arisa 2.3.29 → 2.3.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arisa",
-  "version": "2.3.29",
+  "version": "2.3.31",
   "description": "Arisa - dynamic agent runtime with daemon/core architecture that evolves through user interaction",
   "keywords": [
     "tinyclaw",

package/src/daemon/claude-login.ts

@@ -131,7 +131,7 @@ async function runClaudeSetupToken(): Promise<void> {
 
   let proc: ReturnType<typeof Bun.spawn>;
   try {
-    proc = Bun.spawn(buildBunWrappedAgentCliCommand("claude", ["setup-token"]), {
+    proc = Bun.spawn(buildBunWrappedAgentCliCommand("claude", ["setup-token"], { skipPreload: true }), {
       cwd: config.projectDir,
       stdin: "pipe",
       stdout: "pipe",

package/src/daemon/codex-login.ts

@@ -106,7 +106,7 @@ async function runCodexDeviceAuth(): Promise<void> {
 
   let proc: ReturnType<typeof Bun.spawn>;
   try {
-    proc = Bun.spawn(buildBunWrappedAgentCliCommand("codex", ["login", "--device-auth"]), {
+    proc = Bun.spawn(buildBunWrappedAgentCliCommand("codex", ["login", "--device-auth"], { skipPreload: true }), {
       cwd: config.projectDir,
       stdin: "inherit",
       stdout: "pipe",

package/src/daemon/fallback.ts

@@ -15,6 +15,25 @@ import { getAgentCliLabel, runWithCliFallback } from "./agent-cli";
 
 const log = createLogger("daemon");
 
+/** Detect CLI output that is an error message, not a real response */
+function looksLikeCliError(output: string): boolean {
+  const lower = output.toLowerCase();
+  const errorPatterns = [
+    "authentication_error",
+    "invalid bearer token",
+    "invalid api key",
+    "api error: 401",
+    "api error: 403",
+    "failed to authenticate",
+    "permission_error",
+    "rate_limit_error",
+    "overloaded_error",
+    "api error: 429",
+    "api error: 529",
+  ];
+  return errorPatterns.some(p => lower.includes(p));
+}
+
 export async function fallbackClaude(message: string, coreError?: string): Promise<string> {
   const systemContext = coreError
     ? `[System: Core process is down. Error: ${coreError}. You are running in fallback mode from Daemon. The user's project is at ${config.projectDir}. Respond to the user normally. If they ask about the error, explain what you see.]\n\n`
@@ -37,6 +56,11 @@ export async function fallbackClaude(message: string, coreError?: string): Promi
     const cli = getAgentCliLabel(result.cli);
     if (result.partial) {
       log.warn(`Fallback ${cli} returned output but exited with code ${result.exitCode}`);
+      // Don't forward CLI error messages (auth failures, API errors) to the user
+      if (looksLikeCliError(result.output)) {
+        log.error(`Fallback ${cli} output is a CLI error, not forwarding to user: ${result.output.slice(0, 300)}`);
+        return `[Fallback mode] ${cli} CLI failed (exit ${result.exitCode}). Please check server logs.`;
+      }
     } else {
       log.warn(`Using fallback ${cli} CLI`);
     }

package/src/daemon/setup.ts

@@ -282,7 +282,7 @@ async function runInteractiveLogin(cli: AgentCliName, vars: Record<string, strin
   try {
     // For claude: capture stdout to extract OAuth token while still showing output
     if (cli === "claude") {
-      const proc = Bun.spawn(buildBunWrappedAgentCliCommand(cli, args), {
+      const proc = Bun.spawn(buildBunWrappedAgentCliCommand(cli, args, { skipPreload: true }), {
         stdin: "inherit",
         stdout: "pipe",
         stderr: "inherit",
@@ -390,7 +390,7 @@ async function runInteractiveLogin(cli: AgentCliName, vars: Record<string, strin
     }
 
     // For codex and others: inherit all stdio
-    const proc = Bun.spawn(buildBunWrappedAgentCliCommand(cli, args), {
+    const proc = Bun.spawn(buildBunWrappedAgentCliCommand(cli, args, { skipPreload: true }), {
       stdin: "inherit",
       stdout: "inherit",
       stderr: "inherit",

package/src/shared/ai-cli.ts

@@ -96,12 +96,20 @@ function buildEnvExports(): string {
   return exports.length > 0 ? exports.join(" && ") + " && " : "";
 }
 
-export function buildBunWrappedAgentCliCommand(cli: AgentCliName, args: string[]): string[] {
+export interface AgentCliOptions {
+  /** Skip the ink-shim preload (useful for interactive login flows). Default: false */
+  skipPreload?: boolean;
+}
+
+export function buildBunWrappedAgentCliCommand(cli: AgentCliName, args: string[], options?: AgentCliOptions): string[] {
+  const usePreload = !options?.skipPreload;
+  const preloadArgs = usePreload ? ["--preload", INK_SHIM] : [];
+
   if (isRunningAsRoot()) {
     // Run as arisa user — Claude CLI refuses to run as root.
     // This path is used by Daemon fallback calls; Core runs as arisa directly.
     const cliPath = resolveAgentCliPath(cli) || join(ROOT_BUN_BIN, cli);
-    const inner = ["bun", "--bun", "--preload", INK_SHIM, cliPath, ...args].map(shellEscape).join(" ");
+    const inner = ["bun", "--bun", ...preloadArgs, cliPath, ...args].map(shellEscape).join(" ");
     // su without "-" preserves parent env (tokens, keys); explicit HOME/PATH for arisa
     return ["su", "arisa", "-s", "/bin/bash", "-c", `${ARISA_BUN_ENV} && ${buildEnvExports()}${inner}`];
   }
@@ -112,5 +120,5 @@ export function buildBunWrappedAgentCliCommand(cli: AgentCliName, args: string[]
   }
   // Preload shim that patches process.stdin.setRawMode to prevent Ink crash
   // when running without a TTY (systemd, su -c, etc.)
-  return ["bun", "--bun", "--preload", INK_SHIM, cliPath, ...args];
+  return ["bun", "--bun", ...preloadArgs, cliPath, ...args];
 }