Fleet-launched Claude agents stall forever at Claude Code's one-time "Is this a project you trust?" folder-trust prompt — no human is in the pane to answer it, and the heartbeat keeps reporting healthy because the pane process is alive (just blocked). This is the most common fleet outage (F1 / premature stop), tracked in #644.
Root cause (verified empirically 2026-06-24 on w-jarvis)
--dangerously-skip-permissions does not bypass the folder-trust gate.
trustedProjectDirectories in settings.json does not either (tested: launched Claude in a dir listed there → gate still appeared).
The only record the gate honors is the per-project entry in ~/.claude.json: projects["<dir>"].hasTrustDialogAccepted == true — exactly what answering the prompt writes.
Note: this corrects the original #644 hypothesis, which proposed trustedProjectDirectories. That approach is a no-op.
Fix
start-agent-session.sh pre-seeds the trust record for the claude runtime before launching the pane. Seeding is:
claude-only (codex/pi have no such gate),
idempotent (no-op when already trusted),
atomic (tempfile + os.replace; never corrupts a partial/unreadable file),
flock-serialized across concurrent agent launches sharing ~/.claude.json,
best-effort (any failure is non-fatal — agent still launches, worst case the pre-fix behavior).
Verification
End-to-end on w-jarvis: with /home/jarvis reset to untrusted, the modified launcher flipped hasTrustDialogAccepted to true and Claude booted straight to the ready prompt with no gate. bash -n clean.
## Summary
Fleet-launched **Claude** agents stall forever at Claude Code's one-time *"Is this a project you trust?"* folder-trust prompt — no human is in the pane to answer it, and the heartbeat keeps reporting **healthy** because the pane process is alive (just blocked). This is the most common fleet outage (F1 / premature stop), tracked in #644.
## Root cause (verified empirically 2026-06-24 on w-jarvis)
- `--dangerously-skip-permissions` does **not** bypass the folder-trust gate.
- `trustedProjectDirectories` in `settings.json` does **not** either (tested: launched Claude in a dir listed there → gate still appeared).
- The **only** record the gate honors is the per-project entry in `~/.claude.json`: `projects["<dir>"].hasTrustDialogAccepted == true` — exactly what answering the prompt writes.
> Note: this corrects the original #644 hypothesis, which proposed `trustedProjectDirectories`. That approach is a no-op.
## Fix
`start-agent-session.sh` pre-seeds the trust record for the **claude** runtime before launching the pane. Seeding is:
- claude-only (codex/pi have no such gate),
- idempotent (no-op when already trusted),
- atomic (tempfile + `os.replace`; never corrupts a partial/unreadable file),
- flock-serialized across concurrent agent launches sharing `~/.claude.json`,
- best-effort (any failure is non-fatal — agent still launches, worst case the pre-fix behavior).
## Verification
End-to-end on w-jarvis: with `/home/jarvis` reset to untrusted, the modified launcher flipped `hasTrustDialogAccepted` to `true` and Claude booted **straight to the ready prompt with no gate**. `bash -n` clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Fleet-launched Claude agents stall forever at Claude Code's one-time "Is this a project you trust?" folder-trust prompt — no human is in the pane to answer it, and the heartbeat keeps reporting healthy because the pane process is alive (just blocked). This is the most common fleet outage (F1 / premature stop), tracked in #644.
Root cause (verified empirically 2026-06-24 on w-jarvis)
--dangerously-skip-permissionsdoes not bypass the folder-trust gate.trustedProjectDirectoriesinsettings.jsondoes not either (tested: launched Claude in a dir listed there → gate still appeared).~/.claude.json:projects["<dir>"].hasTrustDialogAccepted == true— exactly what answering the prompt writes.Fix
start-agent-session.shpre-seeds the trust record for the claude runtime before launching the pane. Seeding is:os.replace; never corrupts a partial/unreadable file),~/.claude.json,Verification
End-to-end on w-jarvis: with
/home/jarvisreset to untrusted, the modified launcher flippedhasTrustDialogAcceptedtotrueand Claude booted straight to the ready prompt with no gate.bash -nclean.🤖 Generated with Claude Code
7633bec2b4toaf7dd3fa7c