Headless permissions - skip-all vs deny-all-promptsConcept

Your headless fleet runs with --dangerously-skip-permissions, which approves everything. Claude Code 2.1.259 added the opposite posture, --permission-prompts none, which denies everything that would have asked and leaves an allowlist to say what may run.

A permission mode decides what happens when Claude wants to use a tool. Interactive sessions prompt you. Headless sessions cannot prompt, so they need a rule. --dangerously-skip-permissions (with --permission-mode bypassPermissions) says 'never ask, always allow'. That is why every wrapper in PDB/scripts/run_*.sh and JobHunt's nightly_wrapper.sh carries it.

--permission-prompts none flips the default: anything that would have prompted is denied. On its own that would break every job. It works together with the permissions.allow list in settings.json, where you name the commands and paths that are pre-approved (python3 scripts/..., bun scripts/rm-bridge/..., Edit within PDB/data/). The model can still do everything the job needs; it cannot do the one thing a hostile web page asked for.

The trade: skip-all is zero maintenance and maximum blast radius; deny-plus-allowlist is one afternoon of listing what each job actually runs, then a denial in the log the first time a job needs something new. For a fleet of five unattended jobs that touch a real email account, a real device and a real git remote, the reviewer's answer is the allowlist.

Worked example

Read the current posture and what an allowlist would need:

grep -n 'permission\|strict-mcp\|settings' /Users/tom/Claude/PDB/scripts/run_weekly_review.sh

# what the weekly review actually executes (from tonight's log):
grep -oE '(python3|bun|curl|git) [^ ]+' /Users/tom/Claude/PDB/logs/weekly-review.log | sort | uniq -c | sort -rn | head

• Four flags: the empty plugin set, the MCP fence, skip-permissions, and bypass mode. The last two are the ones an allowlist would replace.
• The second command mines the log for the commands the job really used. That frequency list is the first draft of permissions.allow for this job.

Gotchas

• Switching one wrapper at a time is the safe path. A denial in a headless job shows up as a failed run and a 🚨 task, so the first week after a switch will be noisy.
• The allowlist lives in settings.json, which the update-config skill owns. Do not hand-edit it inside a job wrapper.
• This does not replace --strict-mcp-config. Bash and MCP are two doors; fence both.