What broke when my Claude Code projects started talking to each other

Description and use

Cross‑project Claude Code sessions faced permission, trust, safety, silent stall, and addressing issues. Mitigations involve pre‑approving tools, forbidding shell, confinement, standing trust decisions, explicit model passing, and session name re‑discovery.

Problem

Cross‑project Claude Code sessions stalled or failed due to permission prompts, trust decisions, model safety rejections, silent stalls, addressing bugs, and read‑only transport limitations.

Outcome

The mitigations allow reliable cross‑project question/answer delivery, but full cross‑tree modification remains untested. The main failures now stem from permission, trust, safety, and addressing issues rather than transport bugs.

Workflow

• 1. Pre‑approve read‑only tools at launch to avoid permission dialogs.
• 2. Forbid shell usage in request payloads to prevent silent hangs.
• 3. Enforce confinement so sessions cannot access files outside their tree.
• 4. Set standing trust decisions for unapproved MCP servers to avoid startup stalls.
• 5. Explicitly pass the model when launching background sessions to prevent quota‑related silent deaths.
• 6. Re‑discover session by current name before messaging to avoid addressing bugs.
• 7. Monitor session logs to distinguish idle, still‑working, and stalled states.

Evidence

Pre‑approving read‑only tools at launch and forbidding shell use in the request itself, sub‑agents included, cures the shell class.

Source

Re‑verified on 2.1.252: cross‑session delivery and typed message exchange still work as described.

Source

The workaround is small: re‑discover a session by its current name before any follow‑up message.

Source