fix(cli): prevent root rejection when using canCallTool with bypassPermissions

When running as root, Claude Code rejects --dangerously-skip-permissions
(mapped from --permission-mode bypassPermissions). Since canCallTool already
handles permission auto-approval via --permission-prompt-tool stdio, skip
passing the redundant --permission-mode flag in that case.

Also fixes abort error being overwritten by exit code error (else-if),
captures stderr via logDebug for diagnostics, improves error logging in
remote launcher, and falls back to first online machine in sync engine.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: cruzanstx

cli/src/claude/claudeRemoteLauncher.ts

@@ -361,7 +361,7 @@ class ClaudeRemoteLauncher extends RemoteLauncherBase {
                         session.client.sendSessionEvent({ type: 'message', message: 'Aborted by user' });
                     }
                 } catch (e) {
-                    logger.debug('[remote]: launch error', e);
+                    logger.debug('[remote]: launch error', e instanceof Error ? `${e.name}: ${e.message}\n${e.stack}` : JSON.stringify(e));
                     if (!this.exitReason) {
                         session.client.sendSessionEvent({ type: 'message', message: 'Process exited unexpectedly' });
                         continue;

cli/src/claude/sdk/query.ts

@@ -307,7 +307,9 @@ export function query(config: {
     if (disallowedTools.length > 0) args.push('--disallowedTools', disallowedTools.join(','))
     if (additionalDirectories.length > 0) args.push('--add-dir', ...additionalDirectories)
     if (strictMcpConfig) args.push('--strict-mcp-config')
-    if (permissionMode) args.push('--permission-mode', permissionMode)
+    if (permissionMode && !(canCallTool && permissionMode === 'bypassPermissions')) {
+        args.push('--permission-mode', permissionMode)
+    }
 
     if (fallbackModel) {
         if (model && fallbackModel === model) {
@@ -361,12 +363,10 @@ export function query(config: {
         childStdin = child.stdin
     }
 
-    // Handle stderr in debug mode
-    if (process.env.DEBUG) {
-        child.stderr.on('data', (data) => {
-            console.error('Claude Code stderr:', data.toString())
-        })
-    }
+    // Handle stderr - always capture for diagnostics
+    child.stderr.on('data', (data) => {
+        logDebug('Claude Code stderr: ' + data.toString())
+    })
 
     // Setup cleanup
     const cleanup = () => {
@@ -383,8 +383,7 @@ export function query(config: {
         child.on('close', (code) => {
             if (config.options?.abort?.aborted) {
                 query.setError(new AbortError('Claude Code process aborted by user'))
-            }
-            if (code !== 0) {
+            } else if (code !== 0) {
                 query.setError(new Error(`Claude Code process exited with code ${code}`))
             } else {
                 resolve()

hub/src/sync/syncEngine.ts

@@ -359,13 +359,9 @@ export class SyncEngine {
                 const hostMatch = onlineMachines.find((machine) => machine.metadata?.host === metadata.host)
                 if (hostMatch) return hostMatch
             }
-            return null
+            return onlineMachines[0]
         })()
 
-        if (!targetMachine) {
-            return { type: 'error', message: 'No machine online', code: 'no_machine_online' }
-        }
-
         const spawnResult = await this.rpcGateway.spawnSession(
             targetMachine.id,
             metadata.path,