@super-one/cli 0.50.1-alpha → 0.50.2-alpha

package/MANIFEST.json

@@ -1,7 +1,7 @@
 {
   "name": "@super-one/cli",
-  "version": "0.50.1-alpha",
+  "version": "0.50.2-alpha",
   "kind": "npm",
   "minNodeMajor": 20,
-  "builtAt": "2026-08-06T07:00:52.203Z"
+  "builtAt": "2026-08-06T17:30:12.368Z"
 }

package/lib/cli.mjs

@@ -9945,6 +9945,40 @@ var init_resolve_sdk_binary = __esm({
   }
 });
 
+// ../../packages/claude/src/root-permission-guard.ts
+function isRootWithoutSandboxOptIn(opts) {
+  if (opts.uid !== 0) return false;
+  const env = opts.env ?? {};
+  if (env.IS_SANDBOX === "1") return false;
+  if (env.CLAUDE_CODE_BUBBLEWRAP) return false;
+  return true;
+}
+function applyRootPermissionGuard(input) {
+  const mode = input.permissionMode?.trim() ? input.permissionMode.trim() : void 0;
+  if (!isRootWithoutSandboxOptIn(input)) {
+    return {
+      permissionMode: mode,
+      allowDangerouslySkipPermissions: true,
+      applied: false,
+      downgradedFrom: null
+    };
+  }
+  const downgrade = mode === "bypassPermissions";
+  return {
+    permissionMode: downgrade ? ROOT_SAFE_PERMISSION_MODE : mode,
+    allowDangerouslySkipPermissions: false,
+    applied: true,
+    downgradedFrom: downgrade ? mode : null
+  };
+}
+var ROOT_SAFE_PERMISSION_MODE;
+var init_root_permission_guard = __esm({
+  "../../packages/claude/src/root-permission-guard.ts"() {
+    "use strict";
+    ROOT_SAFE_PERMISSION_MODE = "acceptEdits";
+  }
+});
+
 // ../../packages/claude/src/run-sdk-turn.ts
 import { query as sdkQuery } from "@anthropic-ai/claude-agent-sdk";
 var init_run_sdk_turn = __esm({
@@ -9955,6 +9989,7 @@ var init_run_sdk_turn = __esm({
     init_map_sdk_message();
     init_agent_event_mapper2();
     init_resolve_sdk_binary();
+    init_root_permission_guard();
   }
 });
 
@@ -10103,6 +10138,11 @@ function buildLiveOptions(opts, onPermission, onQuestion, onPlan, signal, timing
     autoAllowBashIfSandboxed: opts.sandboxMode === "auto",
     failIfUnavailable: false
   } : void 0;
+  const permissions = applyRootPermissionGuard({
+    permissionMode: opts.permissionMode,
+    uid: opts.uid === void 0 ? process.getuid?.() : opts.uid,
+    env: env ?? process.env
+  });
   const base = {
     cwd: opts.cwd,
     ...binaryPath ? { pathToClaudeCodeExecutable: binaryPath } : {},
@@ -10115,8 +10155,8 @@ function buildLiveOptions(opts, onPermission, onQuestion, onPlan, signal, timing
     enableFileCheckpointing: true,
     agentProgressSummaries: true,
     extraArgs: { "replay-user-messages": null },
-    permissionMode: opts.permissionMode || "default",
-    allowDangerouslySkipPermissions: true,
+    permissionMode: permissions.permissionMode || "default",
+    allowDangerouslySkipPermissions: permissions.allowDangerouslySkipPermissions,
     canUseTool,
     abortController,
     settingSources: ["user", "project", "local"],
@@ -10156,6 +10196,7 @@ var init_claude_live_session = __esm({
     init_agent_event_mapper2();
     init_map_sdk_message();
     init_resolve_sdk_binary();
+    init_root_permission_guard();
     init_superone_system_prompt();
     init_superone_host_owned_tools();
     ClaudeLiveSession = class _ClaudeLiveSession {
@@ -10393,6 +10434,90 @@ var init_claude_live_session = __esm({
   }
 });
 
+// ../../packages/claude/src/fetch-models.ts
+import { query as sdkQuery3 } from "@anthropic-ai/claude-agent-sdk";
+function extractModelName(descPrefix) {
+  const match = descPrefix.match(MODEL_NAME_RE);
+  if (!match) return null;
+  return match[2] ? `${match[1]} ${match[2]}` : match[1];
+}
+function mapClaudeModelInfo(m2) {
+  const raw = m2.description ?? "";
+  const sepIdx = raw.indexOf("\xB7");
+  const descPrefix = sepIdx !== -1 ? raw.slice(0, sepIdx).trim() : "";
+  const name = extractModelName(descPrefix) ?? m2.displayName;
+  const base = { id: m2.value, name, description: raw };
+  if (m2.resolvedModel) base.resolvedModel = m2.resolvedModel;
+  if (m2.supportsEffort) base.supportsEffort = true;
+  if (m2.supportedEffortLevels?.length) {
+    base.supportedEffortLevels = m2.supportedEffortLevels;
+  }
+  if (m2.supportsAdaptiveThinking) base.supportsAdaptiveThinking = true;
+  if (m2.supportsFastMode) base.supportsFastMode = true;
+  if (m2.supportsAutoMode) base.supportsAutoMode = true;
+  return base;
+}
+async function fetchClaudeModels(opts) {
+  const binaryPath = opts.binaryPath ?? resolveSdkClaudeBinary();
+  const permissions = applyRootPermissionGuard({
+    permissionMode: "default",
+    uid: opts.uid === void 0 ? process.getuid?.() : opts.uid,
+    env: opts.env ?? process.env
+  });
+  const options = {
+    cwd: opts.cwd,
+    ...binaryPath ? { pathToClaudeCodeExecutable: binaryPath } : {},
+    maxTurns: 0,
+    permissionMode: permissions.permissionMode,
+    persistSession: false,
+    ...opts.env ? { env: opts.env } : {}
+  };
+  let q;
+  try {
+    q = (opts.queryFn ?? sdkQuery3)({ prompt: "hi", options });
+    const models = await withTimeout(
+      (async () => {
+        await q.initializationResult();
+        return await q.supportedModels();
+      })(),
+      opts.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS
+    );
+    return models.map(mapClaudeModelInfo);
+  } catch {
+    return [];
+  } finally {
+    try {
+      q?.close();
+    } catch {
+    }
+  }
+}
+function withTimeout(promise2, ms) {
+  return new Promise((resolve13, reject) => {
+    const timer = setTimeout(() => reject(new Error(`claude model probe timed out after ${ms}ms`)), ms);
+    promise2.then(
+      (v2) => {
+        clearTimeout(timer);
+        resolve13(v2);
+      },
+      (e) => {
+        clearTimeout(timer);
+        reject(e);
+      }
+    );
+  });
+}
+var MODEL_NAME_RE, DEFAULT_PROBE_TIMEOUT_MS;
+var init_fetch_models = __esm({
+  "../../packages/claude/src/fetch-models.ts"() {
+    "use strict";
+    init_resolve_sdk_binary();
+    init_root_permission_guard();
+    MODEL_NAME_RE = /^(\w+ [\d.]+)(?:\s+with\s+(\w+)\s+context)?/;
+    DEFAULT_PROBE_TIMEOUT_MS = 2e4;
+  }
+});
+
 // ../../packages/claude/src/fork-session.ts
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, readdirSync, realpathSync, renameSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
@@ -10460,6 +10585,8 @@ var init_src2 = __esm({
     init_claude_live_session();
     init_agent_event_mapper2();
     init_resolve_sdk_binary();
+    init_fetch_models();
+    init_root_permission_guard();
     init_map_sdk_message();
     init_fork_session();
   }
@@ -14019,8 +14146,19 @@ async function collectHarnessResources(input) {
     opencode: emptyOpenCode(),
     acp: emptyAcp()
   };
+  const resolveModels = async (harnessId) => {
+    const listed = input.listModels(harnessId, input.apiProviderId);
+    if (Array.isArray(listed) && listed.length > 0) return listed;
+    if (!input.probeModels) return [];
+    try {
+      const probed = await input.probeModels(harnessId);
+      return Array.isArray(probed) ? probed : [];
+    } catch {
+      return [];
+    }
+  };
   if (want("claude")) {
-    const models = input.listModels("claude", input.apiProviderId);
+    const models = await resolveModels("claude");
     let account = {};
     if (input.probeAccount) {
       try {
@@ -14056,14 +14194,14 @@ async function collectHarnessResources(input) {
     };
   }
   if (want("codex")) {
-    const models = input.listModels("codex", input.apiProviderId);
+    const models = await resolveModels("codex");
     bundle.codex = {
       models: Array.isArray(models) ? models : [],
       prompts: discoverCodexUserPrompts({ homeDir })
     };
   }
   if (want("opencode")) {
-    const models = input.listModels("opencode", input.apiProviderId);
+    const models = await resolveModels("opencode");
     bundle.opencode = {
       models: Array.isArray(models) ? models : [],
       agents: [],
@@ -18178,7 +18316,7 @@ function resolveHarnessService(store, harness, apiProviderId) {
     binding && binding.credentialId === cred.id ? { endpointId: binding.endpointId, config: binding.config } : null
   );
 }
-function listHarnessModels(store, harness, apiProviderId) {
+function listHarnessProviderModels(store, harness, apiProviderId) {
   const resolved = resolveHarnessService(store, harness, apiProviderId);
   if (resolved) {
     const mapped = /* @__PURE__ */ new Map();
@@ -18208,6 +18346,11 @@ function listHarnessModels(store, harness, apiProviderId) {
     const list = [...mapped.values()];
     if (list.length > 0) return list;
   }
+  return [];
+}
+function listHarnessModels(store, harness, apiProviderId) {
+  const fromProvider = listHarnessProviderModels(store, harness, apiProviderId);
+  if (fromProvider.length > 0) return fromProvider;
   if (harness === "claude") return DEFAULT_CLAUDE_MODELS;
   if (harness === "codex") return DEFAULT_CODEX_MODELS;
   return [];
@@ -21088,6 +21231,18 @@ function createNodeClaudeTurnRunner(opts) {
       ...opts.env,
       ...providerEnv
     };
+    const uid = opts.getuid ? opts.getuid() : process.getuid?.();
+    const permissions = applyRootPermissionGuard({
+      permissionMode: input.permissionMode,
+      uid,
+      env: authEnv
+    });
+    if (permissions.downgradedFrom) {
+      input.onAgentEvent?.({
+        type: "agent_setting_change",
+        patch: { permissionMode: permissions.permissionMode }
+      });
+    }
     const priorSession = parseClaudeSessionResume(input.session.providerResume);
     const sessionKey = input.session.sessionId;
     const mergedProbe = ensureMcpMerge({
@@ -21125,7 +21280,8 @@ function createNodeClaudeTurnRunner(opts) {
         sessionId: priorSession,
         model: input.model && input.model.trim() ? input.model.trim() : void 0,
         effort: input.effort && input.effort.trim() ? input.effort.trim() : void 0,
-        permissionMode: input.permissionMode && input.permissionMode.trim() ? input.permissionMode.trim() : void 0,
+        permissionMode: permissions.permissionMode,
+        uid,
         sandboxMode: input.sandboxMode && input.sandboxMode.trim() ? input.sandboxMode.trim() : void 0,
         additionalDirectories: input.additionalDirectories?.filter(Boolean),
         enabledSkills: resolveEnabledSkills(cwd, input.enabledSkills, input.disabledSkills),
@@ -56999,8 +57155,8 @@ import { fileURLToPath } from "node:url";
 function resolveCliReleaseVersion() {
   const fromEnv = process.env.SUPERONE_CLI_VERSION?.trim();
   if (fromEnv) return fromEnv;
-  if ("0.50.1-alpha".trim()) {
-    return "0.50.1-alpha".trim();
+  if ("0.50.2-alpha".trim()) {
+    return "0.50.2-alpha".trim();
   }
   const fromDist = readDistManifestVersion();
   if (fromDist) return fromDist;
@@ -60983,6 +61139,25 @@ function handleDelete(payload, ctx) {
 init_environment();
 init_session();
 init_resolve_service();
+init_claude_turn_runner();
+
+// src/session/claude-model-catalog.ts
+init_src2();
+var CATALOG_TTL_MS = 5 * 6e4;
+var cache = /* @__PURE__ */ new Map();
+async function getNodeClaudeModelCatalog(opts) {
+  const now = opts.now ?? Date.now;
+  const key = opts.binaryPath ?? "sdk-bundled";
+  const hit = cache.get(key);
+  if (hit && now() - hit.fetchedAt < CATALOG_TTL_MS) return hit.models;
+  const fetchModels = opts.fetchModels ?? fetchClaudeModels;
+  const models = await fetchModels({ cwd: opts.cwd, binaryPath: opts.binaryPath });
+  if (models.length > 0) cache.set(key, { fetchedAt: now(), models });
+  else cache.delete(key);
+  return models;
+}
+
+// src/rpc/harness-resources-handlers.ts
 function requireScopes5(client3, scopes) {
   if (!hasAllScopes(client3.scopes, scopes)) {
     return { error: { code: "forbidden", message: `missing scopes: ${scopes.join(", ")}` } };
@@ -60992,6 +61167,14 @@ function requireScopes5(client3, scopes) {
 function asRecord13(payload) {
   return payload && typeof payload === "object" ? payload : {};
 }
+function defaultProbeModels(ctx) {
+  return async (harnessId, cwd) => {
+    if (harnessId !== "claude") return [];
+    const binaryPath = resolveClaudeBinaryPath({ harnesses: ctx.harnesses });
+    if (!binaryPath) return [];
+    return getNodeClaudeModelCatalog({ cwd, binaryPath });
+  };
+}
 function mapThrown5(err) {
   const e = err;
   const code = e.code ?? "internal";
@@ -61020,12 +61203,19 @@ async function handleHarnessResources(payload, ctx) {
     const harnessId = typeof p2.harnessId === "string" && p2.harnessId.trim() ? p2.harnessId.trim() : null;
     const apiProviderId = typeof p2.apiProviderId === "string" && p2.apiProviderId.trim() ? p2.apiProviderId.trim() : p2.apiProviderId === null ? null : void 0;
     const listModels = (hid, apiId) => {
-      return listHarnessModels(ctx.providers, hid, apiId ?? null);
+      return listHarnessProviderModels(ctx.providers, hid, apiId ?? null);
+    };
+    const probeModels = async (hid) => {
+      const probe = ctx.probeModels ?? defaultProbeModels(ctx);
+      const probed = await probe(hid, project.path);
+      if (probed.length > 0) return probed;
+      return listHarnessModels(ctx.providers, hid, apiProviderId ?? null);
     };
     const bundle = await collectHarnessResources({
       projectPath: project.path,
       homeDir: ctx.homeDir,
       listModels,
+      probeModels,
       apiProviderId: apiProviderId ?? null,
       harnessId
     });
@@ -61201,7 +61391,8 @@ async function dispatchRpcInner(method, payload, ctx) {
   const harnessResources = await dispatchHarnessResourcesRpc(method, payload, {
     client: ctx.client,
     projects: ctx.projects,
-    providers: ctx.providers
+    providers: ctx.providers,
+    harnesses: ctx.harnesses
   });
   if (harnessResources) return harnessResources;
   const codex = await dispatchCodexRpc(method, payload, {
@@ -66992,14 +67183,14 @@ var Response2 = class _Response {
     }
   }
   get headers() {
-    const cache = this[cacheKey];
-    if (cache) {
-      if (!(cache[2] instanceof Headers)) {
-        cache[2] = new Headers(
-          cache[2] || { "content-type": "text/plain; charset=UTF-8" }
+    const cache2 = this[cacheKey];
+    if (cache2) {
+      if (!(cache2[2] instanceof Headers)) {
+        cache2[2] = new Headers(
+          cache2[2] || { "content-type": "text/plain; charset=UTF-8" }
         );
       }
-      return cache[2];
+      return cache2[2];
     }
     return this[getResponseCache]().headers;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@super-one/cli",
-  "version": "0.50.1-alpha",
+  "version": "0.50.2-alpha",
   "description": "SuperOne headless node CLI — remote execution environment (RPC, workspaces, sessions).",
   "type": "module",
   "license": "BUSL-1.1",