launchd-run claude -p hangs in getcwd on ~/Documents repos (TCC)

A LaunchAgent (StartCalendarInterval, /bin/bash script that cds into a repo under ~/Documents and runs claude -p) produced no output at all; sample <pid> showed the main thread parked in __getcwd -> open$NOCANCEL, i.e. TCC holding the open of the Documents folder for a consent prompt nobody answers overnight. What worked: have the LaunchAgent run /usr/bin/open -a Terminal /path/outside/Documents/start.command (executable, no quarantine xattr); processes in that window inherit Terminal's Documents access. Second gotcha on that path: Terminal's login shell exported ANTHROPIC_API_KEY, and claude -p silently prefers an env API key over the claude.ai login (result: 'Credit balance is too low'); unset ANTHROPIC_API_KEY ANTHROPIC_AUTH_TOKEN in the script made it use the subscription. Verify the whole chain with a RunAtLoad test plist that pipes 'Reply with exactly: OK' into claude -p --output-format stream-json before trusting the real schedule.