{"id":1222,"date":"2026-06-20T08:46:21","date_gmt":"2026-06-20T07:46:21","guid":{"rendered":"https:\/\/who-offers.site\/index.php\/2026\/06\/20\/aitm-1-0-a-terminal-where-the-ai-is-a-participant-not-the-driver\/"},"modified":"2026-06-20T08:46:25","modified_gmt":"2026-06-20T07:46:25","slug":"aitm-1-0-a-terminal-where-the-ai-is-a-participant-not-the-driver","status":"publish","type":"post","link":"https:\/\/who-offers.site\/index.php\/2026\/06\/20\/aitm-1-0-a-terminal-where-the-ai-is-a-participant-not-the-driver\/","title":{"rendered":"aitm 1.0: a terminal where the AI is a participant, not the driver"},"content":{"rendered":"
\n

The topic aitm 1.0: a terminal where the AI is a participant, not the driver<\/strong> is currently the subject of lively discussion \u2014 readers and analysts are keeping a close eye on developments.<\/p>\n

This is taking place in a dynamic environment: companies\u2019 decisions and competitors\u2019 reactions can quickly change the picture.<\/p>\n

I was doing AI-assisted coding inside a terminal session. The AI kept modifying files, but I had no way to view those changes in the same window \u2014 I had to switch apps, switch context, come back. Every loop through the cycle was an interruption.<\/p>\n

What I wanted was simple: the terminal and the AI and the files, all in the same place, without the context-switching. So I built it.<\/p>\n

That’s the origin of aitm. The version 1.0 is that thing, shipped.<\/p>\n

Most AI terminals are built around a single model: you describe intent, the AI executes. It’s efficient when it works and a bad afternoon when it doesn’t.<\/p>\n

aitm draws a different line. The AI can see your environment, read your files, and call tools \u2014 but execution is always gated by you. The invariant is:<\/p>\n

In practice: the AI calls list_files, read_file, get_terminal_history, and search_history automatically. These are read-only. You see the results in the conversation as they come in. But run_command \u2014 anything that changes state \u2014 stops the loop and waits for your approval.<\/p>\n

That distinction sounds obvious in retrospect. It wasn’t obvious at design time. The first version had a “trust mode” that auto-approved low-risk commands. I removed it. The UX was slightly smoother; the feeling of being in control was not worth trading away.<\/p>\n

Electron was the obvious first option to evaluate. At idle: ~150 MB RAM, several seconds to show the window. Fine for a prototype, not acceptable for something that sits open all day. So Electron was ruled out early.<\/p>\n

The choice was Tauri 2 + Rust from the start. Two months to get to something usable. The numbers:<\/p>\n

The React 19 frontend handles the UI. The Rust layer handles the PTY, IPC, tool execution, and security. This matters: the security gates run in Rust, which means the JavaScript\/React layer cannot bypass them. The AI layer sends requests over Tauri IPC; the Rust handler is the one that decides whether a command actually runs.<\/p>\n

\"\"<\/figure>\n

Every run_command call goes through four sequential gates before it reaches your shell.<\/p>\n

L1 \u2014 Blocklist regex. Hard-coded patterns that always fail. rm -rf \/, the fork bomb :(){ :|:& };:, dd if=\/dev\/zero, and ~50 others. These are commands where “the user confirmed it” is still not enough \u2014 the blocklist exists precisely to be unconditional.<\/p>\n

L2 \u2014 Heuristic risk scoring. The command string is scored against a set of signals: does it touch \/, use redirection (>), pipe to sh, reference system directories? The output is DESTRUCTIVE, HIGH, or LOW. This label shows up in the confirmation dialog so you can see why something got flagged.<\/p>\n

L3 \u2014 Project scope allowlist. Each session has a configured project directory. You can define a globset \u2014 paths and patterns the AI is allowed to operate on. Anything outside scope is flagged before reaching L4. This is opt-in, but it’s what makes “AI working on this project” distinct from “AI with access to your whole machine.”<\/p>\n

L4 \u2014 Explicit user confirmation. Every run_command produces a modal: full command text, risk level, scope check result. There is no auto-approve mode and no way to configure one.<\/p>\n

L1 and L2 run synchronously in Rust with no async overhead. L3 uses the globset crate. L4 is a hard gate in the IPC handler \u2014 no call path in the AI layer can reach the shell without passing through it.<\/p>\n

The tool loop and security model are the headline. Everything else in 1.0 was stuff I’d been deferring:<\/p>\n

Project scope + SQLite persistence. Sessions now have a project directory. Conversation history, session state, and config all live in a local SQLite database. Nothing leaves your machine, no account required.<\/p>\n

Six LLM providers. OpenAI, Anthropic, DeepSeek, Qwen (Alibaba DashScope), Zhipu, and Moonshot (Kimi). You can switch per session. The six were chosen for coverage: Western API providers plus the major Chinese providers for users who want lower-latency access from CN.<\/p>\n

Eight themes, English and Chinese UI. The themes are opinionated. There’s a dark ink-wash one that I find easier on the eyes during long sessions.<\/p>\n

Split-pane CodeMirror editor. A file editor built into the window. For quick edits without losing terminal context.<\/p>\n

\"\"<\/figure>\n

macOS Developer ID notarization. The .dmg is signed and notarized. No Gatekeeper warning on first launch.<\/p>\n

Windows support exists \u2014 CI builds it, I’ve run it \u2014 but macOS is the platform I use daily and where the edge cases are best covered. Windows testing is less thorough.<\/p>\n

There’s no streaming AI response in the tool-calling loop. The AI responds after all tool calls complete. In practice the wait is usually under two seconds, but it’s a noticeable gap when a sequence involves several reads. I’ll revisit this in 1.1.<\/p>\n

Plugin system and user-defined tools are on the roadmap, not here.<\/p>\n

Source on GitHub under Apache 2.0. Issues and discussions are open. If you want to talk about the security model specifically, that’s where to do it.<\/p>\n

Templates let you quickly answer FAQs or store snippets for re-use.<\/p>\n

Are you sure you want to hide this comment? It will become hidden in your post, but will still be visible via the comment’s permalink.<\/p>\n

For further actions, you may consider blocking this person and\/or reporting abuse<\/p>\n

Thank you to our Diamond Sponsors for supporting the DEV Community<\/p>\n

Google AI is the official AI Model and Platform Partner of DEV<\/p>\n

DEV Community \u2014 A space to discuss and keep up software development and manage your software career<\/p>\n

Built on Forem \u2014 the open source software that powers DEV and other inclusive communities.<\/p>\n

We’re a place where coders share, stay up-to-date and grow their careers.<\/p>\n