@love-moon/ai-sdk 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @love-moon/ai-sdk
 
+## 0.11.0
+
+### Minor Changes
+
+- 30afccc: Make the claude backend usable when conductor runs as root.
+
+  Claude Code refuses `bypassPermissions` / `--dangerously-skip-permissions` under
+  root unless `IS_SANDBOX=1` or `CLAUDE_CODE_BUBBLEWRAP` is set, so every claude
+  turn died immediately on root installs (docker, CI, bare VPS). Both routes a
+  claude command takes are now root-aware, sharing one check
+  (`isClaudeRootPermissionRestricted`, which mirrors claude's own gate):
+
+  - The agent-SDK session downgrades the permission mode to `acceptEdits` (auto
+    mode) and stops passing `allowDangerouslySkipPermissions`.
+  - The daemon's tool-preset PTY path rewrites the configured `allow_cli_list`
+    command via `resolveClaudeCommandForRoot`, using the same env the spawned
+    child receives, so a per-task `IS_SANDBOX=1` opt-out is honored.
+  - `conductor config` no longer writes `--dangerously-skip-permissions` into a
+    config generated on a root machine.
+
+  The mode is also configurable now: `claude --permission-mode acceptEdits` in
+  `allow_cli_list` is lifted out of the command string. An unrecognized mode still
+  falls back to the default instead of failing, but logs a warning at session boot.
+
+  ai-sdk gains three exports: `isClaudeRootPermissionRestricted`,
+  `resolveClaudeCommandForRoot`, `resolveClaudePermissionPolicy`.
+
+## 0.10.0
+
+### Minor Changes
+
+- 43c4f87: Add the `codex-app-server-session` provider, recover Codex oversized threads by
+  rolling onto a fresh provider thread with bounded recent history (one retry per
+  turn), and trim the dsh quota raw payload.
+
 ## 0.9.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { BUILT_IN_BACKENDS } from "./built-in-backends.js";
 export { PROVIDER_MEDIA_CAPABILITIES } from "./media-adapters.js";
 export { createAiSession, RemoteAiSession } from "./client.js";
+export { isClaudeRootPermissionRestricted, resolveClaudeCommandForRoot, resolveClaudePermissionPolicy } from "./providers/claude-agent-sdk-session.js";
 export { appendContextFilesToPrompt, normalizeContextFiles } from "./context-files.js";
 export { assertMediaCapabilities, fileMediaToBase64, fileMediaToDataUri, normalizeMediaInputs, resolveTurnMedia } from "./media-input.js";
 export { GOAL_STATUSES, TERMINAL_GOAL_STATUSES, isGoalStatus, isTerminalGoalStatus } from "./shared.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 export { createAiSession, RemoteAiSession } from "./client.js";
 export { BUILT_IN_BACKENDS } from "./built-in-backends.js";
 export { PROVIDER_MEDIA_CAPABILITIES } from "./media-adapters.js";
+export { isClaudeRootPermissionRestricted, resolveClaudeCommandForRoot, resolveClaudePermissionPolicy, } from "./providers/claude-agent-sdk-session.js";
 export { appendContextFilesToPrompt, normalizeContextFiles } from "./context-files.js";
 export { assertMediaCapabilities, fileMediaToBase64, fileMediaToDataUri, normalizeMediaInputs, resolveTurnMedia, } from "./media-input.js";
 export { GOAL_STATUSES, TERMINAL_GOAL_STATUSES, isGoalStatus, isTerminalGoalStatus, } from "./shared.js";

package/dist/manager/quota/dsh.js

@@ -110,6 +110,10 @@ export async function getDshQuota(options = {}) {
         }
         const payload = (await res.json());
         const { isAvailable, balances } = parseDshBalance(payload);
+        // No `raw` field: unlike the window-based providers whose parsing is
+        // lossy, `balances`/`isAvailable` already capture the whole balance
+        // response, so keeping the raw payload would only bloat the cache and the
+        // worker/WebSocket hop to the web client.
         const quota = {
             tool: "dsh",
             isAvailable,
@@ -117,7 +121,6 @@ export async function getDshQuota(options = {}) {
             balances,
             fetchedAt: Math.floor(Date.now() / 1000),
             source: "fresh",
-            raw: payload,
         };
         const entry = await writeCache(file, quota);
         return { ...quota, fetchedAt: entry.fetchedAt };

package/dist/manager/types.d.ts

@@ -128,7 +128,6 @@ export interface DshQuota {
     balances: DshBalanceInfo[];
     fetchedAt: number;
     source: QuotaSource;
-    raw?: Record<string, unknown>;
     error?: string;
 }
 export interface ExternalQuota {

package/dist/providers/claude-agent-sdk-session.d.ts

@@ -1,3 +1,11 @@
+export function isClaudeRootPermissionRestricted(env?: NodeJS.ProcessEnv): boolean;
+export function resolveClaudePermissionPolicy(options?: {}, env?: NodeJS.ProcessEnv): {
+    permissionMode: string;
+    allowDangerouslySkipPermissions: boolean;
+    downgradedFrom: string;
+    invalidMode: any;
+};
+export function resolveClaudeCommandForRoot(commandLine: any, env?: NodeJS.ProcessEnv): string;
 export class ClaudeAgentSdkSession extends EventEmitter<[never]> {
     static capabilities: Readonly<{
         goal: true;
@@ -49,6 +57,12 @@ export class ClaudeAgentSdkSession extends EventEmitter<[never]> {
     turnDeadlineMs: any;
     sdkModulePromise: Promise<any> | Promise<typeof import("@anthropic-ai/claude-agent-sdk")> | null;
     env: any;
+    permissionPolicy: {
+        permissionMode: string;
+        allowDangerouslySkipPermissions: boolean;
+        downgradedFrom: string;
+        invalidMode: any;
+    };
     writeLog(message: any): void;
     trace(message: any): void;
     get threadId(): any;
@@ -131,7 +145,7 @@ export class ClaudeAgentSdkSession extends EventEmitter<[never]> {
         abortController: any;
         cwd: any;
         env: any;
-        permissionMode: "default" | "plan" | "acceptEdits" | "bypassPermissions" | "dontAsk";
+        permissionMode: string;
         settingSources: string[];
         persistSession: boolean;
     };

package/dist/providers/claude-agent-sdk-session.js

@@ -8,6 +8,10 @@ const DEFAULT_TURN_DEADLINE_MS = 12 * 60 * 1000;
 const MIN_TURN_DEADLINE_MS = 30 * 1000;
 const MAX_TURN_DEADLINE_MS = 30 * 60 * 1000;
 const DEFAULT_SETTING_SOURCES = ["user", "project", "local"];
+const PERMISSION_MODES = new Set(["default", "acceptEdits", "bypassPermissions", "plan", "dontAsk"]);
+const DEFAULT_PERMISSION_MODE = "bypassPermissions";
+// Auto ("accept edits") mode: the strongest mode claude allows as root.
+const ROOT_PERMISSION_MODE = "acceptEdits";
 function waitForever() {
     return new Promise(() => { });
 }
@@ -50,16 +54,83 @@ function normalizeSettingSources(value) {
 }
 function normalizePermissionMode(value) {
     const normalized = typeof value === "string" ? value.trim() : "";
-    switch (normalized) {
-        case "default":
-        case "acceptEdits":
-        case "bypassPermissions":
-        case "plan":
-        case "dontAsk":
-            return normalized;
-        default:
-            return "bypassPermissions";
+    return PERMISSION_MODES.has(normalized) ? normalized : DEFAULT_PERMISSION_MODE;
+}
+// Mirrors claude's own root gate byte for byte:
+//
+//   permissionMode === "bypassPermissions" || dangerouslySkipPermissions
+//     ? getuid() === 0 && process.env.IS_SANDBOX !== "1" && !CLAUDE_CODE_BUBBLEWRAP
+//       -> "--dangerously-skip-permissions cannot be used with root/sudo
+//           privileges for security reasons" + exit(1)
+//
+// Two different env idioms in that one line, and both are load-bearing:
+// IS_SANDBOX is a *strict* `=== "1"` compare, while CLAUDE_CODE_BUBBLEWRAP goes
+// through claude's loose truthy parser (`1|true|yes|on`, trimmed+lowercased).
+// Do not "helpfully" accept IS_SANDBOX=true here — being more permissive than
+// the gate keeps bypassPermissions and just moves the failure into claude,
+// which is the exact bug we are fixing.
+export function isClaudeRootPermissionRestricted(env = process.env) {
+    if (typeof process.getuid !== "function" || process.getuid() !== 0) {
+        return false;
+    }
+    if (env?.IS_SANDBOX === "1") {
+        return false;
+    }
+    const bubblewrap = String(env?.CLAUDE_CODE_BUBBLEWRAP ?? "").trim().toLowerCase();
+    return !["1", "true", "yes", "on"].includes(bubblewrap);
+}
+// Root installs (docker, CI, bare VPS) would otherwise fail every turn, so fall
+// back to the closest usable mode instead of dying.
+export function resolveClaudePermissionPolicy(options = {}, env = process.env) {
+    const requested = normalizePermissionMode(options.permissionMode);
+    // A configured value we don't recognize still falls back to the default (a
+    // typo must never take the session down), but the caller reports it so the
+    // user finds out their config line is doing nothing.
+    const rawMode = typeof options.permissionMode === "string" ? options.permissionMode.trim() : "";
+    const invalidMode = rawMode && !PERMISSION_MODES.has(rawMode) ? rawMode : "";
+    if (!isClaudeRootPermissionRestricted(env)) {
+        return {
+            permissionMode: requested,
+            allowDangerouslySkipPermissions: requested === DEFAULT_PERMISSION_MODE || options.allowDangerouslySkipPermissions === true,
+            downgradedFrom: "",
+            invalidMode,
+        };
+    }
+    const permissionMode = requested === DEFAULT_PERMISSION_MODE ? ROOT_PERMISSION_MODE : requested;
+    return {
+        permissionMode,
+        allowDangerouslySkipPermissions: false,
+        downgradedFrom: permissionMode === requested ? "" : requested,
+        invalidMode,
+    };
+}
+// The PTY / tool-preset path in the daemon hands a configured allow_cli_list
+// command straight to a shell, so it never reaches the session class above and
+// never sees resolveClaudePermissionPolicy. Rewrite the command string there
+// too, or a root box keeps failing in terminal tasks after the SDK path is fixed.
+export function resolveClaudeCommandForRoot(commandLine, env = process.env) {
+    const command = typeof commandLine === "string" ? commandLine : "";
+    if (!command.trim() || !isClaudeRootPermissionRestricted(env)) {
+        return command;
+    }
+    // Also drop a valueless `--permission-mode` (end of string, or immediately
+    // followed by another flag). Without this the append branch below would emit
+    // `--permission-mode --permission-mode acceptEdits`, and claude reads the
+    // flag name as the mode and `acceptEdits` as a positional prompt.
+    const stripped = command
+        .replace(/\s*--dangerously-skip-permissions(?=\s|$)/g, "")
+        .replace(/\s*--permission-mode=(?=\s|$)/g, "")
+        .replace(/\s*--permission-mode(?=\s+-|\s*$)/g, "")
+        .trim();
+    const configuredMode = extractLongFlagFromCommandLine(stripped, "permission-mode");
+    if (!configuredMode) {
+        return `${stripped} --permission-mode ${ROOT_PERMISSION_MODE}`;
+    }
+    if (configuredMode === DEFAULT_PERMISSION_MODE) {
+        return stripped.replace(/(--permission-mode[=\s]+)bypassPermissions(?=\s|$)/, `$1${ROOT_PERMISSION_MODE}`);
     }
+    // Any other configured mode is already root-safe; leave it verbatim.
+    return stripped;
 }
 function normalizeText(value) {
     return typeof value === "string" ? value : "";
@@ -163,6 +234,14 @@ export class ClaudeAgentSdkSession extends EventEmitter {
                 options = { ...options, effort: effortFromCommandLine };
             }
         }
+        // Same for `--permission-mode`, so `claude --permission-mode acceptEdits`
+        // in allow_cli_list picks the mode without new plumbing.
+        if (options.permissionMode === undefined && typeof options.commandLine === "string") {
+            const modeFromCommandLine = extractLongFlagFromCommandLine(options.commandLine, "permission-mode");
+            if (modeFromCommandLine) {
+                options = { ...options, permissionMode: modeFromCommandLine };
+            }
+        }
         this.options = options;
         this.logger = normalizeLogger(options.logger);
         this.cwd =
@@ -205,6 +284,18 @@ export class ClaudeAgentSdkSession extends EventEmitter {
         if (!this.env.CLAUDE_AGENT_SDK_CLIENT_APP) {
             this.env.CLAUDE_AGENT_SDK_CLIENT_APP = "conductor-ai-sdk/0.0.0";
         }
+        // Resolved once at boot (options and env are both fixed by now) so the
+        // config warning lands at session start instead of once per turn.
+        this.permissionPolicy = resolveClaudePermissionPolicy(this.options, { ...process.env, ...this.env });
+        if (this.permissionPolicy.invalidMode) {
+            this.trace(`WARN unknown permission mode ${JSON.stringify(this.permissionPolicy.invalidMode)} in config; `
+                + `using ${this.permissionPolicy.permissionMode} instead `
+                + `(valid: ${[...PERMISSION_MODES].join(", ")})`);
+        }
+        if (this.permissionPolicy.downgradedFrom) {
+            this.trace(`permission mode ${this.permissionPolicy.downgradedFrom} -> ${this.permissionPolicy.permissionMode} `
+                + `(claude rejects ${this.permissionPolicy.downgradedFrom} as root; set IS_SANDBOX=1 to keep it)`);
+        }
     }
     writeLog(message) {
         emitLog(this.logger, message);
@@ -537,7 +628,7 @@ export class ClaudeAgentSdkSession extends EventEmitter {
         });
     }
     buildSdkOptions(abortController) {
-        const permissionMode = normalizePermissionMode(this.options.permissionMode);
+        const { permissionMode } = this.permissionPolicy;
         const options = {
             abortController,
             cwd: this.cwd,
@@ -549,7 +640,7 @@ export class ClaudeAgentSdkSession extends EventEmitter {
             settingSources: normalizeSettingSources(this.options.settingSources),
             persistSession: this.options.persistSession !== false,
         };
-        if (permissionMode === "bypassPermissions" || this.options.allowDangerouslySkipPermissions === true) {
+        if (this.permissionPolicy.allowDangerouslySkipPermissions) {
             options.allowDangerouslySkipPermissions = true;
         }
         if (this.sessionId) {

package/dist/providers/codex-app-server-session.d.ts

@@ -53,6 +53,7 @@ export class CodexAppServerSession extends EventEmitter<[never]> {
     } | null;
     bootPromise: Promise<void> | null;
     booted: boolean;
+    _contextRecoveryInFlight: boolean;
     goalMode: boolean;
     currentGoal: (import("../shared.js").GoalState & {
         raw?: unknown;
@@ -127,6 +128,22 @@ export class CodexAppServerSession extends EventEmitter<[never]> {
     }): void;
     applySessionConfigured(params: any): void;
     resolveContextUsagePercent(): number | undefined;
+    /**
+     * Whether a turn failure was caused by the provider thread outgrowing the
+     * model context window. Such failures are recoverable by rolling onto a fresh
+     * thread; ordinary failures (timeouts, closes, tool errors) are not.
+     *
+     * @param {any} error
+     * @returns {boolean}
+     */
+    isRecoverableContextOverflow(error: any): boolean;
+    /**
+     * Reset thread-bound state so the next {@link boot} starts a brand-new Codex
+     * thread, seeded with the most-recent {@link RECOVERY_HISTORY_LIMIT} history
+     * entries as a prompt preface. The oversized thread is abandoned (never
+     * resumed) so its context can no longer overflow.
+     */
+    rollOntoFreshThread(): void;
     normalizeWorkingStatusPayload(payload: any): {
         source: string;
         reply_in_progress: boolean;
@@ -226,26 +243,7 @@ export class CodexAppServerSession extends EventEmitter<[never]> {
     runTurn(promptText: any, { useInitialImages, media: mediaInput, contextFiles, jsonSchema }?: {
         useInitialImages?: boolean | undefined;
         jsonSchema?: null | undefined;
-    }): Promise<{
-        text: string;
-        usage: null;
-        items: never[];
-        events: never[];
-        provider?: undefined;
-        metadata?: undefined;
-    } | {
-        text: string;
-        usage: any;
-        items: any;
-        events: never[];
-        provider: string;
-        metadata: {
-            source: string;
-            threadId: any;
-            threadPath: string | undefined;
-            nativeSessionId: string | undefined;
-        };
-    }>;
+    }): any;
     /**
      * Normalize a goal payload from a codex `thread/goal/*` notification into
      * the cross-layer {@link GoalState} shape.

package/dist/providers/codex-app-server-session.js

@@ -12,6 +12,15 @@ function isTerminalGoalStatusLocal(status) {
 const DEFAULT_TURN_DEADLINE_MS = 12 * 60 * 1000;
 const MIN_TURN_DEADLINE_MS = 30 * 1000;
 const MAX_TURN_DEADLINE_MS = 30 * 60 * 1000;
+// Oversized-thread recovery: when a Codex turn fails because the provider
+// thread outgrew the model context window (and remote compaction could not
+// recover it), roll the same logical chat onto a fresh thread seeded with this
+// many most-recent history entries and retry the prompt once.
+const RECOVERY_HISTORY_LIMIT = 12;
+// Matches the various ways Codex / the underlying model report a context-window
+// overflow. Kept broad but anchored on "context"/"token" wording so ordinary
+// failures are not misclassified as recoverable.
+const CONTEXT_OVERFLOW_PATTERN = /context[ _-]?(?:length|window|limit)|context[ _-]?length[ _-]?exceeded|maximum[ _-]?context|exceed(?:s|ed)?[^.]{0,40}context|too many tokens|token[ _-]?limit|input[^.]{0,20}too long|prompt[^.]{0,20}too long/i;
 function waitForever() {
     return new Promise(() => { });
 }
@@ -217,6 +226,7 @@ export class CodexAppServerSession extends EventEmitter {
         this.currentTurn = null;
         this.bootPromise = null;
         this.booted = false;
+        this._contextRecoveryInFlight = false;
         this.goalMode = options.goalMode === true;
         this.currentGoal = null;
         // Goal-mode lifecycle is decoupled from `currentTurn` so that goal events
@@ -465,6 +475,61 @@ export class CodexAppServerSession extends EventEmitter {
         }
         return Math.max(0, Math.min(100, Math.round((totalTokens / contextWindow) * 100)));
     }
+    /**
+     * Whether a turn failure was caused by the provider thread outgrowing the
+     * model context window. Such failures are recoverable by rolling onto a fresh
+     * thread; ordinary failures (timeouts, closes, tool errors) are not.
+     *
+     * @param {any} error
+     * @returns {boolean}
+     */
+    isRecoverableContextOverflow(error) {
+        if (!error || error.reason === "session_closed" || error.reason === "turn_timeout") {
+            return false;
+        }
+        const parts = [];
+        if (typeof error.message === "string")
+            parts.push(error.message);
+        if (typeof error.turnStatus === "string")
+            parts.push(error.turnStatus);
+        const turnError = error.turnError;
+        if (typeof turnError === "string") {
+            parts.push(turnError);
+        }
+        else if (turnError && typeof turnError === "object") {
+            for (const key of ["message", "code", "type", "reason"]) {
+                if (typeof turnError[key] === "string")
+                    parts.push(turnError[key]);
+            }
+            try {
+                parts.push(JSON.stringify(turnError));
+            }
+            catch {
+                // Ignore non-serializable provider payloads.
+            }
+        }
+        return CONTEXT_OVERFLOW_PATTERN.test(parts.join(" | "));
+    }
+    /**
+     * Reset thread-bound state so the next {@link boot} starts a brand-new Codex
+     * thread, seeded with the most-recent {@link RECOVERY_HISTORY_LIMIT} history
+     * entries as a prompt preface. The oversized thread is abandoned (never
+     * resumed) so its context can no longer overflow.
+     */
+    rollOntoFreshThread() {
+        const recent = this.history.slice(-RECOVERY_HISTORY_LIMIT);
+        this.history = recent;
+        this.pendingHistorySeed = recent.length > 0;
+        this.sessionId = "";
+        this.threadPath = "";
+        this.nativeSessionId = "";
+        this.resumeSessionId = "";
+        this.manualResumeReady = false;
+        this.sessionInfo = null;
+        this.tokenUsage = null;
+        this.booted = false;
+        this.bootPromise = null;
+    }
     normalizeWorkingStatusPayload(payload) {
         return {
             source: CODEX_APP_SERVER_VARIANT,
@@ -1125,6 +1190,51 @@ export class CodexAppServerSession extends EventEmitter {
             if (error?.reason === "turn_timeout") {
                 await this.interruptCurrentTurn();
             }
+            // Oversized-thread recovery: the provider thread outgrew the context
+            // window and remote compaction could not save it. Roll the same logical
+            // chat onto a fresh thread seeded with bounded recent history and retry
+            // the prompt exactly once, rather than surfacing a dead turn. The
+            // in-flight guard ensures a single retry: if the fresh thread also
+            // overflows, the recursive call skips recovery and fails normally.
+            if (!this._contextRecoveryInFlight &&
+                !this.closeRequested &&
+                !currentTurn.goalMode &&
+                this.isRecoverableContextOverflow(error)) {
+                // Drop the user message pushed for the failed attempt; the retry
+                // re-adds it (and folds prior history in as a preface via buildPrompt).
+                if (this.history.length > 0 &&
+                    String(this.history[this.history.length - 1]?.role || "").toLowerCase() === "user") {
+                    this.history.pop();
+                }
+                if (this.currentTurn === currentTurn) {
+                    this.currentTurn = null;
+                }
+                this._contextRecoveryInFlight = true;
+                // Release the outer turn's guards before recursing so their timers do
+                // not linger for the duration of the retry. Both cleanups are
+                // idempotent; the outer `finally` calls them again harmlessly.
+                closeGuard.cleanup();
+                turnTimeoutGuard.cleanup();
+                try {
+                    this.rollOntoFreshThread();
+                    this.trace("context overflow; rolling onto a fresh thread and retrying the turn");
+                    await this.emitWorkingStatus({
+                        phase: "working",
+                        reply_in_progress: true,
+                        status_line: "codex context full; retrying on a fresh thread",
+                    });
+                    this.emit("thread_recovered", { reason: "context_overflow", backend: this.backend });
+                    return await this.runTurn(promptText, {
+                        useInitialImages,
+                        media: mediaInput,
+                        contextFiles,
+                        jsonSchema,
+                    });
+                }
+                finally {
+                    this._contextRecoveryInFlight = false;
+                }
+            }
             if (!this.closeRequested && error?.reason !== "session_closed") {
                 await this.emitWorkingStatus({
                     phase: "turn_failed",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@love-moon/ai-sdk",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lovemoon-ai/conductor.git"
@@ -53,12 +53,12 @@
     "zod": "^4.1.5"
   },
   "optionalDependencies": {
-    "@love-moon/chat-web": "^0.9.0"
+    "@love-moon/chat-web": "^0.11.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",
     "tsx": "^4.20.6",
     "typescript": "^5.6.3"
   },
-  "gitCommitId": "606e5a6"
+  "gitCommitId": "7d57852"
 }