claude-dev-env 8.47.3 → 8.48.1

package/.agents/skills/build-eval/reference/graders-and-commands.md

@@ -89,11 +89,11 @@ writes were all denied still shows the tool_use attempts.
 
 ## Flag-gated features outside plugin eval
 
-The sandbox cannot turn on a flag-gated feature. Test it with `claude -p`, once with the wrapper
-loaded and once without:
+The sandbox cannot turn on a flag-gated feature. Test it with a headless `claude -p` run started
+through the account broker, once with the wrapper loaded and once without:
 
 ```text
-claude -p "<task>" --advisor <model> --plugin-dir <wrapper> --setting-sources project --strict-mcp-config --allowedTools "<list>" --permission-mode dontAsk --output-format stream-json --verbose
+python "$HOME/.claude/scripts/account_broker.py" run --product claude --report <report.json> -- claude -p "<task>" --advisor <model> --plugin-dir <wrapper> --setting-sources project --strict-mcp-config --allowedTools "<list>" --permission-mode dontAsk --output-format stream-json --verbose
 ```
 
 Drop `--plugin-dir <wrapper>` for the second arm.

package/.agents/skills/team-advisor/reference/advisor-docs-review.md

@@ -213,11 +213,13 @@ cannot reach the built-in tool path. Its sandbox turns off feature-flag
 fetching, and `/advisor` replies "isn't available in this environment". A
 plugin-eval suite therefore grades the warm-agent path alone.
 
-Drive the built-in tool path with a headless run, once with the skill and once
-without:
+Drive the built-in tool path with a headless run through the account broker,
+once with the skill and once without:
 
 ```text
-claude -p "<task>" --advisor opus --plugin-dir <wrapper> \
+python "$HOME/.claude/scripts/account_broker.py" run --product claude \
+  --report <report.json> -- \
+  claude -p "<task>" --advisor opus --plugin-dir <wrapper> \
   --setting-sources project --strict-mcp-config \
   --allowedTools "Read,Glob,Grep,Skill,Agent,SendMessage,Write,Edit" \
   --permission-mode dontAsk --output-format stream-json --verbose

package/docs/account-broker.md

@@ -16,7 +16,7 @@ python scripts/account_broker.py run --product claude --report report.json -- cl
 
 `accounts` prints the roster without reading meters. `choose` prints `decision`, `accounts`, and `state_path`. Each decision contains `action`, `account`, `home`, `reason`, `tier`, and `resets_at`. A wait decision has no account or home and includes the soonest reset in UTC. A failed meter read excludes the account for that choice. `--spent` saves an exclusion until the supplied Unix reset, the account's soonest known meter reset, or one hour when neither is available. A `--spent` name absent from the roster is saved until the supplied Unix reset, or for one hour when no reset is given. While any such mark is still in the future, `choose` waits until the soonest mark and exits 3, and with no Codex roster `--spent default` waits until that mark passes. Meter reads younger than 60 seconds are reused.
 
-`check` prints nothing and exits 3 while every account is below its floor. `run` sets only `CLAUDE_CONFIG_DIR` or `CODEX_HOME` for each attempt. It replays the same stdin bytes when a usage limit or start failure leads to another account. It writes the command's stdout to stdout and diagnostics to stderr. A resumed Claude session uses the account bound to its session when that account has room.
+`check` prints nothing and exits 3 while every account is below its floor. `run` sets `CLAUDE_CONFIG_DIR` or `CODEX_HOME` for each attempt. A Claude job also starts without the parent session's variables, such as `CLAUDE_CODE_SESSION_ID` and `CLAUDECODE`, so a child started from inside a Claude Code session runs as its own session. `ALL_PARENT_CLAUDE_SESSION_VARIABLES` lists them. It replays the same stdin bytes when a usage limit or start failure leads to another account. It writes the command's stdout to stdout and diagnostics to stderr. A resumed Claude session uses the account bound to its session when that account has room.
 
 The broker stores cached meters, spent marks, and Claude session bindings in one JSON file under `~/.claude/account-broker`. Every broker process for the same user reads that file, so a spent mark pauses that account for every job. A write holds an exclusive lock on the sibling `state.json.lock`, re-reads the file, merges, and swaps in a sibling temporary file with `os.replace`. The merge keeps the latest reset for each spent mark and the newest meter read for each account.
 

package/hooks/blocking/headless_claude_broker_gate.py

@@ -0,0 +1,142 @@
+#!/usr/bin/env python3
+"""PreToolUse gate: start every headless Claude session through the account broker.
+
+A command segment whose program is ``claude`` or a ``claude-<profile>``
+launcher and that passes ``-p`` or ``--print`` is denied, and the deny reason
+names the broker command to run instead. The program is read past wrappers,
+so ``env -u NAME claude -p`` and ``bash -c "claude -p task"`` are denied too.
+The broker form runs ``python``, so its ``-- claude -p ...`` tail passes.
+Interactive ``claude`` and its subcommands, such as ``claude plugin eval`` or
+``claude --version``, pass.
+
+Hosted by ``blocking/bash_pre_tool_use_dispatcher.py`` for the Bash and
+PowerShell tools.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+try:
+    _hooks_root_directory = str(Path(__file__).resolve().parent.parent)
+    if _hooks_root_directory not in sys.path:
+        sys.path.insert(0, _hooks_root_directory)
+    from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
+        ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        DENY_DECISION,
+        HOOK_EVENT_NAME,
+    )
+    from hooks_constants.headless_claude_broker_gate_constants import (
+        ALL_PRINT_MODE_FLAGS,
+        ALL_WINDOWS_LAUNCHER_SUFFIXES,
+        BROKER_COMMAND_DENY_REASON,
+        CLAUDE_PROFILE_LAUNCHER_PREFIX,
+        CLAUDE_PROGRAM_NAME,
+        GATE_HOOK_NAME,
+        PRINT_MODE_LONG_FLAG_WITH_VALUE_PREFIX,
+    )
+    from hooks_constants.hook_block_logger import log_hook_block
+    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+    from hooks_constants.shell_command_pipeline import pipeline_segments_for_command
+    from hooks_constants.shell_command_wrappers import (
+        all_wrapped_command_texts,
+        segment_program_and_arguments,
+    )
+except ImportError as import_error:
+    raise ImportError(
+        "The headless Claude broker gate cannot import its dependencies; "
+        "ensure the hooks directory is importable."
+    ) from import_error
+
+
+def _is_claude_program(program_name: str) -> bool:
+    """Return True when the program name launches Claude Code or a Claude profile launcher.
+
+    ::
+
+        claude                   -> True
+        claude-ev.cmd            -> True
+        claude_account_worker.py -> False
+
+    Args:
+        program_name: A segment's program basename, read past its wrappers.
+    """
+    launcher_name = program_name
+    for each_suffix in ALL_WINDOWS_LAUNCHER_SUFFIXES:
+        launcher_name = launcher_name.removesuffix(each_suffix)
+    if launcher_name == CLAUDE_PROGRAM_NAME:
+        return True
+    profile_name = launcher_name.removeprefix(CLAUDE_PROFILE_LAUNCHER_PREFIX)
+    return profile_name != launcher_name and profile_name.replace("_", "").replace("-", "").isalnum()
+
+
+def _is_print_mode_flag(argument: str) -> bool:
+    """Return True when one argument turns on Claude's print mode.
+
+    Args:
+        argument: One argument after the segment's program.
+    """
+    return argument in ALL_PRINT_MODE_FLAGS or argument.startswith(PRINT_MODE_LONG_FLAG_WITH_VALUE_PREFIX)
+
+
+def _runs_headless_claude(all_segment_tokens: list[str]) -> bool:
+    """Return True when a segment's program is a Claude launcher in print mode.
+
+    Args:
+        all_segment_tokens: One command segment's shell tokens.
+    """
+    program_name, all_arguments = segment_program_and_arguments(all_segment_tokens)
+    return _is_claude_program(program_name) and any(
+        _is_print_mode_flag(each_argument) for each_argument in all_arguments
+    )
+
+
+def starts_unbrokered_headless_claude(command: str) -> bool:
+    """Return True when a command segment starts headless Claude without the broker.
+
+    ::
+
+        claude -p "task"                                         -> True
+        cd repo && env -u CLAUDECODE claude-ev -p "task"         -> True
+        python account_broker.py run ... -- claude -p "task"     -> False
+        git -C claude-dev-env log -p                             -> False
+
+    Args:
+        command: The shell command text the agent is about to run.
+    """
+    return any(
+        _runs_headless_claude(each_segment)
+        for each_text in all_wrapped_command_texts(command)
+        for each_segment, _each_following_operator in pipeline_segments_for_command(each_text)
+    )
+
+
+def main() -> None:
+    """Deny a headless Claude start that skips the broker, or stay quiet."""
+    hook_payload = read_hook_input_dictionary_from_stdin()
+    if hook_payload is None:
+        return
+    tool_name = hook_payload.get("tool_name")
+    if tool_name not in ALL_BASH_AND_POWERSHELL_TOOL_NAMES:
+        return
+    tool_input = hook_payload.get("tool_input")
+    if not isinstance(tool_input, dict):
+        return
+    command = tool_input.get("command", "")
+    if not isinstance(command, str) or not starts_unbrokered_headless_claude(command):
+        return
+    log_hook_block(GATE_HOOK_NAME, HOOK_EVENT_NAME, BROKER_COMMAND_DENY_REASON, str(tool_name), command)
+    sys.stdout.write(json.dumps({
+        "hookSpecificOutput": {
+            "hookEventName": HOOK_EVENT_NAME,
+            "permissionDecision": DENY_DECISION,
+            "permissionDecisionReason": BROKER_COMMAND_DENY_REASON,
+        }
+    }))
+    sys.stdout.flush()
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/test_bash_dispatcher_interpreter_starts.py

@@ -2,8 +2,8 @@
 
 A Bash tool call starts one interpreter, the dispatcher's own. Each roster
 entry then runs in that process through runpy, so the roster's exact content is
-the chain's cost after that single start. One allow-and-rewrite hook is the
-whole roster; a blocking hook added here fails this test.
+the chain's cost after that single start. The roster holds the MSYS rewriter and
+the headless Claude broker gate; any other hook added here fails this test.
 """
 
 import sys
@@ -14,16 +14,21 @@ if str(_HOOKS_ROOT) not in sys.path:
     sys.path.insert(0, str(_HOOKS_ROOT))
 
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
+    ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
     ALL_BASH_HOSTED_HOOK_ENTRIES,
     ALL_BASH_ONLY_TOOL_NAMES,
     BashHostedHookEntry,
 )
 
 
-def test_bash_roster_starts_only_the_msys_rewriter_and_no_blocking_hook() -> None:
+def test_bash_roster_starts_only_the_msys_rewriter_and_the_broker_gate() -> None:
     assert ALL_BASH_HOSTED_HOOK_ENTRIES == (
         BashHostedHookEntry(
             script_relative_path="blocking/msys_rev_path_rewriter.py",
             applicable_tool_names=ALL_BASH_ONLY_TOOL_NAMES,
         ),
+        BashHostedHookEntry(
+            script_relative_path="blocking/headless_claude_broker_gate.py",
+            applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        ),
     )

package/hooks/blocking/test_headless_claude_broker_gate.py

@@ -0,0 +1,88 @@
+"""Tests for headless_claude_broker_gate, which sends headless Claude through the broker."""
+
+from __future__ import annotations
+
+import json
+from io import StringIO
+from unittest.mock import patch
+
+import pytest
+
+import headless_claude_broker_gate as gate
+
+BROKER_COMMAND = (
+    'python "$HOME/.claude/scripts/account_broker.py" run --product claude --report r.json '
+    '-- claude -p "task" --output-format stream-json --verbose'
+)
+
+
+def _stdout_from_main(payload: dict[str, object]) -> str:
+    """Return what main() wrote to stdout for one hook payload."""
+    captured_stdout = StringIO()
+    with patch("sys.stdin", StringIO(json.dumps(payload))), patch("sys.stdout", captured_stdout), patch.object(
+        gate, "log_hook_block"
+    ):
+        gate.main()
+    return captured_stdout.getvalue()
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        'claude -p "fix the test"',
+        'claude --print "fix the test"',
+        'claude -p --resume abc-123 "next turn" --output-format stream-json --verbose',
+        'cd /repo && claude -p "task"',
+        'env -u CLAUDECODE claude -p "task"',
+        'CLAUDE_CONFIG_DIR=/x claude -p "task"',
+        'claude-ev -p "task"',
+        "claude-ev.cmd -p task",
+        "/opt/node22/bin/claude -p task",
+        "& claude -p 'task'",
+        "timeout 600 claude -p task > out.json",
+        'bash -c "claude -p task"',
+        "sudo -u builder claude -p task",
+    ],
+)
+def test_headless_claude_without_the_broker_is_detected(command: str) -> None:
+    assert gate.starts_unbrokered_headless_claude(command) is True
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        BROKER_COMMAND,
+        "python ~/.claude/scripts/claude_account_worker.py --prompt-file b.md --report-file r.json",
+        "claude plugin eval suite.json",
+        "claude --version",
+        "claude",
+        'grep -rn "claude -p" docs',
+        'echo "run claude -p later"',
+        "python claude_account_worker.py -p x",
+        "git -C claude-dev-env log -p",
+        "mkdir -p claude-dev-env",
+        "cp -rp claude-dev-env /backup -p",
+    ],
+)
+def test_broker_starts_and_other_claude_commands_pass(command: str) -> None:
+    assert gate.starts_unbrokered_headless_claude(command) is False
+
+
+def test_bash_payload_with_bare_headless_claude_is_denied_with_the_broker_command() -> None:
+    decision = json.loads(_stdout_from_main({"tool_name": "Bash", "tool_input": {"command": 'claude -p "task"'}}))
+    specific_output = decision["hookSpecificOutput"]
+    assert specific_output["permissionDecision"] == "deny"
+    assert "account_broker.py\" run --product claude" in specific_output["permissionDecisionReason"]
+
+
+def test_powershell_payload_with_profile_launcher_is_denied() -> None:
+    decision = json.loads(_stdout_from_main({"tool_name": "PowerShell", "tool_input": {"command": "claude-ev -p task"}}))
+    assert decision["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_broker_command_payload_emits_nothing() -> None:
+    assert _stdout_from_main({"tool_name": "Bash", "tool_input": {"command": BROKER_COMMAND}}) == ""
+
+
+def test_other_tool_payload_emits_nothing() -> None:
+    assert _stdout_from_main({"tool_name": "Write", "tool_input": {"command": 'claude -p "task"'}}) == ""

package/hooks/hooks.json

@@ -67,6 +67,16 @@
           }
         ]
       },
+      {
+        "matcher": "PowerShell",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/bash_pre_tool_use_dispatcher.py",
+            "timeout": 60
+          }
+        ]
+      },
       {
         "matcher": "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request)",
         "hooks": [

package/hooks/hooks_constants/bash_pre_tool_use_dispatcher_constants.py

@@ -59,4 +59,8 @@ ALL_BASH_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
         script_relative_path="blocking/msys_rev_path_rewriter.py",
         applicable_tool_names=ALL_BASH_ONLY_TOOL_NAMES,
     ),
+    BashHostedHookEntry(
+        script_relative_path="blocking/headless_claude_broker_gate.py",
+        applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+    ),
 )

package/hooks/hooks_constants/headless_claude_broker_gate_constants.py

@@ -0,0 +1,35 @@
+"""Constants for the headless Claude broker gate.
+
+Holds the Claude program name and its profile-launcher prefix, the Windows
+launcher suffixes stripped before the name check, the two print-mode flags, the
+hook name the block log records, and the deny message that names the broker
+command to run instead.
+"""
+
+from __future__ import annotations
+
+__all__ = [
+    "CLAUDE_PROGRAM_NAME",
+    "CLAUDE_PROFILE_LAUNCHER_PREFIX",
+    "ALL_WINDOWS_LAUNCHER_SUFFIXES",
+    "ALL_PRINT_MODE_FLAGS",
+    "PRINT_MODE_LONG_FLAG_WITH_VALUE_PREFIX",
+    "GATE_HOOK_NAME",
+    "BROKER_COMMAND_DENY_REASON",
+]
+
+CLAUDE_PROGRAM_NAME: str = "claude"
+CLAUDE_PROFILE_LAUNCHER_PREFIX: str = "claude-"
+ALL_WINDOWS_LAUNCHER_SUFFIXES: tuple[str, ...] = (".cmd", ".exe", ".ps1", ".bat")
+ALL_PRINT_MODE_FLAGS: frozenset[str] = frozenset({"-p", "--print"})
+PRINT_MODE_LONG_FLAG_WITH_VALUE_PREFIX: str = "--print="
+GATE_HOOK_NAME: str = "headless_claude_broker_gate.py"
+BROKER_COMMAND_DENY_REASON: str = (
+    "BLOCKED: Start a headless Claude session through the account broker. "
+    "Run: python \"$HOME/.claude/scripts/account_broker.py\" run --product claude "
+    "--report <report.json> -- <the same claude -p command>. "
+    "The broker picks an account with room, sends a --resume turn to the account that owns the session, "
+    "and starts the child without this session's variables. "
+    "Exit 3 means no account has room: report the reset time from the report file. "
+    "For a worker that edits code, use claude_account_worker.py from the second-account-workers skill."
+)

package/hooks/hooks_constants/test_bash_pre_tool_use_dispatcher_constants.py

@@ -8,13 +8,18 @@ ALL_CONSTANT_BINDINGS = run_path(
 )
 ALL_BASH_HOSTED_HOOK_ENTRIES = ALL_CONSTANT_BINDINGS["ALL_BASH_HOSTED_HOOK_ENTRIES"]
 ALL_BASH_ONLY_TOOL_NAMES = ALL_CONSTANT_BINDINGS["ALL_BASH_ONLY_TOOL_NAMES"]
+ALL_BASH_AND_POWERSHELL_TOOL_NAMES = ALL_CONSTANT_BINDINGS["ALL_BASH_AND_POWERSHELL_TOOL_NAMES"]
 BashHostedHookEntry = ALL_CONSTANT_BINDINGS["BashHostedHookEntry"]
 
 
-def test_roster_hosts_only_the_msys_rewriter_and_no_blocking_hook() -> None:
+def test_roster_hosts_only_the_msys_rewriter_and_the_broker_gate() -> None:
     assert ALL_BASH_HOSTED_HOOK_ENTRIES == (
         BashHostedHookEntry(
             script_relative_path="blocking/msys_rev_path_rewriter.py",
             applicable_tool_names=ALL_BASH_ONLY_TOOL_NAMES,
         ),
+        BashHostedHookEntry(
+            script_relative_path="blocking/headless_claude_broker_gate.py",
+            applicable_tool_names=ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+        ),
     )

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.47.3",
+    "version": "8.48.1",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/account_broker.py

@@ -45,6 +45,7 @@ from dev_env_scripts_constants.account_broker_constants import (
     _choose_claude,
     _choose_codex,
     _wait_decision,
+    ALL_PARENT_CLAUDE_SESSION_VARIABLES,
     COMMAND_MISSING_EXIT_CODE,
     REPORT_INDENT_SPACES,
     WAIT_EXIT_CODE,
@@ -248,7 +249,12 @@ def _record_spent_attempt(context: _RunContext, account: Account, status: str, r
 
 
 def _invoke(context: _RunContext, account: Account) -> subprocess.CompletedProcess[str]:
-    environment = {**os.environ, context.active.environment_variable: str(account.home)}
+    environment = {
+        each_variable_name: each_setting
+        for each_variable_name, each_setting in os.environ.items()
+        if context.product is not Product.CLAUDE or each_variable_name not in ALL_PARENT_CLAUDE_SESSION_VARIABLES
+    }
+    environment[context.active.environment_variable] = str(account.home)
     return support.subprocess_runner(
         context.all_argv,
         env=environment,

package/scripts/account_broker_support.py

@@ -25,12 +25,14 @@ import codex_account_meters
 from claude_account_profile import default_profile_home, validate_profile_name
 from claude_chain_usage import WeeklyUtilizationProbeError, probe_account_meters
 from dev_env_scripts_constants.account_broker_constants import (
+    ALL_BATCH_FILE_EXTENSIONS,
     BROKER_STATE_DIRECTORY_NAME,
     BROKER_STATE_FILE_NAME,
     BROKER_STATE_LOCK_SUFFIX,
     BROKER_STATE_TEMP_SUFFIX,
     Account,
     BrokerConfigurationError,
+    CMD_SHELL_METACHARACTERS,
     Decision,
     JobOutcome,
     Meters,
@@ -434,7 +436,29 @@ def _resolve_command(all_argv: Sequence[str]) -> list[str]:
     resolved_command = shutil.which(command_name)
     if resolved_command is None and not os.path.dirname(command_name):
         raise FileNotFoundError(errno.ENOENT, "command not found on PATH", command_name)
-    return [resolved_command or command_name, *all_arguments]
+    launched_command = resolved_command or command_name
+    _refuse_batch_file_shell_metacharacters(launched_command, all_arguments)
+    return [launched_command, *all_arguments]
+
+
+def _refuse_batch_file_shell_metacharacters(launched_command: str, all_arguments: Sequence[str]) -> None:
+    if os.path.splitext(launched_command)[1].casefold() not in ALL_BATCH_FILE_EXTENSIONS:
+        return
+    shell_parsed_argument = next(
+        (
+            each_argument
+            for each_argument in all_arguments
+            if any(each_character in CMD_SHELL_METACHARACTERS for each_character in each_argument)
+        ),
+        None,
+    )
+    if shell_parsed_argument is None:
+        return
+    raise OSError(
+        errno.EINVAL,
+        f"cmd.exe would parse the batch file argument {shell_parsed_argument!r}; send that text on stdin",
+        launched_command,
+    )
 
 
 def _run_captured_subprocess(all_argv: Sequence[str], **options: object) -> subprocess.CompletedProcess[str]:

package/scripts/dev_env_scripts_constants/account_broker_constants.py

@@ -58,6 +58,29 @@ BROKER_STATE_FILE_NAME = "state.json"
 BROKER_STATE_TEMP_SUFFIX = ".json"
 BROKER_STATE_LOCK_SUFFIX = ".lock"
 SECONDS_PER_HOUR = 3600
+ALL_BATCH_FILE_EXTENSIONS = frozenset({".bat", ".cmd"})
+CMD_SHELL_METACHARACTERS = "&|<>^%!\"\r\n"
+ALL_PARENT_CLAUDE_SESSION_VARIABLES: frozenset[str] = frozenset({
+    "CLAUDE_CODE_SESSION_ID",
+    "CLAUDE_CODE_REMOTE",
+    "CLAUDE_CODE_REMOTE_SESSION_ID",
+    "CLAUDE_CODE_MESSAGING_SOCKET",
+    "CLAUDE_CODE_MESSAGING_TOKEN",
+    "CLAUDE_SESSION_INGRESS_TOKEN_FILE",
+    "CLAUDE_CODE_POST_FOR_SESSION_INGRESS_V2",
+    "CLAUDE_CODE_TEE_SDK_STDOUT",
+    "CLAUDE_CODE_SYNC_SESSION_REFS",
+    "CLAUDE_CODE_CHILD_SESSION",
+    "CLAUDE_CODE_SESSION_ATTENDED",
+    "CLAUDECODE",
+    "CLAUDE_PID",
+    "CLAUDE_AFTER_LAST_COMPACT",
+    "CLAUDE_CODE_DIAGNOSTICS_FILE",
+    "CLAUDE_CODE_REMOTE_SEND_KEEPALIVES",
+    "CLAUDE_CODE_WORKER_EPOCH",
+    "CLAUDE_CODE_SYNC_SKILLS",
+    "CLAUDE_EFFORT",
+})
 
 
 def codex_usage_limit_signatures() -> tuple[str, ...]:

package/scripts/dev_env_scripts_constants/test_account_broker_constants.py

@@ -17,6 +17,7 @@ import pytest
 from dev_env_scripts_constants import account_broker_constants as broker_constants
 from dev_env_scripts_constants.account_broker_constants import (
     ALL_CLAUDE_FLOORS,
+    ALL_PARENT_CLAUDE_SESSION_VARIABLES,
     ALL_CODEX_FLOORS,
     JobOutcome,
 )
@@ -166,3 +167,9 @@ def test_codex_usage_limit_signatures_finds_shared_tree_beside_the_scripts_link(
     )
 
     assert installed_constants.codex_usage_limit_signatures() == (TEMP_TREE_MARKER,)
+
+
+def test_parent_session_variables_name_the_session_link_and_leave_the_account_home() -> None:
+    assert "CLAUDE_CODE_SESSION_ID" in ALL_PARENT_CLAUDE_SESSION_VARIABLES
+    assert "CLAUDECODE" in ALL_PARENT_CLAUDE_SESSION_VARIABLES
+    assert "CLAUDE_CONFIG_DIR" not in ALL_PARENT_CLAUDE_SESSION_VARIABLES

package/scripts/test_account_broker.py

@@ -824,3 +824,51 @@ def test_should_refuse_limits_for_claude(tmp_path: Path, capsys: pytest.CaptureF
         account_broker.main(("limits", "--product", "claude", "--home", str(tmp_path)))
     assert exit_info.value.code == 2
     assert "invalid choice: 'claude'" in capsys.readouterr().err
+
+
+def test_should_start_claude_job_without_the_parent_session_variables(
+    monkeypatch: pytest.MonkeyPatch
+) -> None:
+    accounts = (_account("first", Product.CLAUDE),)
+    monkeypatch.setitem(account_broker.all_product_adapters, Product.CLAUDE, _adapter(accounts, {
+        "first": _meters(80, 80)
+    }))
+    monkeypatch.setenv("CLAUDE_CODE_SESSION_ID", "parent-session")
+    monkeypatch.setenv("CLAUDECODE", "1")
+    monkeypatch.setenv("CLAUDE_CODE_MESSAGING_SOCKET", "/parent/socket")
+    monkeypatch.setenv("UNRELATED_SETTING", "kept")
+    all_child_environments: list[dict[str, str]] = []
+
+    def runner(argv: object, **options: object) -> subprocess.CompletedProcess[str]:
+        all_child_environments.append(options["env"])
+        return subprocess.CompletedProcess(argv, 0, "", "")
+
+    with account_broker.override_subprocess_runner(runner):
+        run_job(Product.CLAUDE, ("claude", "-p", "task"))
+
+    child_environment = all_child_environments[0]
+    assert "CLAUDE_CODE_SESSION_ID" not in child_environment
+    assert "CLAUDECODE" not in child_environment
+    assert "CLAUDE_CODE_MESSAGING_SOCKET" not in child_environment
+    assert child_environment["UNRELATED_SETTING"] == "kept"
+    assert child_environment["CODEX_HOME"] == str(Path("/profiles") / "first")
+
+
+def test_should_keep_the_parent_environment_for_codex_jobs(
+    monkeypatch: pytest.MonkeyPatch
+) -> None:
+    accounts = (_account("first"),)
+    monkeypatch.setitem(account_broker.all_product_adapters, Product.CODEX, _adapter(accounts, {
+        "first": _meters(80, 80)
+    }))
+    monkeypatch.setenv("CLAUDE_CODE_SESSION_ID", "parent-session")
+    all_child_environments: list[dict[str, str]] = []
+
+    def runner(argv: object, **options: object) -> subprocess.CompletedProcess[str]:
+        all_child_environments.append(options["env"])
+        return subprocess.CompletedProcess(argv, 0, "", "")
+
+    with account_broker.override_subprocess_runner(runner):
+        run_job(Product.CODEX, ("codex", "exec", "task"))
+
+    assert all_child_environments[0]["CLAUDE_CODE_SESSION_ID"] == "parent-session"

package/scripts/test_account_broker_support.py

@@ -190,3 +190,62 @@ def test_should_refuse_to_launch_a_bare_command_missing_from_path(monkeypatch: p
 
     assert raised.value.errno == errno.ENOENT
     assert raised.value.filename == "claude"
+
+
+@pytest.mark.parametrize("metacharacter", ["&", "|", "<", ">", "^", "%", "!", '"', "\n", "\r"])
+def test_should_refuse_a_batch_file_argument_that_cmd_would_parse(
+    monkeypatch: pytest.MonkeyPatch, metacharacter: str
+) -> None:
+    resolved_command = r"C:\Users\someone\AppData\Roaming\npm\claude.cmd"
+    monkeypatch.setattr(shutil, "which", lambda name: resolved_command)
+    monkeypatch.setattr(support.subprocess, "run", lambda *arguments, **options: pytest.fail("a batch file ran"))
+
+    with pytest.raises(OSError) as raised:
+        support.subprocess_runner(["claude", "-p", f"fix{metacharacter}test"])
+
+    assert raised.value.errno == errno.EINVAL
+    assert raised.value.filename == resolved_command
+    assert "stdin" in raised.value.strerror
+
+
+def test_should_refuse_metacharacters_for_an_uppercase_bat_extension(monkeypatch: pytest.MonkeyPatch) -> None:
+    resolved_command = r"C:\tools\CLAUDE.BAT"
+    monkeypatch.setattr(shutil, "which", lambda name: resolved_command)
+    monkeypatch.setattr(support.subprocess, "run", lambda *arguments, **options: pytest.fail("a batch file ran"))
+
+    with pytest.raises(OSError) as raised:
+        support.subprocess_runner(["claude", "a & b"])
+
+    assert raised.value.errno == errno.EINVAL
+
+
+def test_should_launch_a_batch_file_with_flags_only(monkeypatch: pytest.MonkeyPatch) -> None:
+    resolved_command = r"C:\Users\someone\AppData\Roaming\npm\claude.cmd"
+    monkeypatch.setattr(shutil, "which", lambda name: resolved_command)
+    all_launched_argv: list[list[str]] = []
+
+    def fake_run(all_argv: list[str], **options: object) -> subprocess.CompletedProcess[bytes]:
+        all_launched_argv.append(list(all_argv))
+        return subprocess.CompletedProcess(all_argv, 0)
+
+    monkeypatch.setattr(support.subprocess, "run", fake_run)
+
+    support.subprocess_runner(["claude", "-p", "--output-format", "json", "--model", "opus"], input=b"a & b")
+
+    assert all_launched_argv == [[resolved_command, "-p", "--output-format", "json", "--model", "opus"]]
+
+
+def test_should_pass_metacharacters_to_an_executable_unchanged(monkeypatch: pytest.MonkeyPatch) -> None:
+    resolved_command = "/usr/local/bin/claude"
+    monkeypatch.setattr(shutil, "which", lambda name: resolved_command)
+    all_launched_argv: list[list[str]] = []
+
+    def fake_run(all_argv: list[str], **options: object) -> subprocess.CompletedProcess[bytes]:
+        all_launched_argv.append(list(all_argv))
+        return subprocess.CompletedProcess(all_argv, 0)
+
+    monkeypatch.setattr(support.subprocess, "run", fake_run)
+
+    support.subprocess_runner(["claude", "-p", 'say "a & b" | 100%!'])
+
+    assert all_launched_argv == [[resolved_command, "-p", 'say "a & b" | 100%!']]