diff --git a/CLAUDE.md b/CLAUDE.md
index 875a9b8..ac22cd1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -31,7 +31,7 @@ npm run release <patch|minor|major|x.y.z>  # bump, commit, tag, push → GitHub
 npm run release:mac                         # on the Mac with the cert: build, notarize, verify, upload, bump the cask
 ```
 
-No linting and no build step configured. `npm test` chains 88 test files under `test/`: 19 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 69 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), session expiry (`session-expiry.test.js` boots a real server TWICE against one `APP_DIR`, ages sessions in SQLite between the boots, and pins that expiry removes the worktree, branch and queued messages of a clean session while keeping one with uncommitted work, its Kanban cards, and an orphan tree younger than an hour), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow). `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
+No linting and no build step configured. `npm test` chains 89 test files under `test/`: 19 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 70 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), session expiry (`session-expiry.test.js` boots a real server TWICE against one `APP_DIR`, ages sessions in SQLite between the boots, and pins that expiry removes the worktree, branch and queued messages of a clean session while keeping one with uncommitted work, its Kanban cards, and an orphan tree younger than an hour), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the interactive TUI's first-run screens (`claude-firstrun.test.js` reads the theme picker, trust question and Bypass Permissions warning CAPTURED from CLI 2.1.288 in `test/fixtures/claude-tui/`, pins the config seed, and drives `runInteractiveSingle` against a fake `claude` drawing the trust screen to prove nothing is pasted into it), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow). `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
 
 ## Architecture
 
@@ -923,6 +923,75 @@ session.
   bug and it was discarded at the spawn, leaving one generic line on screen. It is now
   appended to the `error` frame.
 
+### First-run screens of the interactive TUI (claude-firstrun.js)
+
+Measured on CLI 2.1.288 with an empty HOME: an interactive `claude
+--dangerously-skip-permissions` stops on up to three screens before its input box —
+the theme picker, "do you trust this folder?" and the Bypass Permissions warning. The
+subscription engine pasted the user's message into whichever was up; two open with the
+caret on **"No, exit"**, so Enter quit `claude`, the message was lost, and the chat
+said only "failed to start" or "went idle". Every fresh Docker container hit it, which
+is how a third-party image found it (it pre-seeds the keys in its entrypoint).
+
+- **None of the three is numbered, so the #20 detector never saw them.**
+  `paneAwaitingSelection()` adds the unnumbered select, still without matching any
+  wording: in a usable pane the LAST caret line is inside the input box; a dialog
+  replaces the box, so its last caret line has text and a sibling option indented
+  deeper. `_inInputBox()` is the one definition of "the input box", and both branches
+  (numbered and not) consult it, so a draft the user typed — `1. fix tests`, or one
+  quoting `❯ npm test` — never reads as a widget. The box is a region between two
+  horizontal rules whose FIRST line is the caret. "Between two rules" alone is wrong,
+  and a review proposed exactly that: the real AskUserQuestion widget
+  (`test/fixtures/claude-tui/askuserquestion.txt`) is rule-framed too, but its first
+  framed line is a header. The frame is searched over the whole capture, never the
+  24-line tail — a long draft pushes its top rule out of any window. Past prompts in
+  the history also render as `❯ text` (measured); they are harmless because the box is
+  below them. The fixtures in
+  `test/fixtures/claude-tui/` are the real screens — re-capture them when the TUI
+  changes rather than editing them by hand.
+- **The answers are the consent `claude -p` never asks for.** The API engine runs
+  `-p --dangerously-skip-permissions` in the same directories, and `-p` skips the trust
+  dialog by documented design. So screen 3 is answered by `--settings
+  {"skipDangerousModePermissionPrompt":true}` on the spawn command — no file written —
+  and screens 1 and 2, which have no flag, by `seedClaudeFirstRun()` writing
+  `hasCompletedOnboarding` / `theme` / `projects[<dir>].hasTrustDialogAccepted` into
+  `$CLAUDE_CONFIG_DIR/.claude.json` or `~/.claude.json`.
+- **Trust is decided by the dir's OWN key, never an ancestor's.** The CLI does inherit
+  trust from a parent — but its walk stops at a git root (measured: a trusted parent
+  did not cover a child that is its own repository), and every session worktree is a
+  git root. Reading ancestors here skipped the seed in exactly the case that needs it.
+  Like the CLI's own writer, the key is the realpath AND its NFC form.
+- **That write is the user's own CLI config, and an adversarial review found five ways
+  the first version could hurt it.** Each rule below is pinned in
+  `claude-firstrun.test.js`: nothing is written when nothing is missing; a file that
+  does not parse, or is EMPTY (what a writer caught mid-save looks like), is left as
+  found; the temp file goes next to the REALPATH, so a symlinked config keeps its link,
+  and a DANGLING link is refused rather than replaced;
+  mode is `chmod`ed after the write because the umask filtered it, owner copied best
+  effort; the file is re-read just before the rename and the plan redone if a live
+  `claude` saved in between (a running `claude` merges on its own next save — measured
+  — so only that window needs care); a single-file bind mount (EBUSY on rename) is
+  backed up beside itself under a UNIQUE name (an earlier recovery copy is never
+  overwritten), re-planned from the content as it is at that moment, written in a loop
+  until every byte is out (`writeSync` may write less than asked), fsynced, and restored
+  if any of that fails. `CLAUDE_CONFIG_DIR` is resolved to an absolute path once, for
+  the seed and the pane alike. `CCS_CLAUDE_FIRSTRUN_SEED=0` opts out.
+- **What is NOT closed, stated rather than hidden:** a live `claude` saving in the gap
+  between the final re-read and the rename — two consecutive syscalls — loses that
+  save. Closing it needs the CLI's own config lock, which is not a public contract.
+  The seed writes only when a key is missing, which is the first start in a directory.
+- **The pane is pinned to the config that was seeded.** It inherits the TMUX SERVER's
+  environment, which outlives a studio restart, so `buildInteractiveCommand()` puts
+  `HOME=` and `CLAUDE_CONFIG_DIR=` (or `-u CLAUDE_CONFIG_DIR`) on the command itself.
+- **Do not use `CLAUDE_CODE_SANDBOXED` to skip the trust screen.** It does, but it is
+  undocumented and flips at least five unrelated gates in the CLI.
+- **A screen still up after `CLAUDE_STARTUP_PROMPT_WAIT_MS` is reported, never pasted
+  into.** The pre-#20 fall-through ("a false positive costs a delay, never a lost
+  message") was wrong for a TRUE positive: pasting answered "No, exit". The turn now
+  ends with the screen excerpt in the `error` frame, and Stop pressed DURING the wait
+  returns before the paste (it used to fall through and send message + Enter into the
+  dialog). `0` still skips the check.
+
 ### Composer geometry and terminal-pane control
 
 Four reports that all reduce to "the UI moved or stopped listening". Pinned by
@@ -1114,7 +1183,7 @@ Developer ID signed, notarized, **arm64 only**. Pinned by `test/mac-signing.test
 
 ## How to Verify Changes
 
-`npm test` runs 88 test files under `test/` (19 `test/render/*.test.mjs` + 69 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
+`npm test` runs 89 test files under `test/` (19 `test/render/*.test.mjs` + 70 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
 
 ```bash
 # 1. Start server
diff --git a/claude-firstrun.js b/claude-firstrun.js
new file mode 100644
index 0000000..9299a77
--- /dev/null
+++ b/claude-firstrun.js
@@ -0,0 +1,209 @@
+'use strict';
+/**
+ * First-run screens of the interactive `claude` TUI, and why the subscription engine
+ * answers two of them on the user's behalf.
+ *
+ * Measured against CLI 2.1.288 in a fresh HOME: before its input box, an interactive
+ * `claude --dangerously-skip-permissions` shows up to three blocking screens —
+ *
+ *   1. the theme picker            — gone once `hasCompletedOnboarding` is true
+ *   2. "Do you trust this folder?" — gone once `projects[<dir>].hasTrustDialogAccepted`
+ *                                    is true. An ancestor's entry counts only up to a
+ *                                    git root — measured: a trusted parent does NOT
+ *                                    cover a child that is its own repository, which is
+ *                                    exactly what every session worktree is
+ *   3. the Bypass Permissions warning — gone with `skipDangerousModePermissionPrompt`
+ *
+ * None of them is numbered, so the #20 detector did not see them, and 2 and 3 open
+ * with the caret on "No, exit": the engine pasted the user's message, Enter picked
+ * "No, exit", and `claude` quit. On a machine where the CLI had never been opened —
+ * every fresh Docker container — the subscription engine could not start at all.
+ *
+ * Why answering them is not a change of posture: the studio's default engine runs
+ * `claude -p --dangerously-skip-permissions` in the very same directories, and the
+ * CLI documents that `-p` skips the trust dialog outright and shows no warning. The
+ * user consented to both when they added the project and picked the engine; the TUI
+ * merely asks again. Screen 3 is therefore answered with `--settings` on the command
+ * line (claude-interactive.js) and writes nothing. Screens 1 and 2 have no flag, so
+ * this module writes the two keys into the CLI's global config — and only those.
+ *
+ * What the write is allowed to do:
+ *   - nothing at all when nothing is missing, which is every start but the first per
+ *     directory, so the file the user's own `claude` sessions use is rarely touched;
+ *   - never write a file it could not PARSE — a half-written or hand-broken config is
+ *     left exactly as found, and the TUI simply shows its screen (the detector in
+ *     claude-interactive.js then says so in the browser);
+ *   - trust the EXACT directory the engine starts in, never a parent, and decide by
+ *     that exact key alone — the CLI's ancestor rule stops at git roots, so reading an
+ *     ancestor here would skip the seed in precisely the case that needs it. The CLI
+ *     adds a `projects` entry for every directory it runs in anyway, and writes its own
+ *     trust under both the raw and the NFC form of the path; this does the same;
+ *   - an existing file that is EMPTY is refused too: that is what a writer caught
+ *     mid-save looks like, not a config with nothing in it;
+ *   - write atomically: temp file next to the REAL file (a symlinked config keeps its
+ *     link), mode and owner copied, and the file re-read just before the rename — if a
+ *     live `claude` saved in between, the plan is redone on what it wrote instead of
+ *     overwriting it. A running `claude` merges on its own next save (measured: a key
+ *     added while one ran survived its exit), so only that narrow window needs care;
+ *   - a single-file bind mount cannot be renamed onto (EBUSY): there the file is
+ *     backed up beside itself, rewritten in place and fsynced, and restored from the
+ *     backup if the write fails.
+ *
+ * `CCS_CLAUDE_FIRSTRUN_SEED=0` turns the write off; the screens then appear in the
+ * engine pane and the browser asks the user to answer them there.
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+/** Where the CLI keeps its global config — `$CLAUDE_CONFIG_DIR/.claude.json` when
+ *  that is set (measured), `~/.claude.json` otherwise. */
+function claudeGlobalConfigPath(env = process.env) {
+  // Resolved here, once: a RELATIVE dir would mean the studio's cwd to this module and
+  // the project's cwd to the `claude` in the pane. The engine pins the same resolution.
+  if (env.CLAUDE_CONFIG_DIR) return path.join(path.resolve(env.CLAUDE_CONFIG_DIR), '.claude.json');
+  return path.join(env.HOME || os.homedir(), '.claude.json');
+}
+
+function _real(p) {
+  try { return fs.realpathSync.native(p); } catch { return path.resolve(p); }
+}
+
+/** The keys the CLI looks a directory up under: the path and its NFC form. */
+function trustKeys(dir) {
+  return [...new Set([dir, dir.normalize('NFC')])];
+}
+
+/** Is `dir` trusted by its OWN entry? Deliberately not the CLI's ancestor rule: that
+ *  one stops at git roots, and a session worktree is one. */
+function isTrusted(config, dir) {
+  const projects = config && typeof config.projects === 'object' && config.projects ? config.projects : {};
+  return trustKeys(dir).every(k => projects[k] && projects[k].hasTrustDialogAccepted === true);
+}
+
+/**
+ * Pure: what has to change in `config` so the TUI opens on its input box in `dir`.
+ * Returns the NEW object, or null when nothing is missing. Never mutates `config`.
+ * @param {object} config  parsed global config
+ * @param {string} dir     absolute, already-resolved directory the engine starts in
+ */
+function planFirstRunSeed(config, dir) {
+  if (!config || typeof config !== 'object' || Array.isArray(config)) return null;
+  let next = null;
+  const edit = () => (next ||= { ...config });
+  if (config.hasCompletedOnboarding !== true) edit().hasCompletedOnboarding = true;
+  // The picker is what onboarding would have asked; dark matches the studio's own UI.
+  if (!config.theme) edit().theme = 'dark';
+  if (dir && !isTrusted(config, dir)) {
+    const projects = { ...(config.projects && typeof config.projects === 'object' ? config.projects : {}) };
+    for (const k of trustKeys(dir)) projects[k] = { ...(projects[k] || {}), hasTrustDialogAccepted: true };
+    edit().projects = projects;
+  }
+  return next;
+}
+
+/**
+ * Make sure the interactive TUI will not stop on screens 1 and 2 in `workdir`.
+ * Best effort by design: every failure leaves the config untouched and returns a
+ * reason, because the fallback (the screen appears and the browser asks the user)
+ * is worse UX but never wrong.
+ * @returns {{ changed: boolean, reason?: string, path: string }}
+ */
+function seedClaudeFirstRun({ workdir, configPath = claudeGlobalConfigPath(), env = process.env } = {}) {
+  if (env.CCS_CLAUDE_FIRSTRUN_SEED === '0') return { changed: false, reason: 'disabled', path: configPath };
+  const dir = workdir ? _real(workdir) : null;
+  // The REAL file: renaming onto a symlink would replace the link, and the target the
+  // CLI actually reads would stay unseeded while edits split between two files. A
+  // DANGLING link has no real file to resolve to — refuse rather than replace it.
+  let target = configPath;
+  try {
+    if (fs.lstatSync(configPath).isSymbolicLink()) {
+      try { target = fs.realpathSync.native(configPath); }
+      catch { return { changed: false, reason: 'a dangling symlink — left as found', path: configPath }; }
+    }
+  } catch { /* does not exist yet */ }
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const r = _readConfig(target);
+    if (r.error) return { changed: false, reason: r.error, path: target };
+    const next = planFirstRunSeed(r.config, dir);
+    if (!next) return { changed: false, path: target };
+    const body = JSON.stringify(next, null, 2);
+    const mode = r.st ? r.st.mode & 0o777 : 0o600;
+    const tmp = `${target}.ccs-${process.pid}-${Date.now()}.tmp`;
+    try {
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.writeFileSync(tmp, body, { mode });
+      fs.chmodSync(tmp, mode);                                // the umask filtered `mode` above
+      if (r.st) { try { fs.chownSync(tmp, r.st.uid, r.st.gid); } catch { /* not ours to give away */ } }
+      // A live `claude` that saved since our read wins: redo the plan on what it wrote.
+      // What remains is the gap between this read and the rename — two syscalls, not a
+      // lock: the CLI's own lock is not a public contract this file can take part in.
+      if (_readRaw(target) !== r.raw) { fs.unlinkSync(tmp); continue; }
+      try { fs.renameSync(tmp, target); }
+      catch (e) {
+        try { fs.unlinkSync(tmp); } catch {}
+        if (e.code !== 'EBUSY' && e.code !== 'EXDEV') throw e;
+        return _writeInPlace(target, dir);
+      }
+      return { changed: true, path: target };
+    } catch (e) {
+      try { fs.unlinkSync(tmp); } catch {}
+      return { changed: false, reason: `write failed: ${e.code || e.message}`, path: target };
+    }
+  }
+  return { changed: false, reason: 'the file kept changing under us — left to the CLI', path: target };
+}
+
+/** Raw text of the file, or null when it does not exist. Other errors throw. */
+function _readRaw(file) {
+  try { return fs.readFileSync(file, 'utf8'); }
+  catch (e) { if (e.code === 'ENOENT') return null; throw e; }
+}
+
+/** Read + parse with every refusal the seed honours. */
+function _readConfig(file) {
+  let raw, st = null;
+  try { raw = _readRaw(file); if (raw !== null) st = fs.statSync(file); }
+  catch (e) { return { error: `unreadable: ${e.code || e.message}` }; }
+  if (raw === null) return { raw, st, config: {} };
+  if (!raw.trim()) return { error: 'empty — left as found' };
+  try { return { raw, st, config: JSON.parse(raw) }; }
+  catch { return { error: 'not valid JSON — left as found' }; }
+}
+
+/** A single-file bind mount is a mount point and cannot be renamed onto. Rewrite it in
+ *  place: plan from the content AS IT IS NOW (not from the earlier read), keep a backup
+ *  under a unique name, write every byte, fsync — and put the backup back if any of
+ *  that fails. A backup that could not be restored is left where the reason says. */
+function _writeInPlace(target, dir) {
+  const bak = `${target}.ccs-backup-${process.pid}-${Date.now()}`;
+  try { fs.copyFileSync(target, bak, fs.constants.COPYFILE_EXCL); }
+  catch (e) { return { changed: false, reason: `no backup possible: ${e.code || e.message}`, path: target }; }
+  const r = _readConfig(bak);
+  if (r.error) { try { fs.unlinkSync(bak); } catch {} return { changed: false, reason: r.error, path: target }; }
+  const next = planFirstRunSeed(r.config, dir);
+  if (!next) { try { fs.unlinkSync(bak); } catch {} return { changed: false, path: target }; }
+  const buf = Buffer.from(JSON.stringify(next, null, 2), 'utf8');
+  let fd = null;
+  try {
+    fd = fs.openSync(target, 'r+');
+    for (let off = 0; off < buf.length;) off += fs.writeSync(fd, buf, off, buf.length - off, off);
+    fs.ftruncateSync(fd, buf.length);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd); fd = null;
+    try { fs.unlinkSync(bak); } catch {}
+    return { changed: true, path: target };
+  } catch (e) {
+    if (fd !== null) { try { fs.closeSync(fd); } catch {} }
+    try { fs.writeFileSync(target, fs.readFileSync(bak)); fs.unlinkSync(bak); }
+    catch { return { changed: false, reason: `write failed and the original is in ${bak}: ${e.code || e.message}`, path: target }; }
+    return { changed: false, reason: `write failed, original restored: ${e.code || e.message}`, path: target };
+  }
+}
+
+/** `--settings` payload that answers screen 3. A constant, so the spawn command is
+ *  deterministic (engine-spawn-cmd.test.js asserts the argv byte for byte). */
+const SKIP_BYPASS_WARNING_SETTINGS = '{"skipDangerousModePermissionPrompt":true}';
+
+module.exports = { claudeGlobalConfigPath, isTrusted, trustKeys, planFirstRunSeed, seedClaudeFirstRun, SKIP_BYPASS_WARNING_SETTINGS, _writeInPlace };
diff --git a/claude-interactive.js b/claude-interactive.js
index d602e40..c2bd996 100644
--- a/claude-interactive.js
+++ b/claude-interactive.js
@@ -31,6 +31,7 @@ const crypto = require('node:crypto');
 
 const { findClaudeBin } = require('./claude-cli');
 const { agentsMdPreamble } = require('./agents-md');
+const { seedClaudeFirstRun, SKIP_BYPASS_WARNING_SETTINGS } = require('./claude-firstrun');
 // ONE definition of the socket name, imported — never a second copy of the string.
 const { TMUX_SOCKET } = require('./terminal-bridge');
 
@@ -65,8 +66,9 @@ const AWAIT_CONFIRM_POLLS = 2;
 // 0 disables the hold and the turn completes exactly as it did before. The idle
 // watchdog above is untouched and stays the backstop for a prompt nobody answers.
 const AWAIT_GRACE_MS = parseInt(process.env.CLAUDE_PROMPT_GRACE_MS || '300000', 10) || 0;
-// How long a FRESHLY SPAWNED TUI is given to get past a startup dialog before the
-// prompt is pasted anyway. 0 restores the old behaviour (paste immediately).
+// How long a pane on a blocking dialog is given to be answered by a human before the
+// turn gives up WITHOUT pasting (see the block before the paste). 0 skips the check
+// and pastes immediately — the pre-#20 behaviour, kept as an explicit opt-out.
 const SPAWN_PROMPT_WAIT_MS = parseInt(process.env.CLAUDE_STARTUP_PROMPT_WAIT_MS || '90000', 10) || 0;
 // How many consecutive failed clarification pastes are attempted before the engine
 // gives up for the rest of the turn. A dead or unreachable pane fails on every
@@ -192,19 +194,72 @@ function paneBusy(pane, prevPane) {
 //     the turn ends on the idle watchdog. The live pane is still reachable by hand.
 // Both are why the caller ALSO requires the spinner to be stopped before believing it.
 const AWAIT_TAIL_LINES = 24;
+const CARET_RE = /^([❯➤►▶›»>])?\s*(\d{1,2})[.)]\s+\S/;
 function paneAwaitingInput(pane) {
   if (typeof pane !== 'string' || !pane) return false;
-  const lines = pane.split('\n').map(l => l.trim()).filter(Boolean);
-  let numbered = 0, caret = false;
-  for (const raw of lines.slice(-AWAIT_TAIL_LINES)) {
-    // Strip a leading box border so "│ ❯ 1. Yes" reads the same as "❯ 1. Yes".
-    const line = raw.replace(/^[│┃|╎╏┆┊╷╵]+\s*/, '');
-    const m = /^([❯➤►▶›»>])?\s*(\d{1,2})[.)]\s+\S/.exec(line);
+  const lines = _paneLines(pane);
+  const from = Math.max(0, lines.length - AWAIT_TAIL_LINES);
+  let numbered = 0, caretAt = -1;
+  for (let i = from; i < lines.length; i++) {
+    const m = CARET_RE.exec(lines[i].trim());
     if (!m) continue;
     numbered++;
-    if (m[1]) caret = true;
+    if (m[1]) caretAt = i;
   }
-  return numbered >= 2 && caret;
+  // A numbered list the user TYPED into the input box ("1. fix the tests") is not a
+  // widget, however much it looks like one.
+  if (numbered >= 2 && caretAt >= 0 && !_inInputBox(lines, caretAt)) return true;
+  return paneAwaitingSelection(pane);
+}
+
+// Non-blank lines, trailing space dropped, a leading box border turned into indent so
+// "│ ❯ 1. Yes" reads like "  ❯ 1. Yes" and keeps its column.
+function _paneLines(pane) {
+  return pane.split('\n').map(l => l.replace(/\s+$/, '').replace(/^([│┃|╎╏┆┊╷╵]\s?)/, '  ')).filter(l => l.trim());
+}
+
+// Is line `i` inside the TUI's input box? The box is a region between two horizontal
+// rules whose FIRST line is the prompt caret. Measured on CLI 2.1.288, the
+// AskUserQuestion widget is ALSO framed by two rules — so "between two rules" alone
+// would hide it — but its first framed line is a header ("☐ Color"), never the caret.
+// Searched over the WHOLE capture, not the tail: a long draft pushes the box's top
+// rule out of any fixed window.
+const RULE_RE = /^[\s─━═╌╍┄┅-]{10,}$/;
+function _inInputBox(lines, i) {
+  let above = -1, below = -1;
+  for (let k = i; k >= 0; k--) if (RULE_RE.test(lines[k])) { above = k; break; }
+  for (let k = i + 1; k < lines.length; k++) if (RULE_RE.test(lines[k])) { below = k; break; }
+  return above >= 0 && below >= 0 && /^\s?[❯➤►▶›»>](\s|$)/.test(lines[above + 1] || '');
+}
+
+// The OTHER widget: an unnumbered select. Measured on CLI 2.1.288, all three first-run
+// screens are this shape — the theme picker, the trust-this-folder question and the
+// Bypass Permissions warning — and the last two open with the caret on "No, exit":
+//
+//      Quick safety check: Is this a project you created or one you trust? …
+//    ❯ No, exit
+//      Yes, I trust this folder
+//    Enter to confirm · Esc to cancel
+//
+// Still structural, still no wording: the LAST caret line in the tail, when it is not
+// in the input box (_inInputBox), carries text and has at least one sibling option — an
+// adjacent line indented deeper than the caret. History cannot trip it: past prompts
+// render as "❯ text" too (measured), but the input box is below them while the pane is
+// usable, so they are never the last caret line.
+function paneAwaitingSelection(pane) {
+  if (typeof pane !== 'string' || !pane) return false;
+  const lines = _paneLines(pane);
+  const from = Math.max(0, lines.length - AWAIT_TAIL_LINES);
+  let at = -1, col = -1;
+  for (let i = lines.length - 1; i >= from; i--) {
+    const m = /^(\s*)[❯➤►▶›»]\s?/.exec(lines[i]);
+    if (m) { at = i; col = m[1].length; break; }
+  }
+  if (at < 0 || _inInputBox(lines, at)) return false;
+  if (!lines[at].slice(col + 1).trim()) return false;
+  const indent = (l) => l.length - l.trimStart().length;
+  const sibling = (l) => l !== undefined && !RULE_RE.test(l) && indent(l) > col;
+  return sibling(lines[at - 1]) || sibling(lines[at + 1]);
 }
 
 // The pane tail the browser banner shows, so the user can recognise the question
@@ -279,8 +334,21 @@ function spawnScriptDir() {
 
 // Full `claude` invocation for the interactive engine. Pure — the prompt is inline
 // here on purpose: this string becomes the script body, i.e. the child's argv.
-function buildInteractiveCommand({ claudeBin, idFlag, modelAlias, sp, mcpPath }) {
-  let cmd = `env -u CLAUDECODE ${shq(claudeBin)} ${idFlag} --model ${shq(modelAlias)} --dangerously-skip-permissions`;
+//
+// `configEnv` pins HOME and CLAUDE_CONFIG_DIR to the values claude-firstrun.js seeded:
+// the pane inherits the TMUX SERVER's environment, which survives a studio restart, so
+// a studio relaunched with a different CLAUDE_CONFIG_DIR would otherwise seed one config
+// and start `claude` on another.
+function buildInteractiveCommand({ claudeBin, idFlag, modelAlias, sp, mcpPath, configEnv = null }) {
+  let pin = '';
+  if (configEnv) {
+    if (!configEnv.CLAUDE_CONFIG_DIR) pin += ' -u CLAUDE_CONFIG_DIR';
+    if (configEnv.HOME) pin += ` HOME=${shq(configEnv.HOME)}`;
+    if (configEnv.CLAUDE_CONFIG_DIR) pin += ` CLAUDE_CONFIG_DIR=${shq(configEnv.CLAUDE_CONFIG_DIR)}`;
+  }
+  // --settings answers the Bypass Permissions warning the TUI shows for the flag
+  // before it — the same consent `claude -p` never asks for (claude-firstrun.js).
+  let cmd = `env -u CLAUDECODE${pin} ${shq(claudeBin)} ${idFlag} --model ${shq(modelAlias)} --dangerously-skip-permissions --settings ${shq(SKIP_BYPASS_WARNING_SETTINGS)}`;
   if (sp) cmd += ` --append-system-prompt ${shq(sp)}`;
   if (mcpPath) cmd += ` --mcp-config ${shq(mcpPath)}`;
   return cmd;
@@ -384,6 +452,7 @@ async function runInteractiveSingle(params) {
   // used to leave the browser showing "waiting for your answer" over a dead turn,
   // because the client clears it only on input_resolved or on the next send.
   let awaitAnnounced = false;       // 'input_needed' already sent for the prompt now on screen
+  let firstRunSeed = null;          // what claude-firstrun.js did before this spawn, for the error text
 
   try {
     // ── Resolve per-session config (system prompt, MCP, model) ─────────────
@@ -420,8 +489,13 @@ async function runInteractiveSingle(params) {
       if (!cid) cid = crypto.randomUUID();
       const idFlag = resuming ? `--resume ${shq(cid)}` : `--session-id ${shq(cid)}`;
 
+      // The theme picker and the trust question have no flag; seed the two keys that
+      // skip them before the TUI reads its config (claude-firstrun.js).
+      firstRunSeed = seedClaudeFirstRun({ workdir: workdir || process.cwd() });
+
       const claudeBin = findClaudeBin();
-      const innerCmd = buildInteractiveCommand({ claudeBin, idFlag, modelAlias, sp, mcpPath });
+      const innerCmd = buildInteractiveCommand({ claudeBin, idFlag, modelAlias, sp, mcpPath,
+        configEnv: { HOME: process.env.HOME || os.homedir(), CLAUDE_CONFIG_DIR: process.env.CLAUDE_CONFIG_DIR ? path.resolve(process.env.CLAUDE_CONFIG_DIR) : '' } });
 
       const env = utf8Env();
       delete env.CLAUDECODE; // parent Claude Code session sets this and it confuses the child
@@ -458,8 +532,8 @@ async function runInteractiveSingle(params) {
       // question both look "settled" because they are static. Pasting the user's
       // message into one answers it with whichever option the text lands on. Tell
       // the browser and give a human a bounded window to clear it in the live pane
-      // (GitHub #20). On timeout we fall through and paste anyway — the pre-#20
-      // behaviour — so a false positive costs a delay, never a lost message.
+      // (GitHub #20). Most of them never appear now — claude-firstrun.js answers the
+      // three first-run screens before the spawn — and the check below catches the rest.
     }
 
     // A pane can be sitting on a blocking widget for either reason: a fresh TUI that
@@ -468,8 +542,9 @@ async function runInteractiveSingle(params) {
     // while its dialog was still up. Both fail the same way — the paste-buffer below
     // answers the widget with whatever option the caret sits on, which can be a
     // permission grant. So the check runs before EVERY paste, not only after a spawn.
-    // On timeout we fall through and paste anyway (the pre-#20 behaviour): a false
-    // positive costs a delay, never a lost message.
+    // On timeout the turn ends with the screen in the error instead of pasting: a
+    // false positive costs a delay and a resend, a true one no longer costs the
+    // message AND the session.
     if (SPAWN_PROMPT_WAIT_MS > 0 && paneAwaitingInput(capturePane(name))) {
       awaitAnnounced = true;
       wsSendAll({ type: 'input_needed', sessionId, engine: 'subscription', phase: spawned ? 'startup' : 'resume', prompt: promptExcerpt(capturePane(name)) });
@@ -481,6 +556,22 @@ async function runInteractiveSingle(params) {
       }
       awaitAnnounced = false;
       wsSendAll({ type: 'input_resolved', sessionId });
+      // Stop pressed while we waited: end here, before the paste. Falling through sent
+      // the message and Enter into the very dialog the wait was holding off.
+      if (abortController?.signal?.aborted) {
+        return { cid, completed: false, resultMeta: { durationMs: Date.now() - start }, fullText: '', fullThinking: '', toolEvents: [] };
+      }
+      // Still up after the whole window: do NOT paste. The old fall-through answered the
+      // widget with whatever the caret sat on — and two of the three startup screens
+      // open on "No, exit", so the paste quit `claude` and the message was lost anyway.
+      // Saying so, with the screen, is the only outcome that leaves anything to act on.
+      const still = capturePane(name);
+      if (paneAwaitingInput(still)) {
+        const why = firstRunSeed && firstRunSeed.reason && firstRunSeed.reason !== 'disabled'
+          ? ` (could not pre-answer the first-run screens in ${firstRunSeed.path}: ${firstRunSeed.reason})` : '';
+        wsSend({ type: 'error', error: `Claude is waiting on a screen in its terminal pane, so your message was not sent${why}. Answer it in the engine pane, then send again:\n\n${promptExcerpt(still, 10)}` });
+        return { cid, completed: false, resultMeta: null, fullText: '', fullThinking: '', toolEvents: [] };
+      }
     }
 
     // ── Record transcript offset BEFORE sending ────────────────────────────
@@ -900,4 +991,4 @@ function catchUpFromTranscript({ cid, startOffset = 0 } = {}) {
   return out;
 }
 
-module.exports = { runInteractiveSingle, killInteractiveTmux, tmuxAvailable, catchUpFromTranscript, transcriptSize, tmuxName, listOrphanedDefaultSocketSessions, paneAwaitingInput, promptExcerpt, buildInteractiveCommand, tmuxLaunchCommand };
+module.exports = { runInteractiveSingle, killInteractiveTmux, tmuxAvailable, catchUpFromTranscript, transcriptSize, tmuxName, listOrphanedDefaultSocketSessions, paneAwaitingInput, paneAwaitingSelection, promptExcerpt, buildInteractiveCommand, tmuxLaunchCommand };
diff --git a/package.json b/package.json
index dbb0280..26c8029 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
   "scripts": {
     "start": "node server.js",
     "dev": "node --watch server.js",
-    "test": "node --test test/render/*.test.mjs && node test/overload-detector.test.js && node test/usage-limit.test.js && node test/auth-errors.test.js && node test/env-load-order.test.js && node test/multi-agent-result.test.js && node test/terminal-session.test.js && node test/terminal-schema.test.js && node test/bots.test.js && node test/bot-inbox.test.js && node test/bots-api.test.js && node test/running-sessions.test.js && node test/session-liveness.test.js && node test/terminal-bridge.integration.test.js && node test/tmux-composite.test.js && node test/engine-spawn-cmd.test.js && node test/telegram-format.test.js && node test/telegram-behaviour.test.js && node test/ask-user-question.test.js && node test/delegate-terminal.test.js && node test/agent-catalog.test.js && node test/update-flow.test.js && node test/kanban-schedule.test.js && node test/kanban-run-badges.test.js && node test/task-backlog.test.js && node test/i18n-completeness.test.js && node test/config-resolve.test.js && node test/chat-defaults.test.js && node test/chat-defaults-api.test.js && node test/run-continuation.test.js && node test/worktree-manager.test.js && node test/session-expiry.test.js && node test/setup-gate.test.js && node test/path-guard.test.js && node test/subscribe-nocatchup.test.js && node test/cli-import-remote.test.js && node test/remote-list-parse.test.js && node test/config-migrate.test.js && node test/engine-pane.test.js && node test/global-workspace.test.js && node test/ssh-secret.test.js && node test/agent-dag.test.js && node test/ssh-parser.test.js && node test/ssh-termination.test.js && node test/session-restart.test.js && node test/remote-env.test.js && node test/remote-files.test.js && node test/remote-files-api.test.js && node test/auth-token.test.js && node test/cmd-model.test.js && node test/origin-guard.test.js && node test/interrupted-recovery.test.js && node test/queue-persistence.test.js && node test/interrupt-idle-config.test.js && node test/agents-md.test.js && node test/editor-links.test.js && node test/editor-open-api.test.js && node test/interrupt-delivery.test.js && node test/terminal-pane-guard.integration.test.js && node test/composer-terminal.test.js && node test/claude-cli-status.test.js && node test/asar-helpers.test.js && node test/mac-signing.test.js && node test/release-mac.test.js && node test/task-workers.test.js && node test/git-clone.test.js && node test/responsive-ui.test.js && node test/kanban-delegation.test.js && node test/kanban-group-button.test.js && node test/terminal-keys.test.js",
+    "test": "node --test test/render/*.test.mjs && node test/overload-detector.test.js && node test/usage-limit.test.js && node test/auth-errors.test.js && node test/env-load-order.test.js && node test/multi-agent-result.test.js && node test/terminal-session.test.js && node test/terminal-schema.test.js && node test/bots.test.js && node test/bot-inbox.test.js && node test/bots-api.test.js && node test/running-sessions.test.js && node test/session-liveness.test.js && node test/terminal-bridge.integration.test.js && node test/tmux-composite.test.js && node test/engine-spawn-cmd.test.js && node test/claude-firstrun.test.js && node test/telegram-format.test.js && node test/telegram-behaviour.test.js && node test/ask-user-question.test.js && node test/delegate-terminal.test.js && node test/agent-catalog.test.js && node test/update-flow.test.js && node test/kanban-schedule.test.js && node test/kanban-run-badges.test.js && node test/task-backlog.test.js && node test/i18n-completeness.test.js && node test/config-resolve.test.js && node test/chat-defaults.test.js && node test/chat-defaults-api.test.js && node test/run-continuation.test.js && node test/worktree-manager.test.js && node test/session-expiry.test.js && node test/setup-gate.test.js && node test/path-guard.test.js && node test/subscribe-nocatchup.test.js && node test/cli-import-remote.test.js && node test/remote-list-parse.test.js && node test/config-migrate.test.js && node test/engine-pane.test.js && node test/global-workspace.test.js && node test/ssh-secret.test.js && node test/agent-dag.test.js && node test/ssh-parser.test.js && node test/ssh-termination.test.js && node test/session-restart.test.js && node test/remote-env.test.js && node test/remote-files.test.js && node test/remote-files-api.test.js && node test/auth-token.test.js && node test/cmd-model.test.js && node test/origin-guard.test.js && node test/interrupted-recovery.test.js && node test/queue-persistence.test.js && node test/interrupt-idle-config.test.js && node test/agents-md.test.js && node test/editor-links.test.js && node test/editor-open-api.test.js && node test/interrupt-delivery.test.js && node test/terminal-pane-guard.integration.test.js && node test/composer-terminal.test.js && node test/claude-cli-status.test.js && node test/asar-helpers.test.js && node test/mac-signing.test.js && node test/release-mac.test.js && node test/task-workers.test.js && node test/git-clone.test.js && node test/responsive-ui.test.js && node test/kanban-delegation.test.js && node test/kanban-group-button.test.js && node test/terminal-keys.test.js",
     "postinstall": "node scripts/install-hooks.js",
     "release": "node scripts/release.js",
     "release:mac": "node scripts/release-mac.js",
diff --git a/test/claude-firstrun.test.js b/test/claude-firstrun.test.js
new file mode 100644
index 0000000..58ee802
--- /dev/null
+++ b/test/claude-firstrun.test.js
@@ -0,0 +1,215 @@
+// First-run screens of the interactive TUI (claude-firstrun.js + the #20 detector).
+//
+// A `claude` that has never been opened on a machine — every fresh Docker container —
+// stops on up to three screens before its input box: the theme picker, "do you trust
+// this folder?" and the Bypass Permissions warning. None is numbered, so the detector
+// missed all three; two open with the caret on "No, exit", so the engine's paste +
+// Enter quit `claude` and the message was lost. The fixtures under
+// test/fixtures/claude-tui/ are those screens captured from CLI 2.1.288.
+//
+//   1. DETECT  — the real screens read as blocked; a ready pane (input box between two
+//                rules), one holding typed text, and one with carets in its history do not.
+//   2. SEED    — planFirstRunSeed is pure and minimal; seedClaudeFirstRun writes only
+//                when something is missing, never a file it could not parse, atomically.
+//   3. ENGINE  — runInteractiveSingle against a fake `claude` that draws the trust screen:
+//                the config is seeded before the spawn, --settings reaches the argv, and
+//                a screen still up after the wait is reported, NEVER pasted into.
+//
+// Run: node test/claude-firstrun.test.js
+'use strict';
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+let pass = 0, fail = 0;
+function check(label, actual, expected) {
+  try { assert.deepStrictEqual(actual, expected); pass++; console.log(`  ok   ${label}`); }
+  catch { fail++; console.error(`  FAIL ${label} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); }
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'ccs-firstrun-'));
+const HOME = path.join(TMP, 'home');
+fs.mkdirSync(path.join(HOME, '.local', 'bin'), { recursive: true });
+// Before the require: the engine reads both at module load / call time.
+process.env.HOME = HOME;
+delete process.env.CLAUDE_CONFIG_DIR;
+process.env.CLAUDE_STARTUP_PROMPT_WAIT_MS = '3000';
+
+const FR = require('../claude-firstrun');
+const CI = require('../claude-interactive');
+const { TMUX_SOCKET } = require('../terminal-bridge');
+const fixture = n => fs.readFileSync(path.join(__dirname, 'fixtures', 'claude-tui', n === 'askuserquestion' ? `${n}.txt` : `firstrun-${n}.txt`), 'utf8');
+
+let engineSession = null;
+function cleanup() {
+  if (engineSession) spawnSync('tmux', ['-L', TMUX_SOCKET, 'kill-session', '-t', CI.tmuxName(engineSession)], { stdio: 'ignore' });
+  try { fs.rmSync(TMP, { recursive: true, force: true }); } catch {}
+}
+process.on('exit', cleanup);
+
+(async () => {
+  console.log('1. the real first-run screens read as blocked');
+  for (const n of ['theme', 'trust', 'bypass']) check(`${n} screen is a pending prompt`, CI.paneAwaitingInput(fixture(n)), true);
+  const ready = fixture('ready');
+  check('a ready pane is NOT a prompt', CI.paneAwaitingInput(ready), false);
+  check('…nor is one with a draft typed in its input box',
+    CI.paneAwaitingInput(ready.replace(/^❯$/m, '❯ fix the failing test\n  and add a regression test for it')), false);
+  // Past prompts and quoted carets sit ABOVE the input box; it stays the last caret line.
+  const history = ['❯ add a flag', '  that turns it off', '', '⏺ Done — added it.', '  › note: the default is on', ''].join('\n');
+  check('carets in the history above the input box are NOT a prompt', CI.paneAwaitingInput(history + ready), false);
+  check('a lone caret line with no sibling option is NOT a prompt', CI.paneAwaitingSelection('some text\n❯ No, exit\n'), false);
+  // From the review: a draft can itself quote a caret, with continuation lines that look
+  // like sibling options. Inside the input box's frame it is the box, not a dialog.
+  check('a draft quoting "❯ npm test" inside the input box is NOT a prompt',
+    CI.paneAwaitingInput(ready.replace(/^❯$/m, '❯ review this captured output:\n  ❯ npm test\n    tests passed')), false);
+  check('the numbered #20 widget is still recognised', CI.paneAwaitingInput('❯ 1. Yes\n  2. No'), true);
+  // Captured from a real AskUserQuestion: it is framed by two rules exactly like the
+  // input box, so "between two rules" cannot be what marks the input box.
+  check('a real AskUserQuestion widget (rule-framed) is a pending prompt', CI.paneAwaitingInput(fixture('askuserquestion')), true);
+  check('a numbered list TYPED into the input box is NOT a prompt',
+    CI.paneAwaitingInput(ready.replace(/^❯$/m, '❯ 1. Fix tests\n  2. Add docs')), false);
+  check('a draft long enough to push the box\'s top rule out of the tail is NOT a prompt',
+    CI.paneAwaitingInput(ready.replace(/^❯$/m, '❯ start\n' + Array.from({ length: 25 }, (_, i) => `  line ${i}`).join('\n') + '\n  ❯ npm test\n    tests passed')), false);
+
+  console.log('\n2. seeding the CLI config');
+  const dir = '/srv/project/a';
+  check('an empty config gets onboarding, a theme and trust for the dir',
+    FR.planFirstRunSeed({}, dir), { hasCompletedOnboarding: true, theme: 'dark', projects: { [dir]: { hasTrustDialogAccepted: true } } });
+  check('a complete config needs nothing',
+    FR.planFirstRunSeed({ hasCompletedOnboarding: true, theme: 'light', projects: { [dir]: { hasTrustDialogAccepted: true } } }, dir), null);
+  // Measured: a trusted parent does NOT cover a child that is its own git repository,
+  // and every session worktree is one. So only the dir's own key decides.
+  check('a trusted ANCESTOR does not stop the seed (the CLI stops at git roots)',
+    FR.planFirstRunSeed({ hasCompletedOnboarding: true, theme: 'dark', projects: { '/srv': { hasTrustDialogAccepted: true } } }, dir)?.projects?.[dir],
+    { hasTrustDialogAccepted: true });
+  const decomposed = '/srv/cafe\u0301';
+  check('a non-NFC path is trusted under both spellings, as the CLI writes it',
+    Object.keys(FR.planFirstRunSeed({ hasCompletedOnboarding: true, theme: 'dark' }, decomposed).projects).sort(),
+    [decomposed, decomposed.normalize('NFC')].sort());
+  const keep = { hasCompletedOnboarding: true, theme: 'light', mcpServers: { x: { command: 'y' } }, projects: { [dir]: { allowedTools: ['Bash'] }, '/other': { a: 1 } } };
+  const planned = FR.planFirstRunSeed(keep, dir);
+  check('only the trust key is added; the theme the user chose and every other key stay',
+    planned, { ...keep, projects: { [dir]: { allowedTools: ['Bash'], hasTrustDialogAccepted: true }, '/other': { a: 1 } } });
+  check('the input object is not mutated', keep.projects[dir], { allowedTools: ['Bash'] });
+  check('the config path follows CLAUDE_CONFIG_DIR', FR.claudeGlobalConfigPath({ CLAUDE_CONFIG_DIR: '/c', HOME: '/h' }), path.join('/c', '.claude.json'));
+  check('…resolved to an absolute path once (the pane runs in another cwd)',
+    path.isAbsolute(FR.claudeGlobalConfigPath({ CLAUDE_CONFIG_DIR: 'rel-config', HOME: '/h' })), true);
+  check('…and is ~/.claude.json otherwise', FR.claudeGlobalConfigPath({ HOME: '/h' }), path.join('/h', '.claude.json'));
+
+  const work = fs.mkdtempSync(path.join(TMP, 'work-'));
+  const realWork = fs.realpathSync.native(work);
+  const cfg = path.join(TMP, 'cfg', '.claude.json');
+  check('a missing config is created', FR.seedClaudeFirstRun({ workdir: work, configPath: cfg, env: {} }).changed, true);
+  const created = JSON.parse(fs.readFileSync(cfg, 'utf8'));
+  check('…keyed by the REAL path of the workdir', created.projects[realWork], { hasTrustDialogAccepted: true });
+  if (process.platform !== 'win32') check('…at mode 0600', fs.statSync(cfg).mode & 0o777, 0o600);
+  const before = fs.statSync(cfg).mtimeMs;
+  await sleep(20);
+  check('a second start writes nothing', FR.seedClaudeFirstRun({ workdir: work, configPath: cfg, env: {} }).changed, false);
+  check('…and leaves the file untouched', fs.statSync(cfg).mtimeMs, before);
+  fs.writeFileSync(cfg, '{"projects": {');
+  const broken = FR.seedClaudeFirstRun({ workdir: work, configPath: cfg, env: {} });
+  check('a config that does not parse is refused', [broken.changed, /not valid JSON/.test(broken.reason)], [false, true]);
+  check('…and left byte-for-byte as found', fs.readFileSync(cfg, 'utf8'), '{"projects": {');
+  fs.writeFileSync(cfg, '  \n');
+  check('an EMPTY existing file is refused (a writer caught mid-save looks like that)',
+    [FR.seedClaudeFirstRun({ workdir: work, configPath: cfg, env: {} }).changed, fs.readFileSync(cfg, 'utf8')], [false, '  \n']);
+  if (process.platform !== 'win32') {
+    // A symlinked config keeps its link; the file it points at is the one seeded.
+    const shared = path.join(TMP, 'shared.json');
+    fs.writeFileSync(shared, '{"keep":1}');
+    const link = path.join(TMP, 'link', '.claude.json');
+    fs.mkdirSync(path.dirname(link), { recursive: true });
+    fs.symlinkSync(shared, link);
+    FR.seedClaudeFirstRun({ workdir: work, configPath: link, env: {} });
+    check('a symlinked config stays a symlink', fs.lstatSync(link).isSymbolicLink(), true);
+    check('…and its target is what got seeded', JSON.parse(fs.readFileSync(shared, 'utf8')).keep === 1 && JSON.parse(fs.readFileSync(shared, 'utf8')).hasCompletedOnboarding, true);
+    // The umask must not narrow an existing mode.
+    const grp = path.join(TMP, 'grp', '.claude.json');
+    fs.mkdirSync(path.dirname(grp), { recursive: true });
+    fs.writeFileSync(grp, '{}'); fs.chmodSync(grp, 0o640);
+    const old = process.umask(0o077);
+    try { FR.seedClaudeFirstRun({ workdir: work, configPath: grp, env: {} }); } finally { process.umask(old); }
+    check('an existing 0640 survives a 077 umask', fs.statSync(grp).mode & 0o777, 0o640);
+    const dangling = path.join(TMP, 'dangle', '.claude.json');
+    fs.mkdirSync(path.dirname(dangling), { recursive: true });
+    fs.symlinkSync(path.join(TMP, 'nowhere.json'), dangling);
+    const d = FR.seedClaudeFirstRun({ workdir: work, configPath: dangling, env: {} });
+    check('a DANGLING symlinked config is refused, not replaced',
+      [d.changed, /dangling/.test(d.reason), fs.lstatSync(dangling).isSymbolicLink()], [false, true, true]);
+  }
+
+  // The bind-mount path, driven directly (EBUSY cannot be produced portably).
+  const ip = path.join(TMP, 'inplace', '.claude.json');
+  fs.mkdirSync(path.dirname(ip), { recursive: true });
+  const oldBak = `${ip}.ccs-backup-earlier`;
+  fs.writeFileSync(oldBak, 'an earlier recovery copy');
+  fs.writeFileSync(ip, JSON.stringify({ written: 'by a live claude after our first read' }));
+  const realWrite = fs.writeSync;
+  let calls = 0;
+  fs.writeSync = (fd, buf, off, len, pos) => (++calls === 1 ? realWrite(fd, buf, off, Math.ceil(len / 2), pos) : realWrite(fd, buf, off, len, pos));
+  let ipr;
+  try { ipr = FR._writeInPlace(ip, '/srv/inplace'); } finally { fs.writeSync = realWrite; }
+  let ipCfg = null; try { ipCfg = JSON.parse(fs.readFileSync(ip, 'utf8')); } catch {}
+  check('a SHORT write is completed, not truncated into broken JSON', [ipr.changed, !!ipCfg, calls > 1], [true, true, true]);
+  check('the in-place path plans from the file as it is NOW', ipCfg && ipCfg.written, 'by a live claude after our first read');
+  check('an earlier recovery backup is never overwritten', fs.readFileSync(oldBak, 'utf8'), 'an earlier recovery copy');
+  check('its own backup is removed after success', fs.readdirSync(path.dirname(ip)).filter(f => f.includes('ccs-backup') && f !== path.basename(oldBak)), []);
+  check('CCS_CLAUDE_FIRSTRUN_SEED=0 turns it off', FR.seedClaudeFirstRun({ workdir: work, configPath: cfg, env: { CCS_CLAUDE_FIRSTRUN_SEED: '0' } }).reason, 'disabled');
+  check('no temp file is left behind', fs.readdirSync(path.dirname(cfg)).filter(f => f.endsWith('.tmp')), []);
+
+  console.log('\n3. the engine against a fake `claude` that stops on the trust screen');
+  if (!CI.tmuxAvailable()) {
+    console.log('  SKIP — tmux not available on this host');
+  } else {
+    const screen = path.join(TMP, 'screen.txt');
+    fs.writeFileSync(screen, fixture('trust'));
+    const argvDump = path.join(TMP, 'argv.txt');
+    const received = path.join(TMP, 'received.txt');
+    // Draws the screen, records its argv, then records everything typed or pasted into it.
+    fs.writeFileSync(path.join(HOME, '.local', 'bin', 'claude'),
+      `#!/bin/sh\nfor a in "$@"; do printf '%s\\n' "$a"; done > '${argvDump}'\nprintf '%s' "$HOME" > '${argvDump}.home'\ncat '${screen}'\nstty raw -echo 2>/dev/null\nexec cat > '${received}'\n`, { mode: 0o755 });
+    const proj = fs.mkdtempSync(path.join(TMP, 'proj-'));
+    engineSession = `frtest${process.pid}`;
+    const frames = [];
+    const ws = { send: s => frames.push(JSON.parse(s)) };
+    // A bound, so a regression that pastes and then waits on a transcript fails here by
+    // NAME instead of hanging the suite until the engine's own idle watchdog.
+    const ac = new AbortController();
+    const guard = setTimeout(() => ac.abort(), 20000);
+    const r = await CI.runInteractiveSingle({ prompt: 'please do the thing', model: 'sonnet', mode: 'auto', ws, sessionId: engineSession, workdir: proj, abortController: ac });
+    clearTimeout(guard);
+    const cfgFile = path.join(HOME, '.claude.json');
+    const seeded = fs.existsSync(cfgFile) ? JSON.parse(fs.readFileSync(cfgFile, 'utf8')) : { projects: {} };
+    check('the CLI config was seeded before the spawn',
+      [seeded.hasCompletedOnboarding, seeded.projects[fs.realpathSync.native(proj)]], [true, { hasTrustDialogAccepted: true }]);
+    const argv = fs.existsSync(argvDump) ? fs.readFileSync(argvDump, 'utf8').split('\n') : [];
+    const si = argv.indexOf('--settings');
+    check('--settings reaches the child argv byte-identical', si >= 0 ? argv[si + 1] : null, FR.SKIP_BYPASS_WARNING_SETTINGS);
+    check('the browser was told the turn is blocked', frames.some(f => f.type === 'input_needed' && f.phase === 'startup'), true);
+    const err = frames.find(f => f.type === 'error');
+    check('a screen still up after the wait is reported with the screen', !!err && /waiting on a screen/.test(err.error) && /Yes, I trust this folder/.test(err.error), true);
+    check('the turn ends incomplete', r.completed, false);
+    check('the pane runs on the HOME the seed wrote into (the tmux server env cannot override it)',
+      fs.existsSync(argvDump + '.home') ? fs.readFileSync(argvDump + '.home', 'utf8') : null, HOME);
+    await sleep(500);
+    check('NOTHING was pasted into the widget', fs.existsSync(received) ? fs.readFileSync(received, 'utf8') : '', '');
+
+    // From the review: Stop pressed DURING the wait used to fall through to the paste.
+    // The pane from the run above is still up on the same screen — the reused-pane path.
+    fs.writeFileSync(received, '');
+    const ac2 = new AbortController();
+    setTimeout(() => ac2.abort(), 800);
+    const frames2 = [];
+    const r2 = await CI.runInteractiveSingle({ prompt: 'second message', model: 'sonnet', mode: 'auto', ws: { send: x => frames2.push(JSON.parse(x)) }, sessionId: engineSession, claudeSessionId: r.cid, workdir: proj, abortController: ac2 });
+    await sleep(500);
+    check('Stop during the wait ends the turn', r2.completed, false);
+    check('…and pastes NOTHING into the dialog', fs.readFileSync(received, 'utf8'), '');
+  }
+
+  console.log(`\n${pass} passed, ${fail} failed`);
+  process.exit(fail ? 1 : 0);
+})().catch(e => { console.error(e.stack || e); process.exit(1); });
diff --git a/test/fixtures/claude-tui/askuserquestion.txt b/test/fixtures/claude-tui/askuserquestion.txt
new file mode 100644
index 0000000..e45b3c8
--- /dev/null
+++ b/test/fixtures/claude-tui/askuserquestion.txt
@@ -0,0 +1,40 @@
+
+ ▐▛███▛█   Claude Code v2.1.288
+▝▜██████▀  Haiku 4.5 · Claude Max
+ ▝▝   ▝▝   /srv/project
+
+⚠ CLAUDE.md is over the 40.0k-char limit (91.5k chars) · /memory to free up context
+
+❯ Use the AskUserQuestion tool exactly once to ask me which color I prefer, with the two options red and blue. Do not
+  do anything else.
+────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+ ☐ Color
+
+Which color do you prefer?
+
+❯ 1. Red
+     A warm, vibrant color
+  2. Blue
+     A cool, calming color
+  3. Type something.
+────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+  4. Chat about this
+
+Enter to select · ↑/↓ to navigate · Esc to cancel
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/test/fixtures/claude-tui/firstrun-bypass.txt b/test/fixtures/claude-tui/firstrun-bypass.txt
new file mode 100644
index 0000000..fab301a
--- /dev/null
+++ b/test/fixtures/claude-tui/firstrun-bypass.txt
@@ -0,0 +1,40 @@
+
+────────────────────────────────────────────────────────────────────────────────────────────────────
+  WARNING: Claude Code running in Bypass Permissions mode
+
+  In Bypass Permissions mode, Claude Code will not ask for your approval before running
+  potentially dangerous commands.
+  This mode should only be used in a sandboxed container/VM that has restricted internet access
+  and can easily be restored if damaged.
+
+  By proceeding, you accept all responsibility for actions taken while running in Bypass
+  Permissions mode.
+
+  https://code.claude.com/docs/en/security
+
+  ❯ No, exit
+    Yes, I accept
+
+  Enter to confirm · Esc to cancel
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/test/fixtures/claude-tui/firstrun-ready.txt b/test/fixtures/claude-tui/firstrun-ready.txt
new file mode 100644
index 0000000..4222fd4
--- /dev/null
+++ b/test/fixtures/claude-tui/firstrun-ready.txt
@@ -0,0 +1,40 @@
+
+ ▐▛███▛█   Claude Code v2.1.288
+▝▜██████▀  Opus 5.5 · API Usage Billing
+ ▝▝   ▝▝   /srv/project
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+                                                                                ◐ medium · /effort
+────────────────────────────────────────────────────────────────────────────────────────────────────
+❯
+────────────────────────────────────────────────────────────────────────────────────────────────────
+  ⏵⏵ bypass permissions on (shift+tab to cycle) · ← for agents
diff --git a/test/fixtures/claude-tui/firstrun-theme.txt b/test/fixtures/claude-tui/firstrun-theme.txt
new file mode 100644
index 0000000..336fbd1
--- /dev/null
+++ b/test/fixtures/claude-tui/firstrun-theme.txt
@@ -0,0 +1,40 @@
+Welcome to Claude Code v2.1.288
+..........................................................
+
+     *                                       █████▓▓░
+                                 *         ███▓░     ░░
+            ░░░░░░                        ███▓░
+    ░░░   ░░░░░░░░░░                      ███▓░
+   ░░░░░░░░░░░░░░░░░░░    *                ██▓░░      ▓
+                                             ░▓▓███▓▓░
+ *                                 ░░░░
+                                 ░░░░░░░░
+                               ░░░░░░░░░░░░░░░░
+       █████████                                        *
+      ██▄█████▄██                        *
+       █████████      *
+.......█ █   █ █..........................................
+
+ Let's get started.
+
+ Choose the text style that looks best with your terminal
+ To change this later, run /theme
+
+     Auto (match terminal)
+ ❯ ✔ Dark mode
+     Light mode
+     Dark mode (colorblind-friendly)
+     Light mode (colorblind-friendly)
+     Dark mode (ANSI colors only)
+     Light mode (ANSI colors only)
+
+ ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
+  1  function greet() {
+  2 -  console.log("Hello, World!");
+  2 +  console.log("Hello, Claude!");
+  3  }
+ ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌
+  Syntax theme: Monokai Extended (ctrl+t to disable)
+
+
+
diff --git a/test/fixtures/claude-tui/firstrun-trust.txt b/test/fixtures/claude-tui/firstrun-trust.txt
new file mode 100644
index 0000000..fcacfd8
--- /dev/null
+++ b/test/fixtures/claude-tui/firstrun-trust.txt
@@ -0,0 +1,40 @@
+
+────────────────────────────────────────────────────────────────────────────────────────────────────
+ Accessing workspace:
+
+ /srv/project
+
+
+ Quick safety check: Is this a project you created or one you trust? (Like your own code, a
+ well-known open source project, or work from your team). If not, take a moment to review what's in
+ this folder first.
+
+ Claude Code'll be able to read, edit, and execute files here.
+
+ Security guide
+
+ ❯ No, exit
+   Yes, I trust this folder
+
+ Enter to confirm · Esc to cancel
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+