fix(daemon): isolate the curator's SDK session (setting_sources=[])#18
Merged
Conversation
run_typed left setting_sources unset, which defaults to None — and the SDK then loads the user's ~/.claude + project + local settings.json. So the curator inherited the user's permissions (tool auto-approvals), hooks, and enableAllProjectMcpServers — none of which a background memory curator should have. It only stayed on-task because its prompt + memory-only output schema kept it there; isolation was not enforced. Set setting_sources=[] (SDK isolation mode) in run_typed. Both roles funnel through run_typed, so this isolates the Librarian AND the Scholar in one place: they now get ONLY the read-only research tools + submit_result passed explicitly here, regardless of the user's global config. Bonus: a second layer against the recursion loop — the user's event-appending hooks aren't loaded into the curator's own session at all. Regression test asserts run_typed builds options with setting_sources=[]. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The finding
You asked me to check whether the curator could be running your tasks rather than just curating. Short answer: no — its output schema is memory-verbs-only (no "run command"/"edit file" action), it runs with
cwd=~/.agent-mem/knowledge, and empirically it only writes memory entries.But the check surfaced a real isolation gap:
run_typednever setsetting_sources, which defaults toNone→ the SDK loads~/.claude/settings.json+ project + local settings. So the Librarian/Scholar inherited the user'spermissions(tool auto-approvals),hooks, andenableAllProjectMcpServers— none of which a background curator should have. It stayed on-task only because its prompt + memory-only output kept it there; nothing enforced the sandbox.The fix
Set
setting_sources=[](SDK isolation mode) inrun_typed. Because both roles funnel throughrun_typed, this isolates the Librarian and the Scholar in one place — they now get only the read-only research tools +submit_resultwe pass explicitly, regardless of your global config.Bonus: a second layer against the recursion loop fixed in #16 — the user's event-appending hooks aren't even loaded into the curator's own session now.
Verification
run_typedbuildsClaudeAgentOptions(setting_sources=[]).TypedAgentError→ batch dropped (visible in the log), never a loop or a paid-API fallback.Independent of #17 (opus-4-8 config) — disjoint files (
typed_agent.pyonly), merges in any order.Recommend a quick live check after merge: confirm the first real curator batch still logs
parsed_ok=True(i.e. the isolated session still drives the research + submit tools). Happy to run an isolated smoke test against a throwaway library first if you'd prefer.🤖 Generated with Claude Code