Automation

reads every Bash call and fork spawn before it runs: a floor command, a known hazard shape or a fork with no why-fork line is refused with its safe door, never a dialog; each refusal and escape shows in stash's band as a 🛡️ line

keeps secrets out of every transcript: api keys, tokens and private keys read as a stable placeholder in every kept row, and come back only inside the tool call that names them