Suggestions Mode
Suggestions Mode
By default, an MCP agent with a write-capable API key edits your .md files directly.
Every write is attributed and revertible from the timeline — but the change happens first,
you see it after.
Suggestions mode flips that. A propose-only API key turns every agent write into a
proposal: a stored before/after diff that lives under .lettuce/proposals/ and shows up
in the inspector’s Proposals tab until you accept or reject it. The file isn’t touched
until you click Accept.
New agent you don’t fully trust yet. Sensitive vault where you want every write reviewed. Batch rewrites where you’d rather see all the changes side-by-side before anything lands.
Setup
From the GUI (Settings → API Keys → Add key, toggle “Propose-only”), or from the CLI:
lettuce keys add --label untrusted --scope all --propose
Hand the printed secret to the agent. From then on, any write the agent makes goes to the proposal queue; reads still work normally.
What gets proposed
| Tool | Proposed? |
|---|---|
write_note, patch_section, apply_edits, complete_directive |
Yes |
delete_note, move_note |
Yes |
create_folder, rename_folder, delete_folder |
No — folder ops touch many files; not supported in v1 |
Reads (read_note, search, list_tags, …) |
Not applicable — never proposed |
The agent side
Propose-only writes return {"status":"pending","proposalId":"…","path":"…","operation":"…"}
instead of the usual note DTO. An agent can:
Check its own queue with
list_my_proposals(only sees proposals it authored).Cancel a proposal it no longer wants applied with
withdraw_proposal(id).
A robust agent prompt looks like: “propose all edits, then call list_my_proposals once
a minute. If a proposal is missing, the user accepted or rejected it — log and move on.”
The reviewer side
The inspector’s Proposals tab shows pending proposals with +N / −M line counts and
the proposing agent’s label. Click a row → unified diff modal with Accept, Reject,
and Show in note. Accepting runs the write through the same path a direct commit would
take (so attribution, soft-locks, link rewrites, and the agent-edit timeline all behave
consistently).
Staleness
Each proposal records the file’s content at proposal time. If the file changes before you accept (you edited it, another agent wrote it, …), the proposal is stale and Accept refuses with the reason. Reject it and ask the agent to retry against the current state.
Graduating a key to commit
Once you trust an agent enough to skip review, remove its propose-only key and issue a
plain commit-mode key (lettuce keys add --label trusted --scope all).