[rbartoli]

This is L4 from the 2026-10-24 security review.

sourceOf mapped every origin other than composer, bridge and sdk to other, and the prompt gate lets other through untouched. That left these prompts unchecked:

• scheduled-trigger: a schedule, routine or /loop firing;
• channel: a message an MCP server relays from Slack, Telegram and the like, which anyone who can post in that channel can send;
• slack-ping.

So a /loop on a 520k-token session re-read the whole context on every firing, without a question, and a relayed message could do the same. Inside those turns the agent and tool gates still applied.

Changes

• Those three origins now count as headless, so the prompt gate holds a heavy prompt with the reason, and a dormant heavy one counts against the machine-wide cap, as in claude -p. There is nobody at the keyboard to answer, so they are never asked, even in an interactive session.
• A new fromPerson() (composer, bridge, sdk) decides who may lift limits, by bracket marker or by /agent-guard allow. Without it, the move to headless would have let a channel message reading [allow-usage-guard] lift every limit. A test pins that.
• Background-task notifications, other sessions' messages and every other origin still pass untouched, as the README says.

Test plan

• New tests: a scheduled, channel or Slack prompt at 520k is held with a reason and never asked; a marker from a channel or schedule is an ordinary prompt, and no override is journaled
• claude plugin test . on 2.1.310: 105 pass. With hooks/register.ts stashed, the hold test fails. The marker test passes either way and guards against that regression.
• claude plugin validate . --strict and tsc are clean
• CI is green