@love-moon/ai-sdk 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @love-moon/ai-sdk
 
+## 0.11.0
+
+### Minor Changes
+
+- 30afccc: Make the claude backend usable when conductor runs as root.
+
+  Claude Code refuses `bypassPermissions` / `--dangerously-skip-permissions` under
+  root unless `IS_SANDBOX=1` or `CLAUDE_CODE_BUBBLEWRAP` is set, so every claude
+  turn died immediately on root installs (docker, CI, bare VPS). Both routes a
+  claude command takes are now root-aware, sharing one check
+  (`isClaudeRootPermissionRestricted`, which mirrors claude's own gate):
+
+  - The agent-SDK session downgrades the permission mode to `acceptEdits` (auto
+    mode) and stops passing `allowDangerouslySkipPermissions`.
+  - The daemon's tool-preset PTY path rewrites the configured `allow_cli_list`
+    command via `resolveClaudeCommandForRoot`, using the same env the spawned
+    child receives, so a per-task `IS_SANDBOX=1` opt-out is honored.
+  - `conductor config` no longer writes `--dangerously-skip-permissions` into a
+    config generated on a root machine.
+
+  The mode is also configurable now: `claude --permission-mode acceptEdits` in
+  `allow_cli_list` is lifted out of the command string. An unrecognized mode still
+  falls back to the default instead of failing, but logs a warning at session boot.
+
+  ai-sdk gains three exports: `isClaudeRootPermissionRestricted`,
+  `resolveClaudeCommandForRoot`, `resolveClaudePermissionPolicy`.
+
 ## 0.10.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { BUILT_IN_BACKENDS } from "./built-in-backends.js";
 export { PROVIDER_MEDIA_CAPABILITIES } from "./media-adapters.js";
 export { createAiSession, RemoteAiSession } from "./client.js";
+export { isClaudeRootPermissionRestricted, resolveClaudeCommandForRoot, resolveClaudePermissionPolicy } from "./providers/claude-agent-sdk-session.js";
 export { appendContextFilesToPrompt, normalizeContextFiles } from "./context-files.js";
 export { assertMediaCapabilities, fileMediaToBase64, fileMediaToDataUri, normalizeMediaInputs, resolveTurnMedia } from "./media-input.js";
 export { GOAL_STATUSES, TERMINAL_GOAL_STATUSES, isGoalStatus, isTerminalGoalStatus } from "./shared.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 export { createAiSession, RemoteAiSession } from "./client.js";
 export { BUILT_IN_BACKENDS } from "./built-in-backends.js";
 export { PROVIDER_MEDIA_CAPABILITIES } from "./media-adapters.js";
+export { isClaudeRootPermissionRestricted, resolveClaudeCommandForRoot, resolveClaudePermissionPolicy, } from "./providers/claude-agent-sdk-session.js";
 export { appendContextFilesToPrompt, normalizeContextFiles } from "./context-files.js";
 export { assertMediaCapabilities, fileMediaToBase64, fileMediaToDataUri, normalizeMediaInputs, resolveTurnMedia, } from "./media-input.js";
 export { GOAL_STATUSES, TERMINAL_GOAL_STATUSES, isGoalStatus, isTerminalGoalStatus, } from "./shared.js";

package/dist/providers/claude-agent-sdk-session.d.ts

@@ -1,3 +1,11 @@
+export function isClaudeRootPermissionRestricted(env?: NodeJS.ProcessEnv): boolean;
+export function resolveClaudePermissionPolicy(options?: {}, env?: NodeJS.ProcessEnv): {
+    permissionMode: string;
+    allowDangerouslySkipPermissions: boolean;
+    downgradedFrom: string;
+    invalidMode: any;
+};
+export function resolveClaudeCommandForRoot(commandLine: any, env?: NodeJS.ProcessEnv): string;
 export class ClaudeAgentSdkSession extends EventEmitter<[never]> {
     static capabilities: Readonly<{
         goal: true;
@@ -49,6 +57,12 @@ export class ClaudeAgentSdkSession extends EventEmitter<[never]> {
     turnDeadlineMs: any;
     sdkModulePromise: Promise<any> | Promise<typeof import("@anthropic-ai/claude-agent-sdk")> | null;
     env: any;
+    permissionPolicy: {
+        permissionMode: string;
+        allowDangerouslySkipPermissions: boolean;
+        downgradedFrom: string;
+        invalidMode: any;
+    };
     writeLog(message: any): void;
     trace(message: any): void;
     get threadId(): any;
@@ -131,7 +145,7 @@ export class ClaudeAgentSdkSession extends EventEmitter<[never]> {
         abortController: any;
         cwd: any;
         env: any;
-        permissionMode: "default" | "plan" | "acceptEdits" | "bypassPermissions" | "dontAsk";
+        permissionMode: string;
         settingSources: string[];
         persistSession: boolean;
     };

package/dist/providers/claude-agent-sdk-session.js

@@ -8,6 +8,10 @@ const DEFAULT_TURN_DEADLINE_MS = 12 * 60 * 1000;
 const MIN_TURN_DEADLINE_MS = 30 * 1000;
 const MAX_TURN_DEADLINE_MS = 30 * 60 * 1000;
 const DEFAULT_SETTING_SOURCES = ["user", "project", "local"];
+const PERMISSION_MODES = new Set(["default", "acceptEdits", "bypassPermissions", "plan", "dontAsk"]);
+const DEFAULT_PERMISSION_MODE = "bypassPermissions";
+// Auto ("accept edits") mode: the strongest mode claude allows as root.
+const ROOT_PERMISSION_MODE = "acceptEdits";
 function waitForever() {
     return new Promise(() => { });
 }
@@ -50,16 +54,83 @@ function normalizeSettingSources(value) {
 }
 function normalizePermissionMode(value) {
     const normalized = typeof value === "string" ? value.trim() : "";
-    switch (normalized) {
-        case "default":
-        case "acceptEdits":
-        case "bypassPermissions":
-        case "plan":
-        case "dontAsk":
-            return normalized;
-        default:
-            return "bypassPermissions";
+    return PERMISSION_MODES.has(normalized) ? normalized : DEFAULT_PERMISSION_MODE;
+}
+// Mirrors claude's own root gate byte for byte:
+//
+//   permissionMode === "bypassPermissions" || dangerouslySkipPermissions
+//     ? getuid() === 0 && process.env.IS_SANDBOX !== "1" && !CLAUDE_CODE_BUBBLEWRAP
+//       -> "--dangerously-skip-permissions cannot be used with root/sudo
+//           privileges for security reasons" + exit(1)
+//
+// Two different env idioms in that one line, and both are load-bearing:
+// IS_SANDBOX is a *strict* `=== "1"` compare, while CLAUDE_CODE_BUBBLEWRAP goes
+// through claude's loose truthy parser (`1|true|yes|on`, trimmed+lowercased).
+// Do not "helpfully" accept IS_SANDBOX=true here — being more permissive than
+// the gate keeps bypassPermissions and just moves the failure into claude,
+// which is the exact bug we are fixing.
+export function isClaudeRootPermissionRestricted(env = process.env) {
+    if (typeof process.getuid !== "function" || process.getuid() !== 0) {
+        return false;
+    }
+    if (env?.IS_SANDBOX === "1") {
+        return false;
+    }
+    const bubblewrap = String(env?.CLAUDE_CODE_BUBBLEWRAP ?? "").trim().toLowerCase();
+    return !["1", "true", "yes", "on"].includes(bubblewrap);
+}
+// Root installs (docker, CI, bare VPS) would otherwise fail every turn, so fall
+// back to the closest usable mode instead of dying.
+export function resolveClaudePermissionPolicy(options = {}, env = process.env) {
+    const requested = normalizePermissionMode(options.permissionMode);
+    // A configured value we don't recognize still falls back to the default (a
+    // typo must never take the session down), but the caller reports it so the
+    // user finds out their config line is doing nothing.
+    const rawMode = typeof options.permissionMode === "string" ? options.permissionMode.trim() : "";
+    const invalidMode = rawMode && !PERMISSION_MODES.has(rawMode) ? rawMode : "";
+    if (!isClaudeRootPermissionRestricted(env)) {
+        return {
+            permissionMode: requested,
+            allowDangerouslySkipPermissions: requested === DEFAULT_PERMISSION_MODE || options.allowDangerouslySkipPermissions === true,
+            downgradedFrom: "",
+            invalidMode,
+        };
+    }
+    const permissionMode = requested === DEFAULT_PERMISSION_MODE ? ROOT_PERMISSION_MODE : requested;
+    return {
+        permissionMode,
+        allowDangerouslySkipPermissions: false,
+        downgradedFrom: permissionMode === requested ? "" : requested,
+        invalidMode,
+    };
+}
+// The PTY / tool-preset path in the daemon hands a configured allow_cli_list
+// command straight to a shell, so it never reaches the session class above and
+// never sees resolveClaudePermissionPolicy. Rewrite the command string there
+// too, or a root box keeps failing in terminal tasks after the SDK path is fixed.
+export function resolveClaudeCommandForRoot(commandLine, env = process.env) {
+    const command = typeof commandLine === "string" ? commandLine : "";
+    if (!command.trim() || !isClaudeRootPermissionRestricted(env)) {
+        return command;
+    }
+    // Also drop a valueless `--permission-mode` (end of string, or immediately
+    // followed by another flag). Without this the append branch below would emit
+    // `--permission-mode --permission-mode acceptEdits`, and claude reads the
+    // flag name as the mode and `acceptEdits` as a positional prompt.
+    const stripped = command
+        .replace(/\s*--dangerously-skip-permissions(?=\s|$)/g, "")
+        .replace(/\s*--permission-mode=(?=\s|$)/g, "")
+        .replace(/\s*--permission-mode(?=\s+-|\s*$)/g, "")
+        .trim();
+    const configuredMode = extractLongFlagFromCommandLine(stripped, "permission-mode");
+    if (!configuredMode) {
+        return `${stripped} --permission-mode ${ROOT_PERMISSION_MODE}`;
+    }
+    if (configuredMode === DEFAULT_PERMISSION_MODE) {
+        return stripped.replace(/(--permission-mode[=\s]+)bypassPermissions(?=\s|$)/, `$1${ROOT_PERMISSION_MODE}`);
     }
+    // Any other configured mode is already root-safe; leave it verbatim.
+    return stripped;
 }
 function normalizeText(value) {
     return typeof value === "string" ? value : "";
@@ -163,6 +234,14 @@ export class ClaudeAgentSdkSession extends EventEmitter {
                 options = { ...options, effort: effortFromCommandLine };
             }
         }
+        // Same for `--permission-mode`, so `claude --permission-mode acceptEdits`
+        // in allow_cli_list picks the mode without new plumbing.
+        if (options.permissionMode === undefined && typeof options.commandLine === "string") {
+            const modeFromCommandLine = extractLongFlagFromCommandLine(options.commandLine, "permission-mode");
+            if (modeFromCommandLine) {
+                options = { ...options, permissionMode: modeFromCommandLine };
+            }
+        }
         this.options = options;
         this.logger = normalizeLogger(options.logger);
         this.cwd =
@@ -205,6 +284,18 @@ export class ClaudeAgentSdkSession extends EventEmitter {
         if (!this.env.CLAUDE_AGENT_SDK_CLIENT_APP) {
             this.env.CLAUDE_AGENT_SDK_CLIENT_APP = "conductor-ai-sdk/0.0.0";
         }
+        // Resolved once at boot (options and env are both fixed by now) so the
+        // config warning lands at session start instead of once per turn.
+        this.permissionPolicy = resolveClaudePermissionPolicy(this.options, { ...process.env, ...this.env });
+        if (this.permissionPolicy.invalidMode) {
+            this.trace(`WARN unknown permission mode ${JSON.stringify(this.permissionPolicy.invalidMode)} in config; `
+                + `using ${this.permissionPolicy.permissionMode} instead `
+                + `(valid: ${[...PERMISSION_MODES].join(", ")})`);
+        }
+        if (this.permissionPolicy.downgradedFrom) {
+            this.trace(`permission mode ${this.permissionPolicy.downgradedFrom} -> ${this.permissionPolicy.permissionMode} `
+                + `(claude rejects ${this.permissionPolicy.downgradedFrom} as root; set IS_SANDBOX=1 to keep it)`);
+        }
     }
     writeLog(message) {
         emitLog(this.logger, message);
@@ -537,7 +628,7 @@ export class ClaudeAgentSdkSession extends EventEmitter {
         });
     }
     buildSdkOptions(abortController) {
-        const permissionMode = normalizePermissionMode(this.options.permissionMode);
+        const { permissionMode } = this.permissionPolicy;
         const options = {
             abortController,
             cwd: this.cwd,
@@ -549,7 +640,7 @@ export class ClaudeAgentSdkSession extends EventEmitter {
             settingSources: normalizeSettingSources(this.options.settingSources),
             persistSession: this.options.persistSession !== false,
         };
-        if (permissionMode === "bypassPermissions" || this.options.allowDangerouslySkipPermissions === true) {
+        if (this.permissionPolicy.allowDangerouslySkipPermissions) {
             options.allowDangerouslySkipPermissions = true;
         }
         if (this.sessionId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@love-moon/ai-sdk",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lovemoon-ai/conductor.git"
@@ -53,12 +53,12 @@
     "zod": "^4.1.5"
   },
   "optionalDependencies": {
-    "@love-moon/chat-web": "^0.10.0"
+    "@love-moon/chat-web": "^0.11.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",
     "tsx": "^4.20.6",
     "typescript": "^5.6.3"
   },
-  "gitCommitId": "bc7b3a5"
+  "gitCommitId": "7d57852"
 }