The web workspace

aico serve starts a loopback HTTP server and opens a browser client against it. The important part is which of the two owns the run.

The server owns the run

Close the tab mid-turn and the work carries on. Reopen it and the session replays from its event log — real tool results, real sequence numbers, not a summary of what happened. That is only possible because the transcript is a log the server holds, rather than state the page was keeping.

It binds to 127.0.0.1 only, and every request carries a token minted at startup. Reaching the port is not the same as being able to drive it, because this server can run commands and edit files.

Chat and trajectory are one session

Two readings of the same log, not two copies. Tool calls render as cards with diffs and an outcome that means something:

• A browser check reads works or 3 problems, with the worst one inline.
• A persistent shell reports the directory it left you in — because a cd that did not take looks exactly like one that did, until something writes a file into the wrong place.
• A backgrounded command reads running · pid 4321 rather than a misleading exit 0.

Panels that know when to stop talking

A plan and a task list float beside the conversation when there is one. Both collapse to a single line once resolved, and all done is never shown for a list finished by cancelling half of it — that reads 0 done · 5 cancelled, because conflating the two is how a task list becomes a formality.

Closing a panel records what was closed, so a genuinely new plan comes back on its own and the one you dismissed stays gone.

Steering

Type while the agent is working. The message is delivered at its next step boundary, not queued behind the whole run, and the turn is extended rather than cancelled — so everything it has already learned is kept.

❯ refactor the auth module
  ⋯ Read(src/auth.ts)
  ⋯ Edit(src/auth.ts)
actually keep the session cookie name unchanged
  (steering — applies at the next step)
  ⋯ Edit(src/auth.ts)

Queued input also stops the loop finishing: a model that was about to answer will continue instead. Both queues are durable, so anything typed before a crash is still owed when the session resumes.

Plan before you build

Turn Plan on and the turn cannot change anything — the write tools are gone, not discouraged. The agent investigates and finishes with a structured plan:

Plan   Create VERSION.txt with the version from package.json
  1  Write VERSION.txt containing "0.4.1"
     Create VERSION.txt in the repo root with the single line "0.4.1".
     VERSION.txt
  Risk: None.

  [ Go ahead ]  Amend   Later                          Decline

• Go ahead turns planning off and starts work — the mode change is part of the answer, not something you have to remember.
• Amend puts the plan in the composer, so a correction is a sentence rather than a re-brief.
• Later keeps it without starting it, and offers Start it now whenever you come back.

Assumptions appear above the steps, because an assumption you would have corrected costs a sentence now and a rewrite later — putting it beside the approve button is the same as not asking.

Watching what you delegated to

When a turn hands work to a sub-agent, the parent makes one call and waits — and everything interesting happens inside the child. A panel lists each one: what it was asked for, the tool it is inside now, how long it has run, how many calls it has made. Without that, a six-minute delegation and a six-minute hang look identical, which is how people end up stopping work that was going fine.

Each running sub-agent has its own Stop, because the common failure is one child looping while three siblings are fine — and cancelling the whole turn to deal with one is a bad trade. The agent doing the delegating can do the same through AgentSupervise, which reports what each child is spending and terminates one by id with a stated reason. A stop is recorded as cancelled rather than failed: a crash invites a retry, a termination invites a re-plan.

Forking a conversation

Branch from any message and carry on down a different path, with the original left intact. Cuts land on turn boundaries and never split a tool call from its result — every provider rejects a call with no result, so a fork that cut mid-turn would produce a session that cannot be resumed.

Sessions, projects and groups

Sessions are named automatically and pinned by renaming — a name you did not choose that silently changes under you is disorienting, so a provisional one is marked as such. Projects group by directory; groups are yours to arrange.

Transcripts export as Markdown or text, backed by the log, so they include tool calls rather than only the prose. Settings — providers, permission mode, context and spend ceilings — are searchable across every pane.

Safety, in layers

The sandbox is defence in depth against a confused agent, not a jail. It stops a mistaken write; it does not stop deliberate evasion through a shell.