Bash, code and tool calls could compile to one execution plan that is security-checked before it runs

Tobi Lutke labels this explicitly as a bet, not a finding: “Sometime soon someone will (or has already?) create a embeddable, sqlite style mini execution environment that parses bash, typescript, or tool calls into a common IL execution plan that’s easy to security check before executing. And design this specifically for durable execution environments.” After that, “we will just connect cli, mcp, webmcp, whatever to that and it accepts any of the input modalities as they can all be represented as each other.”

The prediction follows from Agents need a REPL that keeps state between steps — the harness decides whether a tool protocol works, not the protocol. If the stateful environment is what matters, then the input format (a shell line, a script, an MCP call, a WebMCP turns websites into agent-native interfaces call) is a front end that should compile to the same thing. The security point is worth noting. A single plan that is checked before it runs puts the guard in the execution layer rather than in the prompt or in each tool separately. That is Policy enforcement must run independently of model cooperation — hooks, not prompt instructions moved one level down, under every tool at once.

This is a prediction from one person, not a description of a shipped system. Tobi’s later pointer, Durable execution snapshots the whole interpreter, so a code-mode session survives restarts and hours-long waits, covers the durability part. Its own README says snapshots are trusted input and malicious ones are not detected, so it does not cover the check-before-run part.