fix(externagent): run claude and codex against their own homes, never copy their tokens

README.md

@@ -370,7 +370,10 @@ the [security policy](SECURITY.md).
 - `--model claude` or `--model codex` lets another coding agent drive the run. Its own
   tools are denied, and it can call only the tools Flynn bridges to it, so every action
   is still checked and recorded. This works on Linux, macOS and WSL2. Native Windows
-  refuses it, since Flynn cannot yet gate the child's network there.
+  refuses it, since Flynn cannot yet gate the child's network there. Flynn runs `claude`
+  and `codex` against homes of their own, kept in Flynn's data directory and separate from
+  yours. The first run prints the command that signs the CLI in with its own login;
+  Flynn never reads or copies the credential.
 
 ```sh
 flynn --model claude                            # interactive session through the CLI

cmd/flynn/claudehome_test.go

@@ -0,0 +1,24 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestMain points the claude and codex backends' homes at temporary directories for the
+// whole package. Building either spawner creates its home, and without this every test that
+// assembles one would create it under the real user's data directory.
+func TestMain(m *testing.M) {
+	dir, err := os.MkdirTemp("", "flynn-agent-homes-")
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	claudeHome = func() string { return filepath.Join(dir, "claude") }
+	codexHome = func() string { return filepath.Join(dir, "codex") }
+	code := m.Run()
+	_ = os.RemoveAll(dir)
+	os.Exit(code)
+}