src/agent/runner.ts

@@ -163,17 +163,19 @@ export async function runAgent(options: RunAgentOptions): Promise<string> {
   }
 
   return new Promise<string>((resolve, reject) => {
-    // NOTE: --bare is intentionally NOT used here. --bare disables OAuth/keychain
-    // auth and requires ANTHROPIC_API_KEY, which breaks Claude Pro/Max subscriptions.
-    // CLAUDE.md isolation is handled structurally: workspaces live under
-    // ~/.disclaw/workspaces/ (outside the DisClaw repo), so walk-up will never
-    // reach the DisClaw project CLAUDE.md. The workspace CLAUDE.md is picked up
-    // automatically because cwd is set to workspacePath.
+    // IMPORTANT: --bare prevents CLAUDE.md walk-up through parent directories.
+    // Without this flag every agent inherits the DisClaw project CLAUDE.md as
+    // its identity (and any other CLAUDE.md files up the directory tree).
+    // --append-system-prompt-file injects the workspace-specific CLAUDE.md
+    // explicitly so each agent keeps its own isolated identity.
     const args = [
       "-p",
       prompt,
       "--output-format",
       "json",
+      "--bare",
+      "--append-system-prompt-file",
+      path.join(workspacePath, "CLAUDE.md"),
     ];
 
     const child = spawn(claudeCommand, args, {

tests/integration/no-parent-claude-md-leak.test.ts

@@ -4,12 +4,9 @@ import * as os from "os";
 import * as path from "path";
 
 /**
- * Integration test: verifies that Claude CLI invocations use the correct args.
- *
- * CLAUDE.md isolation is achieved structurally (workspaces live outside the
- * repo under ~/.disclaw/workspaces/) — NOT via --bare or --append-system-prompt-file.
- * --bare was removed because it disables OAuth/keychain auth, breaking Claude
- * Pro/Max subscriptions.
+ * Integration test: verifies that every Claude CLI invocation includes
+ * --bare (prevents CLAUDE.md walk-up through parent directories) and
+ * --append-system-prompt-file pointing to the workspace CLAUDE.md.
  *
  * We mock cross-spawn so no real process is launched, and capture the exact
  * args array that runner.ts would pass to the CLI.
@@ -119,7 +116,7 @@ describe("no-parent-claude-md-leak", () => {
     }
   });
 
-  it("does NOT pass --bare flag (--bare disables OAuth and breaks Claude Pro/Max)", async () => {
+  it("passes --bare flag to the Claude CLI", async () => {
     await runAgent({
       workspacePath: workspaceDir,
       channelName: "test-channel",
@@ -127,10 +124,10 @@ describe("no-parent-claude-md-leak", () => {
       conversationHistory: [],
     });
 
-    expect(capturedArgs).not.toContain("--bare");
+    expect(capturedArgs).toContain("--bare");
   });
 
-  it("passes -p and --output-format json; does NOT pass --append-system-prompt-file", async () => {
+  it("passes --append-system-prompt-file pointing to workspace CLAUDE.md", async () => {
     await runAgent({
       workspacePath: workspaceDir,
       channelName: "test-channel",
@@ -138,12 +135,12 @@ describe("no-parent-claude-md-leak", () => {
       conversationHistory: [],
     });
 
-    // Required args for non-interactive JSON output
-    expect(capturedArgs).toContain("-p");
-    expect(capturedArgs).toContain("--output-format");
-    expect(capturedArgs).toContain("json");
+    const idx = capturedArgs.indexOf("--append-system-prompt-file");
+    expect(idx).toBeGreaterThanOrEqual(0);
 
-    // CLAUDE.md is auto-discovered via cwd (workspacePath), no flag needed
-    expect(capturedArgs).not.toContain("--append-system-prompt-file");
+    const systemPromptFile = capturedArgs[idx + 1];
+    expect(systemPromptFile).toMatch(/CLAUDE\.md$/);
+    // Must point to the workspace-specific CLAUDE.md, not a parent directory
+    expect(systemPromptFile).toBe(path.join(workspaceDir, "CLAUDE.md"));
   });
 });

tests/unit/sanitize-env.test.ts

@@ -55,13 +55,10 @@ describe("sanitizedEnv", () => {
     expect(result["SOME_SAFE_VAR"]).toBe("safe-value");
   });
 
-  it("(c) sets DISCLAW_AGENT=1 but does NOT set CI=true (breaks Claude Code OAuth)", () => {
-    // CI=true was removed: Claude Code interprets it as headless CI mode
-    // and requires ANTHROPIC_API_KEY instead of OAuth/keychain login.
-    delete process.env["CI"];
+  it("(c) sets CI=true and DISCLAW_AGENT=1 as mandatory markers", () => {
     const result = sanitizedEnv();
 
-    expect(result["CI"]).toBeUndefined();
+    expect(result["CI"]).toBe("true");
     expect(result["DISCLAW_AGENT"]).toBe("1");
   });
 
@@ -94,7 +91,7 @@ describe("sanitizedEnv", () => {
     expect(result["ANOTHER_KEY"]).toBeUndefined();
     // Extras and standard vars should still be present
     expect(result["DISCLAW_AGENT_NAME"]).toBe("test-agent");
-    expect(result["DISCLAW_AGENT"]).toBe("1");
+    expect(result["CI"]).toBe("true");
   });
 
   it("does not mutate process.env", () => {