---
name: v0257-internal-session-isolation
description: "2026-07-22 SHIPPED + FIELD-VERIFIED v0.25.7 — psyche/echo-commune sessions now run --safe-mode (probe-gated, disableAllHooks fallback): user hooks/plugins/CLAUDE.md no longer load inside adapter-spawned internal sessions. Verified via disposable endpoint, 0 vs 352 contamination."
metadata: 
  node_type: memory
  type: project
  originSessionId: 66f829b9-b55e-4e0b-89f4-1053391a6d32
  modified: 2026-07-22T04:42:30.025Z
---

v0.25.7 (2026-07-22, `fece541`, verify record `5b247e9`): **internal-session foreign-config
isolation** (`REQ-HAZARD-PSYCHE-FOREIGN-CONFIG`, KNOWN-HAZARDS 2.11). Operator report: user
hooks/plugins fired inside psyche + echo-commune sessions (they inherit the user's config root;
recursion guard silences only OUR hook). Observed: the caveman persona hook had injected into **352**
entries of my own psyche transcript — actively corrupting commune summarization.

**Fix shape:** shared `isolation.rs`; both shims append `--safe-mode` (kills hooks ALL sources incl.
plugin hooks, plugins, skills, CLAUDE.md, MCP, auto-memory; KEEPS auth — the property that rules out
`--bare` (drops OAuth) and clean `CLAUDE_CONFIG_DIR` (strands Windows creds, re-opens
[[headless-spawn-external-imports-gate]])). Probe `claude --safe-mode --version` exit 0 gates it;
older binary degrades to `--settings '{"disableAllHooks":true}'`; failed probe degrades, never
blocks. sptc deliberately NOT re-enabled inside (recursion guard already no-ops it). Base + `:ccs`
covered by construction (isolation = argv the SHIM appends; ccs overlays only session.self/resume) —
pinned by a leaf-keyed predicate test over ALL profiles: every internal-session `command` leaf must
route through the shim ([[list-vs-predicate-assertions]] applied).

**Field verify (2026-07-22, done + purged):** disposable `perri-isotest` on `claude-spt:ccs`;
psyche full life (adopt + 2 resumes, 7 assistant msgs, model pin held) = **0 hook entries / 0
CAVEMAN** vs pre-fix control 352/358 on same node; outer operator-class session kept its 28 hook
firings (no leak into user-owned sessions); turns completed ⇒ OAuth survives `--safe-mode`.
Endpoint purged (`spt endpoint purge --yes`) + psyche/session transcripts + commune file removed.

**Verify recipe that worked (reusable):** `spt endpoint run --adapter claude-spt:ccs --id <test-id>
--create --start --subnet SPT_DEV` → message it an exact 2-step instruction → inner transcripts live
under ccs projects root at slug `C--...-owlery-<id>-nested-<id>-psyche` → `spt endpoint shutdown
<id>` fires final save → `purge --yes`. Outer session transcript: find by `custom-title` first line.