Local Workspace

#A Separate Files Surface

Every local Daita session admits exactly one workspace. It is not a registered source, does not create a durable file inventory, and does not enter the database catalog.

Pass an explicit directory when predictable selection matters:

daita --workspace /absolute/path/project
daita --workspace /absolute/path/project \
  --workspace-sensitivity confidential

Without --workspace, the terminal uses the current directory when it is safe and does not overlap Daita state; otherwise it creates or reuses ~/Daita Workspace. Allowed sensitivity labels are internal, confidential, and restricted.

Local Python callers must construct the workspace explicitly:

from pathlib import Path
 
from daita import Agent, LocalWorkspace
 
workspace = LocalWorkspace(Path("/absolute/path/project"))
agent = await Agent.open("atlas", workspace=workspace)

The workspace and state roots cannot overlap. The filesystem root, user home, missing paths, non-directories, and public sensitivity are rejected.

#Search and Read

file_search finds workspace-relative paths or literal text. file_read returns one bounded chunk from an exact file and can issue an authenticated current-run binding for a supported text edit.

Daita rejects or skips:

• absolute paths, .. traversal, aliases, and symlinks;
• sockets, devices, FIFOs, and other special files;
• secret-like paths such as .env, private keys, credential stores, and sensitive VCS internals;
• binary content for text search and reads; and
• files that change while a cursor or authenticated binding is in use.

Names and contents are untrusted data. Absolute workspace paths are not placed in model requests, tool results, transcripts, artifact provenance, or durable state.

Use /workspace to inspect the admission and /files <question> for a run that omits source, MCP, and source-job tools:

result = await agent.run(
    "Summarize the release notes",
    files_only=True,
)

#Structured File Queries

file_query analyzes one homogeneous CSV, TSV, JSON-records/NDJSON, or Parquet dataset. Its path_pattern is always workspace-relative and is expanded by Daita without a shell.

The SQL contract is one read-only SELECT over exactly one relation named data. The model cannot introduce another relation, raw path, URL, table or filesystem function, extension, setting, DDL, or DML.

Daita revision-binds the complete input manifest and runs DuckDB 1.5.5 in a private one-call worker with external access, extension installation/autoload, persistent secrets, and network filesystems disabled. Calls are bounded by file count, physical bytes, result rows, time, memory target, and monitored spill.

#Targeted Text Edits

For a bounded UTF-8 text file, the supported sequence is:

file_read -> artifact_edit_text -> approval -> artifact_save_local

artifact_edit_text accepts only the opaque current-run binding returned by file_read. It applies ordered exact replacements and commits a complete replacement artifact without changing the workspace.

The final save derives its target from that binding, presents a bounded path and change summary, requests exact approval, and rechecks file identity, content hash, metadata, ownership, links, and parent safety. It publishes atomically only if the original is unchanged. Drift requires a fresh read and edit; Daita does not merge, redirect, or retry the mutation.

New local files also begin as committed artifacts and use artifact_save_local in create mode. There is no file_write, raw byte API, shell execution, binary editor, or generic filesystem tool.

See Artifacts for creation, recovery, conversion, and delivery behavior.