The headless run refuses the commands it can't ask about

Your product runs agent jobs unattended: nobody is watching, nobody can approve. On an interactive session, rm -rf /, curl | sh, and git push --force park a confirmation gate and wait for a human. Headless has no human.

So a session created with headless: true doesn't park those shapes. It hard-denies them. Same for file writes outside the working directory. The dangerous command doesn't queue for an approval that will never come; it fails, the agent sees the refusal, and the run continues with what it's allowed to do.

You didn't write a blocklist. You declared the session unattended, and the daemon adjusted what "no confirmer" means: not auto-approve, not hang forever, but refuse.

An unattended agent doesn't get fewer questions. It gets fewer permissions.