The agent: tools, approvals, and undo

The agent opens files, queries the knowledge graph, and records its work in the thread so you can check how it reached an answer. Changes follow the selected permission mode and saved approval rules.

This lesson opens the hood: the tool loop, how answers trace back to your notes, and the three systems that keep you in charge (approvals, plans, checkpoints).

How the agent works

The agent works in a loop: think, call a tool, read the result, repeat. Every tool call shows up as one timed chip in the thread, a collapsible row naming the tool, its duration, and what it was asked to do. Expand it for the full output; a chip that's still running shimmers.

Reasoning gets a chip too: it reads "Thinking for Ns" while the agent works, then "Thought for Ns" once it lands. Fold it open to reread the reasoning whenever you want.

• Reads in a row collapse together: two or more file reads back-to-back become one "Read {{count}} files" chip you expand to see each path. Web searches do the same ("Web searched {{count}} queries").
• File-write chips are the one exception, sitting expanded by default. The diff (green for added, red for removed) waits right above the approval prompt, so you review the change before you answer it. An "Open file" button and a full before-and-after diff tab are one click away.
• Every step is labeled with what actually happened, so the thread stays an honest record you can audit.

Check an answer’s sources

When a workspace search feeds an answer, the thread draws an inline 3D mini-graph titled "Where this came from in your notes". It comes with a count line ("{{entities}} items · {{edges}} relations") and a two-color legend: "Directly matched" and "Related".

Watch the "Related" nodes. The graph pulled them in because they connect to the direct matches, even when their names never matched your search words. That's associative recall, and you can see it happen.

References in the answer link back too, with nothing to type. They resolve against your live workspace, so a click opens the exact note, PDF, or entity behind the answer. Even a bare file name ("report.md") auto-links when it exactly matches a workspace file.

Task approval and permission modes

How much the agent asks before acting comes down to one badge on the composer: the permission mode. There are four, and the default is "Ask".

• Command approval. "Run command?" (or "⚠️ Run this command?" for dangerous ones) tells you the reason, anywhere from "read-only command" to "runs with elevated privileges (sudo/su)". Your options are "Allow once", "Allow for the rest of this turn", and "Deny". If a command needs to write outside the workspace, an escalation note names the exact directories.
• File-write approval. "The AI wants to edit the file {{path}}. Apply this change?", with the diff right there in the card. Your options are "Allow once", "Always allow edits in {{scope}}" (saved across chats), and "Deny".
• Guards. "Fetch {{host}}?" and "Save to knowledge base?" show up only after the agent has read external web content in the same turn. They defend against prompt injection: a page the agent just read trying to smuggle its own instructions into the conversation.

Status during computer control

Computer control gets one extra safety layer on top of the approval card, because it happens outside the app window. While the agent is looking at or driving your screen, every display glows along its edges. The glow is transparent and click-through, so it never gets in your way.

Your main display also floats a little pill saying Consilience is controlling your computer, with ESC to stop. You can't miss it, even with Consilience in the background.

• Rotating colored glow. The agent is acting on the screen right now.
• Static amber glow with the pill "Consilience is waiting for you". The agent has paused. It's either waiting on an approval card in the app, or it noticed you took over the mouse.
• ESC, anywhere. While the indicator is visible, a global ESC kill switch is armed. Press it in any app, at any moment, and the agent's computer control stops on the spot.

Plan first, then act

For bigger jobs, switch the badge to "Plan". The agent goes read-only, explores your workspace, and comes back with a plan approval card: "Here's my plan: … Approve it and let me carry it out?" You answer "Approve & run" or "Keep planning". The card also has a note field ("Optional: what to change about the plan"), so you can steer the revision instead of retyping it.

Once the agent starts working, it keeps a live plan checklist in the thread. These are plain checkbox lines: an empty square is pending, a square with an asterisk is in progress, and a check is done. It updates in real time, so you always know which step the agent is on.

Undo work with checkpoints

Any turn that changed files ends with a change card. It shows "Worked for Ns", the file (or a "{{count}} lines changed" row with added and removed counts), an expandable "Markdown diff preview", and a one-click "Revert" button. The button flips to "Reverted" once you use it.

For anything bigger, hover over a past message of yours. A clock icon ("Edit or undo from this message") opens the rewind menu.

• "Edit this message and resend" forks a new conversation from everything before this message, and drops your original text and attachments back into the composer.
• "Undo replies back to here" trims the current thread back to before this message. It's destructive, and it stops an in-flight run first.
• "Undo AI changes back to here" restores your workspace files to the pre-turn code checkpoint. You only see it when the turn has one.
• "Undo AI changes in a new chat" does the same file restore, but into a forked conversation.
• Conversation rewinds apply instantly. Code rewinds always confirm first: "Undo the AI's file changes?" previews exactly which files get restored and which get deleted.

Save notes with the learn tool

One tool earns special treatment. When the agent figures out something worth keeping (an answer you gave it, a fact it verified), a "Learning" chip appears and finishes as "Learned". What it learned is saved so future sessions can build on it.

Because that memory outlives the conversation, it gets its own guard. If the agent tries to save right after reading external web content in the same turn, a card asks "Save to knowledge base?". It warns that untrusted pages can plant false facts future sessions would treat as truth, so "Allow" saves the learned note and "Deny" skips it.

Next, you'll hand the agent bigger, longer jobs, with these same safety systems doing the watching.

tool chip

One collapsible, timed row per tool call: label, duration, a summary of what it was asked to do, and the full output tucked inside

permission mode

The composer badge deciding what needs approval: "Ask", "Auto-edit", "Plan", or "Full access"

approval card

The card that swaps into the composer slot when the agent needs your permission, options plus rationale

plan checklist

The agent's live to-do list, drawn as plain checkbox lines that update as it works

change card

The end-of-turn summary of file changes, with diff preview and a one-click "Revert"

code checkpoint

A per-turn snapshot of your files that powers "Undo AI changes back to here"

learn guard

The confirmation asked before a web-derived note is saved for future sessions