[delayed]

> That is not the niche case, that's the dominant use of models.

It would be helpful to distinguish between your own opinion on how models ought to be used, compared to how others actually use models.

> That is not the niche case, that's the dominant use of models.

And if everyone else jumped off a bridge, I mean, used raw interpolation for SQL queries, would you do it too?

Don't worry, you can just use the automated approver to escape your queries! It's so secure!

Using raw SQL string interpolation doesn't get you anything much that you can't get just as easily with a parameterized query. In contrast, properly sandboxing agents is such a pain, and such a productivity drain, that hardly anyone does it in practice, save for a vocal minority online.

Auto mode seems to have some reasonable restrictions baked in. For example if you give claude access to two k8s namespaces, seriousproject-qa and seriousproject-prod, auto-mode will grant `kubectl exec` on the qa environment while denying the same command for the production environment. Of course you should be enforcing that by restricting what kind of access tokens you give claude access to, but auto-mode does have opinions about this stuff too, even if it's not bulletproof

However I do share your desire for a better manual mode. Auto-mode is both sometimes surprisingly lax, and sometimes too restrictive. Maybe manual mode should inject a reminder "keep your commands as simple one-liners", the same way plan mode injects a reminder that you are in plan mode and don't want any code changes