docs(skill): handle first-run trust prompt after agent start

[MarcusNeufeldt]

Summary

When a coding agent is started in a directory it has not trusted yet, it pauses on a first-run prompt before accepting input. For Codex, that prompt is "Do you trust the contents of this directory?" and it waits for Enter; other agents may show onboarding or login screens.

herdr agent start can return interactive_ready: true while this prompt is still pending. If a driver immediately sends the work prompt, it can race the agent's startup and the first characters can be dropped as the shell interprets them.

This change documents how a driving agent should handle that case: read the pane, detect the first-run prompt, and answer it with agent send-keys before submitting work. It also keeps the consent boundary intact by only accepting the trust prompt when the user asked for work in that directory.

Changes

• skills/herdr/SKILL.md — added a short paragraph after the agent start step describing how to detect and answer a first-run trust/onboarding prompt before prompting the agent.

Why not auto-accept

Auto-answering the directory trust prompt from the CLI would bypass a security consent boundary and should not be automated globally. The guidance keeps the decision with the user while giving the agent a concrete procedure.

Verification

• Validated the JSON/socket flow manually: started Codex in a fresh untrusted temp directory via herdr agent start, observed the trust prompt in herdr pane read, answered it with herdr agent send-keys enter, then confirmed the agent accepted a prompt and returned results.
• Reproduced the original failure mode (prompt text raced startup and leading characters were dropped as a bogus shell command).

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• ai-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ea14f12-2a72-4eb4-8ce9-a795d97061ec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[kangal-bot]

Hi @MarcusNeufeldt, thanks for your interest in contributing.

Herdr does not accept unsolicited implementation pull requests from contributors who are not listed in .github/APPROVED_CONTRIBUTORS.

The pull request author is not an approved contributor.

If you encountered a reproducible bug, report the observed behavior through the bug issue template. A report does not reserve the work or authorize a pull request; accepted fixes are normally implemented by Herdr’s maintainer-controlled agents.

Feature requests, behavior changes, and other proposals belong in GitHub Discussions. Do not open an issue merely to justify an implementation that was already written.

If a maintainer explicitly wants this implementation, they can reopen the pull request. Reopening by anyone else will be closed again automatically.

See https://github.com/herdrdev/herdr/blob/master/CONTRIBUTING.md for the contribution policy.