fix(security): Run setup discovery agent in plan mode

[charlesvien]

Problem

Resolves VERIA-356: RCE via automated repository setup discovery.

Changes

Run the auto-launched discovery agent in plan mode and deny the interactive tools, so an untrusted repo can't steer it into running write/exec tools or hang it.

How did you test this?

Unit test in @posthog/ui (discovery starts in plan mode with the tools denied, never bypassPermissions).

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[charlesvien]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• fix(security): Open files in external apps via argv not shell #3805
• fix(security): Confirm repo-provided setup script before running #3804
• fix(security): Enforce CSP on sandboxed MCP app HTML #3803
• fix(security): Run setup discovery agent in plan mode #3802 👈 (View in Graphite)
• fix(security): Scope MCP UI resource caches by server name #3801
• fix(security): Validate agent slug before building ingress host #3800
• fix(security): Keep OAuth token out of terminal environments #3799
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 3322060.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "run setup discovery agent in plan mode" | Re-trigger Greptile}

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

[github-actions]

Security-sensitive fix restricting the auto-launched discovery agent's permissions; the one critical concern raised by the security bot (repo-controlled settingSources letting committed hooks execute) is directly fixed in this diff (settingSources: ["user"] for the discovery run, threaded through the schema and options builder) and covered by a new unit test, with the security bot's inline comment marked resolved and a follow-up confirming all issues addressed at 0/10 risk.

• Author wrote 0% of the modified lines and has 41 merged PRs in these paths (familiarity MODERATE).
• 👍 on the PR from greptile-apps[bot].

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	22L, 4F substantive, 62L/5F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1b-small (62L, 5F, single-area, fix)
stamphog 2.0.0b3		.stamphog/policy.yml @ bf27356 · reviewed head 4b5fb9e

[trunk-io]

😎 This pull request was merged.

New commits pushed (delta classified non_linear_history) — stamphog approval dismissed; re-review running automatically.

[github-actions]

Security-sensitive change (agent auto-launch permissions), but the diff shows the exact fix for the veria-ai bot's flagged critical issue — settingSources is now restricted to "user" only, excluding repo-controlled project/local hooks — and the bot's follow-up comment confirms no open concerns remain (0/10 risk). That's independent security-reviewer assurance covering the risky part, with a matching unit test.

• Author wrote 0% of the modified lines and has 41 merged PRs in these paths (familiarity MODERATE).
• 👍 on the PR from greptile-apps[bot].

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	22L, 4F substantive, 62L/5F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1b-small (62L, 5F, single-area, fix)
stamphog 2.0.0b3		.stamphog/policy.yml @ bf27356 · reviewed head 3322060