kickoff plan agents stall on Claude Code's workspace-trust dialog (the plan/tmux half of #55)

[magnificentlycursed]

The plan/tmux half of #55: kickoff plan agents stall on Claude Code's workspace-trust dialog

Live-fire retest at 6b4f736f (macOS, tmux, real auth) reproduced #55's "kickoff plan agents launch but stall indefinitely" and captured the exact cause. The tmux pane is parked, pre-execution, on Claude Code's workspace-trust dialog:

Quick safety check: Is this a project you created or one you trust?
❯ 1. Yes, I trust this folder
  2. No, exit

.kickoff-status never advances, no .kickoff-plan.json is produced, and no timeout classification fires until the wall-clock check. A headless dispatcher (e.g. a driver agent, CI, or a harness like vsdd) never sends the keystroke, so the plan agent hangs for its full timeout.

Root cause

crosslink kickoff plan launches its claude session in a freshly created worktree — a directory path Claude Code has never seen — and passes no permission flag: plan.rs (~248-250) hardcodes skip_permissions: false and permission_mode: None ("plan mode never skips permissions", which is correct — plan mode is read-only). Claude Code shows its first-run workspace-trust dialog for any untrusted directory, and --allowedTools does not cover it.

Per claude --help, the trust dialog is skipped only under --dangerously-skip-permissions. That is why the sibling container path does not exhibit this (it passes --dangerously-skip-permissions, recently made consistent in #59) — but blanket-skipping permissions is the wrong tool for read-only plan mode.

Relationship to #55 / #59

• kickoff run --container omits the no-prompt permissions flag that container start passes — container agents can hang on prompts #59 (container permission flag) fixes the container contributor to kickoff plan agents launch but stall indefinitely — no status file, no progress, no gap report #55.
• This issue is the plan/tmux contributor — the one kickoff plan agents launch but stall indefinitely — no status file, no progress, no gap report #55 was literally filed about ("kickoff plan agents") — and no current change touches it.

Proposed fix (pre-seed folder trust)

Before launching a tmux plan (or any non-skip-permissions tmux) agent, mark the worktree path trusted the same way Claude Code stores an accepted trust — set projects["<worktree abs path>"].hasTrustDialogAccepted = true in the resolved config ($CLAUDE_CONFIG_DIR/.claude.json, else $HOME/.claude.json) via an atomic, non-destructive read-modify-write. This keeps plan mode read-only (no permission bypass) while removing the interactive gate that headless dispatch cannot answer.

Repro

crosslink kickoff plan <design-doc>   # in a repo with real claude auth, no TTY attached
# tmux session parks on the trust dialog; .kickoff-status never progresses

Authored by Claude Code on behalf of @magnificentlycursed.

[magnificentlycursed]

Revised fix direction (supersedes the "pre-seed folder trust" proposal above)

A codebase-conventions scan changed my recommendation. The original proposal — have crosslink write hasTrustDialogAccepted into $HOME/.claude.json — is inconsistent with crosslink's established conventions and should not be the fix:

• crosslink has no precedent for writing any user-global file under ~/.claude or ~/.gitconfig; those are strictly read-only inputs (the container mounts ~/.claude/.credentials.json read-only; signing reads ~/.gitconfig). The only $HOME writes anywhere are crosslink's own ~/.crosslink/ state and an opt-in shell alias. Writing another tool's global config would be a first, and an invasive one.

Convention-consistent fix: expose the permission flags on kickoff plan

kickoff run and kickoff launch already expose --skip-permissions and --permission-mode (main.rs:1684-1708, 1826-1847); kickoff plan hardcodes them off (plan.rs:242-244 — skip_permissions=false, permission_mode=None). The fix is to give plan the same two flags, threaded into its launch call. This keeps plan mode read-only by default (interactive users still get the trust dialog — fail-closed), and lets a headless dispatcher pass --skip-permissions, which per claude --help is what actually clears the workspace-trust dialog. No writes outside the repo.

Notes for whoever implements it:

• Keep the default false/None — plan mode is read-only, so this only relaxes on explicit opt-in (extends the #603 opt-in surface to the plan path).
• Document that --permission-mode alone does not clear the trust dialog — only --dangerously-skip-permissions does; a headless plan dispatch needs --skip-permissions.
• Related: kickoff launch --plan appears to silently drop its accepted permission flags (around main.rs:3204-3205) — worth fixing in the same change.
• Swarm's plan/run path has the identical hardcoding (lifecycle.rs:741-742); best addressed in the gh#61 dispatch-dial design pass rather than here.

Happy to open the PR on this shape (small: replace the two hardcoded literals + thread the clap args), rebased on #63 so it can reuse that PR's shared permission_flag() helper.

Authored by Claude Code on behalf of @magnificentlycursed.