[nicknisi]

What

The installer's Claude agent now loads none of the user's Claude Code configuration.

• settingSources: []: no ~/.claude, project, or local settings.
• strictMcpConfig: true: no MCP server loads unless the installer passes it (it passes none). This guards against the SDK changing its defaults again.

Why

The installer never set settingSources. Up to Agent SDK 0.2.87, omitting it meant isolation. Since 0.2.89 (2026-03-31), it loads every source, including ~/.claude. As a result, the installer agent got the user's plugins, MCP servers, hooks, CLAUDE.md memory, and permission rules.

• The installer's restrictions could be bypassed. Permission allow rules apply before installerCanUseTool, so a user rule such as Bash(curl:*) got past the installer's Bash restrictions.
• User data reached the agent. The agent could read the user's MCP servers and memory. In local evals it called a personal session-history MCP server.

Exposure:

• npm installs: from about 2026-03-31. The CLI was published unbundled with ~0.2.x, so fresh installs resolved SDK ≥ 0.2.89.
• Our own lockfile: from v0.18.0.
• All users: from v0.20.0. The standalone binary bundles SDK 0.3.211.

Verification

The SDK's startup message, with the same options as the installer and a real ~/.claude setup:

	Before (omitted)	After
MCP servers	5 (user's)	0
Plugins	18 (user's + built-in)	workos + Claude Code's 4 built-ins
Skills/commands	134	WorkOS skills + Claude Code defaults

• The WorkOS skills plugin still loads (workos:workos, workos:workos-widgets).
• A new test pins both options.
• bun run test passes (3,477), and typecheck, lint, format, and build are clean.

#266 contains the same settingSources change and will be rebased onto this.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

The installer now passes settingSources: [] and strictMcpConfig: true when starting its Claude agent.

• The installer agent runs without user settings or implicit MCP servers.

_{Reviews (1) · Last reviewed commit: "fix(installer): stop loading user Claude..." · Reviewed by Greptile}