fix(claude-local): avoid root-only skip permissions failure (#9463)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Claude local is one of the adapter paths that lets operators run
Claude Code through a local Paperclip runtime.
> - Claude Code rejects `--dangerously-skip-permissions` when the
process is running as root or through sudo.
> - Local/self-hosted Paperclip deployments may run inside root-owned
Docker/runtime processes, so the Claude local adapter can fail before it
reaches the actual runtime/auth condition.
> - Paperclip already uses a curated `--allowedTools` list instead of
`--dangerously-skip-permissions` for remote Claude targets.
> - This pull request applies the same safer permission strategy to
local root processes while preserving existing local non-root and remote
behavior.
> - The benefit is clearer, safer Claude local diagnostics/execution in
containerized setups without widening permissions beyond the existing
explicit tool allowlist.

## Linked Issues or Issue Description

No directly matching public issue or PR found.

Bug description:

- **Problem:** `claude_local` can fail its local probe/execution path
when Paperclip runs from a root-owned local container/runtime because
Claude Code refuses `--dangerously-skip-permissions` under root/sudo.
- **Actual behavior:** The adapter may fail immediately with Claude's
root/sudo guard before validating the real Claude runtime/auth state.
- **Expected behavior:** Local root processes should use the same
explicit allowlist strategy Paperclip already uses for remote targets,
while local non-root behavior remains unchanged.
- **Environment:** Local/self-hosted Docker or container-style Paperclip
runtime where the app process UID is `0`.

Related but different: #4926 covers MCP config propagation for the
Claude local adapter, not the root/sudo permission flag behavior fixed
here.

## What Changed

- Added root-aware permission argument selection for the Claude local
adapter.
- Preserved current local non-root behavior:
`--dangerously-skip-permissions` is still used when allowed.
- Preserved current remote behavior: remote targets continue using
explicit `--allowedTools`.
- Changed local root behavior to use the explicit `--allowedTools` list
instead of `--dangerously-skip-permissions`.
- Threaded process UID awareness through Claude local probe and
execution paths.
- Added unit coverage for skip-disabled, remote, local non-root, local
root, and UID-unavailable behavior.

## Verification

```sh
./node_modules/.bin/vitest run --config g15-vitest-claude-local.config.mjs \
  packages/adapters/claude-local/src/server/permissions.test.ts
```

Result:

```text
1 file passed
8 tests passed
```

```sh
pnpm --filter @paperclipai/adapter-claude-local typecheck
```

Result:

```text
@paperclipai/adapter-claude-local typecheck passed
```

Additional local smoke:

- Ran a disposable root-container Claude adapter diagnostic against this
patch.
- The diagnostic no longer fails with Claude's root/sudo
`--dangerously-skip-permissions` error.
- It proceeds to the actual environment-specific Claude auth/runtime
result.
- No credentials, tokens, hostnames, private paths, or internal
Paperclip issue references are included in this PR.

Public duplicate checks performed:

```sh
gh pr list --repo paperclipai/paperclip --state open --search 'claude local root permissions dangerously skip permissions allowedTools'
gh issue list --repo paperclipai/paperclip --state open --search 'claude local root permissions dangerously skip permissions allowedTools'
```

## Risks

Low-to-medium risk adapter behavior change:

- Local root Claude runs will now use explicit `--allowedTools` rather
than broad skip-permissions behavior.
- That is intentionally safer, but an environment depending on broader
implicit tool access under root may now need the adapter allowlist to
include any required tools.
- Local non-root behavior is unchanged.
- Remote behavior is unchanged.
- No database migrations, API contract changes, or UI changes.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

OpenAI Codex `gpt-5.5` via Hermes Agent, with shell/file/tool use for
repository inspection, patching, local verification, and GitHub CLI
operations.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: LeeJ <elJayAdvisor@users.noreply.github.com>

packages/adapters/claude-local/src/server/execute.ts

@@ -840,6 +840,7 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
     args.push(...buildClaudeExecutionPermissionArgs({
       dangerouslySkipPermissions,
       targetIsRemote: executionTargetIsRemote,
+      localProcessUid: process.getuid?.() ?? null,
     }));
     if (chrome) args.push("--chrome");
     // For Bedrock: only pass --model when the ID is a Bedrock-native identifier

packages/adapters/claude-local/src/server/permissions.test.ts

@@ -37,15 +37,43 @@ describe("claude-local remote permission args", () => {
     expect(buildClaudeProbePermissionArgs({ dangerouslySkipPermissions: false, targetIsRemote: true })).toEqual([]);
   });
 
-  it("uses dangerously-skip-permissions for local execution", () => {
-    expect(buildClaudeExecutionPermissionArgs({ dangerouslySkipPermissions: true, targetIsRemote: false })).toEqual([
-      "--dangerously-skip-permissions",
-    ]);
+  it("uses dangerously-skip-permissions for non-root local execution", () => {
+    expect(
+      buildClaudeExecutionPermissionArgs({
+        dangerouslySkipPermissions: true,
+        targetIsRemote: false,
+        localProcessUid: 1000,
+      }),
+    ).toEqual(["--dangerously-skip-permissions"]);
   });
 
-  it("uses dangerously-skip-permissions for local probes", () => {
-    expect(buildClaudeProbePermissionArgs({ dangerouslySkipPermissions: true, targetIsRemote: false })).toEqual([
-      "--dangerously-skip-permissions",
-    ]);
+  it("uses dangerously-skip-permissions for non-root local probes", () => {
+    expect(
+      buildClaudeProbePermissionArgs({
+        dangerouslySkipPermissions: true,
+        targetIsRemote: false,
+        localProcessUid: 1000,
+      }),
+    ).toEqual(["--dangerously-skip-permissions"]);
+  });
+
+  it("uses allowedTools for local root execution because Claude refuses dangerously-skip-permissions as root", () => {
+    expect(
+      buildClaudeExecutionPermissionArgs({
+        dangerouslySkipPermissions: true,
+        targetIsRemote: false,
+        localProcessUid: 0,
+      }),
+    ).toEqual(["--allowedTools", SANDBOX_ALLOWED_TOOLS]);
+  });
+
+  it("uses allowedTools for local root probes because Claude refuses dangerously-skip-permissions as root", () => {
+    expect(
+      buildClaudeProbePermissionArgs({
+        dangerouslySkipPermissions: true,
+        targetIsRemote: false,
+        localProcessUid: 0,
+      }),
+    ).toEqual(["--allowedTools", SANDBOX_ALLOWED_TOOLS]);
   });
 });

packages/adapters/claude-local/src/server/permissions.ts

@@ -17,26 +17,36 @@ const SANDBOX_ALLOWED_TOOLS =
   "NotebookEdit PushNotification Read RemoteTrigger ScheduleWakeup Skill " +
   "TaskOutput TaskStop TodoWrite ToolSearch WebFetch WebSearch Write";
 
+function shouldUseAllowedTools(input: { targetIsRemote: boolean; localProcessUid?: number | null }): boolean {
+  // Claude Code refuses `--dangerously-skip-permissions` when the process runs
+  // as root. Use the same explicit allowlist that remote targets use so local
+  // Docker/root probes and executions fail safe instead of hard-failing before
+  // auth/runtime validation can complete.
+  return input.targetIsRemote || input.localProcessUid === 0;
+}
+
 export function buildClaudeProbePermissionArgs(input: {
   dangerouslySkipPermissions: boolean;
   targetIsRemote: boolean;
+  localProcessUid?: number | null;
 }): string[] {
   if (!input.dangerouslySkipPermissions) return [];
-  // For remote targets, mirror the execution path: pass `--allowedTools`
-  // with the curated allowlist instead of dropping the flag entirely. The
-  // hello probe is a one-shot prompt that should never trigger a tool, but
-  // if a future probe prompt does, we don't want Claude CLI to stall on an
-  // interactive permission prompt that no human can answer.
-  if (input.targetIsRemote) return ["--allowedTools", SANDBOX_ALLOWED_TOOLS];
+  // For remote targets and local root processes, mirror the execution path:
+  // pass `--allowedTools` with the curated allowlist instead of dropping the
+  // flag entirely. The hello probe is a one-shot prompt that should never
+  // trigger a tool, but if a future probe prompt does, we don't want Claude CLI
+  // to stall on an interactive permission prompt that no human can answer.
+  if (shouldUseAllowedTools(input)) return ["--allowedTools", SANDBOX_ALLOWED_TOOLS];
   return ["--dangerously-skip-permissions"];
 }
 
 export function buildClaudeExecutionPermissionArgs(input: {
   dangerouslySkipPermissions: boolean;
   targetIsRemote: boolean;
+  localProcessUid?: number | null;
 }): string[] {
   if (!input.dangerouslySkipPermissions) return [];
-  if (input.targetIsRemote) {
+  if (shouldUseAllowedTools(input)) {
     return ["--allowedTools", SANDBOX_ALLOWED_TOOLS];
   }
   return ["--dangerously-skip-permissions"];

packages/adapters/claude-local/src/server/test.ts

@@ -353,7 +353,11 @@ export async function testEnvironment(
       }
 
       const args = ["--print", "-", "--output-format", "stream-json", "--verbose"];
-      args.push(...buildClaudeProbePermissionArgs({ dangerouslySkipPermissions, targetIsRemote }));
+      args.push(...buildClaudeProbePermissionArgs({
+        dangerouslySkipPermissions,
+        targetIsRemote,
+        localProcessUid: process.getuid?.() ?? null,
+      }));
       if (chrome) args.push("--chrome");
       // For Bedrock: only pass --model when the ID is a Bedrock-native identifier.
       if (model && (!hasBedrock || isBedrockModelId(model))) {