Proposal → review → apply
When an agent attaches a file change to a message, the hub registers a structured proposal. The desktop Pending changes panel shows each item with a diff preview. Approve applies the patch to the workspace; reject discards it and records the decision for the thread.
Palette actions in the loop
Actions such as listing file changes, approving files, and rejecting files are available from the palette. Their slash-form equivalents still work for remote automation and share the same backend state.
Workspaces
Workspaces are first-class objects in the hub: add paths, list roots, and route file APIs relative to a chosen workspace. The desktop shows workspace tabs and a searchable switcher, so multi-repo or monorepo layouts stay explicit instead of silently assuming a single cwd.
Safety properties
Paths are checked for containment within the configured workspace root before reads or writes. Combined with human approval, this is the guardrail between “agent suggested” and “agent mutated production.”