Safety decision 0104 · accepted
Only the app pushes your library, never the model
Claude can't push, configure remotes or change git settings; the Mac app pushes with fixed arguments after a successful run.
Decision
The headless CLI refuses push and config set, and .git/ is never writable by the model. After a run, the app commits and runs git push -q with fixed arguments, to whatever remote you configured yourself. A prompt injection therefore can’t send your library somewhere else or plant a git hook.