Propose, Don't Run

"Pippa writes the command. Your finger presses Enter. The distance between those two is the entire safety model."

Insert and Run are two different authorities

In the Cmd+K composer you describe an intent — convert the MOVs in this folder to MP4 — and Pippa proposes a command. When you accept, Insert writes that reviewed command into the prompt without a trailing newline. It sits there, editable, unrun. Only your own Enter executes it. That missing newline is the whole boundary: the line between here's a suggestion and do it, and it belongs to the human, not the model.

A model response never auto-submits

The proposal is rendered outside the terminal's input stream — a card you read, not keystrokes already typed. Pippa never invokes the shell on its own, never appends the newline, never promotes its suggestion into a durable operation. Model text is a draft, and a draft that can submit itself isn't a draft — it's an actor you never authorized.

Stale context refuses the insert

Between the moment you asked and the moment Pippa answered, the world can move. So before inserting, the system re-checks the snapshot the proposal was written for: the same terminal session, host, connection generation, working directory, and prompt generation — plus whether any input was sent since the composer opened. If anything changed, insertion is refused. A command written for one host at one prompt must never land on another host after a reconnect.

Scary commands don't get blind-pasted

Insert is for the simple, reviewed, single-prompt case. Multiline scripts, destructive commands, privilege changes, and anything spanning multiple hosts default to a preview or a delegate as operation path instead — routed back into the typed, gated machinery rather than dropped raw into a shell. The easy path is only easy because it's also small.

Propose freely; submit never. The model may write anything into the draft and nothing into the world — the newline is a key the human keeps.

Code

Propose, re-check, insert without a newline·python

# Pippa proposes; the composer renders the proposal OUTSIDE the input stream.
proposal = pippa.compose(intent="convert the MOVs here to MP4")

# Before inserting, re-check the snapshot the proposal was written for:
if snapshot_changed(session, host, connection_gen, cwd, prompt_gen):
    refuse("context moved; ask again")   # a command for host A must not land on host B
else:
    terminal.insert(proposal.command)     # bracketed paste, NO trailing newline

# Only the human's own Enter runs it. The model never appends a newline,
# never invokes the shell, never promotes itself into a durable operation.
# Multiline / destructive / multi-host -> route to preview or 'delegate as operation'.

Exercise

Design a 'propose, don't run' flow for an assistant that suggests shell commands. Write the exact list of facts you'd re-check between proposing and inserting, and decide which single action the assistant must never be allowed to take. Then name one command shape that should skip Insert entirely and go to a preview instead.

Hint

The action the assistant must never take is 'press Enter / append the newline.' The command shapes that should skip Insert are the ones you can't undo with another quick command — anything multiline, destructive, privilege-changing, or aimed at more than one host.

Insert and Run are two different authorities

A model response never auto-submits

Stale context refuses the insert

Scary commands don't get blind-pasted

Code

External links

Exercise

Progress

Comments 0