[ILobeMh]

Problem

Since Claude Code ~2.1.260, launching claude in a directory that isn't trusted yet shows this first:

 Quick safety check: Is this a project you created or one you trust? …
 ❯ No, exit
   Yes, I trust this folder
 Enter to confirm · Esc to cancel

The options have no numbers now, and "No, exit" is the default. ccbot never answers the dialog, so a new session breaks:

1. The SessionStart hook doesn't fire, so the 5s wait_for_session_map_entry times out.
2. The topic's pending first message is typed into the dialog. Enter on the default option exits Claude Code.
3. The topic is left bound to a bare shell, and later messages (/model, /context, …) go to zsh (zsh: no such file or directory: /model).

Fix

• Pre-trust before launch. The new claude_config.ensure_trusted_directory() sets projects[<path>].hasTrustDialogAccepted = true in ~/.claude.json (honours CLAUDE_CONFIG_DIR). This is the documented way to trust a folder. The key is the git repo root when inside a repo, otherwise the directory itself, which matches how Claude Code keys trust. The write is atomic and keeps the file mode. It does nothing if the folder is already trusted, and leaves a missing or malformed file untouched. Set CCBOT_AUTO_TRUST_DIRS=false to turn it off.
• Fallback if the dialog still appears. One case is the home directory, whose trust Claude Code doesn't save. A TrustDialog UI pattern and TmuxManager.auto_answer_dialog() move the ❯ cursor onto "Yes, I trust", capture the pane again to check it landed there, then press Enter. It never types a digit, because the option order changed between versions and a blind 1/Enter now exits.
• Ready wait. _create_and_bind_window now waits for Claude's input box (wait_for_claude_ready) before the hook wait and before forwarding the pending message. Status polling also answers the dialog in windows that already exist.

About 170 lines of source plus tests. No behaviour change for directories that are already trusted, apart from the short ready wait.

Testing

• Unit tests use real tmux capture-pane fixtures from Claude Code 2.1.272 (trust dialog, idle prompt in manual and bypass mode). They cover the ❯ cursor being told apart from the shell's ❯ claude echo, and the answer not being confirmed when the cursor didn't move. test_claude_config.py covers the JSON edits (existing keys and file mode preserved, git-root key, missing and malformed files).
• End-to-end on macOS (tmux 3.6b, Claude Code 2.1.272): claude in a fresh untrusted directory. The dialog was answered and the prompt was ready in about 3s.
• pytest: 274 passed; pyright: 0 errors.