Managed Claude agents inherit the owner's personal Claude Code config (global CLAUDE.md, auto-memory, hooks) — no isolation

# Summary

Buzz Desktop's managed Claude agents load the desktop owner's **personal Claude Code configuration** into every agent session: `~/.claude/CLAUDE.md` (global instructions), the Claude Code auto-memory directory (`~/.claude/projects//memory/`, including `MEMORY.md`), user-scope hooks, and user-scope MCP servers.

If the owner uses Claude Code in the terminal with their own persona/instructions in `~/.claude/CLAUDE.md`, **every Buzz agent boots with that other agent's identity, rules, and memory injected into its context** — ahead of, and in conflict with, the persona the owner defined in Buzz Desktop. There is currently no isolation setting.

# Environment

- Buzz Desktop 0.5.0, macOS 26.5.2 (arm64)
- `@agentclientprotocol/claude-agent-acp` 0.63.0 (latest), bundled in `node-tools`
- Claude Code CLI installed and configured by the owner for personal terminal use

# Root cause

Two doors, both open:

1. **Adapter default.** `claude-agent-acp` hardcodes `settingSources: ["user", "project", "local"]` when building SDK options ([src/acp-agent.ts, current main](https://github.com/agentclientprotocol/claude-agent-acp/blob/main/src/acp-agent.ts) — search `settingSources`). The `"user"` source pulls in the owner's global `~/.claude` config. That default makes sense for the adapter's original IDE use case (the user's editor acting as the user), but not for Buzz's managed, persona-scoped agents. The adapter already spreads `...userProvidedOptions` **after** this default, so an ACP client can override `settingSources` per session via `_meta.claudeCode.options` — Buzz never passes it (no hits for `settingSources` in this repo).

2. **Nest location.** The agent workspace (`~/.buzz`) lives inside the owner's home directory, and Claude Code treats `/.claude/CLAUDE.md` as project memory for that ancestor. `$HOME/.claude/CLAUDE.md` is therefore picked up through the **project** source too, so merely dropping `"user"` is not sufficient. The auto-memory directory similarly resolves to the `$HOME` project and is **not gated by setting sources at all**.

# Reproduction

1. Put any distinctive content in `~/.claude/CLAUDE.md` (e.g. `# I am a different agent named X`).
2. Create a managed Claude agent in Buzz Desktop with its own system prompt.
3. Ask the agent whether its context contains that heading — it does.

One-shot probes against the CLI reproduce it without Buzz:

```console
$ cd ~/.buzz && claude --setting-sources user,project,local -p \
"If your context includes any CLAUDE.md contents, quote its first heading; else NONE"
# → quotes the heading of ~/.claude/CLAUDE.md

$ cd ~/.buzz && claude --setting-sources project,local -p ...
# → STILL quotes it (ancestor project-memory door)

$ cd /tmp && claude --setting-sources project,local -p ...
# → NONE (confirms the ancestor walk is the second door)
```

# Verified fix (tested locally)

Two layers, both verified on the versions above:

**A. Environment variables in the managed-agent spawn env** — works with the adapter's current defaults, no adapter change needed:

```
CLAUDE_CODE_DISABLE_CLAUDE_MDS=1 # stops global + ancestor CLAUDE.md injection
CLAUDE_CODE_DISABLE_AUTO_MEMORY=1 # stops ~/.claude/projects//memory injection
```

With both set, the same probes return `NONE` / no memory even with `--setting-sources user,project,local`.

**B. Full isolation** — additionally pass `settingSources: ["local"]` via `_meta.claudeCode.options` in `session/new` (the adapter already honors it). This also stops the owner's user-scope **hooks** and **MCP servers** from loading into managed agents, which the env vars alone do not. Verified by patching the bundled adapter's options locally: agent context is fully clean, auth (Keychain) and everything else keeps working.

# Suggested behavior

- Managed agents should default to **not** inheriting the desktop owner's personal Claude Code config (persona conflicts, prompt bloat, and the owner's personal instructions/memory leaking into agents that other channel members may interact with).
- If inheritance is ever desirable, make it an explicit per-agent opt-in toggle.

Happy to test a build — this machine reproduces it deterministically.

The issue names src/acp-agent.ts in the claude-agent-acp adapter and the session/new _meta.claudeCode.options entry point; start by tracing how managed-agent spawn environments and these options are passed from Buzz. Verify that managed agents exclude global and ancestor CLAUDE.md files, auto-memory, hooks, and MCP servers while authentication still works.

Written by the indexing model from the issue text.