castle-web-cli 0.4.179 → 0.4.181

package/dist/agent.js

@@ -432,11 +432,11 @@ function handleModelCaps(req, res) {
 }
 // Build the headless CLI invocation for a spawning backend/role (smith never
 // comes through here -- it has no CLI process; see runAgentSmith). Cursor's
-// router runs in read-only ask mode; claude runs permission-mode auto for
-// both roles (NOT plan mode -- that makes it emit plan tool calls) at medium
-// effort. claudeModel "openrouter" keeps the SAME claude binary/flags and
-// swaps only the model slug and env (see envForOpenrouterSpawn) -- plus one
-// extra permission grant, see OPENROUTER_ALLOWED_TOOLS below.
+// router runs in read-only ask mode; hosted claude runs bypassPermissions for
+// both roles because the container is already the permission boundary. Local
+// claude stays on auto (NOT plan mode -- that makes it emit plan tool calls)
+// at medium effort. claudeModel "openrouter" keeps the SAME claude binary and
+// swaps only the model slug and env (see envForOpenrouterSpawn).
 // claude CLI 2.1.198 SILENTLY resolves `--permission-mode auto` to "default"
 // whenever --model is not in its built-in catalog -- which is every free-form
 // OpenRouter slug (verified live: `--model sonnet` inits with
@@ -445,8 +445,8 @@ function handleModelCaps(req, res) {
 // Headless (-p) default mode then denies every prompt-requiring tool with
 // "you haven't granted it yet", so OR-routed tasks could never edit files
 // (incident: task UmI8O3VR looped ~60 denials, then exited 0 having done
-// nothing). This explicit tool allowlist restores auto's effective headless
-// capability -- edits plus unrestricted Bash, network commands included
+// nothing). On local runs, this explicit tool allowlist restores auto's
+// effective headless capability -- edits plus unrestricted Bash, network commands included
 // (acceptEdits was rejected: it survives the downgrade but still denies
 // network Bash like curl, which plain auto allows). Deliberately NOT passed
 // to plain-claude spawns, where auto still resolves correctly.
@@ -507,11 +507,15 @@ function claudeSettingsArg(auth) {
 // new process, so that text (the kit guide: ~23k tokens on a kit deck) is sent
 // uncached on every call of every turn. The router already carries the deck's
 // quick reference and file tree in its cached system part, and can read a
-// guide on demand; tasks keep the CLI's own loading. Measured on a 30k-token
-// router prompt: a second turn goes from 40k tokens written to 4.6k.
+// guide on demand; tasks keep the CLI's own loading. Auto memory is off for the
+// same reason: the first process in a deck creates the memory store, the next
+// one's system prompt gains a memory block, and the cached prefix only matches
+// from the third turn on. Measured on a 30k-token router prompt: a second turn
+// goes from 50k tokens written to 6k.
 const ROUTER_CLAUDE_ENV = {
     CLAUDE_CODE_DISABLE_CLAUDE_MDS: '1',
     CLAUDE_CODE_DISABLE_GIT_INSTRUCTIONS: '1',
+    CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1',
 };
 function buildAgentInvocation(backend, role, prompt, claudeModel, 
 // Already resolved for this role by the caller (router turns pass
@@ -533,6 +537,7 @@ systemPrompt) {
         .filter((text) => Boolean(text))
         .join('\n\n');
     if (backend === 'claude') {
+        const hosted = Boolean(process.env.CASTLE_SANDBOX_ID);
         const viaOpenrouter = claudeModel === 'openrouter';
         const orAuth = viaOpenrouter ? resolveOpenrouterAuth() : null;
         const anAuth = viaOpenrouter ? null : resolveAnthropicAuth();
@@ -549,8 +554,8 @@ systemPrompt) {
                 'stream-json',
                 '--include-partial-messages',
                 '--permission-mode',
-                'auto',
-                ...(viaOpenrouter ? [openrouterAllowedToolsArg(role)] : []),
+                hosted ? 'bypassPermissions' : 'auto',
+                ...(!hosted && viaOpenrouter ? [openrouterAllowedToolsArg(role)] : []),
                 '--model',
                 viaOpenrouter ? openrouterModel : claudeModel,
                 '--effort',
@@ -577,6 +582,9 @@ systemPrompt) {
                     direct,
                 })),
                 ...(role === 'router' ? ROUTER_CLAUDE_ENV : {}),
+                // Claude Code 2.1.258 refuses bypassPermissions as root unless the
+                // child explicitly identifies itself as running in a sandbox.
+                ...(hosted ? { IS_SANDBOX: '1' } : {}),
             },
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "castle-web-cli",
-  "version": "0.4.179",
+  "version": "0.4.181",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/castle-xyz/castle-experimental-web.git"