From df9e7c39ce8db815f727357c5d48e756deca14a1 Mon Sep 17 00:00:00 2001 From: Joseph Fung Date: Mon, 23 Mar 2026 22:47:45 -0400 Subject: [PATCH] fix: read permission_mode from provider config for Docker support The Claude provider hardcoded bypassPermissions, which fails when running as root in Docker ("--dangerously-skip-permissions cannot be used with root/sudo privileges"). Now reads permission_mode from config.toml, allowing containers to use acceptEdits instead. --- src/providers/claude-provider.ts | 7 ++++++- src/types.ts | 6 ++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/src/providers/claude-provider.ts b/src/providers/claude-provider.ts index f58b993..a4f2f77 100644 --- a/src/providers/claude-provider.ts +++ b/src/providers/claude-provider.ts @@ -175,7 +175,12 @@ export class ClaudeProvider implements LLMProvider { this._cwd = options.cwd ?? process.cwd(); this._systemPrompt = options.systemPrompt ?? ''; this._allowedTools = options.allowedTools ?? []; - this._permissionMode = options.permissionMode ?? 'bypassPermissions'; + // Read permission_mode from provider config, falling back to options, then default. + // 'bypassPermissions' fails when running as root in Docker, so containers + // should set permission_mode = "acceptEdits" in config.toml. + this._permissionMode = config.permission_mode + ?? options.permissionMode + ?? 'bypassPermissions'; this._circuitBreaker = new CircuitBreaker(); // Dependency injection: use provided queryFn or lazy-load the real SDK diff --git a/src/types.ts b/src/types.ts index af8c535..b725d2b 100644 --- a/src/types.ts +++ b/src/types.ts @@ -420,6 +420,9 @@ export interface ClaudeProviderConfig extends BaseProviderConfig { type: 'claude-sdk'; auth_method?: 'mac_session' | 'api_key'; api_key_env?: string; + /** Permission mode for the Claude Code subprocess. + * 'bypassPermissions' fails as root in Docker — use 'acceptEdits' instead. */ + permission_mode?: 'default' | 'acceptEdits' | 'bypassPermissions' | 'plan'; } /** TYPE-04: Gemini CLI provider config */ @@ -454,6 +457,9 @@ export interface ProviderConfig { cli_path?: string; api_key_env?: string; endpoint?: string; + /** Permission mode for the Claude Code subprocess. + * 'bypassPermissions' fails as root in Docker — use 'acceptEdits' instead. */ + permission_mode?: 'default' | 'acceptEdits' | 'bypassPermissions' | 'plan'; } /** TYPE-04: Typed provider config discriminated union */