Managed Claude agents inherit the owner's personal Claude Code config (global CLAUDE.md, auto-memory, hooks) — no isolation

[cogpros]

Summary

Buzz Desktop's managed Claude agents load the desktop owner's personal Claude Code configuration into every agent session: ~/.claude/CLAUDE.md (global instructions), the Claude Code auto-memory directory (~/.claude/projects/<home>/memory/, including MEMORY.md), user-scope hooks, and user-scope MCP servers.

If the owner uses Claude Code in the terminal with their own persona/instructions in ~/.claude/CLAUDE.md, every Buzz agent boots with that other agent's identity, rules, and memory injected into its context — ahead of, and in conflict with, the persona the owner defined in Buzz Desktop. There is currently no isolation setting.

Environment

• Buzz Desktop 0.5.0, macOS 26.5.2 (arm64)
• @agentclientprotocol/claude-agent-acp 0.63.0 (latest), bundled in node-tools
• Claude Code CLI installed and configured by the owner for personal terminal use

Root cause

Two doors, both open:

1. Adapter default. claude-agent-acp hardcodes settingSources: ["user", "project", "local"] when building SDK options (src/acp-agent.ts, current main — search settingSources). The "user" source pulls in the owner's global ~/.claude config. That default makes sense for the adapter's original IDE use case (the user's editor acting as the user), but not for Buzz's managed, persona-scoped agents. The adapter already spreads ...userProvidedOptions after this default, so an ACP client can override settingSources per session via _meta.claudeCode.options — Buzz never passes it (no hits for settingSources in this repo).

2. Nest location. The agent workspace (~/.buzz) lives inside the owner's home directory, and Claude Code treats <ancestor>/.claude/CLAUDE.md as project memory for that ancestor. $HOME/.claude/CLAUDE.md is therefore picked up through the project source too, so merely dropping "user" is not sufficient. The auto-memory directory similarly resolves to the $HOME project and is not gated by setting sources at all.

Reproduction

1. Put any distinctive content in ~/.claude/CLAUDE.md (e.g. # I am a different agent named X).
2. Create a managed Claude agent in Buzz Desktop with its own system prompt.
3. Ask the agent whether its context contains that heading — it does.

One-shot probes against the CLI reproduce it without Buzz:

$ cd ~/.buzz && claude --setting-sources user,project,local -p \
    "If your context includes any CLAUDE.md contents, quote its first heading; else NONE"
# → quotes the heading of ~/.claude/CLAUDE.md

$ cd ~/.buzz && claude --setting-sources project,local -p ...
# → STILL quotes it (ancestor project-memory door)

$ cd /tmp && claude --setting-sources project,local -p ...
# → NONE (confirms the ancestor walk is the second door)

Verified fix (tested locally)

Two layers, both verified on the versions above:

A. Environment variables in the managed-agent spawn env — works with the adapter's current defaults, no adapter change needed:

CLAUDE_CODE_DISABLE_CLAUDE_MDS=1     # stops global + ancestor CLAUDE.md injection
CLAUDE_CODE_DISABLE_AUTO_MEMORY=1    # stops ~/.claude/projects/<home>/memory injection

With both set, the same probes return NONE / no memory even with --setting-sources user,project,local.

B. Full isolation — additionally pass settingSources: ["local"] via _meta.claudeCode.options in session/new (the adapter already honors it). This also stops the owner's user-scope hooks and MCP servers from loading into managed agents, which the env vars alone do not. Verified by patching the bundled adapter's options locally: agent context is fully clean, auth (Keychain) and everything else keeps working.

Suggested behavior

• Managed agents should default to not inheriting the desktop owner's personal Claude Code config (persona conflicts, prompt bloat, and the owner's personal instructions/memory leaking into agents that other channel members may interact with).
• If inheritance is ever desirable, make it an explicit per-agent opt-in toggle.

Happy to test a build — this machine reproduces it deterministically.