized;
+	return undefined;
+}
+
 export function normalizeEffortLevel(value: unknown): BridgeEffortLevel | undefined {
 	if (typeof value !== "string") return undefined;
 	const normalized = value.trim().toLowerCase();
@@ -195,6 +261,13 @@ function normalizeProviderConfig(provider: Config["provider"] | undefined): Conf
 	const modelEffortOverrides = normalizeModelEffortOverrides(raw.modelEffortOverrides);
 	if (modelEffortOverrides) out.modelEffortOverrides = modelEffortOverrides;
 	else delete out.modelEffortOverrides;
+	// Fail closed: legacy config files are merged raw, so an unvalidated
+	// connectorWriteMode (e.g. "Deny", "read-only", true) must not slip through as
+	// a truthy non-"allow" value. Drop anything that isn't exactly deny/allow so
+	// the resolver falls back to the default deny.
+	const connectorWriteMode = normalizeConnectorWriteMode(raw.connectorWriteMode);
+	if (connectorWriteMode) out.connectorWriteMode = connectorWriteMode;
+	else delete out.connectorWriteMode;
 	return out;
 }
 
@@ -216,6 +289,10 @@ function managerToConfig(raw: SettingsRecord): Partial<Config> {
 	}
 	const strictMcpConfig = boolFrom(raw, "strictMcpConfig");
 	if (strictMcpConfig !== undefined) provider.strictMcpConfig = strictMcpConfig;
+	const enableConnectors = boolFrom(raw, "enableConnectors");
+	if (enableConnectors !== undefined) provider.enableConnectors = enableConnectors;
+	const connectorWriteMode = normalizeConnectorWriteMode(raw.connectorWriteMode);
+	if (connectorWriteMode) provider.connectorWriteMode = connectorWriteMode;
 	const claudePath = stringFrom(raw, "pathToClaudeCodeExecutable");
 	if (claudePath) provider.pathToClaudeCodeExecutable = claudePath;
 
@@ -237,10 +314,11 @@ function managerToConfig(raw: SettingsRecord): Partial<Config> {
 
 export function loadConfig(cwd: string): Config {
 	const global = tryParseJson(join(piUserDir(), "claude-bridge.json"));
-	const projectSettings = projectSettingsPath(cwd);
-	const trustedProject = projectSettingsTrusted(projectSettings);
+	const isolated = isolatedFromEnv();
+	const projectSettings = isolated ? undefined : projectSettingsPath(cwd);
+	const trustedProject = projectSettings !== undefined && projectSettingsTrusted(projectSettings);
 	const project = trustedProject ? tryParseJson(join(dirname(projectSettings), "claude-bridge.json")) : {};
-	const manager = managerToConfig(readManagerConfig(cwd));
+	const manager: Partial<Config> = isolated ? {} : managerToConfig(readManagerConfig(cwd));
 	const provider = normalizeProviderConfig({ ...global.provider, ...project.provider, ...manager.provider });
 	return {
 		enabled: manager.enabled ?? project.enabled ?? global.enabled ?? true,