Merge pull request #18 from nickroci/fix/curator-sdk-isolation

fix(daemon): isolate the curator's SDK session (setting_sources=[])

Author: nickroci

daemon/agent_mem_daemon/typed_agent.py

@@ -278,6 +278,15 @@ async def run_typed(
         max_turns=max_turns,
         cwd=str(cwd) if cwd is not None else None,
         env=env or {},
+        # SDK isolation mode: load NO filesystem settings. Without this the SDK
+        # defaults to loading ~/.claude + project + local settings.json, so the
+        # curator would inherit the user's permissions, hooks, and project MCP
+        # servers — none of which a background memory curator should have. With
+        # ``[]`` it gets ONLY the read-only research tools + submit_result we
+        # pass explicitly here. Applies to both roles (both go through run_typed).
+        # Also a second layer against the recursion loop: the user's event-
+        # appending hooks aren't even loaded into the curator's own session.
+        setting_sources=[],
     )
 
     run = _query or query

daemon/tests/test_typed_agent.py

@@ -144,6 +144,34 @@ async def fake_query(*, prompt: object, options: object):  # noqa: ARG001
     assert res.attempts == 1
 
 
+async def test_run_typed_runs_in_sdk_isolation_mode() -> None:
+    """The curator must NOT inherit the user's filesystem settings (permissions,
+    hooks, project MCP servers). run_typed must pass setting_sources=[] so both
+    roles get only the research + submit tools handed to them — regression guard
+    for the isolation property."""
+    shared: _RunState[Decision] = _RunState()
+    captured: dict[str, object] = {}
+
+    async def fake_query(*, prompt: object, options: object):  # noqa: ARG001
+        captured["options"] = options
+        evaluate_submission({"n": 1, "label": "x"}, Decision, None, [], shared, 4)
+        yield _assistant_calling_submit()
+        yield _result(0.0)
+
+    await run_typed(
+        "p",
+        Decision,
+        deps=None,
+        system_prompt="s",
+        model="m",
+        mcp_servers={},
+        allowed_tools=[],
+        _query=fake_query,
+        _state=shared,
+    )
+    assert captured["options"].setting_sources == []  # type: ignore[attr-defined]
+
+
 async def test_run_typed_never_submitted_raises_typed_agent_error() -> None:
     shared: _RunState[Decision] = _RunState()