Files and changes

An agent works in your project's files. CompozyOS lets you see that work without leaving the app: browse the project tree, read any file with syntax highlighting, search by name or by content, and review what a session changed against its base branch. Everything is read-only. CompozyOS never writes to the project from these views.

The same views appear in two places:

• The Review panel in a session window has two tabs. Changes shows the session's diff. Files shows the tree and a file viewer, rooted at the session's worktree when it has one, otherwise at the project folder.
• The Files app in the dock opens a project's files in their own window, with a picker for the project and for the root (the project folder or one of its worktrees).

A file path in an assistant message is a link. A plain click opens it in the in-app viewer, in the browser and in the desktop app alike. In the desktop app, Open in sends the file to an installed editor or reveals it in Finder.

Choose a pathCopy Anchor Link

What stays privateCopy Anchor Link

These views read only inside a registered project or one of its worktrees. Responses use paths relative to that root, never absolute host paths, and the .git folder is never served.

• Sensitive files such as .env, .env.*, private keys, and other credential files show a Sensitive file notice instead of their contents. Show contents reveals one file for that view only. .env.example, .env.sample, and .env.template are ordinary files. A symlink that points to a sensitive file is treated the same way.
• Search never returns matches from sensitive files. It reports how many it skipped.
• User-scope sessions have no project, so they have no Review panel. Paths in their messages stay plain text.
• Profiles see only their own projects, worktrees, and sessions.

For agents and scriptsCopy Anchor Link

The views read the same daemon routes that scripts can call. Twelve GET operations under /api/workspaces/{workspace_id} cover the tree, file contents, Go to file, content search, and session changes. Each has a project form (with an optional worktree_id) and a session form. See the generated Workspaces API reference for parameters and response shapes. HTTP and UDS expose the same handlers, and the TypeScript and Go clients include them.

Session changes are also available from the terminal and to agents:

• CLI: compozy session changes prints the summary, and --patch adds patches for chosen files.
• Agents: the compozy__session_changes native tool returns the same summary and bounded patches.

There are no file list, read, or search native tools: an agent already reads files through its own provider tools.