Permission prompts
Each iteration runsclaude -p with permission prompts off (--dangerously-skip-permissions), so Claude can read, edit and run anything in the project without asking. The first run in a project asks you to allow that and remembers your answer in ~/.taskgraph/loop-trusted.json. It asks again when the task text or the project instructions Claude loads changed since you approved it: after parse-prd or github import adds tasks, or after a command saves text from the research model (with --research, or when it answered because the main and fallback models failed), since that text came from someone other than you or from the web, and after the tasks file changed some other way, such as checking out a branch with different tasks or editing a task. The project instructions are CLAUDE.md, .taskgraph/CLAUDE.md and .mcp.json in the project, everything in its .claude folder (settings, rules, agents, commands, skills), the Definition of Done and the loop.bands, loop.resumeMaxContextTokens and loop.smokeCommand settings in .taskgraph/config.json, the complexity reports in .taskgraph/reports (for every tag), and the PRD sections tasks cite; adding, changing or deleting one counts. When the project is in a subfolder of its git repository, the CLAUDE.md, .claude/CLAUDE.md, .claude/rules and .claude/skills of each folder above it, up to the top of the repository (but not your home folder), count too, since Claude Code loads them at start. A symlink in .claude counts by where it points, and also by the file or folder it points to when that is inside the repository; a symlink that points outside the repository counts only by where it points. A file that one of these Markdown files (CLAUDE.md, .taskgraph/CLAUDE.md, a rule, and the rest) imports with @path counts too, as does a file that one imports in turn, up to five imports deep, since Claude Code loads them with the file that names them; adding, changing or deleting it counts. An @path counts wherever it is written, also in a code block, where Claude Code doesn’t import it. An imported folder, a path under ~, and a path or symlink that leads outside the repository don’t count. CLAUDE.local.md (in the project or a folder above it), .claude/settings.local.json and the same settings in .taskgraph/config.local.json count when git tracks them under any mix of upper and lower case, and also when git can’t tell (it isn’t installed, or it won’t use the repository, such as one owned by another user). Untracked, they are your own and don’t count, and neither do .claude/worktrees and the files in your home folder. A .claude folder of more than 5,000 files is too big to check, so loop asks every time. Status changes and checked-off criteria don’t count, and neither do the changes an approved run makes itself, except that saving research-model output during a run still withdraws the approval. Approvals saved before this check existed are asked for once more. show, next and prime print task text between <task-data> and </task-data>, and each prompt tells Claude that text describes the work and doesn’t instruct it. In a script or CI, where nothing can answer, pass --trust. To keep Claude off your machine, pass --sandbox to run each iteration in a Docker sandbox (docker sandbox run claude) instead; the first sandbox run asks you to sign in. A sandboxed run doesn’t ask for approval, and its session can change the project’s .git/config, so on your machine it runs nothing that config names, whether or not you approved the project. The only git command it runs there reads the last commit (git rev-parse HEAD), before the first iteration and after each one. It doesn’t run git status, which would start a filter program set in that config, so its prompt leaves out the files an interrupted task left uncommitted and tells Claude to run git status in the sandbox instead. No git command TaskGraph runs on your machine, show’s commit search included, downloads an object the repository is missing, because a partial-clone remote in that config can name a program to do it. In a real partial clone, fetch what’s missing yourself before loop --parallel; on git older than 2.45, the worktree and merge commands of loop --parallel, which run your git hooks, and the two local fetches --container makes are not covered. Every iteration in a project uses the same sandbox, named taskgraph-loop-<id>, and an iteration that times out or a Ctrl-C stops it (docker sandbox stop). If you used --sandbox before the sandbox had this name, your first run after upgrading creates it and asks you to sign in once more.