Don't Wire the Model Straight to SSH
You must split planner and runner before any generate step. An agent is two hops with unequal privilege, not one brain. Hide that split and the host becomes the chat window. Most generation loops still collapse those hops. A prompt enters, then a remote shell quietly follows. The model reaches your machine like a trusted coworker. That shape fails in small and boring ways. The planner invents a…
Split the planner and runner before any generate step. An agent consists of two hops with unequal privilege, rather than one integrated system. Conceal that division, and the host appears as a chat window. Most generation loops overlook this separation. A prompt enters, followed by a remote shell quietly trailing behind. The model accesses your machine as a trusted colleague.
This configuration proves inadequate in minor and uninteresting ways. The planner generates a flag that your service never actually implemented. The runner executes it, leading you to debug the incorrect machine. You do not dictate the model's subsequent token sequence. Instead, you control which sockets the planner may access. Consider this constraint as architecture, not a future modification.
Varied models tighten this constraint, rather than loosening it. Latency fluctuations and output format shifts occur unpredictably. A free trial cannot guarantee an operational contract. Therefore, establish three fundamental facts on your personal computer first. Identify the permissible files, commands, and rollback procedure.
Everything else remains outside the trust boundary you established. Envision a drawbridge instead of an open lobby entrance. The castle safeguards its keys internally at all times. The visitor never traverses the castle halls without a card. Ensure the data flow remains self-consistent. Define three processes and refrain from merging them later.
Name them planner, gate, and runner without elaborate titles. Assign each process a single mailbox and exclude additional sockets. The planner perceives the contract and user prompt. It never encounters SSH keys, cloud credentials, or live disks. It produces a patch object, not a tentative paragraph. The gate receives that patch and the immutable contract.
It either authorizes or rejects the request with a concise machine response. The runner receives solely an approved job file. It never perceives the prompt or initiates a model execution. It applies the files, validates system health, and subsequently exits. If a single process is capable of performing two of these tasks, cease the operation.
You do not possess a loop in this scenario; you possess a solitary entity masquerading as a helpful agent. Verify the contract within a git repository prior to the planner commencing its operations.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
