Safety decision 0103 · accepted
The headless run is boxed in
Triage on the Mac can read the library, write only in tips/, fetch only documentation hosts and the post's own domains, and can't run commands or load other settings.
Decision
--permission-mode dontAskand--setting-sources "": anything not allowed is refused, and no settings file, hook or MCP server from anywhere can widen the box.- Allowed: Read in the library, Edit only in
tips/,WebFetch(domain:…)for GitHub, npm, PyPI and the Claude docs plus the domains the post names. There’s no Bash and no Skill tool; the Stash CLI is pre-approved by the triage skill. - With
STASH_HEADLESS=1the CLI runs only the commands triage needs: nothing that fetches arbitrary URLs, reads other files, deletes or changes settings. - Commits stage only Stash data, so a planted file (a workflow, say) can never be pushed.
- Each run is capped at $1.50 and times out.
Consequences
A fetch to a post-named domain could only carry library content, because the run can’t read anything else. The red-team test (e2e/redteam.mjs) runs a hostile post through these exact flags.