@technomoron/agent-run 0.99.25 → 0.99.26

package/CHANGES

@@ -1,6 +1,15 @@
 CHANGES
 =======
 
+Version 0.99.26 (2026-07-31)
+----------------------------
+* Add `--danger` support for Claude so unattended runs pass
+  `--dangerously-skip-permissions`.
+* Remove Claude's generated `.claude/settings.local.json` after guarded runs,
+  while preserving project-local settings when `--local` is used.
+* Keep nested command-guard tests independent of an outer agent-run session's
+  executable search path.
+
 Version 0.99.25 (2026-07-11)
 ----------------------------
 * Add config-root `agent-run.defaults.jsonc` inheritance so project manifests

package/README.md

@@ -154,9 +154,8 @@ Codex defaults to `-a on-request -s workspace-write`. `agent-run` sets
 `CODEX_HOME` under the private agent directory, where Codex discovers the
 generated `AGENTS.md`, `config.toml`, and skills natively. It starts Codex from
 that private directory, passes the project root with `-C`, and keeps generated
-guard shims on `PATH`. Use `--danger` explicitly for
-`-a never -s danger-full-access`; use `--network` to enable network access in
-the workspace-write sandbox.
+guard shims on `PATH`. Use `--network` to enable network access in the
+workspace-write sandbox.
 When `~/.codex/auth.json` exists, profile-specific Codex homes link their
 `auth.json` to that shared login cache so changing profiles does not require a
 new ChatGPT login.
@@ -165,7 +164,16 @@ Claude Code currently has no `--cd` equivalent. `agent-run` keeps Claude's
 process cwd at the project root, appends the generated `CLAUDE.md` with
 `--append-system-prompt-file`, passes generated settings with `--settings`, and
 loads generated skills from a local plugin with `--plugin-dir`. It does not
-replace the user's normal `CLAUDE_CONFIG_DIR`.
+replace the user's normal `CLAUDE_CONFIG_DIR`. If Claude writes remembered
+permissions to `.claude/settings.local.json`, `agent-run` removes that file
+after the session unless `--local` was used.
+
+`--danger` runs either tool unattended, with no approval prompts: Codex with
+`-a never -s danger-full-access`, Claude with `--dangerously-skip-permissions`.
+Only use it when the agent may change or delete anything it can reach. Claude
+refuses `--dangerously-skip-permissions` when it runs as root, so run it as a
+normal user. `--sandboxed` and `--network` stay Codex-only because Claude has no
+matching sandbox.
 
 By default, `agent-run codex` and `agent-run claude` fail when local AI files
 such as `AGENTS.md`, `CLAUDE.md`, `CLAUDE.local.md`, `.mcp.json`, `.agents`,

package/dist/cli.js

@@ -130,7 +130,7 @@ function parseRunCommand(command, inputArgs) {
         local: false,
         show: false,
         generate: false,
-        codexSandboxMode: null,
+        sandboxMode: null,
         codexNetwork: false
     };
     const args = [];
@@ -148,12 +148,12 @@ function parseRunCommand(command, inputArgs) {
         if (applyCommonRunOption(arg, wrapperArgs)) {
             continue;
         }
-        if (applyCodexRunOption(command, arg, wrapperArgs)) {
+        if (applySandboxRunOption(command, arg, wrapperArgs)) {
             continue;
         }
         args.push(arg);
     }
-    if (wrapperArgs.codexNetwork && wrapperArgs.codexSandboxMode === 'danger') {
+    if (wrapperArgs.codexNetwork && wrapperArgs.sandboxMode === 'danger') {
         (0, utils_1.fail)('--network cannot be combined with agent-run codex --danger');
     }
     return { args, command, wrapperArgs };
@@ -173,11 +173,11 @@ function applyCommonRunOption(arg, options) {
     options[field] = true;
     return true;
 }
-function applyCodexRunOption(command, arg, options) {
+function applySandboxRunOption(command, arg, options) {
     if (!['--danger', '--sandboxed', '--network'].includes(arg)) {
         return false;
     }
-    if (command !== 'codex') {
+    if (arg !== '--danger' && command !== 'codex') {
         (0, utils_1.fail)(`${arg} is only supported for agent-run codex`);
     }
     if (arg === '--network') {
@@ -185,10 +185,10 @@ function applyCodexRunOption(command, arg, options) {
         return true;
     }
     const mode = arg === '--danger' ? 'danger' : 'sandboxed';
-    if (options.codexSandboxMode !== null && options.codexSandboxMode !== mode) {
+    if (options.sandboxMode !== null && options.sandboxMode !== mode) {
         (0, utils_1.fail)('cannot combine --danger and --sandboxed');
     }
-    options.codexSandboxMode = mode;
+    options.sandboxMode = mode;
     return true;
 }
 function parseCheckCommand(inputArgs) {
@@ -319,7 +319,7 @@ function renderHelp(topic) {
         'Commands:',
         '  codex [--none] [--create] [--local] [--show] [--generate] [--danger|--sandboxed] [--network] [args...]',
         '                                           Run codex with generated private config',
-        '  claude [--none] [--create] [--local] [--show] [--generate] [args...]',
+        '  claude [--none] [--create] [--local] [--show] [--generate] [--danger] [args...]',
         '                                           Run claude with generated private config',
         '  check [--all] [path]                  Validate generated profile output',
         '  init [path]                           Create a sparse profile marker and render output',
@@ -338,9 +338,11 @@ function renderHelp(topic) {
         '  --local            Warn about local AI files instead of failing',
         '  --show             Show read/include and generated files without running the tool',
         '  --generate         Generate files without running the tool',
+        '  --danger           Run unattended without approval prompts:',
+        '                     Codex with -a never -s danger-full-access,',
+        '                     Claude with --dangerously-skip-permissions',
         '',
         'Codex wrapper options:',
-        '  --danger           Run Codex with no sandbox: -a never -s danger-full-access',
         '  --sandboxed        Run Codex with workspace-write sandbox (default)',
         '  --network          Enable network for the workspace-write sandbox',
         ''

package/dist/commands.js

@@ -47,7 +47,8 @@ function runTool(parsed) {
     validateRunModes(parsed, projectRoot);
     if (wrapperArgs.none || (0, project_1.isIgnoredDir)(projectRoot)) {
         (0, utils_1.verbose)(`wrapper bypassed for ${command}${wrapperArgs.none ? ' via --none' : ' because project is ignored'}`);
-        (0, process_1.execTool)((0, process_1.findRealBinary)(command), [...(0, tools_1.getPermissionArgs)(command), ...args]);
+        const runtimeArgs = wrapperArgs.sandboxMode === 'danger' ? (0, tools_1.getDangerArgs)(command) : (0, tools_1.getPermissionArgs)(command);
+        (0, process_1.execTool)((0, process_1.findRealBinary)(command), [...runtimeArgs, ...args]);
         return;
     }
     const profileResult = (0, project_1.resolveProfileResult)(projectRoot);

package/dist/tools.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCodex = runCodex;
 exports.runClaude = runClaude;
+exports.getDangerArgs = getDangerArgs;
 exports.getPermissionArgs = getPermissionArgs;
 const fs = require("fs");
 const path = require("path");
@@ -25,15 +26,13 @@ function runCodex(realBinary, permissionArgs, context, args, wrapperArgs) {
         AGENT_RUN_REAL_PATH: realPath,
         PATH: `${path.join(liveDir, 'bin')}${path.delimiter}${realPath}`
     };
-    const runtimeArgs = wrapperArgs.codexSandboxMode === 'danger'
-        ? ['-a', 'never', '-s', 'danger-full-access']
-        : ['-a', 'on-request', '-s', 'workspace-write'];
+    const runtimeArgs = wrapperArgs.sandboxMode === 'danger' ? getDangerArgs('codex') : ['-a', 'on-request', '-s', 'workspace-write'];
     (0, process_1.execCommand)(realBinary, [
         ...permissionArgs,
         ...runtimeArgs,
         '-C',
         projectRoot,
-        ...(wrapperArgs.codexSandboxMode !== 'danger' && wrapperArgs.codexNetwork
+        ...(wrapperArgs.sandboxMode !== 'danger' && wrapperArgs.codexNetwork
             ? ['--config', 'sandbox_workspace_write.network_access=true']
             : []),
         ...args
@@ -55,8 +54,9 @@ function runClaude(realBinary, permissionArgs, context, args, wrapperArgs) {
         AGENT_RUN_REAL_PATH: realPath,
         PATH: `${path.join(liveDir, 'bin')}${path.delimiter}${realPath}`
     };
+    const runtimeArgs = wrapperArgs.sandboxMode === 'danger' ? getDangerArgs('claude') : permissionArgs;
     (0, process_1.execCommand)(realBinary, [
-        ...permissionArgs,
+        ...runtimeArgs,
         '--append-system-prompt-file',
         claudePath,
         '--settings',
@@ -70,6 +70,9 @@ function postflightProjectCheck(context, allowLocal, code) {
     if (!context.guardrails.forbidRepoAiFiles) {
         return code;
     }
+    if (!allowLocal) {
+        removeClaudeLocalSettings(context.projectRoot);
+    }
     const localAiFiles = (0, project_1.findLocalAiFiles)(context.projectRoot, context.profileDir);
     if (localAiFiles.length === 0) {
         return code;
@@ -77,11 +80,34 @@ function postflightProjectCheck(context, allowLocal, code) {
     (0, project_1.warnForLocalAiFiles)(null, context.projectRoot, localAiFiles);
     return allowLocal ? code : 1;
 }
+function removeClaudeLocalSettings(projectRoot) {
+    const claudeDir = path.join(projectRoot, '.claude');
+    const localSettingsPath = path.join(claudeDir, 'settings.local.json');
+    if (!fs.existsSync(localSettingsPath)) {
+        return;
+    }
+    fs.rmSync(localSettingsPath);
+    try {
+        fs.rmdirSync(claudeDir);
+    }
+    catch (error) {
+        if (!isDirectoryNotEmptyError(error)) {
+            throw error;
+        }
+    }
+    process.stderr.write(`agent-run: removed Claude's project-local settings: ${localSettingsPath}\n`);
+}
+function isDirectoryNotEmptyError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'ENOTEMPTY';
+}
 function failMissingConfig(tool, agentDir) {
     process.stderr.write(`agent-run: no ${tool} config found for this project: ${agentDir}\n`);
     process.stderr.write(`agent-run: run \`agent-run ${tool} --none\` to bypass agent setup, or \`agent-run ${tool} --create\` to create profile files.\n`);
     process.exit(1);
 }
+function getDangerArgs(tool) {
+    return tool === 'codex' ? ['-a', 'never', '-s', 'danger-full-access'] : ['--dangerously-skip-permissions'];
+}
 function getPermissionArgs(tool) {
     if (process.env.AGENT_WRAPPER_FORCE_PERMISSIVE !== '1') {
         return [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@technomoron/agent-run",
-  "version": "0.99.25",
+  "version": "0.99.26",
   "packageManager": "pnpm@10.28.1",
   "bin": {
     "agent-run": "dist/agent-run.js"