Provider-home env vars are neutralized to "" instead of unset, so the Claude CLI falls back to cwd and writes session state into the agent worktree

[mrthankyou]

Summary

workflowControlChildEnvironment neutralizes BUILT_IN_PROVIDER_HOME_ENVIRONMENT_VARIABLES (including CLAUDE_CONFIG_DIR) by assigning the empty string:

const child: Record<string, string> = Object.fromEntries(
  [
    ...CONTROLLER_ONLY_ENVIRONMENT_VARIABLES,
    ...BUILT_IN_PROVIDER_HOME_ENVIRONMENT_VARIABLES,
    ...providerCredentialEnvironmentVariables(source)
  ].map((name) => [name, ""])
);

An empty value is not equivalent to an unset variable. Claude Code treats an empty CLAUDE_CONFIG_DIR as absent and falls back to the current working directory for its config dir, rather than to ~/.claude.

Impact

When an agent runs without a forwarded config directory, the CLI writes its session state into the agent's own git worktree:

projects/<munged-cwd>/<session-id>.jsonl
projects/<munged-cwd>/<session-id>/tool-results/<id>.txt

Those files become part of the workspace patch. They are agent session transcripts, so this also means conversation state is written into a tree that is diffed, snapshotted, and handed to downstream nodes.

Combined with the 128-character WORKSPACE_PATCH_SEGMENT cap (filed separately), <munged-cwd> is the absolute worktree path with separators replaced, so the run fails non-deterministically depending on path length:

✗ verify:setup-foundry (attempt 1): workspace patch file path contains an unsafe path segment
✗ Run failed: Task failed: verify:setup-foundry

Two runs of the same project, differing only in the length of the run id, produced a 123-character segment (passed) and a 130-character segment (failed).

Suggested direction

Neutralizing by assignment is the right intent, but for variables whose absence is meaningful the child environment should omit the key rather than set it to "". Worth auditing the other entries in BUILT_IN_PROVIDER_HOME_ENVIRONMENT_VARIABLES (CODEX_HOME, KIMI_CODE_HOME, KIMI_SHARE_DIR) for the same CLI-dependent behavior.

I have not attempted a fix: this is the credential/environment isolation boundary and I could not validate a change to it across all providers.

Notes

• Reproduced on darwin/arm64 with ClaudeAgent + auth = "subscription".
• Not macOS-specific in principle — the empty-vs-unset distinction applies anywhere.
• Encountered while making the config directory conditional; the correct resolution there was operational (register the config dir once via CLAUDE_CONFIG_DIR=<dir> claude + /login, since Claude Code scopes the subscription credential per config directory). But the empty-string neutralization remains a latent trap for any code path that legitimately omits a provider home.

🤖 Generated with Claude Code

[mrthankyou]

Closing: not reachable on main (checked at 38715053).

The "" neutralization is still there (environment.tsx:92), but no shipped adapter ever hands the CLI an empty provider home:

• Claude: resolveProviderHome("claude", ...) always returns an absolute directory (configured config_dir, else $CLAUDE_CONFIG_DIR, else ~/.claude). Smithers sets CLAUDE_CONFIG_DIR from configDir on the command env (ClaudeCodeAgent.js:781), and CompatibleClaudeCodeAgent.buildCommand passes that as additions, which override the blanked value.
• DeepSeek, Codex, OpenRouter: also always forward a resolved home (CODEX_HOME / configDir). Kimi takes an explicit configDir. Pi and OpenCode don't read these variables.

The repro came from a local change that made Claude's configDir conditional (to work around macOS Keychain subscription auth). That change was reverted and never landed. It was prompted by a stale comment claiming the config dir was "only forwarded when configured"; #1158 corrects that comment.

If a provider home ever becomes optional again, note that the suggested fix (omit the key) would be wrong: Smithers builds the child env as { ...process.env, ...agentEnv } when inheritEnv is on (the default), so an omitted key lets the controller's own CLAUDE_CONFIG_DIR leak through. The correct fix is to set the value to undefined, which Node's spawn drops, so the variable is truly unset. That touches the credential-isolation boundary for every adapter and should come with per-adapter tests.

The 128-character segment cap that turned this into a hard failure is tracked separately in #987.