diff --git a/packages/adapters/claude-local/src/server/execute.ts b/packages/adapters/claude-local/src/server/execute.ts
index 72fdde9545..ad1bdc253e 100644
--- a/packages/adapters/claude-local/src/server/execute.ts
+++ b/packages/adapters/claude-local/src/server/execute.ts
@@ -840,6 +840,7 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
     args.push(...buildClaudeExecutionPermissionArgs({
       dangerouslySkipPermissions,
       targetIsRemote: executionTargetIsRemote,
+      localProcessUid: process.getuid?.() ?? null,
     }));
     if (chrome) args.push("--chrome");
     // For Bedrock: only pass --model when the ID is a Bedrock-native identifier
diff --git a/packages/adapters/claude-local/src/server/permissions.test.ts b/packages/adapters/claude-local/src/server/permissions.test.ts
index d8619b0f01..b0306ee82e 100644
--- a/packages/adapters/claude-local/src/server/permissions.test.ts
+++ b/packages/adapters/claude-local/src/server/permissions.test.ts
@@ -37,15 +37,43 @@ describe("claude-local remote permission args", () => {
     expect(buildClaudeProbePermissionArgs({ dangerouslySkipPermissions: false, targetIsRemote: true })).toEqual([]);
   });
 
-  it("uses dangerously-skip-permissions for local execution", () => {
-    expect(buildClaudeExecutionPermissionArgs({ dangerouslySkipPermissions: true, targetIsRemote: false })).toEqual([
-      "--dangerously-skip-permissions",
-    ]);
+  it("uses dangerously-skip-permissions for non-root local execution", () => {
+    expect(
+      buildClaudeExecutionPermissionArgs({
+        dangerouslySkipPermissions: true,
+        targetIsRemote: false,
+        localProcessUid: 1000,
+      }),
+    ).toEqual(["--dangerously-skip-permissions"]);
   });
 
-  it("uses dangerously-skip-permissions for local probes", () => {
-    expect(buildClaudeProbePermissionArgs({ dangerouslySkipPermissions: true, targetIsRemote: false })).toEqual([
-      "--dangerously-skip-permissions",
-    ]);
+  it("uses dangerously-skip-permissions for non-root local probes", () => {
+    expect(
+      buildClaudeProbePermissionArgs({
+        dangerouslySkipPermissions: true,
+        targetIsRemote: false,
+        localProcessUid: 1000,
+      }),
+    ).toEqual(["--dangerously-skip-permissions"]);
+  });
+
+  it("uses allowedTools for local root execution because Claude refuses dangerously-skip-permissions as root", () => {
+    expect(
+      buildClaudeExecutionPermissionArgs({
+        dangerouslySkipPermissions: true,
+        targetIsRemote: false,
+        localProcessUid: 0,
+      }),
+    ).toEqual(["--allowedTools", SANDBOX_ALLOWED_TOOLS]);
+  });
+
+  it("uses allowedTools for local root probes because Claude refuses dangerously-skip-permissions as root", () => {
+    expect(
+      buildClaudeProbePermissionArgs({
+        dangerouslySkipPermissions: true,
+        targetIsRemote: false,
+        localProcessUid: 0,
+      }),
+    ).toEqual(["--allowedTools", SANDBOX_ALLOWED_TOOLS]);
   });
 });
diff --git a/packages/adapters/claude-local/src/server/permissions.ts b/packages/adapters/claude-local/src/server/permissions.ts
index bb8fc137c6..10498d5cca 100644
--- a/packages/adapters/claude-local/src/server/permissions.ts
+++ b/packages/adapters/claude-local/src/server/permissions.ts
@@ -17,26 +17,36 @@ const SANDBOX_ALLOWED_TOOLS =
   "NotebookEdit PushNotification Read RemoteTrigger ScheduleWakeup Skill " +
   "TaskOutput TaskStop TodoWrite ToolSearch WebFetch WebSearch Write";
 
+function shouldUseAllowedTools(input: { targetIsRemote: boolean; localProcessUid?: number | null }): boolean {
+  // Claude Code refuses `--dangerously-skip-permissions` when the process runs
+  // as root. Use the same explicit allowlist that remote targets use so local
+  // Docker/root probes and executions fail safe instead of hard-failing before
+  // auth/runtime validation can complete.
+  return input.targetIsRemote || input.localProcessUid === 0;
+}
+
 export function buildClaudeProbePermissionArgs(input: {
   dangerouslySkipPermissions: boolean;
   targetIsRemote: boolean;
+  localProcessUid?: number | null;
 }): string[] {
   if (!input.dangerouslySkipPermissions) return [];
-  // For remote targets, mirror the execution path: pass `--allowedTools`
-  // with the curated allowlist instead of dropping the flag entirely. The
-  // hello probe is a one-shot prompt that should never trigger a tool, but
-  // if a future probe prompt does, we don't want Claude CLI to stall on an
-  // interactive permission prompt that no human can answer.
-  if (input.targetIsRemote) return ["--allowedTools", SANDBOX_ALLOWED_TOOLS];
+  // For remote targets and local root processes, mirror the execution path:
+  // pass `--allowedTools` with the curated allowlist instead of dropping the
+  // flag entirely. The hello probe is a one-shot prompt that should never
+  // trigger a tool, but if a future probe prompt does, we don't want Claude CLI
+  // to stall on an interactive permission prompt that no human can answer.
+  if (shouldUseAllowedTools(input)) return ["--allowedTools", SANDBOX_ALLOWED_TOOLS];
   return ["--dangerously-skip-permissions"];
 }
 
 export function buildClaudeExecutionPermissionArgs(input: {
   dangerouslySkipPermissions: boolean;
   targetIsRemote: boolean;
+  localProcessUid?: number | null;
 }): string[] {
   if (!input.dangerouslySkipPermissions) return [];
-  if (input.targetIsRemote) {
+  if (shouldUseAllowedTools(input)) {
     return ["--allowedTools", SANDBOX_ALLOWED_TOOLS];
   }
   return ["--dangerously-skip-permissions"];
diff --git a/packages/adapters/claude-local/src/server/test.ts b/packages/adapters/claude-local/src/server/test.ts
index 1c50a7ae47..7520137024 100644
--- a/packages/adapters/claude-local/src/server/test.ts
+++ b/packages/adapters/claude-local/src/server/test.ts
@@ -353,7 +353,11 @@ export async function testEnvironment(
       }
 
       const args = ["--print", "-", "--output-format", "stream-json", "--verbose"];
-      args.push(...buildClaudeProbePermissionArgs({ dangerouslySkipPermissions, targetIsRemote }));
+      args.push(...buildClaudeProbePermissionArgs({
+        dangerouslySkipPermissions,
+        targetIsRemote,
+        localProcessUid: process.getuid?.() ?? null,
+      }));
       if (chrome) args.push("--chrome");
       // For Bedrock: only pass --model when the ID is a Bedrock-native identifier.
       if (model && (!hasBedrock || isBedrockModelId(model))) {