@vanillagreen/pi-claude-bridge 1.8.0 → 2.0.0

package/src/auth-presence.ts

@@ -6,10 +6,12 @@
 // "not-used"` as "configured" and the provider would look connected while every
 // request fails at spawn time.
 //
-// This module answers two pure questions used to gate registration:
-//   1. hasClaudeCredentials() — are real credentials present RIGHT NOW?
-//   2. decideRegistration()   — given credential presence + the primary-instance
-//      / stream-guard tokens, should we register / unregister / do nothing?
+// This module answers one pure question: hasClaudeCredentials() — are real
+// credentials present RIGHT NOW? Since 2.0 it feeds the native provider's
+// auth check/resolve (native-provider.ts) and the pre-spawn fail-fast, rather
+// than gating register/unregister transitions (the 1.x decideRegistration
+// state machine is gone — registration is unconditional and pi hides
+// unconfigured providers' models itself).
 //
 // SECURITY: this module only ever checks for the EXISTENCE of credentials — a
 // file's presence, an env var being non-empty, a settings key being a non-empty
@@ -110,49 +112,3 @@ export function hasClaudeCredentials(
 	return false;
 }
 
-/**
- * Snapshot of the inputs to a registration decision.
- *
- * The bridge keeps two process-global tokens (Symbol.for): a PRIMARY-instance
- * token, claimed unconditionally by the first-loaded module instance, and the
- * stream-guard token holding the registered instance's streamSimple. ONLY the
- * primary instance may ever register/unregister or claim the stream guard — this
- * prevents a subagent module reload (a fresh, non-primary instance) from
- * stealing ownership and registering ITS streamSimple, which would split-brain
- * the shared session/ctx and break tool-result delivery.
- */
-export interface RegistrationState {
-	/** Does the machine have Claude credentials right now? */
-	credentialed: boolean;
-	/** Is THIS module instance the primary (first-loaded) instance? */
-	isPrimary: boolean;
-	/** Has this instance already registered (owns the stream guard)? */
-	registered: boolean;
-}
-
-export type RegistrationDecision = "register" | "unregister" | "noop";
-
-/**
- * Pure decision for extension load, every session_start re-check, and the
- * pre-spawn fail-fast path.
- *
- * Rules:
- *   - Not the primary instance                    → NOOP (never touch registration).
- *   - Primary + credentialed + not registered     → REGISTER (claim guard + register).
- *   - Primary + credentialed + already registered → NOOP.
- *   - Primary + uncredentialed                    → UNREGISTER (defensive).
- *
- * The uncredentialed primary always returns UNREGISTER rather than NOOP:
- * pi.unregisterProvider is idempotent ("Has no effect if the provider was never
- * registered"), and a defensive call is the ONLY way to retract a registration
- * that survived a /reload — the ModelRegistry's registeredProviders is a
- * process-lifetime Map and module reload does NOT clear it. (At extension-load
- * time this defensive unregister only filters the pending-registration queue and
- * cannot mutate the persistent registry; the authoritative retraction happens on
- * the post-load session_start re-check — see applyProviderRegistration.)
- */
-export function decideRegistration(state: RegistrationState): RegistrationDecision {
-	if (!state.isPrimary) return "noop";
-	if (state.credentialed) return state.registered ? "noop" : "register";
-	return "unregister";
-}

package/src/bridge-state.ts

@@ -0,0 +1,178 @@
+import { type ExtensionAPI, type ExtensionUIContext } from "@earendil-works/pi-coding-agent";
+import { debug, diagDump, diagLogPath } from "./debug.js";
+import { type QueryContext } from "./query-state.js";
+import { summarizeMissingToolNames, type MissingToolResult } from "./tool-pairing-audit.js";
+
+export interface SessionState {
+	sessionId: string;
+	cursor: number;
+	cwd: string;
+	// Force the next syncSharedSession call down the REBUILD path. Set when
+	// pi has mutated its messages array out from under us (compact, tree
+	// navigation) or after an abort left the JSONL in an indeterminate state.
+	// REBUILD wipes and rewrites the file to match pi's current history.
+	needsRebuild?: boolean;
+	// Set ONLY after an abort. The killed CC subprocess may still be flushing
+	// a late "[Request interrupted by user]" record to the session JSONL.
+	// Reusing the same sessionId/path would race that orphan write into our
+	// fresh file and break CC's parent-uuid chain on the next resume. When
+	// this flag is set, REBUILD takes a fresh UUID and skips deleteSession
+	// so the orphan writes land on a dead inode. Compact/tree do NOT set
+	// this — there's no concurrent CC writer during those events, so
+	// in-place rebuild (preserve UUID, deleteSession + createSession) is safe.
+	forceRotate?: boolean;
+}
+
+// Shared mutable bridge state. Lives in its own module so the extracted
+// modules and index.ts observe the SAME state: ESM live bindings let every
+// importer READ these `let` bindings live, but only this module may assign
+// them — cross-module writes must go through the setters below.
+export let sharedSession: SessionState | null = null;
+export let extensionApi: ExtensionAPI | undefined;
+export let piUI: ExtensionUIContext | undefined;
+
+export function setSharedSession(next: SessionState | null): void {
+	sharedSession = next;
+}
+
+export function setExtensionApi(next: ExtensionAPI | undefined): void {
+	extensionApi = next;
+}
+
+export function setPiUI(next: ExtensionUIContext | undefined): void {
+	piUI = next;
+}
+
+export function safeNotify(message: string, level: "info" | "warning" | "error" = "warning"): void {
+	try { piUI?.notify(message, level); }
+	catch (error) { debug("notify failed:", error); }
+}
+
+export function argKeys(args: Record<string, unknown> | undefined): string[] {
+	return Object.keys(args ?? {}).sort();
+}
+
+export function safeToolCallSummary(calls: Array<{ id: string; toolName: string; arguments?: Record<string, unknown> }>): Array<{ id: string; toolName: string; argKeys: string[] }> {
+	return calls.map((call) => ({ id: call.id, toolName: call.toolName, argKeys: argKeys(call.arguments) }));
+}
+
+export const INTEGRITY_CUSTOM_TYPE = "claude-bridge-integrity";
+
+/**
+ * Persist a bridge integrity event into the pi session transcript.
+ *
+ * The diag log and a piUI toast both die with the machine or the render cycle:
+ * the 2026-07-28 post-mortem found `Error: Claude bridge: …` messages that were
+ * SHOWN but existed nowhere in the pi session file, making analysis from the
+ * session alone impossible. A `CustomEntry` closes that gap the same way the
+ * connector-call audit does — persisted, never part of built context, never
+ * dispatchable by pi's agent loop. Payloads must stay compact metadata (ids,
+ * counts, tool names), never tool output.
+ *
+ * Never throws; returns whether the entry was appended (false outside a pi
+ * session — tests, embedded hosts without extensionApi).
+ */
+export function appendIntegrityEntry(label: string, data: Record<string, unknown>): boolean {
+	try {
+		if (!extensionApi) return false;
+		extensionApi.appendEntry(INTEGRITY_CUSTOM_TYPE, { label, at: new Date().toISOString(), ...data });
+		return true;
+	} catch (error) {
+		debug("appendIntegrityEntry failed:", error);
+		return false;
+	}
+}
+
+function compactToolNameSummary(names: Array<{ name: string; count: number }>, limit = 12): string[] {
+	const shown = names.slice(0, limit).map(({ name, count }) => count > 1 ? `${name}×${count}` : name);
+	if (names.length > limit) shown.push(`+${names.length - limit} more`);
+	return shown;
+}
+
+export function reportSyntheticToolResultRepair(missing: MissingToolResult[], context: Record<string, unknown>): void {
+	try {
+		if (missing.length === 0) return;
+		const toolNames = summarizeMissingToolNames(missing);
+		const toolNameSummary = compactToolNameSummary(toolNames);
+		const sampledToolCallIds = missing.slice(0, 50).map((item) => item.id);
+		diagDump("repair_tool_pairing_synthetic_results", {
+			count: missing.length,
+			toolNames,
+			sampledToolCallIds,
+			missing: missing.slice(0, 50),
+			...context,
+		});
+		appendIntegrityEntry("repair_tool_pairing_synthetic_results", {
+			count: missing.length,
+			toolNames,
+			sampledToolCallIds: sampledToolCallIds.slice(0, 12),
+		});
+		safeNotify(
+			`Claude bridge: ${missing.length} missing tool result(s) repaired with an explicit error placeholder` +
+			`${toolNameSummary.length ? ` for ${toolNameSummary.join(", ")}` : ""}. ` +
+			`Real tool output was lost before Claude session import; see ${diagLogPath()}.`,
+			"error",
+		);
+	} catch (error) {
+		debug("reportSyntheticToolResultRepair failed:", error);
+	}
+}
+
+export function reportToolResultMismatch(queryCtx: QueryContext, reason: string, cwd: string | undefined, opts: { forceRotate?: boolean } = {}): boolean {
+	try {
+		if (queryCtx.reportedToolResultMismatch) return false;
+		const progress = queryCtx.toolResultProgress();
+		const hasMismatch = progress.expectedCount > 0
+			? progress.unresolvedIds.length > 0 || progress.waitingCount > 0 || progress.queuedCount > 0 || progress.unmatchedResultCount > 0
+			: progress.waitingCount > 0 || progress.queuedCount > 0 || progress.unmatchedResultCount > 0;
+		if (!hasMismatch) return false;
+		queryCtx.reportedToolResultMismatch = true;
+		if (sharedSession) {
+			sharedSession = { ...sharedSession, needsRebuild: true, ...(opts.forceRotate ? { forceRotate: true } : {}) };
+		}
+		const toolNameSummary = compactToolNameSummary(progress.toolNames);
+		diagDump("tool_result_delivery_mismatch", {
+			reason,
+			cwd,
+			progress,
+			activeQueryExists: queryCtx.activeQuery !== null,
+			sharedSession: sharedSession ? {
+				sessionId: sharedSession.sessionId.slice(0, 8),
+				cursor: sharedSession.cursor,
+				needsRebuild: sharedSession.needsRebuild === true,
+				forceRotate: sharedSession.forceRotate === true,
+			} : null,
+		});
+		appendIntegrityEntry("tool_result_delivery_mismatch", {
+			reason,
+			toolNames: progress.toolNames,
+			expectedCount: progress.expectedCount,
+			deliveredCount: progress.deliveredCount,
+			resolvedCount: progress.resolvedCount,
+			waitingIds: progress.waitingIds,
+			queuedIds: progress.queuedIds,
+			unmatchedResultIds: progress.unmatchedResultIds,
+		});
+		safeNotify(
+			`Claude bridge: tool result delivery interrupted during ${reason}; ` +
+			`delivered ${progress.deliveredCount}/${progress.expectedCount}, resolved ${progress.resolvedCount}/${progress.expectedCount}, ` +
+			`waiting=${progress.waitingCount}, queued=${progress.queuedCount}, unmatched=${progress.unmatchedResultCount}` +
+			`${toolNameSummary.length ? `, tools=${toolNameSummary.join(", ")}` : ""}. ` +
+			`Claude session will rebuild before the next turn; see ${diagLogPath()}.`,
+			"error",
+		);
+		return true;
+	} catch (error) {
+		debug("reportToolResultMismatch failed:", error);
+		return false;
+	}
+}
+
+export function __testSetBridgeIntegrityState(state: { ui?: Pick<ExtensionUIContext, "notify"> | null; sharedSession?: SessionState | null }): void {
+	if ("ui" in state) piUI = state.ui as ExtensionUIContext | undefined;
+	if ("sharedSession" in state) sharedSession = state.sharedSession ?? null;
+}
+
+export function __testGetBridgeIntegrityState(): { sharedSession: SessionState | null } {
+	return { sharedSession };
+}

package/src/claude-executable.ts

@@ -0,0 +1,264 @@
+import { type SpawnOptions, type SpawnedProcess } from "@anthropic-ai/claude-agent-sdk";
+import { spawn as spawnProcess } from "child_process";
+import { accessSync, constants as fsConstants, readFileSync, realpathSync, statSync } from "fs";
+import { delimiter, join } from "path";
+import { isolatedFromEnv } from "./config.js";
+import { DEBUG, debug } from "./debug.js";
+
+function executableFromPath(name: string): string | undefined {
+	const paths = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+	for (const dir of paths) {
+		const candidate = join(dir, name);
+		try {
+			accessSync(candidate, fsConstants.X_OK);
+			return candidate;
+		} catch {
+			// keep searching
+		}
+	}
+	return undefined;
+}
+
+export function resolveClaudeExecutable(configured?: string): string | undefined {
+	const trimmed = configured?.trim();
+	if (trimmed) return trimmed;
+	// Isolated mode: never run whatever `claude` happens to be on $PATH — the
+	// host app either pins an executable in config or gets the SDK's bundled
+	// default, which ships inside the host bundle.
+	if (isolatedFromEnv()) return undefined;
+	return executableFromPath("claude") ?? executableFromPath("claude-code");
+}
+
+export type ClaudeExecutableFileType = "elf" | "mach-o" | "pe" | "shebang-script" | "empty" | "unknown";
+
+export interface ClaudeExecutablePreflightResult {
+	path: string;
+	realPath: string;
+	cwd: string;
+	realCwd: string;
+	fileType: ClaudeExecutableFileType;
+}
+
+function errnoValue(err: unknown): string | number | undefined {
+	return typeof (err as NodeJS.ErrnoException)?.errno === "number" ? (err as NodeJS.ErrnoException).errno : undefined;
+}
+
+function syscallValue(err: unknown): string | undefined {
+	return typeof (err as NodeJS.ErrnoException)?.syscall === "string" ? (err as NodeJS.ErrnoException).syscall : undefined;
+}
+
+function pathValue(err: unknown): string | undefined {
+	const value = (err as NodeJS.ErrnoException)?.path;
+	return typeof value === "string" ? value : undefined;
+}
+
+function codeValue(err: unknown, fallback: string): string {
+	const value = (err as NodeJS.ErrnoException)?.code;
+	return typeof value === "string" ? value : fallback;
+}
+
+function displayValue(value: unknown): string {
+	return value === undefined || value === null || value === "" ? "<none>" : String(value);
+}
+
+function makeClaudePreflightError(
+	summary: string,
+	details: { code: string; errno?: string | number; syscall?: string; path: string; cwd: string; fileType?: ClaudeExecutableFileType; realPath?: string; cause?: unknown },
+): Error & NodeJS.ErrnoException & { cwd: string; fileType?: ClaudeExecutableFileType; realPath?: string } {
+	const detail = [
+		`code=${details.code}`,
+		`errno=${displayValue(details.errno)}`,
+		`syscall=${displayValue(details.syscall)}`,
+		`path=${details.path}`,
+		`cwd=${details.cwd}`,
+		...(details.fileType ? [`fileType=${details.fileType}`] : []),
+		...(details.realPath ? [`realPath=${details.realPath}`] : []),
+	].join(" ");
+	const error = new Error(`${summary} (${detail})`) as Error & NodeJS.ErrnoException & { cwd: string; fileType?: ClaudeExecutableFileType; realPath?: string };
+	error.name = "ClaudeExecutablePreflightError";
+	error.code = details.code;
+	if (details.errno !== undefined) error.errno = typeof details.errno === "number" ? details.errno : Number(details.errno);
+	if (details.syscall) error.syscall = details.syscall;
+	error.path = details.path;
+	error.cwd = details.cwd;
+	if (details.fileType) error.fileType = details.fileType;
+	if (details.realPath) error.realPath = details.realPath;
+	if (details.cause !== undefined) (error as Error & { cause?: unknown }).cause = details.cause;
+	return error;
+}
+
+export function classifyClaudeExecutableBytes(bytes: Uint8Array): ClaudeExecutableFileType {
+	if (bytes.length === 0) return "empty";
+	if (bytes.length >= 2 && bytes[0] === 0x23 && bytes[1] === 0x21) return "shebang-script";
+	if (bytes.length >= 4 && bytes[0] === 0x7f && bytes[1] === 0x45 && bytes[2] === 0x4c && bytes[3] === 0x46) return "elf";
+	if (bytes.length >= 2 && bytes[0] === 0x4d && bytes[1] === 0x5a) return "pe";
+	if (bytes.length >= 4) {
+		const magic = bytes[0] * 0x1000000 + bytes[1] * 0x10000 + bytes[2] * 0x100 + bytes[3];
+		if (
+			magic === 0xfeedface ||
+			magic === 0xfeedfacf ||
+			magic === 0xcefaedfe ||
+			magic === 0xcffaedfe ||
+			magic === 0xcafebabe ||
+			magic === 0xbebafeca
+		) return "mach-o";
+	}
+	return "unknown";
+}
+
+export function preflightClaudeExecutable(path: string, cwd: string): ClaudeExecutablePreflightResult {
+	let realCwd: string;
+	try {
+		const cwdStat = statSync(cwd);
+		if (!cwdStat.isDirectory()) {
+			throw makeClaudePreflightError("Claude Code spawn cwd preflight failed: cwd is not a directory.", {
+				code: "ENOTDIR",
+				syscall: "chdir",
+				path: cwd,
+				cwd,
+			});
+		}
+		accessSync(cwd, fsConstants.X_OK);
+		realCwd = realpathSync(cwd);
+	} catch (err) {
+		if ((err as Error).name === "ClaudeExecutablePreflightError") throw err;
+		throw makeClaudePreflightError("Claude Code spawn cwd preflight failed: cwd is not reachable before spawning Claude Code.", {
+			code: codeValue(err, "EACCES"),
+			errno: errnoValue(err),
+			syscall: syscallValue(err),
+			path: pathValue(err) ?? cwd,
+			cwd,
+			cause: err,
+		});
+	}
+
+	let realPath: string;
+	try {
+		const stat = statSync(path);
+		if (!stat.isFile()) {
+			throw makeClaudePreflightError("Claude Code executable preflight failed: resolved path is not a file.", {
+				code: "EACCES",
+				syscall: "exec",
+				path,
+				cwd,
+			});
+		}
+		accessSync(path, fsConstants.X_OK);
+		realPath = realpathSync(path);
+	} catch (err) {
+		if ((err as Error).name === "ClaudeExecutablePreflightError") throw err;
+		throw makeClaudePreflightError("Claude Code executable preflight failed: cannot access resolved executable before spawning Claude Code.", {
+			code: codeValue(err, "ENOENT"),
+			errno: errnoValue(err),
+			syscall: syscallValue(err),
+			path: pathValue(err) ?? path,
+			cwd,
+			cause: err,
+		});
+	}
+
+	let fileType: ClaudeExecutableFileType;
+	try {
+		fileType = classifyClaudeExecutableBytes(readFileSync(realPath).subarray(0, 16));
+	} catch (err) {
+		throw makeClaudePreflightError("Claude Code executable preflight failed: cannot read executable header before spawning Claude Code.", {
+			code: codeValue(err, "EACCES"),
+			errno: errnoValue(err),
+			syscall: syscallValue(err),
+			path: pathValue(err) ?? realPath,
+			cwd,
+			realPath,
+			cause: err,
+		});
+	}
+
+	if (!["elf", "mach-o", "pe", "shebang-script"].includes(fileType)) {
+		throw makeClaudePreflightError("Claude Code executable preflight failed: executable header is not an ELF, Mach-O, PE, or shebang script.", {
+			code: "ENOEXEC",
+			syscall: "exec",
+			path,
+			cwd,
+			fileType,
+			realPath,
+		});
+	}
+
+	return { path, realPath, cwd, realCwd, fileType };
+}
+
+function envFlagEnabled(value: string | undefined): boolean {
+	return value === "1" || value?.toLowerCase() === "true";
+}
+
+export function wrapClaudeSpawnErrorForSdk(err: Error, options: SpawnOptions): Error & NodeJS.ErrnoException & { cwd: string; originalCode?: string; originalMessage?: string } {
+	const originalCode = codeValue(err, "SPAWN_ERROR");
+	const originalMessage = err.message;
+	const spawnPath = pathValue(err) ?? options.command;
+	const cwd = options.cwd ?? process.cwd();
+	const detail = [
+		`code=${originalCode}`,
+		`errno=${displayValue(errnoValue(err))}`,
+		`syscall=${displayValue(syscallValue(err))}`,
+		`path=${spawnPath}`,
+		`cwd=${cwd}`,
+		`command=${options.command}`,
+	].join(" ");
+	const wrapped = new Error(`Claude Code spawn failed: ${originalMessage} (${detail})`) as Error & NodeJS.ErrnoException & { cwd: string; originalCode?: string; originalMessage?: string };
+	wrapped.name = "ClaudeSpawnDiagnosticError";
+	// The SDK special-cases code === ENOENT and replaces the message with its
+	// generic "native binary not found" text. Preserve the original code in the
+	// message/originalCode while using a bridge code so the SDK surfaces context.
+	wrapped.code = originalCode === "ENOENT" ? "CLAUDE_BRIDGE_SPAWN_FAILED" : originalCode;
+	wrapped.originalCode = originalCode;
+	wrapped.originalMessage = originalMessage;
+	const errno = errnoValue(err);
+	if (errno !== undefined) wrapped.errno = typeof errno === "number" ? errno : Number(errno);
+	const syscall = syscallValue(err);
+	if (syscall) wrapped.syscall = syscall;
+	wrapped.path = spawnPath;
+	wrapped.cwd = cwd;
+	// Do not set `cause` here: the listener copies these structured fields back
+	// onto the original Error. A cause reference to that same object would become
+	// `err.cause === err`, making JSON.stringify throw on a circular structure.
+	// originalMessage plus code/errno/syscall/path/cwd preserve the useful data.
+	return wrapped;
+}
+
+export function spawnClaudeCodeWithDiagnostics(options: SpawnOptions): SpawnedProcess {
+	const pipeStderr = DEBUG || envFlagEnabled(options.env.DEBUG_CLAUDE_AGENT_SDK);
+	const child = spawnProcess(options.command, options.args, {
+		cwd: options.cwd,
+		env: options.env,
+		signal: options.signal,
+		stdio: ["pipe", "pipe", pipeStderr ? "pipe" : "ignore"],
+		windowsHide: true,
+	});
+	if (pipeStderr) {
+		child.stderr?.on("data", (data) => {
+			for (const line of data.toString().split(/\r?\n/)) {
+				if (line) debug(`[cli-stderr spawn] ${line}`);
+			}
+		});
+	}
+	child.prependListener("error", (err) => {
+		const originalStack = err.stack;
+		const wrapped = wrapClaudeSpawnErrorForSdk(err, options);
+		Object.assign(err, wrapped);
+		err.name = wrapped.name;
+		err.message = wrapped.message;
+		// Keep V8's stack from the actual Node spawn failure, not the wrapper
+		// construction site. Diagnostic fields above remain enumerable and
+		// JSON-serializable; stack stays the spawn-time breadcrumb for operators.
+		if (originalStack) err.stack = originalStack;
+	});
+	return {
+		stdin: child.stdin,
+		stdout: child.stdout,
+		get killed() { return child.killed; },
+		get exitCode() { return child.exitCode; },
+		kill: child.kill.bind(child),
+		on: child.on.bind(child),
+		once: child.once.bind(child),
+		off: child.off.bind(child),
+	};
+}

package/src/config.ts

@@ -1,6 +1,8 @@
 // User-facing extension config. Legacy config is loaded from
 // ~/.pi/agent/claude-bridge.json and .pi/claude-bridge.json. vstack extension
-// manager config is loaded from settings.json and overrides legacy files.
+// manager config is loaded from settings.json and overrides legacy files in
+// normal Pi sessions. Isolated embedding hosts consume only the authoritative
+// user claude-bridge.json and never read extension-manager settings.
 
 import type { SettingSource } from "@anthropic-ai/claude-agent-sdk";
 import { existsSync, readFileSync } from "fs";
@@ -87,10 +89,11 @@ export function piUserDir(): string {
 /**
  * Isolated mode (`CLAUDE_BRIDGE_ISOLATED=1`): a host app embedding the bridge
  * declares that nothing outside its explicitly configured dirs may be read.
- * Disables every cwd/home discovery fallback — the cwd AGENTS.md walk, project
- * `.pi/` settings + claude-bridge.json, project APPEND_SYSTEM.md, and the
- * `$PATH` claude executable search. Reads stay confined to `piUserDir()` (i.e.
- * `PI_CODING_AGENT_DIR`) and the explicitly configured executable path.
+ * Disables every cwd/home discovery fallback — all AGENTS.md discovery,
+ * extension-manager settings, project `.pi/` settings + claude-bridge.json,
+ * project APPEND_SYSTEM.md, and the `$PATH` claude executable search. Bridge
+ * configuration comes only from `piUserDir()/claude-bridge.json` and any
+ * explicitly configured executable path.
  * Default (unset) behavior for normal pi CLI users is unchanged.
  */
 export function isolatedFromEnv(): boolean {
@@ -163,7 +166,10 @@ function projectSettingsTrusted(settingsPath: string): boolean {
 
 function settingsPaths(cwd: string): string[] {
 	const user = join(piUserDir(), "settings.json");
-	if (isolatedFromEnv()) return [user];
+	// An embedding host may have to share PI_CODING_AGENT_DIR with an in-process
+	// Pi SDK. In isolated mode, settings.json is therefore not authoritative and
+	// must not be consulted even at user scope.
+	if (isolatedFromEnv()) return [];
 	const project = projectSettingsPath(cwd);
 	return projectSettingsTrusted(project) ? [user, project] : [user];
 }
@@ -312,7 +318,7 @@ export function loadConfig(cwd: string): Config {
 	const projectSettings = isolated ? undefined : projectSettingsPath(cwd);
 	const trustedProject = projectSettings !== undefined && projectSettingsTrusted(projectSettings);
 	const project = trustedProject ? tryParseJson(join(dirname(projectSettings), "claude-bridge.json")) : {};
-	const manager = managerToConfig(readManagerConfig(cwd));
+	const manager: Partial<Config> = isolated ? {} : managerToConfig(readManagerConfig(cwd));
 	const provider = normalizeProviderConfig({ ...global.provider, ...project.provider, ...manager.provider });
 	return {
 		enabled: manager.enabled ?? project.enabled ?? global.enabled ?? true,