castle-web-cli 0.4.180 → 0.4.181

package/dist/agent.js

@@ -432,15 +432,11 @@ function handleModelCaps(req, res) {
 }
 // Build the headless CLI invocation for a spawning backend/role (smith never
 // comes through here -- it has no CLI process; see runAgentSmith). Cursor's
-// router runs in read-only ask mode; claude runs permission-mode
-// bypassPermissions for both roles (NOT plan mode -- that makes it emit plan
-// tool calls) at medium effort. Not `auto`: auto mode runs a sonnet
-// classifier call beside every turn, on Anthropic's own key, whatever --model
-// says -- a second model's cost and a second billing line per turn. bypass
-// asks no classifier. A cli fix is expected upstream; until then bypass is
-// the mode. claudeModel "openrouter" keeps the SAME claude binary/flags and
-// swaps only the model slug and env (see envForOpenrouterSpawn) -- plus one
-// extra permission grant, see OPENROUTER_ALLOWED_TOOLS below.
+// router runs in read-only ask mode; hosted claude runs bypassPermissions for
+// both roles because the container is already the permission boundary. Local
+// claude stays on auto (NOT plan mode -- that makes it emit plan tool calls)
+// at medium effort. claudeModel "openrouter" keeps the SAME claude binary and
+// swaps only the model slug and env (see envForOpenrouterSpawn).
 // claude CLI 2.1.198 SILENTLY resolves `--permission-mode auto` to "default"
 // whenever --model is not in its built-in catalog -- which is every free-form
 // OpenRouter slug (verified live: `--model sonnet` inits with
@@ -449,8 +445,8 @@ function handleModelCaps(req, res) {
 // Headless (-p) default mode then denies every prompt-requiring tool with
 // "you haven't granted it yet", so OR-routed tasks could never edit files
 // (incident: task UmI8O3VR looped ~60 denials, then exited 0 having done
-// nothing). This explicit tool allowlist restores auto's effective headless
-// capability -- edits plus unrestricted Bash, network commands included
+// nothing). On local runs, this explicit tool allowlist restores auto's
+// effective headless capability -- edits plus unrestricted Bash, network commands included
 // (acceptEdits was rejected: it survives the downgrade but still denies
 // network Bash like curl, which plain auto allows). Deliberately NOT passed
 // to plain-claude spawns, where auto still resolves correctly.
@@ -541,6 +537,7 @@ systemPrompt) {
         .filter((text) => Boolean(text))
         .join('\n\n');
     if (backend === 'claude') {
+        const hosted = Boolean(process.env.CASTLE_SANDBOX_ID);
         const viaOpenrouter = claudeModel === 'openrouter';
         const orAuth = viaOpenrouter ? resolveOpenrouterAuth() : null;
         const anAuth = viaOpenrouter ? null : resolveAnthropicAuth();
@@ -557,8 +554,8 @@ systemPrompt) {
                 'stream-json',
                 '--include-partial-messages',
                 '--permission-mode',
-                'bypassPermissions',
-                ...(viaOpenrouter ? [openrouterAllowedToolsArg(role)] : []),
+                hosted ? 'bypassPermissions' : 'auto',
+                ...(!hosted && viaOpenrouter ? [openrouterAllowedToolsArg(role)] : []),
                 '--model',
                 viaOpenrouter ? openrouterModel : claudeModel,
                 '--effort',
@@ -585,6 +582,9 @@ systemPrompt) {
                     direct,
                 })),
                 ...(role === 'router' ? ROUTER_CLAUDE_ENV : {}),
+                // Claude Code 2.1.258 refuses bypassPermissions as root unless the
+                // child explicitly identifies itself as running in a sandbox.
+                ...(hosted ? { IS_SANDBOX: '1' } : {}),
             },
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "castle-web-cli",
-  "version": "0.4.180",
+  "version": "0.4.181",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/castle-xyz/castle-experimental-web.git"