Bug: PreToolUse Hooks Skipped - "Workspace Trust Not Accepted"

Bug: PreToolUse Hooks Skipped - "Workspace Trust Not Accepted"

Version: 2.0.49 | Platform: macOS | Related: #9113, #11519

Problem

PreToolUse hooks are silently skipped with debug message "workspace trust not accepted" even when:

• Trust dialog was accepted
• hasTrustDialogAccepted: true is set in ~/.claude.json
• Hook is visible and registered in /hooks menu

Debug Evidence

[DEBUG] executePreToolHooks called for tool: Write
[DEBUG] Getting matching hook commands for PreToolUse with query: Write
[DEBUG] Found 1 hook matchers in settings
[DEBUG] Matched 1 unique hooks for query "Write" (1 before deduplication)
[DEBUG] Skipping PreToolUse:Write hook execution - workspace trust not accepted

What We Tried (ALL FAILED)

1. Disabling all plugins
2. Removing permissions.allow list from settings
3. Disabling/removing settings.local.json
4. Testing user-level vs project-level hooks separately
5. Setting hasTrustDialogAccepted: false to re-trigger prompt (no prompt appeared!)
6. Deleting entire project entry from ~/.claude.json
7. Creating fresh project entry with hasTrustDialogAccepted: true
8. Verified hook script works correctly when tested manually (exits code 2)

Only Workaround That Works: Rename Repository

cd ~/projects
mv my-repo my-repo-temp  # Start Claude in new path - hooks work!
mv my-repo-temp my-repo  # Bug returns immediately

The same codebase, same config, same hook script - only the path matters.

Theory: Server-Side Trust State

We believe trust state is stored server-side (tied to account + workspace path), not just locally. Evidence:

• All local config changes have zero effect
• Deleting local project entries doesn't help
• Only changing the path works (new path = new workspace server-side)

This would explain why local troubleshooting is futile.

Requests

1. Investigate server-side trust - If stored server-side, provide a way to reset it
2. Add /trust command - Allow users to explicitly reset/re-trigger trust evaluation
3. Better visibility - Show when hooks are skipped in the UI, not just debug logs

Time Investment

~4 hours debugging across multiple sessions before discovering the rename workaround.

Minimal Reproduction

1. Have a workspace where this bug manifests (unclear how it gets into this state)
2. Configure PreToolUse hook in settings.json
3. Run claude --debug
4. Trigger a Write operation
5. Check debug logs for "workspace trust not accepted"