diff --git a/.agents/skills/harness-adapters/SKILL.md b/.agents/skills/harness-adapters/SKILL.md
index 0e441fd6d2b..535325a3f3b 100644
--- a/.agents/skills/harness-adapters/SKILL.md
+++ b/.agents/skills/harness-adapters/SKILL.md
@@ -1,6 +1,9 @@
 ---
 name: harness-adapters
-description: Agent-only reference for firstmate harness operations. Use before spawning or recovering a crewmate or secondmate, handling a trust dialog, sending a harness-specific skill invocation, interrupting or exiting an agent, resuming an exited agent, or verifying a new harness adapter. Contains verified facts for claude, codex, opencode, pi, and grok.
+description: >-
+  Agent-only reference for firstmate harness operations.
+  Use before spawning or recovering a crewmate or secondmate, handling a trust or permission dialog, sending a harness-specific skill invocation, interrupting or exiting an agent, resuming an exited agent, or verifying a new harness adapter.
+  Contains verified facts for claude, codex, opencode, pi, and grok.
 user-invocable: false
 metadata:
   internal: true
@@ -47,6 +50,14 @@ When verifying a new adapter, record its env marker and command name in `bin/fm-
 For stuck recovery, the target window's harness is recorded as `harness=` in `state/<id>.meta`.
 Use that value for interrupt, exit, resume, and skill-invocation facts.
 
+## Mid-run permission prompts
+
+Firstmate launches every verified crewmate harness in its unattended mode, but a managed policy, a newly introduced tool class, or a failed autonomy flag can still produce a permission prompt after work has started.
+`bin/fm-watch.sh` owns the deterministic pane matcher and the busy/no-progress system-dialog fallback.
+`docs/permission-stall-detection.md` owns the empirical capture and macOS capability record.
+On either permission wake, load `stuck-crewmate-recovery` and follow its permission-blocked branch before using any interrupt, exit, or relaunch mechanic below.
+Never apply an adapter's startup trust-dialog acceptance rule to a mid-run command or capability grant.
+
 ## Primary turn-end guard
 
 Every verified primary harness has an empirically validated hook path for the "no turn ends blind" guard.
@@ -109,10 +120,13 @@ Natural language is acceptable if uncertain.
 | Exit command | `/exit` |
 | Interrupt | single Escape |
 | Skill invocation | `/<skill>` (e.g. `/no-mistakes`) |
+| Protected mid-run grant shapes | `Do you want to proceed?` together with the `Esc to cancel · Tab to amend` footer, or `Quick safety check: Is this a project you created or one you trust?` together with `Yes, I trust this folder`, `No, exit`, and the confirmation footer. |
 
 First launch in a fresh worktree, or first ever on a machine, may show a trust or bypass-permissions confirmation.
 After every spawn, peek the pane within about 20 seconds.
-If such a dialog is showing, accept it from an active firstmate session using `FM_HOME=<this-firstmate-home> bin/fm-send.sh <window> --key Enter`, or the choice the dialog requires, unless `FM_HOME` is already set to the active firstmate home; verify the brief started processing.
+If a workspace trust or bypass-permissions dialog is showing before the brief starts processing, accept it from an active firstmate session using `FM_HOME=<this-firstmate-home> bin/fm-send.sh <window> --key Enter`, or the choice the dialog requires, unless `FM_HOME` is already set to the active firstmate home; verify the brief started processing.
+The separate `Hooks need review` prompt with `Trust all on first launch` is Firstmate's own supervision-hook trust path and must also be accepted with Enter before the brief starts.
+Once the brief has started processing, treat either protected shape in the table as a security-sensitive mid-run grant and escalate it to the captain without pressing an approval or denial key.
 
 Claude renders a predicted-next-prompt suggestion as dim/faint text inside an otherwise-empty composer after a turn completes.
 A plain `tmux capture-pane` cannot tell that ghost text apart from typed text.
@@ -139,6 +153,7 @@ Claude Code's primary watcher protocol is the lowest-friction path: run `bin/fm-
 | Exit command | `/quit` (slash popup needs about 1 second between text and Enter; `fm-send` handles it) |
 | Interrupt | single Escape |
 | Skill invocation | `$<skill>` (e.g. `$no-mistakes`); `/<skill>` is claude-only and codex rejects it as "Unrecognized command" |
+| Protected mid-run grant shapes | One of `Would you like to run the following command?`, `Would you like to grant these permissions?`, `Would you like to make the following edits?`, or `Do you want to approve network access to "<host>"?`, together with its title-specific choices and `Press enter to confirm or esc to cancel`; or `Do you trust the contents of this directory?` together with `Yes, continue` and `No, quit`. |
 
 A `$<skill>` invocation opens a `$`-autocomplete (skill) popup, the same hazard as the `/` slash popup: submitting too fast lets the popup swallow the Enter, so the invocation never lands.
 `fm-send` handles it the same way it handles `/` - it gives the popup a longer settle (1.2s) between typing and the first Enter, with the target backend's submit retry as the safety net - but the `$` settle is scoped to `harness=codex`, read from the target metadata for exact task ids or legacy `fm-<id>` labels.
@@ -147,8 +162,9 @@ An explicit `session:window` target has no meta, so its harness is unknown and t
 This is why the validation trigger (`$no-mistakes`) to a codex crew now lands on the first Enter instead of biting the popup.
 
 Directory trust dialog on first run per repo root: "Do you trust the contents of this directory?"
-Accept with Enter.
+Accept with Enter only during the spawn-time peek before the brief starts processing.
 The decision persists for the repo, so later worktrees of the same project skip it.
+If that shape appears after work has started, escalate it to the captain as a mid-run directory-trust grant without pressing an approval or denial key.
 
 Resume after exit with `codex resume <session-id>`.
 The session id is printed on quit.
diff --git a/.agents/skills/stuck-crewmate-recovery/SKILL.md b/.agents/skills/stuck-crewmate-recovery/SKILL.md
index 2204c6bb7ef..d8b1d1e20e9 100644
--- a/.agents/skills/stuck-crewmate-recovery/SKILL.md
+++ b/.agents/skills/stuck-crewmate-recovery/SKILL.md
@@ -1,6 +1,9 @@
 ---
 name: stuck-crewmate-recovery
-description: Agent-only playbook for stuck firstmate direct reports. Use after a stale wake, looping pane, repeated confusion, an answered-by-brief question, an unresponsive crewmate, or a failed steer. Escalates from peek, to one-line steer, to harness-specific interrupt, to relaunch with progress, to failed status.
+description: >-
+  Agent-only playbook for stuck firstmate direct reports.
+  Use after a stale wake, permission-prompt or system-dialog suspicion, looping pane, repeated confusion, an answered-by-brief question, an unresponsive crewmate, or a failed steer.
+  Routes permission grants to the captain before the ordinary peek, steer, interrupt, relaunch, and failed-status ladder.
 user-invocable: false
 metadata:
   internal: true
@@ -8,12 +11,30 @@ metadata:
 
 # stuck-crewmate-recovery
 
-Use this playbook when a direct report is stale, looping, repeatedly confused, asking a question its brief already answers, unresponsive, or when a steer failed to land.
+Use this playbook when a direct report is stale, permission-blocked, looping, repeatedly confused, asking a question its brief already answers, unresponsive, or when a steer failed to land.
 
-Load `harness-adapters` before sending an interrupt, exit command, resume command, or harness-specific skill invocation.
+Load `harness-adapters` before handling a permission prompt or sending an interrupt, exit command, resume command, or harness-specific skill invocation.
 The target window's harness is recorded as `harness=` in `state/<id>.meta`.
 
-Escalate in order:
+## Permission-blocked branch
+
+Handle permission evidence before the ordinary recovery ladder because approving, denying, interrupting, or relaunching can change the security decision or hide the only useful evidence.
+
+1. Peek the pane and read the requested command, tool, directory, or capability.
+2. If the wake says `permission-prompt detected`, or the pane matches the target's mid-run permission shape in `harness-adapters`, do not press an approval or denial key and do not interrupt or relaunch the agent.
+3. Tell the captain what action is waiting and ask them to approve or deny it in the visible prompt.
+   Keep the message product-facing, such as `Work is blocked waiting for permission to <action>; please approve or deny that request in the visible dialog.`
+   Do not name the harness, pane, task id, watcher, or other fleet machinery.
+4. If the wake says `permission/system-dialog suspected`, remember that it is a timeout heuristic rather than a directly observed macOS dialog.
+   Inspect the pane for the foreground action and any clear evidence of ordinary progress.
+   If ordinary progress is visible, resume supervision and treat the wake as a conservative false positive.
+   Otherwise tell the captain `A macOS permission dialog may be blocking <action>; please grant or deny it in the visible dialog or in Privacy & Security in System Settings.`
+5. Never try to grant a macOS TCC permission with keystrokes, AppleScript, Accessibility APIs, `tccutil`, or a settings-database edit.
+   macOS owns that decision and the captain must make it.
+6. After the captain clears the dialog, verify that the pane changes or `bin/fm-crew-state.sh <id>` reports resumed work before returning to supervision.
+   If the permission was denied and the task still cannot proceed, use the ordinary ladder below with that denial as evidence.
+
+For a non-permission stall, escalate in order:
 
 1. Peek the pane.
 2. If the crewmate is waiting on a question its brief already answers, answer in one line via `FM_HOME=<this-firstmate-home> bin/fm-send.sh` from an active firstmate session unless `FM_HOME` is already set to the active firstmate home.
diff --git a/AGENTS.md b/AGENTS.md
index b0cbb7d6c6e..3136877408b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -111,7 +111,7 @@ state/               volatile runtime signals; gitignored
   .afk               durable away-mode flag; present = sub-supervisor may inject escalations (set by /afk, cleared on user return)
   .lock              per-home session lock written by fm-lock.sh: harness PID on line 1, holder process start time on line 2; direct readers parse only the first-line PID, while acquire/status treat it as held only when that PID is live with a matching start time (skipped for a legacy one-line lock, which is held while its PID is a live harness) and is not a Codex app-server
   .watch.lock .wake-queue.lock watcher singleton and queue serialization locks
-  .hash-* .count-* .stale-* .stale-since-* .paused-* .wedge-escalations-* .seen-* .hb-surfaced-* .last-* .heartbeat-streak   watcher internals; never touch
+  .hash-* .count-* .stale-* .stale-since-* .paused-* .wedge-escalations-* .brief-started-* .seen-* .hb-surfaced-* .last-* .heartbeat-streak   watcher internals; never touch
   .watch-triage.log  watcher's absorbed-wake debug log (size-capped); never relied on, safe to delete
   .last-watcher-beat watcher liveness beacon, touched every poll (including while absorbing benign wakes); guard scripts read it
   .subsuper-* .supervise-daemon.*   sub-supervisor internals; never touch
@@ -561,11 +561,11 @@ Whenever at least one task is in flight, keep exactly one live supervision wait
 The emitted block is the only per-harness operating recipe in the session context.
 Do not substitute another harness's command shape for it.
 **Always-on wake triage (absorb only when provably working).**
-`bin/fm-watch.sh` classifies every wake in bash and absorbs the benign majority without waking you: crews with positive working evidence (an actively-running no-mistakes step for their branch, or a busy pane, read via `bin/fm-crew-state.sh`), a declared `paused:` external wait until its bounded recheck cadence, and no-change heartbeats.
+`bin/fm-watch.sh` classifies every wake in bash and absorbs the benign majority without waking you: crews with positive working evidence (an actively-running no-mistakes step for their branch, or a busy pane read via `bin/fm-crew-state.sh`) unless the separate permission-stall no-progress threshold has expired, a declared `paused:` external wait until its bounded recheck cadence, and no-change heartbeats.
 It never absorbs a crewmate that stopped without that evidence - whatever its stale status log claims - and only an actionable wake is queued durably and ends the supervision wait, so you resume the emitted protocol exactly once per actionable event.
 A `paused:` status is a deliberate external wait, not `blocked:`; its initial signal still surfaces once, and a forgotten pause re-surfaces for a recheck once per window.
-Repeated provably-working stale escalations on one unchanged pane eventually add `demand-deep-inspection` to the wake reason so it is not mistaken for another routine validation wait.
-`docs/architecture.md` ("Event-driven supervision") owns the full classification mechanism, its thresholds, and the shared classifier library; while `state/.afk` exists the daemon owns triage and the watcher surfaces every wake to it.
+Repeated unchanged wedge or permission-stall escalations eventually add `demand-deep-inspection` to the wake reason so they are not mistaken for another routine validation wait.
+`docs/architecture.md` ("Event-driven supervision") owns the general classification mechanism and shared classifier library, while `docs/permission-stall-detection.md` owns permission-prompt matching and the macOS timeout heuristic; while `state/.afk` exists the daemon owns triage and the watcher surfaces every wake to it.
 At the start of every wake-handling turn, run `bin/fm-wake-drain.sh` before peeking panes, reading status files beyond the reason line, or starting new work.
 Session-start recovery is the exception: `bin/fm-session-start.sh` already drained the queue when locked, or deliberately skipped the drain when read-only because another session owns it.
 The printed reason line is still useful, but the drained queue is the lossless backlog.
@@ -600,7 +600,9 @@ On wake, in order of cheapness:
 1. Read the reason line and drain queued wake records with `bin/fm-wake-drain.sh`.
 2. `signal:` read the listed status files first; a wake lists every signal that landed within the coalescing grace window (e.g. a status write plus the same turn's turn-end marker), and each is ~30 tokens and usually sufficient.
    A status line is the wake *event*, not the crewmate's current state; when you need the live state - especially to confirm a `needs-decision`/`blocked`/`paused` status is still real and not already resolved-and-resumed - read it with `bin/fm-crew-state.sh <id>`, which reconciles the authoritative run-step over the possibly-stale log line, and never `tail` the status log as the current-state source.
-3. `stale:` the crewmate stopped without reporting; peek the pane (`bin/fm-peek.sh <window>`) to diagnose.
+3. `stale:` the crewmate stopped without reporting, a recognized mid-run permission prompt is waiting, or a busy pane exceeded the possible system-dialog no-progress threshold.
+   If the reason includes `permission-prompt detected` or `permission/system-dialog suspected`, load `stuck-crewmate-recovery` before taking any ordinary recovery action and follow its permission-blocked branch.
+   Otherwise peek the pane (`bin/fm-peek.sh <window>`) to diagnose.
    If the stale reason includes `demand-deep-inspection`, inspect the pane, `bin/fm-crew-state.sh <id>`, and the validation logs before resuming supervision.
    If the pane is waiting, looping, confused, or unresponsive, load `stuck-crewmate-recovery`.
 4. `check:` a per-task poll fired (usually a merge, or X mode when enabled); act on it.
@@ -655,7 +657,7 @@ Inline facts that must survive without a loaded skill:
 
 ### Stuck-crewmate recovery
 
-On `stale`, looping, repeated confusion, an answered-by-brief question, an unresponsive pane, or a failed steer, load `stuck-crewmate-recovery`.
+On `stale`, `permission-prompt detected`, `permission/system-dialog suspected`, looping, repeated confusion, an answered-by-brief question, an unresponsive pane, or a failed steer, load `stuck-crewmate-recovery`.
 That playbook escalates from peek, to one-line steer, to harness-specific interrupt, to relaunch with a progress note, to `failed` with evidence.
 
 ## 9. Escalation and captain etiquette
@@ -774,10 +776,10 @@ It performs only fast-forward self-updates of firstmate and registered secondmat
 These skills are not captain-invocable; they are conditional operating references you must load at the trigger points below.
 
 - `bootstrap-diagnostics` - load whenever the session-start digest's bootstrap section prints any diagnostic or capability line (`MISSING:`, `MISSING_MANUAL:`, `BACKEND_INVALID:`, `ACCOUNT_ROUTING:`, `NEEDS_GH_AUTH`, `TANGLE:`, `CREW_HARNESS_OVERRIDE:`, `CREW_DISPATCH:`, `FLEET_SYNC:`, `SECONDMATE_SYNC:`, `SECONDMATE_LIVENESS:`, `TASKS_AXI:`, `NUDGE_SECONDMATES:`, `REPORT_RETENTION:`, or `FMX:`); silence needs no load.
-- `harness-adapters` - load before spawning or recovering a crewmate or secondmate, handling a trust dialog, sending a harness-specific skill invocation, interrupting or exiting an agent, resuming an exited agent, or verifying a new harness adapter.
+- `harness-adapters` - load before spawning or recovering a crewmate or secondmate, handling a trust or permission dialog, sending a harness-specific skill invocation, interrupting or exiting an agent, resuming an exited agent, or verifying a new harness adapter.
 - `operating-fundamentals` - load when intaking any captain ask, deciding whether to dispatch or work inline, supervising under load, handling a blocked lane or finished crew, protecting shared validation capacity, acting on an explicit captain order, or about to assert a fleet fact.
 - `firstmate-orca` - load before recovering or supervising legacy Orca-backed work, testing Orca backend behavior, debugging Orca task state, or reconciling Orca-backed task metadata.
-- `stuck-crewmate-recovery` - load after a stale wake, looping pane, repeated confusion, an answered-by-brief question, an unresponsive crewmate, or a failed steer.
+- `stuck-crewmate-recovery` - load after a stale wake, permission-prompt or system-dialog suspicion, looping pane, repeated confusion, an answered-by-brief question, an unresponsive crewmate, or a failed steer.
 - `secondmate-provisioning` - load before creating, seeding, validating, launching, handing backlog to, recovering, pushing inherited config into, or retiring a secondmate home, and before editing `data/secondmates.md`.
 - `fmx-respond` - load on an `x-mention <request_id>` `check:` wake to handle the mention, on an `x-mode-error ...` `check:` wake to report the X-mode configuration blocker, and on any milestone or terminal wake for an X-mode-linked task before posting its completion follow-up; relevant only when X mode is on.
 - `firstmate-codexapp` - load before coordinating a visible Codex Desktop thread, evaluating a Codex App backend request, or reconciling Codex Desktop host-tool smoke evidence for Firstmate work.
diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh
index 4246204157f..a4ca5b575be 100755
--- a/bin/fm-watch.sh
+++ b/bin/fm-watch.sh
@@ -30,7 +30,12 @@
 #                          also carries a "demand-deep-inspection" marker so the
 #                          wake payload itself, not just repetition, forces a
 #                          closer look instead of another routine supervision
-#                          resume. Unless afk is active.
+#                          resume. A recognized harness permission prompt surfaces
+#                          immediately with an explicit permission-blocked reason.
+#                          A pane that remains busy without meaningful output,
+#                          status, or turn-end progress surfaces after
+#                          FM_PERMISSION_STALL_ESCALATE_SECS as a possible macOS
+#                          permission/system-dialog block. Unless afk is active.
 #   check: <script>: <out> per-task check output, always actionable
 #   heartbeat              fleet-scan backstop found an unsurfaced captain-relevant
 #                          status, unless afk is active
@@ -136,6 +141,16 @@ BUSY_REGEX=${FM_BUSY_REGEX:-'esc (to )?interrupt|Working\.\.\.|Ctrl\+c:cancel'}
 # daemon owns triage, so this watcher reverts to one-shot (enqueue + exit on every
 # wake) and never double-triages - and never runs the costly provably-working read.
 STALE_ESCALATE_SECS=${FM_STALE_ESCALATE_SECS:-240}  # idle secs before a provably-working stale escalates as a possible wedge
+# A macOS TCC/system dialog can block a foreground tool while the harness keeps
+# rendering its busy footer, so ordinary stale detection never starts. Track a
+# semantic pane fingerprint that excludes verified busy-footer churn and surface
+# a suspected permission/system-dialog block after this bounded interval. This is
+# deliberately a timeout heuristic: direct OS-dialog inspection requires
+# pre-granted Accessibility or Screen Recording access and cannot be assumed.
+PERMISSION_STALL_ESCALATE_SECS=${FM_PERMISSION_STALL_ESCALATE_SECS:-900}
+case "$PERMISSION_STALL_ESCALATE_SECS" in
+  ''|*[!0-9]*|0) PERMISSION_STALL_ESCALATE_SECS=900 ;;
+esac
 # A crew that DECLARED a pause (paused: <reason>, fm-classify-lib.sh) is idling on
 # a known external wait, so its stale pane is absorbed rather than wedge-escalated;
 # it re-surfaces once for a recheck every PAUSE_RESURFACE_SECS - far longer than the
@@ -218,6 +233,16 @@ window_kind() {
   echo unknown
 }
 
+window_harness() {
+  local w=$1 meta harness
+  meta=$(fm_backend_meta_for_window "$w" "$STATE" 2>/dev/null || true)
+  if [ -n "$meta" ]; then
+    harness=$(grep '^harness=' "$meta" | tail -1 | cut -d= -f2- || true)
+    [ -n "$harness" ] && { printf '%s' "$harness"; return 0; }
+  fi
+  printf 'unknown'
+}
+
 # window_backend: the backend recorded in the meta whose window= matches <w>,
 # defaulting to tmux (absent backend= means tmux; the P1 compatibility
 # contract) when no matching meta carries the field, or none matches at all.
@@ -397,6 +422,168 @@ surface_nonterminal_stale() {  # <window> <hash>
   wake "stale: $win"
 }
 
+# Recognize the stable confirmation chrome rendered by verified harnesses when a
+# mid-run permission or trust grant is waiting on a human. The question alone is
+# insufficient because pane output can quote it; each shape also requires its
+# title-specific choices and any verified footer in the final 16 lines, and the
+# caller requires the harness not to show its busy indicator.
+# Exact live-capture evidence and version details live in
+# docs/permission-stall-detection.md.
+# Pi has no permission system, while firstmate launches OpenCode and Grok in
+# their verified unattended modes; their unexpected
+# or future prompt shapes remain covered by the bounded no-progress fallback.
+permission_prompt_kind() {  # <harness> <tail40> <allow-directory-trust>
+  local harness=$1 tail40=$2 allow_directory_trust=${3:-0} prompt_tail
+  prompt_tail=$(printf '%s\n' "$tail40" | tail -16)
+  case "$harness" in
+    claude|unknown)
+      if printf '%s\n' "$tail40" | grep -Fq 'Do you want to proceed?' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq '1\. Yes' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq '3\. No' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq 'Esc to cancel.*Tab to amend'; then
+        printf 'command/tool permission'
+        return 0
+      fi
+      if [ "$allow_directory_trust" = 1 ] \
+        && printf '%s\n' "$tail40" | grep -Fq 'Quick safety check: Is this a project you created or one you trust?' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'Yes, I trust this folder' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'No, exit' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq 'Enter to confirm.*Esc to cancel'; then
+        printf 'directory trust'
+        return 0
+      fi
+      ;;
+  esac
+  case "$harness" in
+    codex|unknown)
+      if printf '%s\n' "$tail40" | grep -Fq 'Would you like to run the following command?' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'Yes, proceed' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq "No, (continue without running it|and tell Codex what to do differently)" \
+        && printf '%s\n' "$prompt_tail" | grep -Fqi 'Press enter to confirm or esc to cancel'; then
+        printf 'command/tool permission'
+        return 0
+      fi
+      if printf '%s\n' "$tail40" | grep -Fq 'Would you like to grant these permissions?' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'Yes, grant these permissions for this turn' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'No, continue without permissions' \
+        && printf '%s\n' "$prompt_tail" | grep -Fqi 'Press enter to confirm or esc to cancel'; then
+        printf 'permission profile'
+        return 0
+      fi
+      if printf '%s\n' "$tail40" | grep -Fq 'Would you like to make the following edits?' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'Yes, proceed' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'No, and tell Codex what to do differently' \
+        && printf '%s\n' "$prompt_tail" | grep -Fqi 'Press enter to confirm or esc to cancel'; then
+        printf 'file edit permission'
+        return 0
+      fi
+      if printf '%s\n' "$tail40" | grep -Eq 'Do you want to approve network access to ".+"\?' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'Yes, just this once' \
+        && printf '%s\n' "$prompt_tail" | grep -Eq "No, (continue without running it|and tell Codex what to do differently|and block this host in the future)" \
+        && printf '%s\n' "$prompt_tail" | grep -Fqi 'Press enter to confirm or esc to cancel'; then
+        printf 'network access'
+        return 0
+      fi
+      if [ "$allow_directory_trust" = 1 ] \
+        && printf '%s\n' "$tail40" | grep -Fq 'Do you trust the contents of this directory?' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'Yes, continue' \
+        && printf '%s\n' "$prompt_tail" | grep -Fq 'No, quit'; then
+        printf 'directory trust'
+        return 0
+      fi
+      ;;
+  esac
+  return 1
+}
+
+clear_busy_stall_tracking() {  # <window>
+  local win=$1 key
+  key=$(printf '%s' "$win" | tr ':/.' '___')
+  rm -f "$STATE/.stale-busy-hash-$key" "$STATE/.stale-busy-since-$key" \
+    "$STATE/.wedge-escalations-busy-$key"
+}
+
+handle_permission_prompt() {  # <window> <task> <hash> <kind>
+  local win=$1 task=$2 h=$3 kind=$4 key marker escalation_file prior n reason
+  key=$(printf '%s' "$win" | tr ':/.' '___')
+  marker="$STATE/.stale-permission-$key"
+  escalation_file="$STATE/.wedge-escalations-permission-$key"
+  prior=$(cat "$marker" 2>/dev/null || true)
+  if [ "$prior" = "$h" ] && [ "$(age_of "$marker")" -lt "$PERMISSION_STALL_ESCALATE_SECS" ]; then
+    return 0
+  fi
+  if [ "$prior" = "$h" ]; then
+    n=$(( $(cat "$escalation_file" 2>/dev/null || echo 1) + 1 ))
+  else
+    n=1
+  fi
+  printf '%s' "$n" > "$escalation_file"
+  reason="stale: $win (permission-prompt detected: waiting for a $kind grant; inspect the requested action and escalate it to the captain - do not approve it automatically; escalation $n)"
+  if [ "$n" -ge "$FM_WEDGE_DEMAND_INSPECT_COUNT" ]; then
+    reason="stale: $win (permission-prompt detected: waiting for a $kind grant; inspect the requested action and escalate it to the captain - do not approve it automatically; escalation $n; demand-deep-inspection)"
+  fi
+  fm_wake_append stale "$win" "$reason" || exit 1
+  printf '%s' "$h" > "$marker"
+  clear_busy_stall_tracking "$win"
+  mark_surfaced "$STATE/$task.status"
+  wake "$reason"
+}
+
+# Hash meaningful progress while a harness stays busy. Verified busy-footer lines
+# are excluded because elapsed counters and spinners can change on every capture
+# while a foreground tool is actually blocked behind an OS modal. Claude's
+# separate "Running N shell command" row can also animate its leading glyph, so
+# normalize that prefix while preserving the semantic row. Status and turn-end
+# signatures are folded in so either signal resets the no-progress clock.
+busy_progress_hash() {  # <task> <tail40>
+  local task=$1 tail40=$2 status_sig turn_sig
+  status_sig=$(stat_sig "$STATE/$task.status" || true)
+  turn_sig=$(stat_sig "$STATE/$task.turn-ended" || true)
+  {
+    printf '%s\n' "$tail40" \
+      | awk -v busy_re="$BUSY_REGEX" '{ line[NR] = $0 } END { start = NR - 5; if (start < 1) start = 1; for (i = 1; i <= NR; i++) if (i < start || line[i] !~ busy_re) print line[i] }' \
+      | sed -E 's/^.*(Running [0-9]+ shell commands?)/\1/'
+    printf 'status=%s\nturn=%s\n' "$status_sig" "$turn_sig"
+  } | hash_pane
+}
+
+# The OS does not provide a reliable unprivileged TCC-dialog query. This bounded
+# fallback detects the observable consequence instead: a harness remains busy but
+# its semantic pane, status, and turn-end state make no progress. The wake says
+# "possible" rather than claiming a dialog was observed, and repeats only once per
+# threshold window while preserving the existing demand-deep-inspection counter.
+busy_stall_check() {  # <window> <task> <tail40>
+  local win=$1 task=$2 tail40=$3 key hash_file since_file escalation_file h prev since age n reason now
+  key=$(printf '%s' "$win" | tr ':/.' '___')
+  hash_file="$STATE/.stale-busy-hash-$key"
+  since_file="$STATE/.stale-busy-since-$key"
+  escalation_file="$STATE/.wedge-escalations-busy-$key"
+  h=$(busy_progress_hash "$task" "$tail40")
+  prev=$(cat "$hash_file" 2>/dev/null || true)
+  now=$(date +%s)
+  if [ "$h" != "$prev" ]; then
+    printf '%s' "$h" > "$hash_file"
+    printf '%s' "$now" > "$since_file"
+    rm -f "$escalation_file"
+    return 0
+  fi
+  since=$(cat "$since_file" 2>/dev/null || true)
+  case "$since" in
+    ''|*[!0-9]*) printf '%s' "$now" > "$since_file"; return 0 ;;
+  esac
+  age=$(( now - since ))
+  [ "$age" -ge "$PERMISSION_STALL_ESCALATE_SECS" ] || return 0
+  n=$(( $(cat "$escalation_file" 2>/dev/null || echo 0) + 1 ))
+  printf '%s' "$n" > "$escalation_file"
+  reason="stale: $win (permission/system-dialog suspected: no meaningful progress for ${age}s while the harness remained busy; inspect the visible macOS dialog or Privacy & Security in System Settings and escalate any grant to the captain; timeout heuristic, not direct OS detection; escalation $n)"
+  if [ "$n" -ge "$FM_WEDGE_DEMAND_INSPECT_COUNT" ]; then
+    reason="stale: $win (permission/system-dialog suspected: no meaningful progress for ${age}s while the harness remained busy; inspect the visible macOS dialog or Privacy & Security in System Settings and escalate any grant to the captain; timeout heuristic, not direct OS detection; escalation $n; demand-deep-inspection)"
+  fi
+  fm_wake_append stale "$win" "$reason" || exit 1
+  printf '%s' "$now" > "$since_file"
+  wake "$reason"
+}
+
 # Check and heartbeat cadence must survive actionable exits and restarts: the
 # watcher may be relaunched before in-memory counters reach their threshold on a
 # busy fleet. Persist the schedule as file mtimes instead.
@@ -458,6 +645,34 @@ safe_marker_path() {  # <path>
   [ ! -L "$marker" ] && { [ ! -e "$marker" ] || [ -f "$marker" ]; }
 }
 
+task_generation_id() {  # <task>
+  local task=$1 meta generation
+  meta="$STATE/$task.meta"
+  [ -f "$meta" ] && [ ! -L "$meta" ] || return 1
+  generation=$(fm_meta_get "$meta" generation_id)
+  [ -n "$generation" ] || return 1
+  printf '%s' "$generation"
+}
+
+brief_processing_started() {  # <task>
+  local task=$1 generation marker
+  generation=$(task_generation_id "$task") || return 1
+  marker="$STATE/.brief-started-$task"
+  safe_marker_path "$marker" || return 1
+  [ "$(cat "$marker" 2>/dev/null || true)" = "$generation" ]
+}
+
+mark_brief_processing_started() {  # <task>
+  local task=$1 generation marker tmp
+  brief_processing_started "$task" && return 0
+  generation=$(task_generation_id "$task") || return 1
+  marker="$STATE/.brief-started-$task"
+  tmp=$(mktemp "$STATE/.brief-started-$task.XXXXXX") || return 1
+  printf '%s' "$generation" > "$tmp" || { rm -f "$tmp"; return 1; }
+  safe_marker_path "$marker" || { rm -f "$tmp"; return 1; }
+  mv "$tmp" "$marker"
+}
+
 UNSAFE_MARKERS_LOGGED='|'
 safe_touch_marker_or_log() {  # <path> <label>
   local marker=$1 label=$2
@@ -814,6 +1029,26 @@ EOF
     tail40=$(fm_backend_capture "$(window_backend "$w")" "$w" 40 "$(window_label "$w")" "$(window_scoped_target "$w")" 2>/dev/null) || continue
     h=$(printf '%s' "$tail40" | hash_pane)
     key=$(printf '%s' "$w" | tr ':/.' '___')
+    window_busy=0
+    if window_is_busy "$w" "$tail40"; then
+      window_busy=1
+      mark_brief_processing_started "$task" || true
+    fi
+    if [ "$window_busy" != 1 ]; then
+      allow_directory_trust=0
+      brief_processing_started "$task" && allow_directory_trust=1
+      prompt_kind=$(permission_prompt_kind "$(window_harness "$w")" "$tail40" "$allow_directory_trust" || true)
+      if [ -n "$prompt_kind" ]; then
+        handle_permission_prompt "$w" "$task" "$h" "$prompt_kind"
+        continue
+      fi
+    fi
+    rm -f "$STATE/.stale-permission-$key" "$STATE/.wedge-escalations-permission-$key"
+    if [ "$window_busy" = 1 ]; then
+      busy_stall_check "$w" "$task" "$tail40"
+    else
+      clear_busy_stall_tracking "$w"
+    fi
     hf="$STATE/.hash-$key"
     cf="$STATE/.count-$key"
     sf="$STATE/.stale-$key"
@@ -828,7 +1063,7 @@ EOF
       # else the last 6 non-blank lines only (the TUI footer area, where every
       # verified harness renders its busy indicator) so busy-looking strings
       # in displayed content cannot suppress stale detection.
-      if [ "$n" -ge 2 ] && ! window_is_busy "$w" "$tail40"; then
+      if [ "$n" -ge 2 ] && [ "$window_busy" != 1 ]; then
         # The pane is idle/stale at hash $h. Triage decides whether this wakes
         # firstmate. Detection itself is unchanged from above.
         if [ "$kind" = secondmate ]; then
@@ -939,7 +1174,7 @@ EOF
       echo 0 > "$cf"
       rm -f "$ssf" "$ewf"
       task=$(window_to_task "$w" "$STATE")
-      if ! afk_present && status_is_paused "$(last_status_line "$STATE/$task.status")" && ! window_is_busy "$w" "$tail40"; then
+      if ! afk_present && status_is_paused "$(last_status_line "$STATE/$task.status")" && [ "$window_busy" != 1 ]; then
         case "$(pause_state_class "$w" "$task")" in
           paused) handle_paused_stale "$w" "$task" "$h" ;;
           *)      clear_pause_tracking "$w" ;;
diff --git a/docs/architecture.md b/docs/architecture.md
index 35abd51867a..5e8a2a01564 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -10,7 +10,9 @@ firstmate's full operating manual for the orchestrator agent itself is [`AGENTS.
 
 A zero-token bash watcher (`bin/fm-watch.sh`) sleeps on the fleet, classifies detected wakes in bash, and wakes the first mate only when something is actionable.
 Actionable wakes include captain-relevant status signals, no-verb signals whose crew is not provably working, check-script output such as PR merge polling or an X-mode mention, stale panes whose crew is not provably working whether their status log looks terminal or non-terminal, provably-working stale panes that persist past `FM_STALE_ESCALATE_SECS`, declared external waits that remain paused past `FM_PAUSE_RESURFACE_SECS`, and heartbeat backstop hits.
-Repeated provably-working stale escalations on the same unchanged pane add an escalation count to the wake reason and, at `FM_WEDGE_DEMAND_INSPECT_COUNT`, a `demand-deep-inspection` marker.
+They also include recognized mid-run Claude or Codex permission prompts and busy panes that make no semantic pane, status, or turn-end progress for `FM_PERMISSION_STALL_ESCALATE_SECS`.
+The permission-prompt matcher and the explicitly heuristic macOS system-dialog fallback are detailed in [permission-stall-detection.md](permission-stall-detection.md).
+Repeated unchanged wedge or permission-stall escalations add an escalation count to the wake reason and, at `FM_WEDGE_DEMAND_INSPECT_COUNT`, a `demand-deep-inspection` marker.
 Those actionable wakes are written to a durable local queue (`state/.wake-queue`) before detector state advances, so a missed process exit can be recovered by draining the queue.
 No-verb wakes, such as `working:` notes and bare turn-ended signals, are benign only when `bin/fm-crew-state.sh` reports positive evidence that the crew is still working: an actively running no-mistakes step for that crew's branch or a backend busy signature.
 A crew that declares `paused:` for a known external wait is separately absorbed while idle and re-surfaced only on the longer pause cadence, rather than being treated as a possible wedge.
diff --git a/docs/configuration.md b/docs/configuration.md
index f35f98d1f83..250f724a26a 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -448,8 +448,9 @@ FM_SIGNAL_GRACE=30      # seconds to coalesce nearby status and turn-end signals
 FM_CAPTAIN_RE='done:|needs-decision:|blocked:|failed:|PR ready|checks green|ready in branch|merged'   # status regex that makes watcher and daemon signal/stale/scan output captain-relevant
 FM_CLASSIFY_PAUSED_VERB=paused     # leading status verb for a declared external wait; excluded from FM_CAPTAIN_RE and distinct from blocked
 FM_STALE_ESCALATE_SECS=240         # idle seconds before a provably-working stale pane escalates; stale panes whose crew is not provably working surface immediately unless they declare the pause verb
+FM_PERMISSION_STALL_ESCALATE_SECS=900 # busy seconds without meaningful pane/status/turn-end progress before a possible macOS permission/system-dialog block surfaces; timeout heuristic, not direct OS detection
 FM_PAUSE_RESURFACE_SECS=3600       # seconds before an idle declared external wait re-surfaces for a recheck in the watcher or away-mode daemon
-FM_WEDGE_DEMAND_INSPECT_COUNT=3    # consecutive provably-working stale escalations on the same unchanged pane before demand-deep-inspection is added
+FM_WEDGE_DEMAND_INSPECT_COUNT=3    # consecutive unchanged wedge or permission-stall escalations before demand-deep-inspection is added
 FM_WATCH_TRIAGE_LOG_MAX_BYTES=262144   # size cap for the watcher's absorbed-wake debug log
 FM_FLEET_SYNC_BOOTSTRAP_TIMEOUT=     # optional seconds allowed for bootstrap's best-effort clone refresh; unset/blank defaults to max(20, 5 + 3 * origin-backed-project-count)
 FM_FLEET_PRUNE=1        # set to 0 to skip pruning local branches whose upstream is gone
@@ -489,6 +490,8 @@ FM_LOG_MAX_BYTES=1048576           # daemon log size that triggers trimming
 FM_LOG_KEEP_LINES=2000             # daemon log lines kept when trimming
 ```
 
+[`permission-stall-detection.md`](permission-stall-detection.md) records why the watcher uses direct harness-prompt matching but a timeout heuristic for macOS system dialogs.
+
 `fm-teardown.sh` retries only Git's `Unable to create '...index.lock': File exists` return failure up to `FM_TREEHOUSE_RETURN_LOCK_RETRIES` times.
 `FM_TREEHOUSE_RETURN_LOCK_RETRIES` accepts a nonnegative integer, and an unset, blank, or invalid value uses the default of 3.
 `FM_TREEHOUSE_RETURN_LOCK_RETRY_WAIT_SECS` accepts nonnegative whole or fractional seconds between attempts.
diff --git a/docs/permission-stall-detection.md b/docs/permission-stall-detection.md
new file mode 100644
index 00000000000..99fdad9c389
--- /dev/null
+++ b/docs/permission-stall-detection.md
@@ -0,0 +1,120 @@
+# Permission-stall detection
+
+Firstmate must surface a command permission prompt or a possible blocking macOS privacy dialog instead of treating the affected work as indefinitely healthy.
+The two cases have different evidence quality, so the watcher reports them differently.
+
+## Harness prompts are directly recognizable
+
+The watcher recognizes the stable question, numbered choices, and footer near the bottom of a non-busy pane rather than matching a question alone.
+This prevents ordinary transcript text from impersonating an active confirmation prompt.
+
+The following captures were recorded on 2026-07-22 in an isolated task worktree on Claude Code 2.1.216 and Codex CLI 0.145.0-alpha.27.
+Each harness was launched without its normal Firstmate autonomy flag and was asked to run a harmless `touch` command.
+Neither prompt was approved, and neither probe file was created.
+
+Claude was launched in an isolated tmux session with this command.
+
+```sh
+claude --safe-mode --no-chrome --permission-mode manual --tools Bash \
+  'Use Bash now to run exactly: touch .permission-probe-claude. Do not use another tool and do not explain.'
+```
+
+Its rendered permission gate contained this stable pair.
+
+```text
+Do you want to proceed?
+...
+Esc to cancel · Tab to amend · ctrl+e to explain
+```
+
+Codex was launched in an isolated tmux session with this command.
+
+```sh
+codex --no-alt-screen -a untrusted -s workspace-write \
+  'Use the shell tool now to run exactly: touch .permission-probe-codex. Do not use another tool and do not explain.'
+```
+
+Its rendered permission gate contained this stable pair.
+
+```text
+Would you like to run the following command?
+...
+Press enter to confirm or esc to cancel
+```
+
+The installed Codex binary also carries the sibling question strings `Would you like to grant these permissions?` and `Would you like to make the following edits?` with the same confirmation footer.
+Its permissions overlay has three affirmative choices followed by `No, continue without permissions`, while its network overlay asks `Do you want to approve network access to "<host>"?`.
+The matcher therefore identifies each Codex overlay from its title-specific option text and footer without depending on any option number.
+The protected trust shapes are Claude's `Quick safety check: Is this a project you created or one you trust?` dialog and Codex's `Do you trust the contents of this directory?` dialog when either reaches the stale post-spawn watcher after work has started.
+The separate Claude `Hooks need review` prompt with `Trust all on first launch` remains Firstmate's legitimate supervision-hook trust path and is handled during the spawn-time peek before the brief starts.
+The watcher records brief-processing evidence only after observing a harness-busy state and binds that evidence to the task's current `generation_id`, so metadata existence or evidence retained across a respawn cannot convert an initial workspace-trust dialog into a mid-run grant.
+`bin/fm-watch.sh` matches protected permission shapes on the first capture and protected trust shapes on the first capture after that current-generation evidence, then emits an explicit `permission-prompt detected` stale wake.
+An unchanged prompt re-surfaces on the same bounded cadence as the system-dialog heuristic until it is cleared.
+`stuck-crewmate-recovery` owns the response: inspect what is being requested, do not auto-approve it, and ask the captain to approve or deny it.
+
+## A general macOS TCC probe is not reliable without prior grants
+
+The capability probes below were recorded on 2026-07-22 on macOS 26.5.2 build 25F84.
+They intentionally did not request a new TCC grant or create a real TCC prompt.
+A real prompt was not induced because macOS requires the user to grant or deny it and the test could have left the desktop blocked.
+
+The non-prompting Accessibility preflight succeeded in this execution context.
+
+```sh
+$ osascript -l JavaScript -e 'ObjC.import("ApplicationServices"); $.AXIsProcessTrusted()'
+true
+```
+
+[Apple documents `AXIsProcessTrusted()` as a check for whether the current process is already a trusted Accessibility client](https://developer.apple.com/documentation/applicationservices/1460720-axisprocesstrusted).
+This result means Accessibility inspection happened to be available on this host, not that Firstmate can assume it on another host or launch context.
+
+The non-prompting Screen Recording preflight failed.
+
+```sh
+$ xcrun swift -e 'import CoreGraphics; print(CGPreflightScreenCaptureAccess())'
+false
+```
+
+[Apple exposes `CGPreflightScreenCaptureAccess()` specifically to check existing screen-capture access](https://developer.apple.com/documentation/coregraphics/cgpreflightscreencaptureaccess%28%29?language=objc).
+[Apple requires the user to control Screen and System Audio Recording access in Privacy & Security](https://support.apple.com/guide/mac-help/control-access-screen-system-audio-recording-mchld6aa7d23/mac).
+
+Core Graphics still returned 97 on-screen window records and their owning process names in that unprivileged screen-capture state.
+The relevant owners included `Control Center`, `Notification Center`, and `System Settings`.
+The same records returned no window titles for those owners, so process presence could not distinguish a TCC prompt from ordinary system UI.
+`Control Center` contributed many always-present windows, and `Notification Center` contributed both ordinary windows and an Accessibility `AXSystemDialog` titled `Notification Center`.
+Those observations make both owner-name matching and `AXSystemDialog` matching unsafe as standalone detectors.
+
+Direct Accessibility inspection could read current window titles and subroles only because `AXIsProcessTrusted()` was already true.
+The exact read used `NSWorkspace.shared.runningApplications`, `AXUIElementCreateApplication`, and `AXUIElementCopyAttributeValue` for `kAXWindowsAttribute`, `kAXTitleAttribute`, and `kAXSubroleAttribute`.
+It returned `AXError` zero for the inspected system processes and showed the ordinary Notification Center `AXSystemDialog`, demonstrating the false-positive risk.
+
+`System Events` UI scripting was not used as a production detector.
+[Apple documents that Accessibility and Automation capabilities require user permission](https://support.apple.com/en-mide/guide/security/secddd1d86a6/web), so an `osascript` query can require the same prior grants that a portable detector cannot assume.
+Prompting for Accessibility, Automation, or Screen Recording merely to detect a prompt would create the failure mode this feature is intended to report.
+
+The investigation therefore did not establish a system-process/window signature that is both observable without prior grants and specific to a blocking TCC dialog.
+Firstmate does not ship a fragile direct macOS dialog probe.
+
+## Timeout fallback for a suspected system dialog
+
+A TCC dialog can block a foreground tool while the harness continues to render a busy footer.
+The ordinary stale path sees the busy footer as positive activity and would otherwise reset its wedge timer forever.
+
+While a pane remains busy, the watcher now keeps a separate semantic progress fingerprint.
+It excludes the verified harness busy-footer lines whose spinners and elapsed counters change continuously.
+It preserves command output and folds in status-file and turn-end signatures, so meaningful pane output or either signal resets the clock.
+
+After `FM_PERMISSION_STALL_ESCALATE_SECS` without semantic progress, the watcher emits `permission/system-dialog suspected` with the elapsed time and an explicit `timeout heuristic, not direct OS detection` qualifier.
+The default is 900 seconds.
+Repeated unchanged stalls use the existing escalation count and eventually add `demand-deep-inspection`.
+
+The recovery playbook requires a pane inspection before reporting the heuristic to the captain.
+Clear evidence of ordinary progress makes it a conservative false positive and supervision resumes.
+Otherwise the captain receives an actionable request to inspect the visible macOS dialog or Privacy & Security in System Settings and grant or deny the permission there.
+
+## Known limitations
+
+- A legitimate command that produces no meaningful output for longer than the threshold can trigger a conservative false positive.
+- An unrecognized harness prompt that keeps changing meaningful pane content can delay the timeout fallback.
+- The heuristic can report that a system dialog is possible, but it cannot name an OS capability that never appears in the pane.
+- Firstmate never grants or dismisses TCC permissions programmatically.
diff --git a/tests/fm-watch-triage.test.sh b/tests/fm-watch-triage.test.sh
index a1c75fc014a..16d29f07911 100755
--- a/tests/fm-watch-triage.test.sh
+++ b/tests/fm-watch-triage.test.sh
@@ -9,8 +9,9 @@
 # advanced, beacon fresh), stopped-crew no-verb wakes surfaced (queue + exit),
 # provably-working stale panes absorbed-then-escalated past the threshold,
 # terminal-looking stale status lines overridden by an active run, the heartbeat
-# backstop fail-safe, and afk coherence (no double-triage while the away-mode
-# daemon owns supervision).
+# backstop fail-safe, direct harness-permission prompt escalation, the bounded
+# busy/no-progress system-dialog heuristic, and afk coherence (no double-triage
+# while the away-mode daemon owns supervision).
 #
 # Daemon-side classification/injection lives in fm-daemon.test.sh; watcher/lock
 # liveness in fm-watcher-lock.test.sh; the durable-queue safety matrix in
@@ -64,6 +65,16 @@ wait_numeric_file() {
   return 1
 }
 
+wait_file_value() {
+  local file=$1 expected=$2 limit=${3:-30} i=0
+  while [ "$i" -lt "$limit" ]; do
+    [ "$(cat "$file" 2>/dev/null || true)" = "$expected" ] && return 0
+    sleep 0.1
+    i=$((i + 1))
+  done
+  return 1
+}
+
 # Portable mtime in epoch seconds. Platform-detected, never the `stat -f || stat -c`
 # fallback (which writes a partial filesystem dump on Linux; see fm-watch.sh).
 file_mtime() {
@@ -370,6 +381,247 @@ test_actionable_signal_surfaced() {
   pass "captain-relevant signal is surfaced (queue + exit) and marked surfaced"
 }
 
+# A mid-run permission or trust prompt is actionable on its first capture, before
+# the generic two-identical-hashes stale path. The command fixtures preserve the
+# captured Claude Code 2.1.216 and Codex CLI 0.145.0-alpha.27 shapes, while the
+# sibling fixtures cover the other verified title-specific overlays.
+assert_permission_prompt_surfaced() {  # <harness> <fixture> <kind>
+  local harness=$1 fixture=$2 expected_kind=$3 dir state fakebin out drain_out capture_file prompt_file window pid generation marker
+  dir=$(make_case "permission-prompt-$fixture"); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; drain_out="$dir/drain.out"; capture_file="$dir/pane.txt"; prompt_file="$dir/prompt.txt"
+  window="test:fm-permission-$fixture"
+  generation="test:$fixture"
+  cat > "$prompt_file"
+  if [ "$expected_kind" = 'directory trust' ]; then
+    cp "$prompt_file" "$capture_file"
+    printf 'window=%s\nkind=ship\nharness=%s\ngeneration_id=%s\n' "$window" "$harness" "$generation" > "$state/permission-$fixture.meta"
+    printf 'test:previous-generation' > "$state/.brief-started-permission-$fixture"
+    PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+      FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_POLL=1 FM_SIGNAL_GRACE=1 \
+      FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+    pid=$!
+    wait_for_exit "$pid" 40 || fail "$fixture spawn-time trust prompt did not reach ordinary stale handling"
+    grep -F 'permission-prompt detected' "$out" >/dev/null \
+      && fail "$fixture metadata or prior-generation evidence was treated as current mid-run evidence"
+
+    dir=$(make_case "permission-prompt-$fixture-started"); state="$dir/state"; fakebin="$dir/fakebin"
+    out="$dir/watch.out"; drain_out="$dir/drain.out"; capture_file="$dir/pane.txt"
+    window="test:fm-permission-$fixture-started"
+    generation="test:$fixture-started"
+    marker="$state/.brief-started-permission-$fixture-started"
+    printf 'window=%s\nkind=ship\nharness=%s\ngeneration_id=%s\n' "$window" "$harness" "$generation" > "$state/permission-$fixture-started.meta"
+    printf '• Working (1s • esc to interrupt)\n' > "$capture_file"
+  else
+    cp "$prompt_file" "$capture_file"
+    printf 'window=%s\nkind=ship\nharness=%s\ngeneration_id=%s\n' "$window" "$harness" "$generation" > "$state/permission-$fixture.meta"
+  fi
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  if [ "$expected_kind" = 'directory trust' ]; then
+    wait_file_value "$marker" "$generation" 40 \
+      || { reap "$pid"; fail "$fixture did not record current-generation brief-processing evidence"; }
+    cp "$prompt_file" "$capture_file"
+  fi
+  wait_for_exit "$pid" 40 || fail "$fixture permission prompt did not wake the watcher immediately"
+  grep -F "stale: $window (permission-prompt detected: waiting for a $expected_kind grant;" "$out" >/dev/null \
+    || fail "$fixture permission prompt wake was not classified explicitly: $(cat "$out")"
+  grep -F 'do not approve it automatically' "$out" >/dev/null \
+    || fail "$fixture permission prompt wake omitted the security-sensitive escalation instruction"
+  FM_STATE_OVERRIDE="$state" "$DRAIN" > "$drain_out" 2>/dev/null \
+    || fail "drain after $fixture permission prompt wake failed"
+  grep "$(printf '\tstale\t')" "$drain_out" | grep -F 'permission-prompt detected' >/dev/null \
+    || fail "$fixture permission prompt wake was not queued durably"
+}
+
+test_harness_permission_prompts_surface_immediately() {
+  local dir state fakebin out capture_file window pid
+  assert_permission_prompt_surfaced claude claude-command 'command/tool permission' <<'EOF'
+Bash command
+
+  touch .permission-probe-claude
+
+Do you want to proceed?
+❯ 1. Yes
+  2. Yes, and always allow access to firstmate/ from this project
+  3. No
+
+Esc to cancel · Tab to amend · ctrl+e to explain
+EOF
+  assert_permission_prompt_surfaced codex codex-command 'command/tool permission' <<'EOF'
+Would you like to run the following command?
+
+Environment: local
+
+$ touch .permission-probe-codex
+
+› 1. Yes, proceed (y)
+  2. Yes, and don't ask again for commands that start with `touch .permission-probe-codex` (p)
+  3. No, and tell Codex what to do differently (esc)
+
+Press enter to confirm or esc to cancel
+EOF
+  assert_permission_prompt_surfaced codex codex-permissions 'permission profile' <<'EOF'
+Would you like to grant these permissions?
+
+Permission rule: network; write `/private/tmp/export`
+
+› 1. Yes, grant these permissions for this turn (y)
+  2. Yes, grant for this turn with strict auto review (r)
+  3. Yes, grant these permissions for this session (p)
+  4. No, continue without permissions (n)
+
+Press enter to confirm or esc to cancel
+EOF
+  assert_permission_prompt_surfaced codex codex-network 'network access' <<'EOF'
+Do you want to approve network access to "api.example.test"?
+
+› 1. Yes, just this once (y)
+  2. Yes, and allow this host for this conversation (p)
+  3. No, continue without running it (n)
+
+Press enter to confirm or esc to cancel
+EOF
+  assert_permission_prompt_surfaced claude claude-trust 'directory trust' <<'EOF'
+Accessing workspace:
+
+/worktree/example
+
+Quick safety check: Is this a project you created or one you trust?
+
+Claude Code'll be able to read, edit, and execute files here.
+
+❯ 1. Yes, I trust this folder
+  2. No, exit
+
+Enter to confirm · Esc to cancel
+EOF
+  assert_permission_prompt_surfaced codex codex-trust 'directory trust' <<'EOF'
+You are in /worktree/example
+
+Do you trust the contents of this directory? Working with untrusted contents comes with higher risk of prompt injection.
+
+› 1. Yes, continue
+  2. No, quit
+EOF
+
+  dir=$(make_case permission-prompt-hook-trust); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; capture_file="$dir/pane.txt"; window="test:fm-permission-hook-trust"
+  cat > "$capture_file" <<'EOF'
+Hooks need review
+
+❯ 1. Trust all on first launch
+  2. Review hooks
+  3. Exit
+
+Enter to confirm · Esc to cancel
+EOF
+  printf 'window=%s\nkind=ship\nharness=claude\ngeneration_id=test:hook-trust\n' "$window" > "$state/permission-hook-trust.meta"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_POLL=1 FM_SIGNAL_GRACE=1 \
+    FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_for_exit "$pid" 40 || { reap "$pid"; fail "hook-trust fixture did not reach ordinary stale handling"; }
+  grep -F 'permission-prompt detected' "$out" >/dev/null \
+    && fail "Firstmate's launch-time hook-trust prompt was misclassified as a protected mid-run grant"
+
+  # A working agent can quote this documentation or a prior prompt in its
+  # transcript. The active busy footer must outrank the quoted dialog so the
+  # watcher does not manufacture a permission block from displayed text.
+  dir=$(make_case permission-prompt-quoted); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; capture_file="$dir/pane.txt"; window="test:fm-permission-quoted"
+  cat > "$capture_file" <<'EOF'
+Would you like to run the following command?
+› 1. Yes, proceed (y)
+  2. Yes, and don't ask again for this command (p)
+  3. No, and tell Codex what to do differently (esc)
+Press enter to confirm or esc to cancel
+• Working (2s • esc to interrupt)
+EOF
+  printf 'window=%s\nkind=ship\nharness=codex\n' "$window" > "$state/permission-quoted.meta"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_PERMISSION_STALL_ESCALATE_SECS=999999 \
+    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_live "$pid" 20 || { reap "$pid"; fail "a quoted permission prompt inside a busy pane caused a false escalation: $(cat "$out")"; }
+  [ ! -s "$state/.wake-queue" ] || { reap "$pid"; fail "a quoted permission prompt inside a busy pane enqueued a wake"; }
+  reap "$pid"
+  pass "recognized Claude and Codex permission prompts surface immediately, while quoted prompt text in a busy pane stays non-actionable"
+}
+
+# A macOS TCC dialog can block the foreground command while the harness footer
+# remains busy and its elapsed counter changes forever. The watcher therefore
+# hashes semantic progress without that footer: real output resets the timer,
+# but footer-only churn past the threshold raises a clearly heuristic permission
+# or system-dialog suspicion instead of silently treating the pane as healthy.
+test_busy_no_progress_suspects_system_permission_dialog() {
+  local dir state fakebin out drain_out capture_file window key since_file pid back now
+  dir=$(make_case busy-permission-stall); state="$dir/state"; fakebin="$dir/fakebin"
+  out="$dir/watch.out"; drain_out="$dir/drain.out"; capture_file="$dir/pane.txt"
+  window="test:fm-busy-permission"
+  key=$(printf '%s' "$window" | tr ':/.' '___')
+  since_file="$state/.stale-busy-since-$key"
+  printf 'window=%s\nkind=ship\nharness=codex\n' "$window" > "$state/busy-permission.meta"
+  cat > "$capture_file" <<'EOF'
+• Running osascript -e request_access
+progress: phase one
+• Working (1s • esc to interrupt)
+EOF
+
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_PERMISSION_STALL_ESCALATE_SECS=999999 \
+    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_numeric_file "$since_file" 40 || { reap "$pid"; fail "busy no-progress timer was not initialized"; }
+  reap "$pid"
+
+  # Meaningful command output must reset an already-overdue timer instead of
+  # generating a false permission warning.
+  back=$(( $(date +%s) - 500 ))
+  printf '%s' "$back" > "$since_file"
+  cat > "$capture_file" <<'EOF'
+• Running osascript -e request_access
+progress: phase two
+• Working (501s • esc to interrupt)
+EOF
+  : > "$out"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_PERMISSION_STALL_ESCALATE_SECS=240 \
+    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_live "$pid" 20 || { reap "$pid"; fail "meaningful busy-pane progress was misclassified as a permission stall: $(cat "$out")"; }
+  now=$(cat "$since_file" 2>/dev/null || echo 0)
+  [ "$now" -gt "$back" ] || { reap "$pid"; fail "meaningful busy-pane progress did not reset the permission-stall timer"; }
+  [ ! -s "$state/.wake-queue" ] || { reap "$pid"; fail "meaningful busy-pane progress enqueued a stale wake"; }
+  reap "$pid"
+
+  # Only the verified busy footer's elapsed value changes now. Its semantic hash
+  # is unchanged, so the overdue timer must surface the suspected OS dialog.
+  back=$(( $(date +%s) - 500 ))
+  printf '%s' "$back" > "$since_file"
+  cat > "$capture_file" <<'EOF'
+• Running osascript -e request_access
+progress: phase two
+• Working (901s • esc to interrupt)
+EOF
+  : > "$out"
+  PATH="$fakebin:$PATH" FM_FAKE_TMUX_WINDOW="$window" FM_FAKE_TMUX_CAPTURE="$capture_file" \
+    FM_STATE_OVERRIDE="$state" FM_CREW_STATE_BIN="$fakebin/fm-crew-state.sh" FM_PERMISSION_STALL_ESCALATE_SECS=240 \
+    FM_POLL=1 FM_SIGNAL_GRACE=1 FM_CHECK_INTERVAL=999999 FM_HEARTBEAT=999999 "$WATCH" > "$out" &
+  pid=$!
+  wait_for_exit "$pid" 40 || fail "busy pane with no meaningful progress did not escalate a suspected system dialog"
+  grep -F "stale: $window (permission/system-dialog suspected:" "$out" >/dev/null \
+    || fail "busy no-progress wake omitted the suspected permission/system-dialog classification: $(cat "$out")"
+  grep -F 'timeout heuristic, not direct OS detection' "$out" >/dev/null \
+    || fail "busy no-progress wake overstated the macOS detection certainty"
+  FM_STATE_OVERRIDE="$state" "$DRAIN" > "$drain_out" 2>/dev/null \
+    || fail "drain after suspected system-dialog wake failed"
+  grep "$(printf '\tstale\t')" "$drain_out" | grep -F 'permission/system-dialog suspected' >/dev/null \
+    || fail "suspected system-dialog wake was not queued durably"
+  pass "busy semantic progress resets the timer, while footer-only churn escalates a possible macOS permission/system dialog"
+}
+
 test_terminal_stale_surfaced() {
   local dir state fakebin out drain_out capture_file window key pane_hash sig pid
   dir=$(make_case terminal-stale); state="$dir/state"; fakebin="$dir/fakebin"
@@ -1246,6 +1498,11 @@ if [ "${FM_TEST_FOCUSED:-}" = managed-tmux-reverse-map ]; then
   exit 0
 fi
 
+if [ "${FM_TEST_FOCUSED:-}" = permission-prompts ]; then
+  test_harness_permission_prompts_surface_immediately
+  exit 0
+fi
+
 test_signal_reason_is_actionable_classifier
 test_stale_is_terminal_classifier
 test_scan_captain_relevant_statuses_classifier
@@ -1260,6 +1517,8 @@ test_turn_ended_provably_working_absorbed
 test_turn_ended_not_working_surfaced
 test_working_note_not_working_surfaced
 test_actionable_signal_surfaced
+test_harness_permission_prompts_surface_immediately
+test_busy_no_progress_suspects_system_permission_dialog
 test_terminal_stale_surfaced
 test_stale_terminal_status_overridden_by_active_run
 test_nonterminal_stale_provably_working_absorbed_then_escalated