@vincemakes/kiso-code 0.52.0 → 0.54.0

package/dist/chat.d.ts

@@ -411,5 +411,7 @@ export interface ChatNav {
     /** 0.40.0: an id outside this project's folder — refused, or opened where it is */
     readonly route?: (id: string) => SessionRoute | null;
     readonly pick?: () => Promise<string | null>;
+    /** the session's first message was sent: the caller may title the session from it (Session.title) */
+    readonly titled?: (firstMessage: string) => void;
 }
 export declare function chat(session: AgentSession, faux: boolean, input: LineInput, autoCompact?: AutoCompact, nav?: ChatNav, seed?: readonly string[]): Promise<ChatEnd>;

package/dist/chat.js

@@ -1386,7 +1386,11 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         // 0.40.0: a skill turn is not scanned either — its text is a
         // SKILL.md body, and a body that mentions `diagram.png` must not
         // attach a file from the workspace the person never pointed at.
+        input.setGhost?.(null); // a new turn: the last run's follow-up no longer applies
         const content = via !== undefined ? text : attachImages(text, input.attachments?.(), protectedFiles());
+        // the person's first message of the session: a title is made from it beside the run, never in its way
+        if (via === undefined && !session.log.all.some((e) => e.type === "user_input"))
+            nav?.titled?.(text);
         // ADR-0058: a task notice is the runtime's input — source "system"
         const run = via !== undefined ? session.run(content, { via, ...(via.kind === "tasks" ? { source: "system" } : {}) }) : session.run(content);
         currentRun = run;
@@ -1435,6 +1439,15 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
                 // round 8: after EVERY turn the prompt is re-armed — the human
                 // never types blind after the first turn.
                 input.prompt();
+                // the follow-up (owner 2026-11-03): after a run that ended well, the line the person may send next,
+                // asked of the session's own model with the run's own prefix (Session.followUp); shown dim in the
+                // empty box only while no other turn has started or waits; off with the faux model and KISO_FOLLOWUP=off
+                if (last?.type === "terminal" && last.outcome.kind === "completed" && !faux && input.setGhost !== undefined && process.env["KISO_FOLLOWUP"] !== "off" && queued === 0) {
+                    void session.followUp({ maxTokens: 200, signal: AbortSignal.timeout(15_000) }).then((line) => {
+                        if (turnNo === myTurn && currentRun === null && queued === 0 && !leaving)
+                            input.setGhost?.(line === "" ? null : line);
+                    }, () => undefined);
+                }
                 // the ergonomics batch C8: the opt-in auto-compact — checked AFTER the
                 // turn ended (the run's terminal is in the log, the ratio
                 // is post-run).
@@ -1889,11 +1902,13 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         requestSwitch: (id) => {
             switchTo = id;
             leaving = true;
+            input.setGhost?.(null); // REL-0530-F1: the follow-up belongs to the session being left
             resolveEnd();
         },
         requestReload: () => {
             reloadReq = true;
             leaving = true;
+            input.setGhost?.(null);
             resolveEnd();
         },
         sessions: () => nav?.sessions() ?? [],

package/dist/create-coding-agent.js

@@ -34,7 +34,7 @@ import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { sweepStaleMergeDirs } from "./temp-sweep.js";
 import { CODING_TOOL_RULES, composeSystemPrompt } from "./coding-prompt.js";
-import { createAgent, loadExtensions, loadProjectExtensions, SessionStore } from "@vincemakes/kiso-runtime";
+import { createAgent, loadExtensions, loadProjectExtensions, readEnvironment, SessionStore } from "@vincemakes/kiso-runtime";
 import { preferences, startingEffort } from "./preferences.js";
 /** LT-1: the stream watchdog's bound from the environment — a non-negative
  *  number of milliseconds (0 disables it); anything else is ignored. The
@@ -269,7 +269,7 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     setUserProtectedPaths(userConfig?.protectedPaths);
     const extensions = [
         protectedShellExtension({ files: protectedFiles, workspaceRoot, env: () => ({ home: homedir(), kisoHome: kisoHome() }) }),
-        floorExtension(() => floorOn, workspaceRoot),
+        floorExtension(() => floorOn, workspaceRoot, undefined, () => (sessionId === undefined ? [] : readEnvironment(activeStoreDir, sessionId).added)),
         breakerExtension(),
         ...modeExtensions(workspaceRoot),
         readOnlyShellExtension(codingToolOptions),

package/dist/dispatch.d.ts

@@ -4,7 +4,9 @@
  * the context (the chain, the run state, the prompt arming).
  */
 import type { SessionRoute } from "./projects.js";
-import type { AgentSession } from "@vincemakes/kiso-runtime";
+import { type StoreRecord } from "@vincemakes/kiso-runtime/internal";
+import { type AgentSession } from "@vincemakes/kiso-runtime";
+import type { SessionCardView } from "@vincemakes/kiso-tui";
 import { type LineInput } from "./state.js";
 import type { UserInputVia } from "@vincemakes/kiso-core";
 /** Everything dispatch touches that chat() owns. */
@@ -72,3 +74,8 @@ export declare function parseBang(trimmed: string): {
 export declare function markCompactWhy(why: string): void;
 export declare function markAutoCompact(): void;
 export declare function dispatch(line: string, ctx: DispatchCtx): void;
+/** /fork's rows: each finished run, newest first, by the person's message it answered and when it ended; the opened
+ *  row shows the reply's first line under it (owner 2026-11-04: the person knows a turn by what they asked, and an
+ *  "answered:" label over their own line read backwards). The card's id is the seq of the run's terminal, where
+ *  SessionStore.fork cuts. */
+export declare function replyCards(records: readonly StoreRecord[]): SessionCardView[];

package/dist/dispatch.js

@@ -5,11 +5,13 @@
  */
 import { STATUS_GLYPHS, contextRows, contextSheetRows, contextUnavailableRows, contextUnavailableSheetRows, displayVerb, escapeTerminal, helpRows, toolTarget, infoSheetRows, kUnit, modePickView, modelPickView, namedPickView, settingsPickView, compactingStatus, liveRow, palette, renderEvent, settledLabel, slashCommandNames } from "@vincemakes/kiso-tui";
 import { newSessionId } from "./session-id.js";
-import { buildAdapter, lookupModelMetadata, readSessionName, resolveContinuationScope, resolveReasoning, sessionTitle, tiersFor, writeSessionName } from "@vincemakes/kiso-runtime/internal";
+import { buildAdapter, isForkNote, lookupModelMetadata, readSessionName, resolveContinuationScope, resolveReasoning, sessionTitle, tiersFor, writeSessionName } from "@vincemakes/kiso-runtime/internal";
+import { isEnvironmentNote } from "@vincemakes/kiso-runtime";
+import { ForkRefusedError, SessionStore } from "@vincemakes/kiso-runtime";
 import { MODE_LABEL, MODE_NOTE, OFFERED_MODES, applyModeSetting, getDontAsk, getMode, modeDisplay, parseMode, setDontAsk } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
 import { protectedBangReason, protectedShellVerdict } from "./protected-shell.js";
-import { activeStoreDir, agentBaseUrl, currentProfileName, setCurrentProfileName, currentModelName, agentModel, body, bodyLog, codingToolOptions, protectedFiles, kisoHome, configModels, dock, lastBinding, loadedSkillsCatalog, mergedConfig, readContextLedger, retryOnRow, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setRetryShown, upstreamOf, VERSION, setLastBinding } from "./state.js";
+import { activeStoreDir, sessionStoreRef, agentBaseUrl, currentProfileName, setCurrentProfileName, currentModelName, agentModel, body, bodyLog, codingToolOptions, protectedFiles, kisoHome, configModels, dock, lastBinding, loadedSkillsCatalog, mergedConfig, readContextLedger, retryOnRow, sessionsDir, setAgentModel, setConfiguredWindow, setCurrentModelName, setModelChoice, setRetryShown, upstreamOf, VERSION, setLastBinding } from "./state.js";
 import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { profileProviderLabel, providerLabel } from "./provider-label.js";
 import { installedVersion, versionStatusLine } from "./stale-version.js";
@@ -1384,6 +1386,44 @@ export function dispatch(line, ctx) {
         ctx.requestReload();
         return;
     }
+    if (trimmed === "/fork") {
+        // owner 2026-11-03: the web app's fork, one rule — a new session from after one of this session's replies
+        // (SessionStore.fork), then the terminal switches to it as /resume does; the replies are picked in /resume's band
+        if (ctx.isRunning()) {
+            body.notice("[/fork] a run is in flight — let it finish (esc stops it), then fork");
+            ctx.input.prompt();
+            return;
+        }
+        ctx.chainRef.current = ctx.chainRef.current.then(async () => {
+            const cards = replyCards(sessionStoreRef?.load(ctx.session.id) ?? []);
+            if (cards.length === 0) {
+                body.notice("no finished reply to fork after yet");
+                ctx.input.prompt();
+                return;
+            }
+            const fork = (afterSeq) => {
+                try {
+                    const made = new SessionStore(activeStoreDir).fork(ctx.session.id, { afterSeq });
+                    body.notice(`forked "${escapeTerminal(readSessionName(activeStoreDir, made.id) ?? made.id)}" — switching to it`);
+                    ctx.requestSwitch(made.id);
+                }
+                catch (error) {
+                    body.notice(error instanceof ForkRefusedError ? `[/fork] ${error.message}` : `[/fork] ${error instanceof Error ? error.message : String(error)}`);
+                    ctx.input.prompt();
+                }
+            };
+            // no band (a pipe, a dock-less terminal): after the last reply, the sidebar's Fork
+            if (ctx.input.pick === undefined || !dock.active)
+                return fork(Number(cards[0].id));
+            ctx.input.pick(() => cards, (picked) => {
+                if (picked === null)
+                    ctx.input.prompt(); // esc: nothing forked, nothing said
+                else
+                    fork(Number(picked));
+            }, undefined, "fork");
+        });
+        return;
+    }
     if (trimmed === "/resume" || trimmed.startsWith("/resume ")) {
         // the mini-spec: the in-session door to the durable sessions —
         // /resume <id> switches directly; bare /resume opens the SAME
@@ -1589,3 +1629,30 @@ async function tasksCommand(arg, ctx) {
     else if (action === 1)
         stop(task);
 }
+/** /fork's rows: each finished run, newest first, by the person's message it answered and when it ended; the opened
+ *  row shows the reply's first line under it (owner 2026-11-04: the person knows a turn by what they asked, and an
+ *  "answered:" label over their own line read backwards). The card's id is the seq of the run's terminal, where
+ *  SessionStore.fork cuts. */
+export function replyCards(records) {
+    const cards = [];
+    let asked = "";
+    let reply = "";
+    for (const { event: e, ts } of records) {
+        if (e.type === "user_input" && e.source !== "system") {
+            const content = Array.isArray(e.content) ? e.content.filter((b) => !(b.type === "text" && (isForkNote(b.text ?? "") || isEnvironmentNote(b.text ?? "")))) : e.content;
+            asked = (typeof content === "string" ? content : content.map((b) => (b.type === "text" ? (b.text ?? "") : "")).join(" ")).trim();
+            reply = "";
+        }
+        else if (e.type === "tool_result")
+            reply = "";
+        else if (e.type === "text_delta")
+            reply += e.text;
+        else if (e.type === "terminal" && e.outcome.kind === "completed") {
+            // the row is the person's own line; the reply's first line, inline code read as plain text, opens under it
+            const first = (reply.split("\n").map((l) => l.trim()).find((l) => l !== "") ?? "(no reply text)").replace(/`([^`]*)`/g, "$1");
+            const line = asked.split("\n").map((l) => l.trim()).find((l) => l !== "") ?? "(no message text)";
+            cards.unshift({ id: String(e.seq), title: line, badge: "completed", turns: null, updatedAt: ts, uncertain: 0, asks: 0, outcome: null, detail: `└ ${first}` });
+        }
+    }
+    return cards;
+}

package/dist/empty-sessions.js

@@ -65,6 +65,8 @@ export function findEmptySessions(dirs, alive = pidAlive) {
             const files = [name];
             if (names.includes(lock))
                 files.push(lock);
+            if (names.includes(`${id}.environment.json`))
+                files.push(`${id}.environment.json`);
             if (existsSync(join(dir, "traces", `${id}.jsonl`)))
                 files.push(join("traces", `${id}.jsonl`));
             empty.push({ dir, id, files });

package/dist/floor.d.ts

@@ -88,12 +88,12 @@ export declare function gitInvocation(args: readonly LooseWord[]): GitInvocation
  * Would the floor refuse this command line? `workspaceRoot` is where the
  * shell runs it.
  */
-export declare function floorCheck(commandLine: string, workspaceRoot: string, home?: string): FloorVerdict;
+export declare function floorCheck(commandLine: string, workspaceRoot: string, home?: string, added?: readonly string[]): FloorVerdict;
 /** Is there a destructive command anywhere in the line, whatever its
  *  target? A saved allow is never inherited by one (plan §4). */
 export declare function isDestructive(commandLine: string): boolean;
 /** The chain member, at the chain's head: DENY or ABSTAIN. */
-export declare function floorExtension(on: () => boolean, workspaceRoot: () => string, check?: typeof floorCheck): KisoExtension;
+export declare function floorExtension(on: () => boolean, workspaceRoot: () => string, check?: typeof floorCheck, added?: () => readonly string[]): KisoExtension;
 /** Plan §4: "destructive commands never inherit a saved allow in the
  *  asking modes" — the predicate the saved-allow wrap
  *  (protected-writes.ts) is given, keyed on destructiveness, not on the

package/dist/floor.js

@@ -77,9 +77,9 @@ function windowsRoots(home) {
 /** Memoized per (workspace, home): the roots do not move within a session,
  *  and resolving forty of them cost every shell call ~4 ms. */
 const WHERE = new Map();
-function where(root, home) {
+function where(root, home, added = []) {
     const dialect = hostDialect();
-    const key = `${dialect.msys ? "msys" : "posix"}\0${root}\0${home}`;
+    const key = `${dialect.msys ? "msys" : "posix"}\0${root}\0${home}\0${added.join("\0")}`;
     const hit = WHERE.get(key);
     if (hit !== undefined)
         return hit;
@@ -94,6 +94,7 @@ function where(root, home) {
         rootReal,
         homeReal: real(home),
         gitReal: join(rootReal, ".git"),
+        added: added.map(real),
         sys: named(roots.sys),
         mounts: named(roots.mounts),
         temps: [...new Set(roots.temps.map(real))],
@@ -137,6 +138,12 @@ function unrecoverable(w, p, over) {
         return what("the workspace root");
     if (within(p, w.rootReal))
         return what(`a directory above the workspace (${p})`);
+    for (const a of w.added) {
+        if (same(p, a) || within(p, a))
+            return what(`an added folder, or a directory above one (${p})`);
+        if (within(hostDialect().path.join(a, ".git"), p))
+            return what("an added folder's .git");
+    }
     // R7: the workspace's history — without a remote, gone
     if (within(w.gitReal, p))
         return what("the workspace's .git");
@@ -519,8 +526,8 @@ const child = (s) => ({ cwds: [...s.cwds], lastCd: null, prev: s.prev });
  * Would the floor refuse this command line? `workspaceRoot` is where the
  * shell runs it.
  */
-export function floorCheck(commandLine, workspaceRoot, home = homedir()) {
-    const w = where(workspaceRoot, home);
+export function floorCheck(commandLine, workspaceRoot, home = homedir(), added = []) {
+    const w = where(workspaceRoot, home, added);
     const seen = new Set();
     const tilde = (word) => (word.tilde && (word.text === "~" || word.text.startsWith("~/")) ? home + word.text.slice(1) : word.text);
     const walk = (nodes, state, depth) => {
@@ -652,7 +659,7 @@ export function isDestructive(commandLine) {
 }
 const ABSTAIN = { action: "abstain" };
 /** The chain member, at the chain's head: DENY or ABSTAIN. */
-export function floorExtension(on, workspaceRoot, check = floorCheck) {
+export function floorExtension(on, workspaceRoot, check = floorCheck, added = () => []) {
     return {
         name: "floor",
         approvals: [
@@ -669,7 +676,7 @@ export function floorExtension(on, workspaceRoot, check = floorCheck) {
                     // allow. The floor denies what it could not read.
                     let v;
                     try {
-                        v = check(command, workspaceRoot());
+                        v = check(command, workspaceRoot(), undefined, added());
                     }
                     catch (err) {
                         return { action: "deny", reason: `the floor could not read this line (${err instanceof Error ? err.name : "error"}) — kiso does not run it.` };

package/dist/index.js

@@ -33,7 +33,8 @@ import { createRequire } from "node:module";
 import { basename, dirname, join } from "node:path";
 import { Body, Editor, PROMPT, bannerLines, currentGround, currentGroundRgb, parseOscColor, resolveGround, setGround, escapeTerminal, extensionsBannerText, extensionsFact, idColumn, interactivePrompt, palette, renderSessionLine, sessionListFooter, sessionListHeader, sessionListRow, sessionListUnknownLine, slashCommandNames } from "@vincemakes/kiso-tui";
 import { disposeExtensions, SessionStore } from "@vincemakes/kiso-runtime";
-import { listSessionSidecars, migrateSummaries, readProfile, readSessionName, summaryMigrationPending } from "@vincemakes/kiso-runtime/internal";
+import { readEnvironment } from "@vincemakes/kiso-runtime";
+import { listSessionSidecars, migrateSummaries, readProfile, readSessionName, summaryMigrationPending, writeSessionName } from "@vincemakes/kiso-runtime/internal";
 import { skillMenuItems } from "./skill-invoke.js";
 import { canonicalPath, hasSession, locateSession, projectLayoutActive, sessionFolders } from "./projects.js";
 import { reverseMigration } from "./session-migration.js";
@@ -332,8 +333,8 @@ function editorInput(editor) {
         // TUI2-R2 ②: the session picker — the editor owns the keys (the
         // selection walk, the filter, enter/esc), the compositor draws the
         // band, and the id comes back here.
-        pick(cards, onPick, here) {
-            editor.beginPick(cards, onPick, here);
+        pick(cards, onPick, here, kind) {
+            editor.beginPick(cards, onPick, here, kind);
         },
         // W22: the pending-turn queue — the ↑ pop walk (the keys); the
         // chips are the compositor's bindQueue (the dock side).
@@ -341,6 +342,9 @@ function editorInput(editor) {
             editor.bindQueue(state, pop);
         },
         // ADR-0057: the steers a stop handed back return to the buffer.
+        setGhost(text) {
+            editor.setGhost(text);
+        },
         restore(text) {
             editor.restore(text);
         },
@@ -1070,6 +1074,10 @@ async function chatLoop(first, firstId, input, autoCompact) {
             refused = true;
             continue;
         }
+        // ADR-0058 Amendment 19: the folders a web Work added; the tools here honour them too
+        const addedFolders = readEnvironment(activeStoreDir, id).added;
+        if (addedFolders.length > 0)
+            bodyLog(`also working in: ${addedFolders.map(tildeOf).join(", ")}`);
         opened = id;
         if (rebuilt) {
             rebuilt = false;
@@ -1158,6 +1166,30 @@ async function chatLoop(first, firstId, input, autoCompact) {
             sessions: () => agent.sessionIds(),
             route: (sessionId) => routeSession(sessionId),
             ...(process.stdin.isTTY ? { pick: () => pickSession(agent, input) } : {}),
+            // owner 2026-11-03: a session is titled by a summary of its first message, in the background; the person's own
+            // name wins, before or after; off with KISO_AUTO_TITLE=off and with the faux model, and never without a TTY:
+            // a piped chat is a script or a bench leg, where one more request per session is not the person's
+            ...(currentFaux || process.env["KISO_AUTO_TITLE"] === "off" || process.stdin.isTTY !== true
+                ? {}
+                : {
+                    titled: (firstMessage) => {
+                        // the session and its folder as they are NOW: a /resume or a switch before the title lands must not
+                        // send it to another session, nor repaint another session's window title
+                        const [titling, mine, dir] = [session, session.id, activeStoreDir];
+                        if (readSessionName(dir, mine) !== null)
+                            return;
+                        void titling.title(firstMessage, { signal: AbortSignal.timeout(15_000) }).then((title) => {
+                            if (title === "" || readSessionName(dir, mine) !== null)
+                                return;
+                            writeSessionName(dir, mine, title);
+                            // `id` is the loop's: the session open now (a switch moves it on)
+                            if (id !== mine)
+                                return;
+                            setTitleName(title);
+                            paintWindowTitle();
+                        }, () => undefined);
+                    },
+                }),
         };
         const end = await chat(session, currentFaux, input, autoCompact, nav, seed);
         if (end.next === "exit") {

package/dist/policy.d.ts

@@ -10,7 +10,9 @@
 export { CODING_TOOL_RULES, SYSTEM_PROMPT, composeSystemPrompt } from "./coding-prompt.js";
 export { breakerExtension } from "./breaker.js";
 export { floorExtension } from "./floor.js";
+export { fileStopRoots } from "./shell-words.js";
 export { MODE_LABEL, OFFERED_MODES, getMode, modeExtensions, modeSystemPrompt, setMode } from "./mode.js";
 export { protectedShellExtension } from "./protected-shell.js";
 export { guardSavedAllow, neverInheritedCall } from "./protected-writes.js";
 export { readOnlyShellExtension } from "./readonly-shell.js";
+export { cdTargets, isGhPrCreate } from "./shell-facts.js";

package/dist/policy.js

@@ -10,7 +10,9 @@
 export { CODING_TOOL_RULES, SYSTEM_PROMPT, composeSystemPrompt } from "./coding-prompt.js";
 export { breakerExtension } from "./breaker.js";
 export { floorExtension } from "./floor.js";
+export { fileStopRoots } from "./shell-words.js";
 export { MODE_LABEL, OFFERED_MODES, getMode, modeExtensions, modeSystemPrompt, setMode } from "./mode.js";
 export { protectedShellExtension } from "./protected-shell.js";
 export { guardSavedAllow, neverInheritedCall } from "./protected-writes.js";
 export { readOnlyShellExtension } from "./readonly-shell.js";
+export { cdTargets, isGhPrCreate } from "./shell-facts.js";

package/dist/projects.js

@@ -153,7 +153,7 @@ export function locateSession(home, id, except) {
  * repeated move is a no-op.
  */
 export function sessionFiles(id) {
-    return [join("traces", `${id}.jsonl`), `${id}.meta.json`, `${id}.lock`, `${id}.jsonl`];
+    return [join("traces", `${id}.jsonl`), `${id}.meta.json`, `${id}.environment.json`, `${id}.environment.json.lock`, `${id}.lock`, `${id}.jsonl`];
 }
 export function moveSessionFiles(fromDir, toDir, id, files = sessionFiles(id)) {
     let moved = 0;

package/dist/replay.d.ts

@@ -19,7 +19,7 @@
  *     summary (what the model sees next) and the turns it covers, read in
  *     the viewer — then any uncovered earlier turns folded as above.
  */
-import type { TaskInfo } from "@vincemakes/kiso-runtime/internal";
+import { type TaskInfo } from "@vincemakes/kiso-runtime/internal";
 import type { NoticeMark } from "@vincemakes/kiso-tui";
 /** The Body surface the replay drives — the live run's own mutations. */
 export interface ReplayBody {

package/dist/replay.js

@@ -22,6 +22,8 @@
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
 import { bandHeader } from "@vincemakes/kiso-tui-cells/strings";
 import { cappedWaitLine, taskNoticeLines, taskNoticeRows, taskWhat } from "./task-notice.js";
+import { isForkNote } from "@vincemakes/kiso-runtime/internal";
+import { isEnvironmentNote } from "@vincemakes/kiso-runtime";
 /** How many turns stay on screen in full. */
 const FULL_TURNS = 2;
 /** A user turn's opening line, or null when this input does not open one
@@ -32,7 +34,9 @@ function askOf(e) {
     if (e.type !== "user_input" || e.source === "system")
         return null;
     const via = e.via;
-    const text = typeof via?.line === "string" ? via.line : echoText(e.content);
+    // a fork's first input carries the fork note before the person's words: the model's, not the line they typed
+    const content = Array.isArray(e.content) ? e.content.filter((b) => !(b.type === "text" && (isForkNote(b.text ?? "") || isEnvironmentNote(b.text ?? "")))) : e.content;
+    const text = typeof via?.line === "string" ? via.line : echoText(content);
     return text.trim() === "" ? null : text;
 }
 /** Split events into turns: each starts at a user turn's input; anything

package/dist/shell-facts.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The directories a line moves the shell to, in order, when the call that ran it did not fail: the literal `cd <path>` commands of a line
+ * that is one `&&` chain, so every one of them ran (`cd /nonexistent; echo hello` exits 0 without having moved, and so does
+ * `false && cd /x && ls || true`). Relative paths resolve against `base`, then against the previous `cd`; `~` is `home`. An option, a
+ * variable or a word the host's shell cannot spell stops the reading there.
+ */
+export declare function cdTargets(line: string, base: string, home: string): readonly string[];
+/** Whether the line is one `&&` chain that ENDS in `gh pr create`: what its output ends with is the pull request it made (a mention in an echo, a `||` branch, or a command after it that prints another URL, is not one). */
+export declare function isGhPrCreate(line: string): boolean;

package/dist/shell-facts.js

@@ -0,0 +1,46 @@
+/**
+ * Two facts a UI may read from a shell line, conservatively: literal words only, and what the reader cannot read yields nothing.
+ * They are DISPLAY facts (the web page's Recent folders and Repository rows): nothing here grants or refuses anything.
+ */
+import { hostDialect, msysPath, parseShellLooseChecked } from "./shell-words.js";
+const literal = (w) => (w === undefined || w.unknownAt !== -1 || w.variableOnly ? null : w.text);
+/** The commands of a line that is ONE `&&` chain (no `||`, `;`, pipe or group anywhere), or null: only then did every command run when the call did not fail. */
+function chainOf(line) {
+    const { nodes, truncated } = parseShellLooseChecked(line);
+    if (truncated || nodes.some((n, i) => n.kind !== "cmd" || (i > 0 && n.joinedBy !== "&&")))
+        return null;
+    return nodes;
+}
+/**
+ * The directories a line moves the shell to, in order, when the call that ran it did not fail: the literal `cd <path>` commands of a line
+ * that is one `&&` chain, so every one of them ran (`cd /nonexistent; echo hello` exits 0 without having moved, and so does
+ * `false && cd /x && ls || true`). Relative paths resolve against `base`, then against the previous `cd`; `~` is `home`. An option, a
+ * variable or a word the host's shell cannot spell stops the reading there.
+ */
+export function cdTargets(line, base, home) {
+    const chain = chainOf(line);
+    if (chain === null)
+        return [];
+    const out = [];
+    const d = hostDialect(); // the shell's own spelling: Git Bash on Windows (`/c/x`, `C:/x`), POSIX elsewhere
+    let at = base;
+    for (const cmd of chain) {
+        if (literal(cmd.argv[0]) !== "cd")
+            continue;
+        const raw = cmd.argv.length === 2 ? literal(cmd.argv[1]) : null;
+        if (raw === null || raw === "-" || raw.startsWith("-"))
+            break;
+        const word = raw === "~" || raw.startsWith("~/") ? d.path.join(home, raw.slice(2)) : raw;
+        const read = d.msys ? msysPath(word) : { native: word };
+        if ("opaque" in read)
+            break;
+        at = d.path.resolve(at, read.native);
+        out.push(at);
+    }
+    return out;
+}
+/** Whether the line is one `&&` chain that ENDS in `gh pr create`: what its output ends with is the pull request it made (a mention in an echo, a `||` branch, or a command after it that prints another URL, is not one). */
+export function isGhPrCreate(line) {
+    const c = chainOf(line)?.at(-1);
+    return c !== undefined && literal(c.argv[0]) === "gh" && literal(c.argv[1]) === "pr" && literal(c.argv[2]) === "create";
+}

package/dist/shell-words.d.ts

@@ -93,6 +93,8 @@ export declare const HOME_SUBTREES: readonly string[];
 /** The home subtrees for this host: on Windows, AppData too — credentials
  *  and configuration that runs live there (Windows P2). */
 export declare function homeSubtrees(): readonly string[];
+/** Folders the file tools' new reach never enters (ADR-0058 Amendment 19): kiso's own home and the credential homes. */
+export declare function fileStopRoots(home: string, kisoHome: string): readonly string[];
 /** A real path in the case the DISK holds it. The JS realpath keeps the
  *  case it was given, so on a case-insensitive disk `.ENV` stayed `.ENV`
  *  and walked past every name-based predicate (the lead's review, B2). */

package/dist/shell-words.js

@@ -334,6 +334,10 @@ export const HOME_SUBTREES = [".ssh", ".config", ".kiso", ".gnupg", ".aws"];
 export function homeSubtrees() {
     return hostDialect().msys ? [...HOME_SUBTREES, "AppData"] : HOME_SUBTREES;
 }
+/** Folders the file tools' new reach never enters (ADR-0058 Amendment 19): kiso's own home and the credential homes. */
+export function fileStopRoots(home, kisoHome) {
+    return [kisoHome, ...homeSubtrees().map((s) => hostDialect().path.join(home, s))];
+}
 /** A real path in the case the DISK holds it. The JS realpath keeps the
  *  case it was given, so on a case-insensitive disk `.ENV` stayed `.ENV`
  *  and walked past every name-based predicate (the lead's review, B2). */

package/dist/state.d.ts

@@ -10,7 +10,7 @@ import type { TaskDeliveryItem } from "@vincemakes/kiso-core";
 import { kisoHome, type KisoExtension, type StoreRecord } from "@vincemakes/kiso-runtime";
 import type { ReasoningSetting } from "@vincemakes/kiso-runtime/internal";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
-import { type ShellTasks } from "@vincemakes/kiso-tools-node";
+import { type FileAccess, type ShellTasks } from "@vincemakes/kiso-tools-node";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
  *  env vars (KISO_EXTENSIONS_DIR / KISO_MCP_CONFIG / KISO_SKILLS_DIR)
@@ -35,6 +35,8 @@ export declare function codingToolOptions(): {
     readonly excludeRoots: readonly string[];
     readonly secretEnvNames: readonly string[];
     readonly protectedFiles: readonly string[];
+    readonly access: (sessionId: string | undefined) => FileAccess;
+    readonly stopRoots: readonly string[];
     readonly tasks: (sessionId: string | undefined) => ShellTasks | undefined;
     readonly observedRevision: (sessionId: string | undefined, full: string, kind?: "edit" | "write") => string | undefined;
     readonly limits?: {
@@ -241,7 +243,7 @@ export interface LineInput {
      *  picked id, or null when the human leaves without picking.
      *  OPTIONAL: only the raw-mode editor has it, and the picker only
      *  ever opens on a TTY (a pipe has nobody to pick). */
-    pick?(cards: () => readonly SessionCardView[], onPick: (id: string | null) => void, here?: string): void;
+    pick?(cards: () => readonly SessionCardView[], onPick: (id: string | null) => void, here?: string, kind?: "resume" | "fork"): void;
     /** W22: bind the pending-turn queue — the ↑ pop walks the CLI's
      *  live slots (each pop cancels the turn), esc ends the walk after
      *  one more pop. The chips are the compositor's own bindQueue. */
@@ -249,6 +251,9 @@ export interface LineInput {
     /** ADR-0057: put text back into the editor — the steers a stop handed
      *  back before they landed. The pipe path has no editor; optional. */
     restore?(text: string): void;
+    /** The follow-up: a line the person may send next, dim in the empty box, Tab takes it; null clears it. Optional: the
+     *  readline input has no box to draw it in. */
+    setGhost?(text: string | null): void;
     /** R3a: cross-session history — seed the recall buffer, register the
      *  append sink. The pipe path has no recall keys; optional. */
     bindHistory?(seed: readonly string[], persist: (line: string) => void): void;

package/dist/state.js

@@ -12,12 +12,14 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { AT_CAP, AT_SKIP, Dock } from "@vincemakes/kiso-tui";
 import { projectMessages } from "@vincemakes/kiso-core";
-import { kisoHome } from "@vincemakes/kiso-runtime";
+import { kisoHome, readEnvironment } from "@vincemakes/kiso-runtime";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
 import { processTaskBackend, readShowsWholeFile } from "@vincemakes/kiso-tools-node";
 import { collectWriter } from "@vincemakes/kiso-subagent-ext";
 import { canonicalPath, LEGACY_SESSIONS_DIR, projectDirFor, projectLayoutActive } from "./projects.js";
 import { taskNoticeLines, taskWhat } from "./task-notice.js";
+import { getMode } from "./mode.js";
+import { fileStopRoots } from "./shell-words.js";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
  *  env vars (KISO_EXTENSIONS_DIR / KISO_MCP_CONFIG / KISO_SKILLS_DIR)
@@ -49,6 +51,12 @@ let printRun = false;
 export function setPrintRun() {
     printRun = true;
 }
+/** ADR-0058 Amendment 19: the same list the web reads, per call; a delegate child gets none of it. */
+function fileAccess(sessionId) {
+    if ((Number.parseInt(process.env.KISO_SUBAGENT_DEPTH ?? "0", 10) || 0) >= 1)
+        return { added: [], outside: "deny" };
+    return { added: sessionId === undefined || activeStoreDir === "" ? [] : readEnvironment(activeStoreDir, sessionId).added, outside: getMode() === "full-access" ? "allow" : "deny" };
+}
 export function codingToolOptions() {
     // KISO_MIN_FOREGROUND_MS — the test rigs' knob (like KISO_AUTO_DETACH_MS):
     // the least foreground wait (ADR-0058 Amendment 10, default 60 s). The
@@ -66,6 +74,8 @@ export function codingToolOptions() {
         excludeRoots: [kisoHome()],
         secretEnvNames: secretEnvNamesOf(configModels),
         protectedFiles: protectedFiles(),
+        access: fileAccess,
+        stopRoots: fileStopRoots(homedir(), kisoHome()),
         tasks: tasksFor,
         observedRevision: observedRevisionFromLog,
         ...(Object.keys(limits).length > 0 ? { limits } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.52.0",
+	"version": "0.54.0",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -29,19 +29,19 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.52.0",
-		"@vincemakes/kiso-core": "0.52.0",
-		"@vincemakes/kiso-evals": "0.52.0",
-		"@vincemakes/kiso-mcp-ext": "0.52.0",
-		"@vincemakes/kiso-provider-anthropic": "0.52.0",
-		"@vincemakes/kiso-provider-openai": "0.52.0",
-		"@vincemakes/kiso-provider-openai-responses": "0.52.0",
-		"@vincemakes/kiso-runtime": "0.52.0",
-		"@vincemakes/kiso-skills-ext": "0.52.0",
-		"@vincemakes/kiso-subagent-ext": "0.52.0",
-		"@vincemakes/kiso-tools-node": "0.52.0",
-		"@vincemakes/kiso-tui": "0.52.0",
-		"@vincemakes/kiso-tui-cells": "0.52.0"
+		"@vincemakes/kiso-ask-ext": "0.54.0",
+		"@vincemakes/kiso-core": "0.54.0",
+		"@vincemakes/kiso-evals": "0.54.0",
+		"@vincemakes/kiso-mcp-ext": "0.54.0",
+		"@vincemakes/kiso-provider-anthropic": "0.54.0",
+		"@vincemakes/kiso-provider-openai": "0.54.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.54.0",
+		"@vincemakes/kiso-runtime": "0.54.0",
+		"@vincemakes/kiso-skills-ext": "0.54.0",
+		"@vincemakes/kiso-subagent-ext": "0.54.0",
+		"@vincemakes/kiso-tools-node": "0.54.0",
+		"@vincemakes/kiso-tui": "0.54.0",
+		"@vincemakes/kiso-tui-cells": "0.54.0"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",