{"record":{"id":"a3114b8ff6f77aaf","repo":"Kuberwastaken/claurst","slug":"dangerously-skip-permissions-cannot-be-used-with","errorCode":null,"errorMessage":"--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons","messagePattern":"--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src-rust/crates/cli/src/main.rs","lineNumber":545,"sourceCode":"    // --bare implies --no-claude-md: opening an untrusted repo in bare mode\n    // must not load or inject AGENTS.md memory files.\n    config.disable_claude_mds = cli.no_claude_md || cli.bare;\n    if cli.bare {\n        // Bare mode runs no event hooks. Drop any hooks resolved from\n        // settings so no `run_hooks` call site has anything to execute.\n        config.hooks.clear();\n    }\n    if let Some(sp) = cli.system_prompt.clone() {\n        config.custom_system_prompt = Some(sp);\n    }\n    if let Some(asp) = cli.append_system_prompt.clone() {\n        config.append_system_prompt = Some(asp);\n    }\n    if cli.dangerously_skip_permissions {\n        // Mirror TS setup.ts: block bypass mode when running as root/sudo.\n        #[cfg(unix)]\n        if nix::unistd::Uid::effective().is_root() {\n            anyhow::bail!(\n                \"--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons\"\n            );\n        }\n        config.permission_mode = PermissionMode::BypassPermissions;\n    } else {\n        config.permission_mode = cli.permission_mode.into();\n    }\n    config.additional_dirs = cli.add_dir.clone();\n    if cli.no_auto_compact {\n        config.auto_compact = false;\n    }\n    if cli.auto_commits {\n        config.auto_commits = Some(true);\n    }\n    config.project_dir = Some(cwd.clone());\n    if let Some(p) = &cli.provider {\n        config.provider = Some(p.clone());\n    }","sourceCodeStart":527,"sourceCodeEnd":563,"githubUrl":"https://github.com/Kuberwastaken/claurst/blob/b0637c97ec34144387cbf2f74f65df6d16a6cef1/src-rust/crates/cli/src/main.rs#L527-L563","documentation":"claurst deliberately refuses to start in permission-bypass mode (`--dangerously-skip-permissions`, which sets PermissionMode::BypassPermissions and lets the agent run arbitrary commands without approval) when the process is running as root or sudo on Unix. This mirrors the TypeScript implementation's guard: running an unrestricted agent with superuser privileges is considered too dangerous.","triggerScenarios":"Launching `claurst --dangerously-skip-permissions` while the effective UID is 0 (running as root, via `sudo claurst ...`, or inside a container/CI job that defaults to root), on a Unix platform (the check is `#[cfg(unix)]`).","commonSituations":"Docker containers that run as root by default; CI pipelines executing as root; developers habitually using sudo for the CLI; WSL or VM shells logged in as root.","solutions":["Run claurst as a non-root user (recommended): create/use a normal user account and rerun without sudo","In Docker, add a `USER <nonroot>` directive or run with `docker run --user 1000:1000`","If elevated filesystem access was the reason for sudo, grant the needed directories to the normal user instead of running the agent as root","If you truly need bypass mode in a root container, re-exec as a non-root user inside the container (e.g. `su developer -c 'claurst --dangerously-skip-permissions ...'`); the guard itself is intentional and should not be bypassed as root"],"exampleFix":"// before: running bypass mode as root in a container\ndocker run -it image claurst --dangerously-skip-permissions \"fix tests\"\n// -> bail: cannot be used with root/sudo privileges\n\n// after: run as a non-root user\ndocker run -it --user 1000:1000 image claurst --dangerously-skip-permissions \"fix tests\"","handlingStrategy":"validation","validationCode":"# Detect root before invoking bypass mode\nif [ \"$(id -u)\" -eq 0 ]; then echo \"refusing: --dangerously-skip-permissions as root\"; exit 1; fi\nexec claurst --dangerously-skip-permissions \"$@\"","typeGuard":null,"tryCatchPattern":"# Wrap invocations so root is caught early with a clear message\nif ! out=$(claurst --dangerously-skip-permissions --print \"task\" 2>&1); then\n  case \"$out\" in *root/sudo*) echo \"Run as a non-root user.\";; esac\nfi","preventionTips":["Run containers as a non-root USER; pass --user to docker run","Avoid sudo for developer CLIs; fix directory ownership instead","In CI, check id -u before enabling bypass flags","Treat the guard as intentional — do not work around it as root"],"tags":["security","permissions","cli","root"],"backgroundTag":"permission-denied","analyzedSha":"b0637c97ec34144387cbf2f74f65df6d16a6cef1","analyzedAt":"2026-09-10T00:24:58.650Z","contentChangedAt":"2026-09-10T00:24:58.650Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}