- Ya
- 3 Septemba 2026, 22:36 UTC
- Mwandishi
- Kamo
- Ahadi ya
- f92aca8
composed prompt — and answers with an opaque TOKEN. A terminal that connects command typed into it. THE TOKEN IS THE WHOLE SECURITY DESIGN. `bootstrap=<command>` would have been half the code and a way to run anything as any provisioned member; a token means the only thing deciding what runs on this machine is the code here that composed it. The caller supplies a token — never a directory, never a command. The prompt lives in a FILE and is read with a double-quoted command substitution, so the file's contents become exactly one argv element with no word splitting, no globbing and no further expansion, whatever a reporter wrote in it. Every other part of the line is a fixed flag or a path this agent generated. Typed rather than exec'd, deliberately. The member sees the command in their scrollback, can interrupt it, scroll back through it and re-run it — which is the point of hosting the session in a terminal they can drive rather than a background process they cannot. `send-keys -l` sends it literally, so a command containing "Enter" or "C-c" is not read as key names, and the Enter is separate. /home/sage/Kamo/Projects rather than one checkout, because a bug report rarely names the right repository and a session rooted in one cannot investigate most of them. Everything the multi-root VS Code workspace holds sits under it, and it is an established working directory on this machine — 60 sessions already live in A reconnect does not re-run the command: `new-session -A` attaches to the shell that is already there, and typing into it would submit the prompt again to a conversation already having it. 16 tests: token **************** the prompt never being interpolated, the model and effort coming from the fixed vocabulary, an unknown model being refused rather than echoed, -l keeping tmux from reading a command as key names, and the title being set before the command runs. 149 tests.