@rubytech/create-maxy-code 0.1.605 → 0.1.606

package/dist/__tests__/claude-trust-seed.test.js

@@ -0,0 +1,125 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { seedClaudeTrust, formatTrustSeedLine } from "../claude-trust-seed.js";
+const ROOT = "/home/neo/maxy-code/data/accounts";
+const A = `${ROOT}/aaa`;
+const B = `${ROOT}/bbb`;
+test("seeds every account directory that exists, alongside $HOME", () => {
+    const r = seedClaudeTrust({
+        state: {},
+        homeWorkspace: "/home/neo",
+        accountsRoot: ROOT,
+        accountDirs: [A, B],
+    });
+    const projects = r.state.projects;
+    assert.equal(projects["/home/neo"].hasTrustDialogAccepted, true);
+    assert.equal(projects[A].hasTrustDialogAccepted, true);
+    assert.equal(projects[B].hasTrustDialogAccepted, true);
+    assert.equal(r.state.hasCompletedOnboarding, true);
+    assert.deepEqual({ accounts: r.accounts, seeded: r.seeded, alreadyTrusted: r.alreadyTrusted, stale: r.stale }, { accounts: 2, seeded: 2, alreadyTrusted: 0, stale: 0 });
+});
+test("preserves other keys on an account entry and counts an existing true as already-set", () => {
+    const r = seedClaudeTrust({
+        state: {
+            numStartups: 519,
+            projects: {
+                [A]: { hasTrustDialogAccepted: true, exampleFilesGenerated: true },
+                [B]: { hasTrustDialogAccepted: false, lastCost: 1.5 },
+            },
+        },
+        homeWorkspace: "/home/neo",
+        accountsRoot: ROOT,
+        accountDirs: [A, B],
+    });
+    const projects = r.state.projects;
+    assert.equal(r.state.numStartups, 519);
+    assert.equal(projects[A].exampleFilesGenerated, true);
+    assert.equal(projects[B].lastCost, 1.5);
+    assert.equal(projects[B].hasTrustDialogAccepted, true);
+    assert.equal(r.alreadyTrusted, 1);
+    assert.equal(r.seeded, 1);
+});
+test("an entry whose directory is gone keeps its value and counts as stale", () => {
+    const gone = `${ROOT}/deleted`;
+    const r = seedClaudeTrust({
+        state: { projects: { [gone]: { hasTrustDialogAccepted: false } } },
+        homeWorkspace: "/home/neo",
+        accountsRoot: ROOT,
+        accountDirs: [A],
+    });
+    const projects = r.state.projects;
+    assert.equal(projects[gone].hasTrustDialogAccepted, false);
+    assert.equal(r.stale, 1);
+    assert.equal(r.accounts, 1);
+});
+// The CLI records an entry for any directory a session ran in, so an account's
+// own subdirectories sit under the accounts root too. Counting them as stale
+// accounts would inflate the field for every operator who worked inside one.
+test("a subdirectory of a live account is not counted as a stale account", () => {
+    const r = seedClaudeTrust({
+        state: {
+            projects: {
+                [A]: { hasTrustDialogAccepted: true },
+                [`${A}/sites/portal`]: { hasTrustDialogAccepted: true },
+            },
+        },
+        homeWorkspace: "/home/neo",
+        accountsRoot: ROOT,
+        accountDirs: [A],
+    });
+    assert.equal(r.stale, 0);
+});
+test("no account directories is accounts=0, not a throw", () => {
+    const r = seedClaudeTrust({
+        state: {},
+        homeWorkspace: "/home/neo",
+        accountsRoot: ROOT,
+        accountDirs: [],
+    });
+    assert.equal(r.accounts, 0);
+    assert.equal(r.state.projects["/home/neo"] !== undefined, true);
+});
+// deployPayload() runs before setupAccount(), so on a FRESH install the first
+// pass sees no accounts directory at all and the account that setupAccount
+// then creates would never be trusted. The installer therefore primes twice;
+// this pins the shape that second pass depends on.
+test("fresh-install shape: an empty first pass then a second pass seeds the new account", () => {
+    const first = seedClaudeTrust({
+        state: {},
+        homeWorkspace: "/home/neo",
+        accountsRoot: ROOT,
+        accountDirs: [],
+    });
+    assert.equal(first.accounts, 0);
+    assert.equal(first.seeded, 0);
+    const second = seedClaudeTrust({
+        state: first.state,
+        homeWorkspace: "/home/neo",
+        accountsRoot: ROOT,
+        accountDirs: [A],
+    });
+    const projects = second.state.projects;
+    assert.equal(projects[A].hasTrustDialogAccepted, true);
+    assert.equal(second.accounts, 1);
+    assert.equal(second.seeded, 1);
+    assert.equal(projects["/home/neo"].hasTrustDialogAccepted, true);
+});
+test("the install line names which pass ran", () => {
+    const r = seedClaudeTrust({
+        state: {},
+        homeWorkspace: "/home/neo",
+        accountsRoot: ROOT,
+        accountDirs: [A],
+    });
+    const line = formatTrustSeedLine("/cfg/.claude.json", "/home/neo", r, "none", "post-account");
+    assert.equal(line, "  [install] op=claude-trust-seed phase=post-account file=/cfg/.claude.json home=/home/neo" +
+        " accounts=1 seeded=1 alreadyTrusted=0 stale=0 error=none");
+});
+test("second run over the first run's output is byte-identical", () => {
+    const input = { state: {}, homeWorkspace: "/home/neo", accountsRoot: ROOT, accountDirs: [A, B] };
+    const first = seedClaudeTrust(input);
+    const second = seedClaudeTrust({ ...input, state: first.state });
+    assert.equal(JSON.stringify(second.state), JSON.stringify(first.state));
+    assert.equal(second.seeded, 0);
+    assert.equal(second.alreadyTrusted, 2);
+});

package/dist/claude-trust-seed.js

@@ -0,0 +1,52 @@
+// Task 2720 — Claude Code scopes folder trust to the git repository root, and
+// provision-account-dir.sh gives every account directory its own repo, so
+// trusting $HOME does not reach them. An untrusted workspace halts the
+// PTY-spawned `claude --remote-control` on the folder-trust dialog before it
+// binds, which reads downstream as `op=bind-signal-absent … pidFileSeen=false`
+// and, because /rc-spawn answers 200, reaches the operator as silence.
+//
+// Pure so the counts and the preservation invariant are testable without a
+// filesystem; the caller owns the read and the write.
+export function seedClaudeTrust(input) {
+    const state = input.state;
+    state.hasCompletedOnboarding = true;
+    state.theme = state.theme ?? "auto";
+    const projects = (state.projects ?? {});
+    const homeEntry = projects[input.homeWorkspace] ?? {};
+    homeEntry.hasTrustDialogAccepted = true;
+    projects[input.homeWorkspace] = homeEntry;
+    let seeded = 0;
+    let alreadyTrusted = 0;
+    for (const dir of input.accountDirs) {
+        const entry = projects[dir] ?? {};
+        if (entry.hasTrustDialogAccepted === true) {
+            alreadyTrusted += 1;
+        }
+        else {
+            entry.hasTrustDialogAccepted = true;
+            seeded += 1;
+        }
+        projects[dir] = entry;
+    }
+    // A deleted account cannot be spawned into, so its entry is left exactly as
+    // the CLI wrote it. Counting it separately keeps the install line's
+    // `seeded + alreadyTrusted === accounts` invariant meaningful.
+    //
+    // Direct children only. The CLI records an entry for ANY directory a session
+    // ran in, so an account's own subdirectory (a `sites/<project>` tree, say)
+    // also sits under this prefix; counting those as stale accounts would inflate
+    // the field every time somebody worked inside an account.
+    const onDisk = new Set(input.accountDirs);
+    const prefix = `${input.accountsRoot}/`;
+    const stale = Object.keys(projects).filter((k) => k.startsWith(prefix) && !k.slice(prefix.length).includes("/") && !onDisk.has(k)).length;
+    state.projects = projects;
+    return { state, accounts: input.accountDirs.length, seeded, alreadyTrusted, stale };
+}
+/** `phase` distinguishes the two passes: `deploy` seeds an upgrade's existing
+ *  accounts, `post-account` seeds the directory a fresh install just created.
+ *  Without it the two lines are byte-identical and the operator cannot tell
+ *  which pass did the work. */
+export function formatTrustSeedLine(file, home, r, error, phase) {
+    return (`  [install] op=claude-trust-seed phase=${phase} file=${file} home=${home} accounts=${r.accounts}` +
+        ` seeded=${r.seeded} alreadyTrusted=${r.alreadyTrusted} stale=${r.stale} error=${error}`);
+}

package/dist/index.js

@@ -27,6 +27,7 @@ import { parseSwVers, isSupportedMacosVersion } from "./macos-version.js";
 import { decideChromiumAction, isSnapConfinedPath } from "./snap-chromium.js";
 import { classifyPortHolder } from "./preflight-port-classifier.js";
 import { memoryControllerMissing, cmdlineAlreadyPatched, patchCmdline } from "./cgroup-memory-controller.js";
+import { seedClaudeTrust, formatTrustSeedLine } from "./claude-trust-seed.js";
 import { parsePluginList, computeInstallActions, parseExternalPlugins, findUnregisteredResyncs, discoverMarketplaceCandidateDirs, } from "./lib/plugin-install.js";
 import { findPremiumMcpDirs } from "./lib/premium-mcp-discover.js";
 import { pickBindDecision, pickEdgeBindDecision, formatEdgeBindDecision, pickWebsockifyBind, formatWebsockifyBindFile, mergeSmbConf, formatSambaMarker, SAMBA_ENABLE_UNITS, } from "./samba-provision.js";
@@ -2488,6 +2489,67 @@ function runInstallInvariantCheck(usersFile, accountsDir) {
     }
     console.log(`  ${TAG} check complete divergences=${divergences}`);
 }
+// pre-populate the brand `.claude.json` so the manager's PTY-spawned
+// `claude --verbose --remote-control` boots straight into the session URL
+// without stopping at the first-run theme picker or the workspace-trust
+// dialog. Both prompts ate the manager's 30 s url-capture window on
+// 0.1.6 / 0.1.8 installs (Pi 192.168.88.16 verified). The markers required:
+//   - hasCompletedOnboarding: true       (suppresses theme picker)
+//   - projects[<dir>].hasTrustDialogAccepted: true, for $HOME AND for every
+//     account directory (Task 2720). Claude Code scopes folder trust to the
+//     git repository root, and provision-account-dir.sh gives each account
+//     directory its own repo, so $HOME's trust does not reach them. Seeding
+//     $HOME alone left every spawn halted on the trust dialog.
+// Existing fields (firstStartTime, oauthAccount, migrationVersion, …) are
+// preserved so a brand re-install does not clobber state written by claude
+// during the previous run.
+//
+// Called TWICE, and both calls are load-bearing. `deploy` runs inside
+// deployPayload, which is where an upgrade's already-existing account
+// directories are seeded; `post-account` runs after setupAccount(), which is
+// the only point a FRESH install has an account directory on disk at all.
+// Running deploy alone would leave every fresh install untrusted and hang its
+// first session. The transform is idempotent, so the second pass rewrites
+// nothing the first already did (`seeded=0` when there was nothing new).
+function primeClaudeState(phase) {
+    const persistentDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
+    const persistentClaudeDir = join(persistentDir, ".claude");
+    mkdirSync(persistentClaudeDir, { recursive: true });
+    const claudeStateFile = join(persistentClaudeDir, ".claude.json");
+    const homeWorkspace = process.env.HOME ?? "/root";
+    let claudeState = {};
+    if (existsSync(claudeStateFile)) {
+        try {
+            claudeState = JSON.parse(readFileSync(claudeStateFile, "utf-8"));
+        }
+        catch {
+            claudeState = {};
+        }
+    }
+    // An absent accounts directory is a first install, not an error; a listing
+    // that throws is reported on the line rather than aborting the install.
+    const accountsRoot = join(INSTALL_DIR, "data/accounts");
+    let accountDirs = [];
+    let seedError = "none";
+    try {
+        if (existsSync(accountsRoot)) {
+            accountDirs = readdirSync(accountsRoot, { withFileTypes: true })
+                .filter((e) => e.isDirectory())
+                .map((e) => join(accountsRoot, e.name));
+        }
+    }
+    catch (err) {
+        seedError = err instanceof Error ? err.message : String(err);
+    }
+    const seedResult = seedClaudeTrust({
+        state: claudeState,
+        homeWorkspace,
+        accountsRoot,
+        accountDirs,
+    });
+    writeFileSync(claudeStateFile, JSON.stringify(seedResult.state, null, 2) + "\n", { mode: 0o600 });
+    console.log(formatTrustSeedLine(claudeStateFile, homeWorkspace, seedResult, seedError, phase));
+}
 function deployPayload() {
     log("8", TOTAL, `Deploying ${BRAND.productName}...`);
     if (!existsSync(PAYLOAD_DIR)) {
@@ -2511,39 +2573,8 @@ function deployPayload() {
     // `claude` SDK subprocess and admin server read from there via the
     // Environment=CLAUDE_CONFIG_DIR= block in port-resolution.ts. Fresh
     // installs prompt the operator to run `claude /login`.
-    const persistentClaudeDir = join(persistentDir, ".claude");
-    mkdirSync(persistentClaudeDir, { recursive: true });
-    // pre-populate the brand `.claude.json` so the manager's
-    // PTY-spawned `claude --verbose --remote-control` boots straight into the
-    // session URL without stopping at the first-run theme picker or the
-    // workspace-trust dialog. Both prompts ate the manager's 30 s url-capture
-    // window on 0.1.6 / 0.1.8 installs (Pi 192.168.88.16 verified). The two
-    // markers required are:
-    //   - hasCompletedOnboarding: true       (suppresses theme picker)
-    //   - projects[$HOME].hasTrustDialogAccepted: true
-    // Existing fields (firstStartTime, oauthAccount, migrationVersion, …) are
-    // preserved so a brand re-install does not clobber state written by claude
-    // during the previous run.
-    const claudeStateFile = join(persistentClaudeDir, ".claude.json");
-    const homeWorkspace = process.env.HOME ?? "/root";
-    let claudeState = {};
-    if (existsSync(claudeStateFile)) {
-        try {
-            claudeState = JSON.parse(readFileSync(claudeStateFile, "utf-8"));
-        }
-        catch {
-            claudeState = {};
-        }
-    }
-    claudeState.hasCompletedOnboarding = true;
-    claudeState.theme = claudeState.theme ?? "auto";
-    const projects = (claudeState.projects ?? {});
-    const homeEntry = projects[homeWorkspace] ?? {};
-    homeEntry.hasTrustDialogAccepted = true;
-    projects[homeWorkspace] = homeEntry;
-    claudeState.projects = projects;
-    writeFileSync(claudeStateFile, JSON.stringify(claudeState, null, 2) + "\n", { mode: 0o600 });
-    console.log(`  [install] claude-state primed: ${claudeStateFile} hasCompletedOnboarding=true trustedWorkspace=${homeWorkspace}`);
+    // primeClaudeState creates that directory, so there is no separate mkdir here.
+    primeClaudeState("deploy");
     // Brand isolation: installer does not read ~/.maxy/, ~/.cloudflared/, or
     // ~/.cloudflare/ on non-default brands. These are peer-brand or
     // shared-singleton paths.
@@ -5458,6 +5489,10 @@ try {
     registerLocalAndExternalPlugins(); // install-time plugin registration
     setupVncViewer();
     setupAccount();
+    // Task 2720 — the account directory only exists from here on a fresh
+    // install, and provision-account-dir.sh has just made it a git repo root,
+    // so this is the pass that trusts it. Idempotent on the upgrade path.
+    primeClaudeState("post-account");
     if (ENTITLEMENT_PAYLOAD) {
         writeEntitlementFromFlag(ENTITLEMENT_PAYLOAD);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.605",
+  "version": "0.1.606",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:6af2c17c66037f12d4a3172828a7db1fef57c3a15e9be8264072e9ae2ae5b362
+content-hash: sha256:4cf85978124889a43767660591634992d687b20aa692836be272c878c4505481
 brand: maxy-code
 product-name: Maxy
 ---
@@ -325,6 +325,8 @@ If you suspect background processes are piling up, run `grep '\[reaper\]' ~/.{br
 
 Every install seeds `permissions.allow:[]` plus `defaultMode:"bypassPermissions"` into both the brand-scoped settings file (`~/.{brand}/.claude/settings.json`) and every account-scoped one (`<install>/data/accounts/<id>/.claude/settings.json`). `bypassPermissions` alone stops Claude Code from sending tool calls to its remote auto-classifier (it skips all permission checks), which would otherwise surface a permission prompt in the chat that an unattended session never answers. The `allow` array stays empty and **must never contain `"*"`**: Claude Code ≥ 2.1.167 rejects `"*"` as an allow token and renders a blocking Settings Warning that, under `--remote-control`, stops every `/rc-spawn` from binding. What each subagent is allowed to use is still controlled by the `tools:` line in its agent file, not by a top-level allowlist. To verify after an install: `cat ~/.{brand}/.claude/settings.json | jq '.permissions'` (expect `allow: []`). To repair an install seeded before this change: `bash <install>/platform/scripts/backfill-bypass-permissions.sh ~/.{brand}`.
 
+**Workspace trust.** Separate from permissions, and its own way to stop a spawn dead. Claude Code refuses to start in a directory it does not trust, and it scopes that trust to the **git repository root** of the working directory rather than to any trusted ancestor. Every account directory is its own repository (`provision-account-dir.sh` runs `git init` there so Claude Code finds the account's own `.claude/` hook set), so trusting the home directory does not reach them. Every install therefore seeds `projects[<dir>].hasTrustDialogAccepted: true` into `~/.{brand}/.claude/.claude.json` for the home directory **and for every directory under `<install>/data/accounts`**, preserving all other fields the CLI wrote. Without it the PTY-spawned session halts on "Quick safety check: Is this a project you created or one you trust?" and never binds, which surfaces as a session that starts and answers nothing, with no error in the interface. The seeding runs twice per install and both passes matter: the `deploy` pass trusts the accounts an upgrade already has, and the `post-account` pass, which runs straight after account setup, trusts the account a brand-new install has only just created. The install line is `[install] op=claude-trust-seed phase=<deploy|post-account> file=… accounts=<N> seeded=<n> alreadyTrusted=<n> stale=<n> error=<none|msg>`; `seeded + alreadyTrusted` equals `accounts`, and a re-run reads `seeded=0`. Because an account added *after* an install has an untrusted repository root that no event announces, the session manager reconciles the two every hour and logs `[claude-trust-census] accounts=<N> trusted=<n> untrusted=<n> untrustedDirs=<csv|none> homeTrusted=<bool> onboarded=<bool>` — a non-zero `untrusted` names the directories whose next session will hang. To verify after an install: `node -e 'const j=require(process.env.HOME+"/.{brand}/.claude/.claude.json");const p=j.projects||{};for(const k of Object.keys(p))if(k.includes("/data/accounts/"))console.log(k,p[k].hasTrustDialogAccepted)'` (expect `true` for every account directory that exists).
+
 **`autoMode` trust block.** The same brand-scoped writer ([`permissions-seed.ts`](../../../packages/create-maxy-code/src/permissions-seed.ts), `AUTO_MODE_BLOCK`) also seeds the harness `autoMode` block. `bypassPermissions` skips the auto-mode classifier entirely, so the block is **belt-and-suspenders**: it only matters when a session is toggled into `auto` mode, where the classifier otherwise soft-denies the doctrine-sanctioned Cloudflare scoped-token mint ("permission/credential escalation") because the install's own Cloudflare infra is not in the classifier's default trusted environment. The block keeps `"$defaults"` first in `environment` and `allow` (so the built-in Data-Exfiltration / force-push / prod-deploy guards stay intact) and adds prose declaring `api.cloudflare.com` the install's own provider endpoint plus an allow for minting/persisting narrow per-scope tokens. It is seeded **only** into the brand/user settings (`~/.{brand}/.claude/settings.json`) — the classifier never reads `autoMode` from the shared project (account-scoped) settings, so `setup-account.sh` does not carry it. An auto-mode agent cannot seed this itself (the default `hard_deny` "Auto-Mode Bypass" blocks any agent editing `.claude/settings*.json`); installer seed is the only path. To verify after an install: `CLAUDE_CONFIG_DIR=~/.{brand}/.claude claude auto-mode config | jq '.environment, .allow'` (expect the Cloudflare entries, `$defaults` expanded) and `jq '.autoMode' ~/.{brand}/.claude/settings.json`.
 
 ---
@@ -4095,6 +4097,19 @@ which fails `prebuild` if any emoji codepoint appears in a `.ts`/`.tsx` file
 under `app/` (tests excluded). Inline an icon at the surrounding text size and
 colour (`size={14}` matches body text; Lucide inherits `currentColor`).
 
+**A long message shows its first 8 lines.** On `/chat`, the WhatsApp and
+Telegram readers and the public visitor chat, a message body taller than 8 lines
+is cut at 8 and carries a "Show more…" control that reveals the rest; "Show
+less" puts it back. The control appears only when there is genuinely more to
+see, so a short message looks exactly as it did before. Expanding one message
+expands only that message, and scrolling back through older messages does not
+carry an expansion onto a different one. Two things are never cut: an error the
+agent reports, and the map on a shared location. The reader's search also opens
+any message whose match would otherwise sit in the hidden part, so a search
+never finds something it then hides. See
+[`.docs/message-body-clamp.md`](../../../.docs/message-body-clamp.md) for the
+render sites and the census that watches it.
+
 ## Admin Hono routes
 
 Every admin sub-app is mounted by

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,11 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-14 (0.1.606)
+
+- Conversations start after an install again. The installer marked only your home folder as trusted, and the assistant now asks about the folder each account actually runs from, so a session would stop at a trust prompt nobody could answer.
+- A long chat message is capped at eight lines with a control to show the rest, instead of filling the pane.
+
 ## 2026-08-14 (0.1.605)
 
 - Five more routines now check whether there is anything to do before waking the assistant. Mail triage, appointment reminders, the operational and finance reconciles, and the two health reports all previously ran on the clock and did the deciding after starting up.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -37,6 +37,19 @@ which fails `prebuild` if any emoji codepoint appears in a `.ts`/`.tsx` file
 under `app/` (tests excluded). Inline an icon at the surrounding text size and
 colour (`size={14}` matches body text; Lucide inherits `currentColor`).
 
+**A long message shows its first 8 lines.** On `/chat`, the WhatsApp and
+Telegram readers and the public visitor chat, a message body taller than 8 lines
+is cut at 8 and carries a "Show more…" control that reveals the rest; "Show
+less" puts it back. The control appears only when there is genuinely more to
+see, so a short message looks exactly as it did before. Expanding one message
+expands only that message, and scrolling back through older messages does not
+carry an expansion onto a different one. Two things are never cut: an error the
+agent reports, and the map on a shared location. The reader's search also opens
+any message whose match would otherwise sit in the hidden part, so a search
+never finds something it then hides. See
+[`.docs/message-body-clamp.md`](../../../.docs/message-body-clamp.md) for the
+render sites and the census that watches it.
+
 ## Admin Hono routes
 
 Every admin sub-app is mounted by

package/payload/platform/plugins/docs/references/platform.md

@@ -198,4 +198,6 @@ If you suspect background processes are piling up, run `grep '\[reaper\]' ~/.{br
 
 Every install seeds `permissions.allow:[]` plus `defaultMode:"bypassPermissions"` into both the brand-scoped settings file (`~/.{brand}/.claude/settings.json`) and every account-scoped one (`<install>/data/accounts/<id>/.claude/settings.json`). `bypassPermissions` alone stops Claude Code from sending tool calls to its remote auto-classifier (it skips all permission checks), which would otherwise surface a permission prompt in the chat that an unattended session never answers. The `allow` array stays empty and **must never contain `"*"`**: Claude Code ≥ 2.1.167 rejects `"*"` as an allow token and renders a blocking Settings Warning that, under `--remote-control`, stops every `/rc-spawn` from binding. What each subagent is allowed to use is still controlled by the `tools:` line in its agent file, not by a top-level allowlist. To verify after an install: `cat ~/.{brand}/.claude/settings.json | jq '.permissions'` (expect `allow: []`). To repair an install seeded before this change: `bash <install>/platform/scripts/backfill-bypass-permissions.sh ~/.{brand}`.
 
+**Workspace trust.** Separate from permissions, and its own way to stop a spawn dead. Claude Code refuses to start in a directory it does not trust, and it scopes that trust to the **git repository root** of the working directory rather than to any trusted ancestor. Every account directory is its own repository (`provision-account-dir.sh` runs `git init` there so Claude Code finds the account's own `.claude/` hook set), so trusting the home directory does not reach them. Every install therefore seeds `projects[<dir>].hasTrustDialogAccepted: true` into `~/.{brand}/.claude/.claude.json` for the home directory **and for every directory under `<install>/data/accounts`**, preserving all other fields the CLI wrote. Without it the PTY-spawned session halts on "Quick safety check: Is this a project you created or one you trust?" and never binds, which surfaces as a session that starts and answers nothing, with no error in the interface. The seeding runs twice per install and both passes matter: the `deploy` pass trusts the accounts an upgrade already has, and the `post-account` pass, which runs straight after account setup, trusts the account a brand-new install has only just created. The install line is `[install] op=claude-trust-seed phase=<deploy|post-account> file=… accounts=<N> seeded=<n> alreadyTrusted=<n> stale=<n> error=<none|msg>`; `seeded + alreadyTrusted` equals `accounts`, and a re-run reads `seeded=0`. Because an account added *after* an install has an untrusted repository root that no event announces, the session manager reconciles the two every hour and logs `[claude-trust-census] accounts=<N> trusted=<n> untrusted=<n> untrustedDirs=<csv|none> homeTrusted=<bool> onboarded=<bool>` — a non-zero `untrusted` names the directories whose next session will hang. To verify after an install: `node -e 'const j=require(process.env.HOME+"/.{brand}/.claude/.claude.json");const p=j.projects||{};for(const k of Object.keys(p))if(k.includes("/data/accounts/"))console.log(k,p[k].hasTrustDialogAccepted)'` (expect `true` for every account directory that exists).
+
 **`autoMode` trust block.** The same brand-scoped writer ([`permissions-seed.ts`](../../../packages/create-maxy-code/src/permissions-seed.ts), `AUTO_MODE_BLOCK`) also seeds the harness `autoMode` block. `bypassPermissions` skips the auto-mode classifier entirely, so the block is **belt-and-suspenders**: it only matters when a session is toggled into `auto` mode, where the classifier otherwise soft-denies the doctrine-sanctioned Cloudflare scoped-token mint ("permission/credential escalation") because the install's own Cloudflare infra is not in the classifier's default trusted environment. The block keeps `"$defaults"` first in `environment` and `allow` (so the built-in Data-Exfiltration / force-push / prod-deploy guards stay intact) and adds prose declaring `api.cloudflare.com` the install's own provider endpoint plus an allow for minting/persisting narrow per-scope tokens. It is seeded **only** into the brand/user settings (`~/.{brand}/.claude/settings.json`) — the classifier never reads `autoMode` from the shared project (account-scoped) settings, so `setup-account.sh` does not carry it. An auto-mode agent cannot seed this itself (the default `hard_deny` "Auto-Mode Bypass" blocks any agent editing `.claude/settings*.json`); installer seed is the only path. To verify after an install: `CLAUDE_CONFIG_DIR=~/.{brand}/.claude claude auto-mode config | jq '.environment, .allow'` (expect the Cloudflare entries, `$defaults` expanded) and `jq '.autoMode' ~/.{brand}/.claude/settings.json`.

package/payload/platform/services/claude-session-manager/dist/claude-trust-census.d.ts

@@ -0,0 +1,34 @@
+export type Logger = (line: string) => void;
+export interface TrustFacts {
+    accounts: number;
+    trusted: number;
+    untrusted: number;
+    untrustedDirs: string[];
+    homeTrusted: boolean;
+    onboarded: boolean;
+}
+/** Pure. An account directory with no entry counts as untrusted, not absent. */
+export declare function collectTrustFacts(input: {
+    state: Record<string, unknown>;
+    homeWorkspace: string;
+    accountDirs: string[];
+}): TrustFacts;
+/** Pure. */
+export declare function formatTrustCensus(f: TrustFacts): string;
+export interface TrustCensusDeps {
+    claudeJsonPath: string;
+    accountsDir: string;
+    homeWorkspace: string;
+    logger: Logger;
+    intervalMs: number;
+    /** Injected in tests so the collector runs without a filesystem. */
+    readState?: () => Record<string, unknown>;
+    listAccountDirs?: () => string[];
+}
+export interface TrustCensus {
+    tickOnce(): void;
+    start(): void;
+    stop(): void;
+}
+export declare function createClaudeTrustCensus(deps: TrustCensusDeps): TrustCensus;
+//# sourceMappingURL=claude-trust-census.d.ts.map

package/payload/platform/services/claude-session-manager/dist/claude-trust-census.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-trust-census.d.ts","sourceRoot":"","sources":["../src/claude-trust-census.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;AAE3C,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,EAAE,OAAO,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB,GAAG,UAAU,CAWb;AAED,YAAY;AACZ,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,eAAe,CAAC,EAAE,MAAM,MAAM,EAAE,CAAA;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,IAAI,IAAI,CAAA;IAChB,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CA6C1E"}

package/payload/platform/services/claude-session-manager/dist/claude-trust-census.js

@@ -0,0 +1,83 @@
+// Task 2720 — standing reconciliation of account directories against the
+// workspace-trust entries in the brand's `.claude.json`.
+//
+// Claude Code scopes folder trust to the git repository root, and
+// provision-account-dir.sh gives every account directory its own repo, so a
+// directory with no `hasTrustDialogAccepted: true` entry halts the spawned
+// child on the folder-trust dialog before it binds.
+//
+// Two of that defect's failure modes emit no event and do not reproduce on
+// demand: an installer enumeration that skipped a directory, and an account
+// created after the install (a fresh repo root with no entry). Neither
+// produces a log line until somebody tries to spawn a session there, and by
+// then the symptom is a 60 s bind timeout that `/rc-spawn`'s 200 turns into
+// silence. Only a periodic reconcile of expected against actual surfaces them.
+//
+// Shape mirrors the other standing censuses in this service (a pure collector,
+// a pure formatter, and a start/stop factory whose setInterval is unref'd):
+// see `role-census.ts`.
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+const TAG = '[claude-trust-census]';
+/** Pure. An account directory with no entry counts as untrusted, not absent. */
+export function collectTrustFacts(input) {
+    const projects = (input.state.projects ?? {});
+    const untrustedDirs = input.accountDirs.filter((d) => projects[d]?.hasTrustDialogAccepted !== true);
+    return {
+        accounts: input.accountDirs.length,
+        trusted: input.accountDirs.length - untrustedDirs.length,
+        untrusted: untrustedDirs.length,
+        untrustedDirs,
+        homeTrusted: projects[input.homeWorkspace]?.hasTrustDialogAccepted === true,
+        onboarded: input.state.hasCompletedOnboarding === true,
+    };
+}
+/** Pure. */
+export function formatTrustCensus(f) {
+    const dirs = f.untrustedDirs.length === 0 ? 'none' : f.untrustedDirs.join(',');
+    return (`${TAG} accounts=${f.accounts} trusted=${f.trusted} untrusted=${f.untrusted}` +
+        ` untrustedDirs=${dirs} homeTrusted=${f.homeTrusted} onboarded=${f.onboarded}`);
+}
+export function createClaudeTrustCensus(deps) {
+    let timer = null;
+    const readState = deps.readState ??
+        (() => JSON.parse(readFileSync(deps.claudeJsonPath, 'utf-8')));
+    const listAccountDirs = deps.listAccountDirs ??
+        (() => readdirSync(deps.accountsDir, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => join(deps.accountsDir, e.name)));
+    function tickOnce() {
+        try {
+            const facts = collectTrustFacts({
+                state: readState(),
+                homeWorkspace: deps.homeWorkspace,
+                accountDirs: listAccountDirs(),
+            });
+            // Emitted on a clean result too. A quiet interval is itself the signal
+            // that the census is alive, so a missing line means the audit stopped
+            // rather than that every directory is trusted.
+            deps.logger(formatTrustCensus(facts));
+        }
+        catch (err) {
+            deps.logger(`${TAG} op=census-failed message=${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return {
+        tickOnce,
+        start() {
+            if (timer)
+                return;
+            timer = setInterval(tickOnce, deps.intervalMs);
+            if (typeof timer.unref === 'function')
+                timer.unref();
+            deps.logger(`${TAG} op=census-started intervalMs=${deps.intervalMs}`);
+        },
+        stop() {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=claude-trust-census.js.map

package/payload/platform/services/claude-session-manager/dist/claude-trust-census.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-trust-census.js","sourceRoot":"","sources":["../src/claude-trust-census.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,yDAAyD;AACzD,EAAE;AACF,kEAAkE;AAClE,4EAA4E;AAC5E,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,wBAAwB;AACxB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,GAAG,GAAG,uBAAuB,CAAA;AAanC,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,KAIjC;IACC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAwD,CAAA;IACpG,MAAM,aAAa,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,sBAAsB,KAAK,IAAI,CAAC,CAAA;IACnG,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;QAClC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM;QACxD,SAAS,EAAE,aAAa,CAAC,MAAM;QAC/B,aAAa;QACb,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,sBAAsB,KAAK,IAAI;QAC3E,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,sBAAsB,KAAK,IAAI;KACvD,CAAA;AACH,CAAC;AAED,YAAY;AACZ,MAAM,UAAU,iBAAiB,CAAC,CAAa;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9E,OAAO,CACL,GAAG,GAAG,aAAa,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,SAAS,EAAE;QAC7E,kBAAkB,IAAI,gBAAgB,CAAC,CAAC,WAAW,cAAc,CAAC,CAAC,SAAS,EAAE,CAC/E,CAAA;AACH,CAAC;AAmBD,MAAM,UAAU,uBAAuB,CAAC,IAAqB;IAC3D,IAAI,KAAK,GAA0C,IAAI,CAAA;IAEvD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS;QACd,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAA4B,CAAC,CAAA;IAE3F,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe;QACpB,CAAC,GAAG,EAAE,CACJ,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACnD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAElD,SAAS,QAAQ;QACf,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,CAAC;gBAC9B,KAAK,EAAE,SAAS,EAAE;gBAClB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,eAAe,EAAE;aAC/B,CAAC,CAAA;YACF,uEAAuE;YACvE,sEAAsE;YACtE,+CAA+C;YAC/C,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpG,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,KAAK;YACH,IAAI,KAAK;gBAAE,OAAM;YACjB,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAC9C,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;YACpD,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,iCAAiC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QACvE,CAAC;QACD,IAAI;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/index.js

@@ -36,6 +36,7 @@ import { createPermissionModeTail } from './permission-mode-tail.js';
 import { createReaper } from './reaper.js';
 import { createReachabilityAudit } from './public-agent-reachability.js';
 import { createRoleCensus } from './role-census.js';
+import { createClaudeTrustCensus } from './claude-trust-census.js';
 import { createPublicPromptSurfaceCensus } from './public-prompt-surface.js';
 import { createPublicKnowledgeAudit, readPublicAgentKnowledge } from './public-knowledge-audit.js';
 import { createPtyCensus } from './pty-census.js';
@@ -1264,6 +1265,18 @@ async function main() {
         intervalMs: 900_000,
     });
     quoteReconcile.start();
+    // Task 2720 — hourly reconcile of account directories against their
+    // workspace-trust entries in the brand's `.claude.json`. An account created
+    // after the install is a fresh git repo root with no trust entry, and
+    // nothing announces it: the first spawn there halts on the folder-trust
+    // dialog and /rc-spawn's 200 hides the failure. Purely filesystem.
+    createClaudeTrustCensus({
+        claudeJsonPath: join(claudeConfigDirResolved, '.claude.json'),
+        accountsDir: dirname(config.accountDir),
+        homeWorkspace: process.env.HOME ?? '/root',
+        logger: log,
+        intervalMs: 3_600_000,
+    }).start();
     // Task 183 — recorder JSONL tail. Posts [recorder-session-init] and
     // [recorder-turn] lines for every database-operator specialist spawn,
     // routed through the platform UI's /api/admin/log-ingest loopback