> ## Documentation Index
> Fetch the complete documentation index at: https://taskgraph-ai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Loop Permissions

> When loop asks before running Claude with permission prompts off, what counts as a change to approve, and the --trust and --sandbox alternatives

## Permission prompts

Each iteration runs `claude -p` with permission prompts off (`--dangerously-skip-permissions`), so Claude can read, edit and run anything in the project without asking. The first run in a project asks you to allow that and remembers your answer in `~/.taskgraph/loop-trusted.json`. It asks again when the task text or the project instructions Claude loads changed since you approved it: after `parse-prd` or `github import` adds tasks, or after a command saves text from the research model (with `--research`, or when it answered because the main and fallback models failed), since that text came from someone other than you or from the web, and after the tasks file changed some other way, such as checking out a branch with different tasks or editing a task. The project instructions are `CLAUDE.md`, `.taskgraph/CLAUDE.md` and `.mcp.json` in the project, everything in its `.claude` folder (settings, rules, agents, commands, skills), the Definition of Done and the `loop.bands`, `loop.resumeMaxContextTokens` and `loop.smokeCommand` settings in `.taskgraph/config.json`, the complexity reports in `.taskgraph/reports` (for every tag), and the PRD sections tasks cite; adding, changing or deleting one counts. When the project is in a subfolder of its git repository, the `CLAUDE.md`, `.claude/CLAUDE.md`, `.claude/rules` and `.claude/skills` of each folder above it, up to the top of the repository (but not your home folder), count too, since Claude Code loads them at start. A symlink in `.claude` counts by where it points, and also by the file or folder it points to when that is inside the repository; a symlink that points outside the repository counts only by where it points. A file that one of these Markdown files (`CLAUDE.md`, `.taskgraph/CLAUDE.md`, a rule, and the rest) imports with `@path` counts too, as does a file that one imports in turn, up to five imports deep, since Claude Code loads them with the file that names them; adding, changing or deleting it counts. An `@path` counts wherever it is written, also in a code block, where Claude Code doesn't import it. An imported folder, a path under `~`, and a path or symlink that leads outside the repository don't count. `CLAUDE.local.md` (in the project or a folder above it), `.claude/settings.local.json` and the same settings in `.taskgraph/config.local.json` count when git tracks them under any mix of upper and lower case, and also when git can't tell (it isn't installed, or it won't use the repository, such as one owned by another user). Untracked, they are your own and don't count, and neither do `.claude/worktrees` and the files in your home folder. A `.claude` folder of more than 5,000 files is too big to check, so `loop` asks every time. Status changes and checked-off criteria don't count, and neither do the changes an approved run makes itself, except that saving research-model output during a run still withdraws the approval. Approvals saved before this check existed are asked for once more. `show`, `next` and `prime` print task text between `<task-data>` and `</task-data>`, and each prompt tells Claude that text describes the work and doesn't instruct it. In a script or CI, where nothing can answer, pass `--trust`. To keep Claude off your machine, pass `--sandbox` to run each iteration in a Docker sandbox (`docker sandbox run claude`) instead; the first sandbox run asks you to sign in. A sandboxed run doesn't ask for approval, and its session can change the project's `.git/config`, so on your machine it runs nothing that config names, whether or not you approved the project. The only git command it runs there reads the last commit (`git rev-parse HEAD`), before the first iteration and after each one. It doesn't run `git status`, which would start a `filter` program set in that config, so its prompt leaves out the files an interrupted task left uncommitted and tells Claude to run `git status` in the sandbox instead. No git command TaskGraph runs on your machine, `show`'s commit search included, downloads an object the repository is missing, because a partial-clone remote in that config can name a program to do it. In a real partial clone, fetch what's missing yourself before `loop --parallel`; on git older than 2.45, the worktree and merge commands of `loop --parallel`, which run your git hooks, and the two local fetches `--container` makes are not covered. Every iteration in a project uses the same sandbox, named `taskgraph-loop-<id>`, and an iteration that times out or a Ctrl-C stops it (`docker sandbox stop`). If you used `--sandbox` before the sandbox had this name, your first run after upgrading creates it and asks you to sign in once more.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.