Chat and the agent
Chat is the main area of the room. One composer, one model, one folder. Everything the model does to that folder is visible and reversible.
Ask or Agent
The composer’s toggle decides what a turn may do. Ask answers in the chat and touches nothing. Agent can read files, write files, search the web when that setting is on, and call tool servers you added. Each turn’s actions appear as cards on the transcript; a wrong answer can be regenerated, edited or copied.
Consent before every write
A write is never silent. The preset you chose at the folder gate sets how often you are asked:
| Preset | Behaviour |
|---|---|
| Safe | Confirm every action the agent takes. |
| Balanced | Auto-approve reads and edits; still confirm shell commands and deletions. |
| Autonomous | Auto-approve everything — use only in a folder under version control. |
Change it any time under Settings → Agent → Permissions or from the Chat menu. Whatever the preset, every write is checkpointed first, so it can be undone in Changes.
What goes into the prompt
The “+” button attaches a file, the current selection, an image (read by the on-device vision model) or the preview console. The header shows a context gauge so you can see how full the model’s window is, and for a key the running cost.
Project rules
Two files teach the agent how to behave in a repository, read in this order and exactly one wins: .oioxo/rules.md first, then AGENTS.md. An empty rules file falls through rather than shadowing a real AGENTS.md beside it. Chat → Project rules opens whichever file the agent will read, or creates .oioxo/rules.md if neither exists.
Tool servers (MCP)
Settings → Agent → Tool servers takes the URL of an MCP server. Its tools join the agent’s list and confirm like any other tool under your preset.
Web search
Off by default. Turn it on under Settings → Agent and the agent can run a search through oioxo.com/api/search; the query is the only thing that leaves the device, and the snippets come back into the prompt.
Stop
Esc or the Stop button aborts the model immediately, on every tier. A second agent started while the first is running is visible and stoppable under Runs in the command palette; if two runs write the same file, the collision is named — which file, which run, how long ago — and Changes can undo either.
The web tier has no shell. The agent can run JavaScript in a sandboxed worker to check its own work, and it can load a page in Preview, but npm, Python and compilers need the desktop app, which has a real terminal.