Headless mode isn't a flag you set. It's a privilege you earn.
Taking the human out of the loop is the real unlock - but headless plus loose permissions plus production access is how you wake up to a wiped repo.
#hooks
14 posts tagged #hooks.
You can't prompt away a hallucination. You can validate it away.
A deterministic check on the agent's output, with one retry, kills a class of wrong answers no prompt rewrite reaches - and gives you a number, not a vibe.
The friction humans hate in pre-commit hooks is perfect for agents.
A git pre-commit hook turns 'the agent should run the tests' into 'the agent cannot commit broken code' - a deterministic gate that ships with every clone.
Gate three routes and the agent forgets the fourth. Make it one call.
Scatter gating logic inline and consistency depends on luck. Collapse the policy into one named helper, make calling it a rule, and enforcement is the default.
A legitimate MCP server with two trust levels is the exploit
The dangerous MCP server isn't the malicious one - it's the convenient all-in-one that reads untrusted data and holds privileged access to a second system.
The best prompt you'll ever write is the one you delete.
An agent that waits for you to remember to ask it is a toy. Wire a deterministic event to a headless run that reads your rules, and routine work fires itself.
Run your whole eval suite on every commit and you'll stop running it.
The fix for slow, flaky agent evals isn't a faster suite - it's two loops. A cheap deterministic gate on every PR, and a slow judge suite on a schedule.
An Agent That Can't Forget Is Worse Than One With No Memory
A rules file is write-once and rots; auto-memory saves corrections on its own judgment. Add the human-gated layer between them so corrections compound.
You already have labeled data. It's the transcripts you throw away.
Every failed agent session is a labeled example of where your context falls short. Capture them, cluster them, and fix the top category once in your rules file.
A Second Opinion It Didn't Write
An agent reviewing its own plan shares its blind spots. Wire a different vendor's model in as a gate, and a fail verdict re-engages planning before any code.
By the time you review the diff, the destructive call already ran.
Reviewing irreversible actions after the fact is too late. Split tools by reversibility, force a plan, and gate the destructive step behind a human interrupt.
Inject the Reminder When the Agent Forgets
Your rules file is necessary but not sufficient. Persistent context degrades as the window fills - move the ignored rule into a hook that fires when it matters.
When your agent reads a webpage, that webpage can give it orders.
Prompt injection is a context-engineering problem. Fence untrusted tool output as data, run a guardrail hook, and cap the blast radius with permissions.
'It worked for me' is not a test for a non-deterministic system.
Treat prompts like code: a golden dataset run headless on every change, gated by a hook that fails the build below baseline. Only a blocking eval works.