[FEATURE] Graduated double-confirmation for wide-scope permission grants (e.g., trusting the home directory)

Type: Feature Request / Enhancement
Area: Security / UX
Severity: Usability Risk

Summary

High-privilege, wide-scope permission grants (trusting the home directory, writing a standing "don't ask again" allow rule, enabling bypass modes) are currently confirmed with the same single Yes/No keystroke as routine, narrow, one-off approvals. Because users answer many permission prompts per session, responses become habituated (prompt fatigue / de-sensitization), and a single habituated keystroke can silently produce a standing, wide-ranging elevation of privileges. We propose graduated confirmation: friction proportional to the scope and persistence of the grant.

Problem

• Launching claude in ~ (or any very broad directory) presents the standard folder-trust dialog. One keystroke records standing trust for the entire home tree in ~/.claude.json, and the question is never asked again.
• "Yes, don't ask again" answers on permission prompts write persistent allow rules, yet are visually near-identical to session-only approvals.
• The failure mode is real, not hypothetical: while auditing old AI-tool configs, we found a trust_level = "trusted" grant for the entire home directory in another agent's config (Codex), which the user had no memory of ever making — almost certainly a single habituated keystroke a year earlier. Claude Code's trust dialog has the same interaction shape, so the same accident is available here.
• Related: #90582 recently discussed the ordering of the trust-dialog options; demoting the trust option helps, but ordering alone does not distinguish a narrow grant from a wide one. #66173 documents that reads outside the working directory can occur unprompted, which raises the stakes of a too-broad trust grant.

Proposed behavior

When a grant exceeds a scope threshold (e.g., trust for ~, /, or any directory above a configurable depth; global/user-level allow rules; bypass-permissions modes):

1. Distinct presentation — a visually different dialog (banner/color) that states the scope explicitly: "This trusts your ENTIRE HOME DIRECTORY (~248,000 files), permanently, for all future sessions."
2. A second, structurally different confirmation — e.g., typing a short word ("trust") or selecting the scope from a list, so that a habituated Enter/1 keystroke cannot complete the elevation. (Same rationale as GitHub's type-the-repo-name pattern for destructive actions.)
3. Consequence summary — where the grant is stored, that it is standing rather than session-scoped, and how to revoke it (/permissions).
4. Optionally: expiry or periodic re-confirmation for wide-scope grants, and a /permissions audit view that flags wide-scope entries.

Narrow, session-scoped approvals should keep the current lightweight single-keystroke flow — the point is not more prompts, but that the one dangerous prompt must not feel identical to the fifty harmless ones.

Environment

• Claude Code v2.1.234, macOS (darwin 25.5.0)