From 5521d768b2bd2960ec6c5d56ef15247c095e304d Mon Sep 17 00:00:00 2001 From: LeeJ Date: Thu, 13 Aug 2026 00:08:14 +0100 Subject: [PATCH] fix(claude-local): avoid root-only skip permissions failure (#9463) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Claude local is one of the adapter paths that lets operators run Claude Code through a local Paperclip runtime. > - Claude Code rejects `--dangerously-skip-permissions` when the process is running as root or through sudo. > - Local/self-hosted Paperclip deployments may run inside root-owned Docker/runtime processes, so the Claude local adapter can fail before it reaches the actual runtime/auth condition. > - Paperclip already uses a curated `--allowedTools` list instead of `--dangerously-skip-permissions` for remote Claude targets. > - This pull request applies the same safer permission strategy to local root processes while preserving existing local non-root and remote behavior. > - The benefit is clearer, safer Claude local diagnostics/execution in containerized setups without widening permissions beyond the existing explicit tool allowlist. ## Linked Issues or Issue Description No directly matching public issue or PR found. Bug description: - **Problem:** `claude_local` can fail its local probe/execution path when Paperclip runs from a root-owned local container/runtime because Claude Code refuses `--dangerously-skip-permissions` under root/sudo. - **Actual behavior:** The adapter may fail immediately with Claude's root/sudo guard before validating the real Claude runtime/auth state. - **Expected behavior:** Local root processes should use the same explicit allowlist strategy Paperclip already uses for remote targets, while local non-root behavior remains unchanged. - **Environment:** Local/self-hosted Docker or container-style Paperclip runtime where the app process UID is `0`. Related but different: #4926 covers MCP config propagation for the Claude local adapter, not the root/sudo permission flag behavior fixed here. ## What Changed - Added root-aware permission argument selection for the Claude local adapter. - Preserved current local non-root behavior: `--dangerously-skip-permissions` is still used when allowed. - Preserved current remote behavior: remote targets continue using explicit `--allowedTools`. - Changed local root behavior to use the explicit `--allowedTools` list instead of `--dangerously-skip-permissions`. - Threaded process UID awareness through Claude local probe and execution paths. - Added unit coverage for skip-disabled, remote, local non-root, local root, and UID-unavailable behavior. ## Verification ```sh ./node_modules/.bin/vitest run --config g15-vitest-claude-local.config.mjs \ packages/adapters/claude-local/src/server/permissions.test.ts ``` Result: ```text 1 file passed 8 tests passed ``` ```sh pnpm --filter @paperclipai/adapter-claude-local typecheck ``` Result: ```text @paperclipai/adapter-claude-local typecheck passed ``` Additional local smoke: - Ran a disposable root-container Claude adapter diagnostic against this patch. - The diagnostic no longer fails with Claude's root/sudo `--dangerously-skip-permissions` error. - It proceeds to the actual environment-specific Claude auth/runtime result. - No credentials, tokens, hostnames, private paths, or internal Paperclip issue references are included in this PR. Public duplicate checks performed: ```sh gh pr list --repo paperclipai/paperclip --state open --search 'claude local root permissions dangerously skip permissions allowedTools' gh issue list --repo paperclipai/paperclip --state open --search 'claude local root permissions dangerously skip permissions allowedTools' ``` ## Risks Low-to-medium risk adapter behavior change: - Local root Claude runs will now use explicit `--allowedTools` rather than broad skip-permissions behavior. - That is intentionally safer, but an environment depending on broader implicit tool access under root may now need the adapter allowlist to include any required tools. - Local non-root behavior is unchanged. - Remote behavior is unchanged. - No database migrations, API contract changes, or UI changes. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used OpenAI Codex `gpt-5.5` via Hermes Agent, with shell/file/tool use for repository inspection, patching, local verification, and GitHub CLI operations. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: LeeJ --- .../claude-local/src/server/execute.ts | 1 + .../src/server/permissions.test.ts | 44 +++++++++++++++---- .../claude-local/src/server/permissions.ts | 24 +++++++--- .../adapters/claude-local/src/server/test.ts | 6 ++- 4 files changed, 59 insertions(+), 16 deletions(-) diff --git a/packages/adapters/claude-local/src/server/execute.ts b/packages/adapters/claude-local/src/server/execute.ts index 72fdde9545..ad1bdc253e 100644 --- a/packages/adapters/claude-local/src/server/execute.ts +++ b/packages/adapters/claude-local/src/server/execute.ts @@ -840,6 +840,7 @@ export async function execute(ctx: AdapterExecutionContext): Promise { expect(buildClaudeProbePermissionArgs({ dangerouslySkipPermissions: false, targetIsRemote: true })).toEqual([]); }); - it("uses dangerously-skip-permissions for local execution", () => { - expect(buildClaudeExecutionPermissionArgs({ dangerouslySkipPermissions: true, targetIsRemote: false })).toEqual([ - "--dangerously-skip-permissions", - ]); + it("uses dangerously-skip-permissions for non-root local execution", () => { + expect( + buildClaudeExecutionPermissionArgs({ + dangerouslySkipPermissions: true, + targetIsRemote: false, + localProcessUid: 1000, + }), + ).toEqual(["--dangerously-skip-permissions"]); }); - it("uses dangerously-skip-permissions for local probes", () => { - expect(buildClaudeProbePermissionArgs({ dangerouslySkipPermissions: true, targetIsRemote: false })).toEqual([ - "--dangerously-skip-permissions", - ]); + it("uses dangerously-skip-permissions for non-root local probes", () => { + expect( + buildClaudeProbePermissionArgs({ + dangerouslySkipPermissions: true, + targetIsRemote: false, + localProcessUid: 1000, + }), + ).toEqual(["--dangerously-skip-permissions"]); + }); + + it("uses allowedTools for local root execution because Claude refuses dangerously-skip-permissions as root", () => { + expect( + buildClaudeExecutionPermissionArgs({ + dangerouslySkipPermissions: true, + targetIsRemote: false, + localProcessUid: 0, + }), + ).toEqual(["--allowedTools", SANDBOX_ALLOWED_TOOLS]); + }); + + it("uses allowedTools for local root probes because Claude refuses dangerously-skip-permissions as root", () => { + expect( + buildClaudeProbePermissionArgs({ + dangerouslySkipPermissions: true, + targetIsRemote: false, + localProcessUid: 0, + }), + ).toEqual(["--allowedTools", SANDBOX_ALLOWED_TOOLS]); }); }); diff --git a/packages/adapters/claude-local/src/server/permissions.ts b/packages/adapters/claude-local/src/server/permissions.ts index bb8fc137c6..10498d5cca 100644 --- a/packages/adapters/claude-local/src/server/permissions.ts +++ b/packages/adapters/claude-local/src/server/permissions.ts @@ -17,26 +17,36 @@ const SANDBOX_ALLOWED_TOOLS = "NotebookEdit PushNotification Read RemoteTrigger ScheduleWakeup Skill " + "TaskOutput TaskStop TodoWrite ToolSearch WebFetch WebSearch Write"; +function shouldUseAllowedTools(input: { targetIsRemote: boolean; localProcessUid?: number | null }): boolean { + // Claude Code refuses `--dangerously-skip-permissions` when the process runs + // as root. Use the same explicit allowlist that remote targets use so local + // Docker/root probes and executions fail safe instead of hard-failing before + // auth/runtime validation can complete. + return input.targetIsRemote || input.localProcessUid === 0; +} + export function buildClaudeProbePermissionArgs(input: { dangerouslySkipPermissions: boolean; targetIsRemote: boolean; + localProcessUid?: number | null; }): string[] { if (!input.dangerouslySkipPermissions) return []; - // For remote targets, mirror the execution path: pass `--allowedTools` - // with the curated allowlist instead of dropping the flag entirely. The - // hello probe is a one-shot prompt that should never trigger a tool, but - // if a future probe prompt does, we don't want Claude CLI to stall on an - // interactive permission prompt that no human can answer. - if (input.targetIsRemote) return ["--allowedTools", SANDBOX_ALLOWED_TOOLS]; + // For remote targets and local root processes, mirror the execution path: + // pass `--allowedTools` with the curated allowlist instead of dropping the + // flag entirely. The hello probe is a one-shot prompt that should never + // trigger a tool, but if a future probe prompt does, we don't want Claude CLI + // to stall on an interactive permission prompt that no human can answer. + if (shouldUseAllowedTools(input)) return ["--allowedTools", SANDBOX_ALLOWED_TOOLS]; return ["--dangerously-skip-permissions"]; } export function buildClaudeExecutionPermissionArgs(input: { dangerouslySkipPermissions: boolean; targetIsRemote: boolean; + localProcessUid?: number | null; }): string[] { if (!input.dangerouslySkipPermissions) return []; - if (input.targetIsRemote) { + if (shouldUseAllowedTools(input)) { return ["--allowedTools", SANDBOX_ALLOWED_TOOLS]; } return ["--dangerously-skip-permissions"]; diff --git a/packages/adapters/claude-local/src/server/test.ts b/packages/adapters/claude-local/src/server/test.ts index 1c50a7ae47..7520137024 100644 --- a/packages/adapters/claude-local/src/server/test.ts +++ b/packages/adapters/claude-local/src/server/test.ts @@ -353,7 +353,11 @@ export async function testEnvironment( } const args = ["--print", "-", "--output-format", "stream-json", "--verbose"]; - args.push(...buildClaudeProbePermissionArgs({ dangerouslySkipPermissions, targetIsRemote })); + args.push(...buildClaudeProbePermissionArgs({ + dangerouslySkipPermissions, + targetIsRemote, + localProcessUid: process.getuid?.() ?? null, + })); if (chrome) args.push("--chrome"); // For Bedrock: only pass --model when the ID is a Bedrock-native identifier. if (model && (!hasBedrock || isBedrockModelId(model))) {