[backnotprop]

Stacked on #2402 (feat/inbox-launch-host).

What changes

Trust and start in New message is now the main path (approval .product/approved/inbox-launch-trust-compose/). On a folder Claude Code doesn't trust, New message's button reads Trust and start. One press trusts the folder and starts, with no confirm step.

• A question circle beside the button opens the details: "Trust ?", naming the folder the trust lands on, and short fact lines, with no button inside. Press again, Escape or a press outside closes them.
• The circle takes the warning color when the folder has hooks, MCP servers, helper commands, env settings, tools without asking, outside folders or unreadable files. "Whole repository, not just " alone keeps it quiet. A clean folder has no circle. Scratch folders work the same way.
• A trusted folder keeps plain Send. Home, /, a folder above home and guests get no offer.
• Cmd/Ctrl+Enter does what the button does, once. There are no new shortcuts.
• On a phone, the button and circle sit in the bottom bar, the top bar keeps Cancel and the title, and the details open in the Inbox's bottom sheet. Main's Inbox: Send in a phone's bottom row, head folds over the keyboard #2466 puts a phone's Send in the bottom bar for every message, so a trusted folder's Send sits there too, with no circle.
• The status line about starting a session is gone from the footer on every launch.

The thread's Trust folder button stays as the fallback for a launch that still stops on trust.

The press is the consent

• GET /api/inbox/sessions carries launch.agents[i].untrusted, from the cached trusts(), so the 5 s refresh reads no folder's files. ?trust_agent=&trust_project= adds facts and warns for the folder To names. Facts and the run line's warning come from one reading (claudeTrustReading).
• A Send carries to.launch.trust: { folder, facts }. If the folder changed since that reading, the answer is 409 trust_warning_changed: nothing is trusted, sent or made. The window reads again, opens the details on what changed, and ignores presses for 600 ms.
• Order: validate, trust, write the thread, start. A taken thread name or a bad upload refuses before the trust is saved. 409 trust_failed sends nothing, keeps the words and removes a scratch folder made for that Send.

The gate

Compose's Send can now write the person's Claude config, so to.launch.trust belongs to the owner's window alone.

Caller	Answer
The owner's window, or the owner's login over the tailnet	Goes through
An agent's bare call, a bearer token, no serverSession	403 window_only
An MCP client	send_message has no such field
The device door	Refused, and gets no offer
A guest on the allow list	403 owner_only, and gets no offer
Another site's page	403 cross_origin
A tab from an older run	409, stale tab

A trust key that holds nothing still counts as a press, so null can't pass as a plain launch. Behavior change: POST /api/inbox/launch/:id/trust now has the same window check. Before, a bare local call counted as the owner. A local program that forges Origin and reads serverSession stays "Accepted, not defended" in inbox-launch.md.

The thread's Trust folder button

When Claude Code refuses a start or a restart because the folder isn't trusted, the run line gets a Trust folder button. One click saves the trust, then starts the launch again, so the kept message goes out with no second click.

• It works over the tailnet and on a phone, where Open in Terminal is hidden. It's for the machine's owner only: a guest on the allow list gets no button, and the route answers 403 owner_only.
• Before the click, one plain line says what Claude's own trust prompt warns on, such as "This folder has 2 hooks, 1 MCP server and env settings that will run once you trust it." A folder with none of these shows no line.
• The click sends the line it showed. A folder that changed since saves nothing and answers the new line; the next click goes through.
• A failed write says why under the line, and the message stays kept.
• The home folder, the file-system root and a folder above home get no button. With no button the line says how to trust a folder by hand, and that the home folder can't be trusted: Claude never saves trust there, so accepting its prompt does nothing.
• Every launch's settings file sets enableAllProjectMcpServers: true: Claude's "New MCP server found" prompt would otherwise hold the hidden session, and the folder's hooks behind it. disabledMcpjsonServers still wins. Found by a real claude check of ffc4d22.

The write

It sets projects["<key>"].hasTrustDialogAccepted = true in the file Claude picks: a legacy .config.json when it applies, else $CLAUDE_CONFIG_DIR/.claude.json, else ~/.claude.json, with the custom OAuth name when that is set. Only that value changes: every other byte stays, and so does the file's mode. A symlinked config is written at its target. The write is flushed to disk before the rename, as Claude's own save is.

• The key: the physical NFC path of the git root (a linked worktree's main checkout), else the folder. A scratch launch trusts the scratch root.
• The lock: Claude's own, read from the 2.1.316 binary. It is a directory made with mkdir at <config path>.lock and released with rmdir. It counts as dead once its mtime is 10 s old. The Inbox holds it only for a synchronous read, edit and rename.
• Refusals: a file that isn't JSON, is empty, is over 32 MiB, or whose lock stays held for 12 s is never replaced. An empty file is Claude's to repair.

claudeTrustsFolder now reads the same key, which fixes the two mismatches: a linked worktree of a trusted repository reads as trusted, and paths compare physically.

Open in Terminal

Owner's decision, in its own commit: out of the ⋯ menu. It shows on the thread's status line only when a session is waiting on Terminal or can't start. Copy attach command stays in ⋯.

• The thread decides it once (openTerminal), for the line and for Approve in Terminal on the permission card, with the rule the ⋯ item had: not on a phone or over the tailnet, and only with a session or a refused folder.
• Fix: the run line drew the button in a tailnet window, where the route refuses it. It no longer does, and that window gets the phone's "Answer it in Terminal on your Mac:" line above the command.
• New on the line: a failed line with a session (never connected, a restart that failed) has the button. ⋯ used to be its only way there. The rule looks at the session, not at attach_command, so a host that offers no attach command while something holds the session still has it.
• The press re-reads the line, as ⋯'s did, so a host's hand-off shows at once.
• The route and each host's terminal() are unchanged, so a host's own guard on the command stands. That's the guard against a second writer on feat/inbox-launch-pi.

Fixes from the security review

• New message on a slow read: an answer with a newer read behind it was dropped and the 5 s refresh asked again, so a sessions read taking 5 s or more left compose empty and Send doing nothing. That also reached people with launching off. An answer is now dropped only when it was asked for another folder.
• Open route: a test now posts to it over the tailnet, as owner, guest and no owner, and gets 403 owner_only.
• Thread name: it's checked again with Claude's lock held, so a name taken during the lock wait saves no trust. accept takes an allowed callback for this.
• One offer: Send saves the offer the press was compared with, not a second one.
• FIFOs: claudeTrustKey skips a .git that isn't a regular file or folder, and reads its pointer files through readAgentFile, so a FIFO can't block the Inbox.

Copy and docs

• The untrusted cause is now " isn't a trusted folder yet." The old text told a phone to open Terminal.
• The scratch row's "trust it once" hint now shows only where no press can trust the root (a guest, a root at home).
• inbox-launch.md covers Trust and start, the offer, the press, the gate and the seam (trustOffer(target): { folder, read(), accept() }), and no longer says the Inbox never edits ~/.claude.json.
• server-and-storage.md has the new route and fields.

Test sandbox

Under PLANNOTATOR_TEST_SANDBOX, the server's launch home is now <dataDir>/agents-home, so a test that clicks through the real server can't reach the real ~/.claude.json. refuseRealClaudeConfig refuses a home or its Claude folder as a test's config dir. startInboxServer gains a launchHosts test seam, and fakeLaunchHost moved to tests/helpers/.

Tests

• Compiled build, Playwright, Chromium, fake claude: the launch specs run in CI's Inbox window e2e on this PR, on Linux. Locally, the five (inbox-launch-claude, -permission, -scratch, -trust, -trust-compose) with the Pi spec, 54 passed on a trial merge of this branch and Inbox launch: Pi host #2412. The compose spec covers desktop and phones 390 and 320 wide.
• Server, on a real server with a fake host: inbox-launch-trust-send.test.ts, 32 tests for the gate, the order, 409 and trust_failed.
• DOM: composeTrust.test.tsx (23) and openInTerminal.test.tsx (9), both rendering the real components.
• CI on this head (ci:full): unit-1 to unit-3, dom-1 to dom-4, heavy-agents, heavy-mod and Checks all pass.
• Mutation checks, each reverted: the gate, the owner check, the reading comparison, the held-key and 600 ms guards, the Open in Terminal rule, the tailnet line on the Open route, the old useComposeSessions check, the name re-check under the lock, the reused offer, and both FIFO guards each failed tests when removed or changed.
• Not run: heavy-* lanes, the full bun test, WebKit, and real CLIs. The real-CLI check is the owner's.