[BUG] Workspace trust dialog never appears in the VS Code extension (shown via CLI), so project-scope plugins / project .claude/settings.json are silently skipped

This is happening to me in the regular claude code command, not in an IDE. It keeps saying:

Ignoring 1 permissions.allow entry from .claude/settings.json: this workspace has not been trusted. Run Claude Code interactively here once and accept the trust dialog

But the trust dialog is not appearing

Still present on 2.1.220, and it has a consequence not yet listed in this thread: repo-committed extraKnownMarketplaces never registers, which silently breaks the documented team-onboarding path.

Environment

• Claude Code CLI 2.1.220 (native install, ~/.local/bin/claude)
• VS Code extension anthropic.claude-code 2.1.220-darwin-arm64
• VS Code 1.130.0 / Cursor 3.15.6 · macOS 26.5.2 (arm64)

What I observe

~/.claude.json on this machine has 13 project entries and hasTrustDialogAccepted: true on zero of them — including repos I've worked in daily for weeks, exclusively through the extension. projectOnboardingSeenCount is 0 across the board. I have never seen a trust dialog in the extension.

The downstream effect on marketplaces: a repo whose committed .claude/settings.json declares

{
  "extraKnownMarketplaces": {
    "my-marketplace": {
      "source": { "source": "github", "repo": "my-org/my-marketplace" },
      "autoUpdate": true
    }
  }
}

never gets that marketplace registered. ~/.claude/plugins/known_marketplaces.json gains no entry, and /plugin → Marketplaces doesn't list it. Access isn't the problem — claude plugin marketplace add my-org/my-marketplace succeeds immediately over HTTPS for the same private repo.

This is not the ancestor-trust variant in #84402: with zero trusted entries anywhere, there is no trusted ancestor to suppress the prompt.

Minimal reproduction (public marketplace, anyone can run)

mkdir -p /tmp/cc-trust-test/.claude
cat > /tmp/cc-trust-test/.claude/settings.json <<'EOF'
{"extraKnownMarketplaces":{"claude-plugins-official":{"source":{"source":"github","repo":"anthropics/claude-plugins-official"},"autoUpdate":true}}}
EOF

1. Open /tmp/cc-trust-test in VS Code / Cursor and start Claude Code via the extension.
2. No trust dialog appears.
3. python3 -c "import json,os;print(json.load(open(os.path.expanduser('~/.claude.json')))['projects'].get('/tmp/cc-trust-test'))" → hasTrustDialogAccepted: false.
4. ~/.claude/plugins/known_marketplaces.json has no claude-plugins-official entry from the project declaration; /plugin → Marketplaces doesn't list it.
5. Nothing is printed anywhere — no stderr warning, no /plugin warning row, no notification.

Why the extension can't show the dialog

The extension spawns the CLI headless rather than as a TTY: --output-format stream-json --input-format stream-json, with CLAUDE_CODE_ENTRYPOINT="claude-vscode". The CLI's own --print help text says:

The workspace trust dialog is skipped when Claude is run in non-interactive mode (via -p, or when stdout is not a TTY, e.g. piped or redirected output). Only use this in directories you trust. Settings files that fail validation are silently ignored in this mode (no error dialog is shown).

So in the extension's default mode the dialog is structurally unreachable — it isn't suppressed by a flag, and it isn't delegated to the editor.

Worth noting for whoever picks this up: the extension bundles contain zero references to vscode.workspace.isTrusted, onDidGrantWorkspaceTrust, requestWorkspaceTrust, or hasTrustDialogAccepted. VS Code's own workspace trust is never consulted, and the extension never passes trust state to the CLI — the SDK's set_cwd accepts trust_accepted / trusted_directory, but the extension never sets either. package.json declares only capabilities.untrustedWorkspaces.supported: false, which just stops VS Code activating the extension in Restricted Mode.

Setting claudeCode.useTerminal: true renders the real TUI and does show the dialog. That's currently the only in-editor way to grant trust.

Compounding problem: this particular failure is completely uninstrumented

Every other trust-gated surface tells the user something. extraKnownMarketplaces is the exception:

| Surface | Behavior on an untrusted workspace |
|---|---|
| permissions.allow / permissions.additionalDirectories | console.error: "Ignoring N … entries from …: this workspace has not been trusted. Run Claude Code interactively here once and accept the trust dialog, or set projects[…].hasTrustDialogAccepted: true in ~/.claude.json." |
| agent frontmatter hooks | error-level log + tengu_agent_hooks_origin_untrusted telemetry |
| .claude/skills/ project plugins | structured /plugin warning project-scope-suppressed-untrusted, with the hint "Accept the trust dialog for this workspace, then run /reload-plugins." |
| MCP .mcp.json approvals | notification + mcp_approval_persist_gated |
| hooks / statusline | debug log "Skipping X - workspace trust not accepted" |
| extraKnownMarketplaces | nothing — no stderr, no /plugin warning, no notification, no telemetry |

The only trace anywhere is a --debug-only line, and it names a different gate than the one that actually dropped the config:

Trust not accepted for current directory - skipping plugin installations

Why this matters beyond one user

The docs (plugin-marketplaces → "Require marketplaces for your team") tell teams to commit extraKnownMarketplaces so that "team members are automatically prompted to install your marketplace when they trust the project folder."

For every IDE-extension user that is a silent no-op — and critically, the repo owner has no way to discover it didn't work. Teammates simply, quietly, don't have the org's plugins. There's no error to search for and nothing in the UI to notice.

A project-scope-suppressed-untrusted-style warning for marketplaces would make this self-diagnosing even before the trust-dialog problem itself is fixed. The pattern already exists in the product for the adjacent .claude/skills/ case.

Two doc-accuracy notes while this is open

1. **There is no prompt in 2.1.220 even when trust is accepted.** Registration is a silent background install with a status indicator; the trust dialog's own text ("Accessing workspace:" … "Yes, I trust this folder") never mentions plugins or marketplaces. The docs promise an interaction that doesn't exist.
2. The trust dependency is undocumented. The settings-schema description for extraKnownMarketplaces — "Additional marketplaces to make available for this repository. Typically used in repository .claude/settings.json to ensure team members have required plugin sources." — says nothing about requiring trust. #13097 raised exactly this and was closed as stale, then locked.

Related

• #84402 — same gate, different trigger (trust granted by ancestor walk but consumed by exact match)
• #74612 — extension silently ignores --scope project plugin installs
• #78119 — same extraKnownMarketplaces no-op in claude.ai/code cloud sandboxes
• #16870 — extraKnownMarketplaces ignored in managed-settings.json
• #72896 — the permissions equivalent of the ancestor-vs-exact-match asymmetry
• #13097 — docs issue asking for exactly the clarification in note 2; closed as stale, then locked

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

This issue was incorrectly closed by the github-actions bot, despite having reproduction steps and Claude version. This bot behavior is tracked in https://github.com/anthropics/claude-code/issues/87647. Consider upvoting that issue for visibilty, maybe the bot behavior gets fixed.