[mstomar125]

Closes #3605

Summary

SettingsServiceImpl::with_default_path built $HOME/.nodespace/daemon.toml, so an isolated daemon (NODESPACE_HOME set) still read and wrote the user's real settings file, including API keys and cached routing-probe verdicts. It now resolves through the existing crate::nodespace_dir(), the same resolver every other daemon.toml consumer in the daemon already uses (local agent, capture, assembly). No second resolver.

Callers checked

• Eval scripts: none read or depend on the real daemon.toml; evals use local models. No opt-in env var added (none exists for settings, and nothing needs one). scripts/eval/preflight.ts isolation message now says daemon.toml follows NODESPACE_HOME too.
• run-app skill: documents that an isolated daemon has no API keys and how to supply a throwaway daemon.toml under the isolated home.
• CLI: nodespace mcp (packages/cli/src/commands/mcp.rs) also read $HOME; now uses nodespace_daemon::nodespace_dir() too, so it cannot flip the real user's [mcp] flag under NODESPACE_HOME.

Tests

Two tests with HOME at a temp home holding a settings file with an API key and NODESPACE_HOME at another dir: the isolated service never sees or rewrites the real file, and uses the file under NODESPACE_HOME. Both fail when with_default_path is reverted to $HOME. Daemon nextest (excluding golden/live/scenario6): 488 passed; clippy, fmt, bun test scripts/eval, pro-boundary check clean.

Documentation

Updates the state-path list in architecture/daemon-cli-protocol.md: https://github.com/NodeSpaceAI/nodespace-docs/pull/104

🤖 Generated with Claude Code

[mstomar125]

Review round 1 (pragmatic-code-reviewer, medium)

Verdict: approve, no critical issues. Improvements raised: (1) CLI mcp still resolves daemon.toml from $HOME, so under NODESPACE_HOME it would mutate the real file and its doc comment was stale; (2) env-mutation test helper not panic-safe; nits on stale ~/.nodespace/daemon.toml comments.

Address-review

• (1) Fixed: daemon_config_path in packages/cli/src/commands/mcp.rs now uses nodespace_daemon::nodespace_dir(); doc comment corrected. CLI mcp integration tests now env_remove("NODESPACE_HOME") so an ambient value can't redirect them. Removed the 'out of scope' note.
• (2) Fixed: EnvRestore Drop guard. No existing repo helper to reuse (grepped serial_test/env guards).
• Nits: stale default-case comments (~/.nodespace/daemon.toml in lib.rs, local_agent_service.rs, frontend files) left as accurate default descriptions; error string kept.
  Verification: fmt, clippy (daemon+cli, -D warnings -D clippy::unused-async), nextest daemon+cli 768 passed with NODESPACE_HOME set, cli 281 passed without it.

[mstomar125]

Review round 2 (pragmatic-code-reviewer, medium)

Verdict: approve. Code change correct (CLI resolver, test env isolation, EnvRestore guard). One blocker: a stray mcp_integration.rs-E sed backup was committed.

Address-review

Removed in a follow-up commit (no other changes). Follow-up noted, not blocking: uninstall.rs/logs.rs in the CLI still read $HOME directly; separate from daemon.toml, can be a new issue. No further re-review needed.