fix(claude_code): stop echoed system prompt from short-circuiting trust dialog (#319)

The startup handler treated any "> "/"❯ " in the capture buffer as the idle
prompt and returned early. The injected --append-system-prompt contains a line
starting with "> `memory_store`", which the shell echoes into the capture
buffer ~300ms before the workspace-trust dialog renders. The handler matched
that marker, declared Claude Code ready, and returned before accepting the
trust dialog. initialize() then blocked on {IDLE, COMPLETED} for 30s and the
session was killed, so `cao launch` failed on every not-yet-trusted working
directory.

Remove the bare IDLE_PROMPT_PATTERN early-return. The version banner
("Welcome to" / "Claude Code v<n>") is the only ready signal that cannot appear
in the echoed launch command; the trust and bypass dialogs are still handled
explicitly above, and wait_until_status() remains the real readiness gate.

Add a regression test that returns the echoed command on the first poll and the
trust dialog on the second, asserting the trust dialog is accepted (the old
early-return would skip it).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cdrury526

src/cli_agent_orchestrator/providers/claude_code.py

@@ -338,13 +338,22 @@ def _handle_startup_prompts(self, timeout: Optional[float] = None) -> None:
                 get_backend().send_special_key(self.session_name, self.window_name, "Enter")
                 return
 
-            # 3) Claude Code fully started — no prompts needed
+            # 3) Claude Code fully started — no prompts needed.
+            #    The version banner is the ONLY reliable "ready" signal here: it
+            #    renders only once the REPL is up and cannot appear in the echoed
+            #    launch command. The old bare IDLE_PROMPT_PATTERN ("> "/"❯ ") check
+            #    was removed: the injected --append-system-prompt text contains
+            #    "> `memory_store`" (start of a line), which the echoed command
+            #    surfaces in the capture buffer within ~300ms and false-matches as
+            #    "idle". The handler then returned BEFORE the workspace-trust dialog
+            #    rendered, leaving it unaccepted; initialize() then blocked on
+            #    {IDLE, COMPLETED} for 30s and the session was killed. Trust/bypass
+            #    dialogs are handled explicitly above; if no banner ever appears the
+            #    loop just waits out its timeout and the downstream
+            #    wait_until_status() remains the real readiness gate.
             if re.search(r"Welcome to|Claude Code v\d+", clean_output):
                 logger.info("Claude Code started without prompts")
                 return
-            if re.search(IDLE_PROMPT_PATTERN, clean_output):
-                logger.info("Claude Code idle prompt detected, no prompts needed")
-                return
 
             time.sleep(1.0)
         logger.warning("Startup prompt handler timed out")

test/providers/test_claude_code_coverage.py

@@ -1,7 +1,8 @@
 """Additional tests for ClaudeCodeProvider to cover uncovered branches.
 
 Covers: McpServer model_dump path, bypass permissions prompt handling,
-and idle prompt early return in _handle_startup_prompts.
+and the workspace-trust handling in _handle_startup_prompts (including the
+regression where the echoed launch command false-matched the idle prompt).
 """
 
 import re
@@ -66,16 +67,39 @@ def test_bypass_permissions_prompt(self, mock_backend, provider):
             provider.session_name, provider.window_name, "Enter"
         )
 
+    @patch("cli_agent_orchestrator.providers.claude_code.time.sleep", lambda *a, **k: None)
     @patch("cli_agent_orchestrator.backends.registry._backend")
-    def test_idle_prompt_detected_early_return(self, mock_backend, provider):
-        """When idle prompt is visible, returns immediately without sending keys."""
-        from cli_agent_orchestrator.providers.claude_code import IDLE_PROMPT_PATTERN
-
-        mock_backend.get_history.return_value = "❯ "
+    def test_echoed_prompt_does_not_short_circuit_trust(self, mock_backend, provider):
+        """Regression: the injected --append-system-prompt contains a line that
+        starts with "> `memory_store`". The shell echoes the launch command into
+        the capture buffer ~300ms before the workspace-trust dialog renders, so
+        that "> " must NOT be treated as the idle prompt and end startup handling
+        early — otherwise the trust dialog is left unaccepted and initialize()
+        blocks on {IDLE, COMPLETED} until it times out and the session is killed.
+
+        First poll returns the echoed command (with the "> memory_store" marker
+        but no dialog yet); second poll returns the trust dialog. The handler must
+        accept the trust dialog (Enter) rather than returning on the first frame.
+        """
+        echoed_launch_cmd = (
+            "user@host:/tmp/proj$ claude --dangerously-skip-permissions "
+            "--append-system-prompt '## Memory\n"
+            "> `memory_store` and `memory_recall` are CAO's memory tools'"
+        )
+        trust_frame = (
+            "Quick safety check: Is this a project you created or one you trust?\n"
+            "❯ 1. Yes, I trust this folder\n"
+            "  2. No, exit\n"
+        )
+        mock_backend.get_history.side_effect = [echoed_launch_cmd, trust_frame]
 
-        provider._handle_startup_prompts(timeout=1.0)
+        provider._handle_startup_prompts(timeout=5.0)
 
-        # No exception means early return worked
+        # Trust dialog accepted via Enter — proves we did not early-return on the
+        # echoed "> memory_store" marker.
+        mock_backend.send_special_key.assert_called_once_with(
+            provider.session_name, provider.window_name, "Enter"
+        )
 
     @patch("cli_agent_orchestrator.backends.registry._backend")
     def test_welcome_banner_detected_early_return(self, mock_backend, provider):