@vincemakes/kiso-code 0.53.0 → 0.54.0

package/dist/chat.js

@@ -1444,7 +1444,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
                 // empty box only while no other turn has started or waits; off with the faux model and KISO_FOLLOWUP=off
                 if (last?.type === "terminal" && last.outcome.kind === "completed" && !faux && input.setGhost !== undefined && process.env["KISO_FOLLOWUP"] !== "off" && queued === 0) {
                     void session.followUp({ maxTokens: 200, signal: AbortSignal.timeout(15_000) }).then((line) => {
-                        if (turnNo === myTurn && currentRun === null && queued === 0)
+                        if (turnNo === myTurn && currentRun === null && queued === 0 && !leaving)
                             input.setGhost?.(line === "" ? null : line);
                     }, () => undefined);
                 }
@@ -1902,11 +1902,13 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         requestSwitch: (id) => {
             switchTo = id;
             leaving = true;
+            input.setGhost?.(null); // REL-0530-F1: the follow-up belongs to the session being left
             resolveEnd();
         },
         requestReload: () => {
             reloadReq = true;
             leaving = true;
+            input.setGhost?.(null);
             resolveEnd();
         },
         sessions: () => nav?.sessions() ?? [],

package/dist/create-coding-agent.js

@@ -34,7 +34,7 @@ import { adapterOptionsFor } from "./auth/adapter-options.js";
 import { createFauxProvider } from "@vincemakes/kiso-evals";
 import { sweepStaleMergeDirs } from "./temp-sweep.js";
 import { CODING_TOOL_RULES, composeSystemPrompt } from "./coding-prompt.js";
-import { createAgent, loadExtensions, loadProjectExtensions, SessionStore } from "@vincemakes/kiso-runtime";
+import { createAgent, loadExtensions, loadProjectExtensions, readEnvironment, SessionStore } from "@vincemakes/kiso-runtime";
 import { preferences, startingEffort } from "./preferences.js";
 /** LT-1: the stream watchdog's bound from the environment — a non-negative
  *  number of milliseconds (0 disables it); anything else is ignored. The
@@ -269,7 +269,7 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     setUserProtectedPaths(userConfig?.protectedPaths);
     const extensions = [
         protectedShellExtension({ files: protectedFiles, workspaceRoot, env: () => ({ home: homedir(), kisoHome: kisoHome() }) }),
-        floorExtension(() => floorOn, workspaceRoot),
+        floorExtension(() => floorOn, workspaceRoot, undefined, () => (sessionId === undefined ? [] : readEnvironment(activeStoreDir, sessionId).added)),
         breakerExtension(),
         ...modeExtensions(workspaceRoot),
         readOnlyShellExtension(codingToolOptions),

package/dist/dispatch.d.ts

@@ -74,6 +74,8 @@ export declare function parseBang(trimmed: string): {
 export declare function markCompactWhy(why: string): void;
 export declare function markAutoCompact(): void;
 export declare function dispatch(line: string, ctx: DispatchCtx): void;
-/** /fork's rows: each finished run's reply, newest first, by its first line and when it ended; the opened row says the
- *  line it answered. The card's id is the seq of the run's terminal, where SessionStore.fork cuts. */
+/** /fork's rows: each finished run, newest first, by the person's message it answered and when it ended; the opened
+ *  row shows the reply's first line under it (owner 2026-11-04: the person knows a turn by what they asked, and an
+ *  "answered:" label over their own line read backwards). The card's id is the seq of the run's terminal, where
+ *  SessionStore.fork cuts. */
 export declare function replyCards(records: readonly StoreRecord[]): SessionCardView[];

package/dist/dispatch.js

@@ -6,6 +6,7 @@
 import { STATUS_GLYPHS, contextRows, contextSheetRows, contextUnavailableRows, contextUnavailableSheetRows, displayVerb, escapeTerminal, helpRows, toolTarget, infoSheetRows, kUnit, modePickView, modelPickView, namedPickView, settingsPickView, compactingStatus, liveRow, palette, renderEvent, settledLabel, slashCommandNames } from "@vincemakes/kiso-tui";
 import { newSessionId } from "./session-id.js";
 import { buildAdapter, isForkNote, lookupModelMetadata, readSessionName, resolveContinuationScope, resolveReasoning, sessionTitle, tiersFor, writeSessionName } from "@vincemakes/kiso-runtime/internal";
+import { isEnvironmentNote } from "@vincemakes/kiso-runtime";
 import { ForkRefusedError, SessionStore } from "@vincemakes/kiso-runtime";
 import { MODE_LABEL, MODE_NOTE, OFFERED_MODES, applyModeSetting, getDontAsk, getMode, modeDisplay, parseMode, setDontAsk } from "./mode.js";
 import { clipboardWrite, lastAnswer } from "./clipboard.js";
@@ -1628,15 +1629,17 @@ async function tasksCommand(arg, ctx) {
     else if (action === 1)
         stop(task);
 }
-/** /fork's rows: each finished run's reply, newest first, by its first line and when it ended; the opened row says the
- *  line it answered. The card's id is the seq of the run's terminal, where SessionStore.fork cuts. */
+/** /fork's rows: each finished run, newest first, by the person's message it answered and when it ended; the opened
+ *  row shows the reply's first line under it (owner 2026-11-04: the person knows a turn by what they asked, and an
+ *  "answered:" label over their own line read backwards). The card's id is the seq of the run's terminal, where
+ *  SessionStore.fork cuts. */
 export function replyCards(records) {
     const cards = [];
     let asked = "";
     let reply = "";
     for (const { event: e, ts } of records) {
         if (e.type === "user_input" && e.source !== "system") {
-            const content = Array.isArray(e.content) ? e.content.filter((b) => !(b.type === "text" && isForkNote(b.text ?? ""))) : e.content;
+            const content = Array.isArray(e.content) ? e.content.filter((b) => !(b.type === "text" && (isForkNote(b.text ?? "") || isEnvironmentNote(b.text ?? "")))) : e.content;
             asked = (typeof content === "string" ? content : content.map((b) => (b.type === "text" ? (b.text ?? "") : "")).join(" ")).trim();
             reply = "";
         }
@@ -1645,9 +1648,10 @@ export function replyCards(records) {
         else if (e.type === "text_delta")
             reply += e.text;
         else if (e.type === "terminal" && e.outcome.kind === "completed") {
-            // the row is how the person recognizes the reply: its first line, inline code read as plain text
+            // the row is the person's own line; the reply's first line, inline code read as plain text, opens under it
             const first = (reply.split("\n").map((l) => l.trim()).find((l) => l !== "") ?? "(no reply text)").replace(/`([^`]*)`/g, "$1");
-            cards.unshift({ id: String(e.seq), title: first, badge: "completed", turns: null, updatedAt: ts, uncertain: 0, asks: 0, outcome: null, detail: `answered: ${asked.split("\n")[0] ?? ""}` });
+            const line = asked.split("\n").map((l) => l.trim()).find((l) => l !== "") ?? "(no message text)";
+            cards.unshift({ id: String(e.seq), title: line, badge: "completed", turns: null, updatedAt: ts, uncertain: 0, asks: 0, outcome: null, detail: `└ ${first}` });
         }
     }
     return cards;

package/dist/empty-sessions.js

@@ -65,6 +65,8 @@ export function findEmptySessions(dirs, alive = pidAlive) {
             const files = [name];
             if (names.includes(lock))
                 files.push(lock);
+            if (names.includes(`${id}.environment.json`))
+                files.push(`${id}.environment.json`);
             if (existsSync(join(dir, "traces", `${id}.jsonl`)))
                 files.push(join("traces", `${id}.jsonl`));
             empty.push({ dir, id, files });

package/dist/floor.d.ts

@@ -88,12 +88,12 @@ export declare function gitInvocation(args: readonly LooseWord[]): GitInvocation
  * Would the floor refuse this command line? `workspaceRoot` is where the
  * shell runs it.
  */
-export declare function floorCheck(commandLine: string, workspaceRoot: string, home?: string): FloorVerdict;
+export declare function floorCheck(commandLine: string, workspaceRoot: string, home?: string, added?: readonly string[]): FloorVerdict;
 /** Is there a destructive command anywhere in the line, whatever its
  *  target? A saved allow is never inherited by one (plan §4). */
 export declare function isDestructive(commandLine: string): boolean;
 /** The chain member, at the chain's head: DENY or ABSTAIN. */
-export declare function floorExtension(on: () => boolean, workspaceRoot: () => string, check?: typeof floorCheck): KisoExtension;
+export declare function floorExtension(on: () => boolean, workspaceRoot: () => string, check?: typeof floorCheck, added?: () => readonly string[]): KisoExtension;
 /** Plan §4: "destructive commands never inherit a saved allow in the
  *  asking modes" — the predicate the saved-allow wrap
  *  (protected-writes.ts) is given, keyed on destructiveness, not on the

package/dist/floor.js

@@ -77,9 +77,9 @@ function windowsRoots(home) {
 /** Memoized per (workspace, home): the roots do not move within a session,
  *  and resolving forty of them cost every shell call ~4 ms. */
 const WHERE = new Map();
-function where(root, home) {
+function where(root, home, added = []) {
     const dialect = hostDialect();
-    const key = `${dialect.msys ? "msys" : "posix"}\0${root}\0${home}`;
+    const key = `${dialect.msys ? "msys" : "posix"}\0${root}\0${home}\0${added.join("\0")}`;
     const hit = WHERE.get(key);
     if (hit !== undefined)
         return hit;
@@ -94,6 +94,7 @@ function where(root, home) {
         rootReal,
         homeReal: real(home),
         gitReal: join(rootReal, ".git"),
+        added: added.map(real),
         sys: named(roots.sys),
         mounts: named(roots.mounts),
         temps: [...new Set(roots.temps.map(real))],
@@ -137,6 +138,12 @@ function unrecoverable(w, p, over) {
         return what("the workspace root");
     if (within(p, w.rootReal))
         return what(`a directory above the workspace (${p})`);
+    for (const a of w.added) {
+        if (same(p, a) || within(p, a))
+            return what(`an added folder, or a directory above one (${p})`);
+        if (within(hostDialect().path.join(a, ".git"), p))
+            return what("an added folder's .git");
+    }
     // R7: the workspace's history — without a remote, gone
     if (within(w.gitReal, p))
         return what("the workspace's .git");
@@ -519,8 +526,8 @@ const child = (s) => ({ cwds: [...s.cwds], lastCd: null, prev: s.prev });
  * Would the floor refuse this command line? `workspaceRoot` is where the
  * shell runs it.
  */
-export function floorCheck(commandLine, workspaceRoot, home = homedir()) {
-    const w = where(workspaceRoot, home);
+export function floorCheck(commandLine, workspaceRoot, home = homedir(), added = []) {
+    const w = where(workspaceRoot, home, added);
     const seen = new Set();
     const tilde = (word) => (word.tilde && (word.text === "~" || word.text.startsWith("~/")) ? home + word.text.slice(1) : word.text);
     const walk = (nodes, state, depth) => {
@@ -652,7 +659,7 @@ export function isDestructive(commandLine) {
 }
 const ABSTAIN = { action: "abstain" };
 /** The chain member, at the chain's head: DENY or ABSTAIN. */
-export function floorExtension(on, workspaceRoot, check = floorCheck) {
+export function floorExtension(on, workspaceRoot, check = floorCheck, added = () => []) {
     return {
         name: "floor",
         approvals: [
@@ -669,7 +676,7 @@ export function floorExtension(on, workspaceRoot, check = floorCheck) {
                     // allow. The floor denies what it could not read.
                     let v;
                     try {
-                        v = check(command, workspaceRoot());
+                        v = check(command, workspaceRoot(), undefined, added());
                     }
                     catch (err) {
                         return { action: "deny", reason: `the floor could not read this line (${err instanceof Error ? err.name : "error"}) — kiso does not run it.` };

package/dist/index.js

@@ -33,6 +33,7 @@ import { createRequire } from "node:module";
 import { basename, dirname, join } from "node:path";
 import { Body, Editor, PROMPT, bannerLines, currentGround, currentGroundRgb, parseOscColor, resolveGround, setGround, escapeTerminal, extensionsBannerText, extensionsFact, idColumn, interactivePrompt, palette, renderSessionLine, sessionListFooter, sessionListHeader, sessionListRow, sessionListUnknownLine, slashCommandNames } from "@vincemakes/kiso-tui";
 import { disposeExtensions, SessionStore } from "@vincemakes/kiso-runtime";
+import { readEnvironment } from "@vincemakes/kiso-runtime";
 import { listSessionSidecars, migrateSummaries, readProfile, readSessionName, summaryMigrationPending, writeSessionName } from "@vincemakes/kiso-runtime/internal";
 import { skillMenuItems } from "./skill-invoke.js";
 import { canonicalPath, hasSession, locateSession, projectLayoutActive, sessionFolders } from "./projects.js";
@@ -1073,6 +1074,10 @@ async function chatLoop(first, firstId, input, autoCompact) {
             refused = true;
             continue;
         }
+        // ADR-0058 Amendment 19: the folders a web Work added; the tools here honour them too
+        const addedFolders = readEnvironment(activeStoreDir, id).added;
+        if (addedFolders.length > 0)
+            bodyLog(`also working in: ${addedFolders.map(tildeOf).join(", ")}`);
         opened = id;
         if (rebuilt) {
             rebuilt = false;

package/dist/policy.d.ts

@@ -10,7 +10,9 @@
 export { CODING_TOOL_RULES, SYSTEM_PROMPT, composeSystemPrompt } from "./coding-prompt.js";
 export { breakerExtension } from "./breaker.js";
 export { floorExtension } from "./floor.js";
+export { fileStopRoots } from "./shell-words.js";
 export { MODE_LABEL, OFFERED_MODES, getMode, modeExtensions, modeSystemPrompt, setMode } from "./mode.js";
 export { protectedShellExtension } from "./protected-shell.js";
 export { guardSavedAllow, neverInheritedCall } from "./protected-writes.js";
 export { readOnlyShellExtension } from "./readonly-shell.js";
+export { cdTargets, isGhPrCreate } from "./shell-facts.js";

package/dist/policy.js

@@ -10,7 +10,9 @@
 export { CODING_TOOL_RULES, SYSTEM_PROMPT, composeSystemPrompt } from "./coding-prompt.js";
 export { breakerExtension } from "./breaker.js";
 export { floorExtension } from "./floor.js";
+export { fileStopRoots } from "./shell-words.js";
 export { MODE_LABEL, OFFERED_MODES, getMode, modeExtensions, modeSystemPrompt, setMode } from "./mode.js";
 export { protectedShellExtension } from "./protected-shell.js";
 export { guardSavedAllow, neverInheritedCall } from "./protected-writes.js";
 export { readOnlyShellExtension } from "./readonly-shell.js";
+export { cdTargets, isGhPrCreate } from "./shell-facts.js";

package/dist/projects.js

@@ -153,7 +153,7 @@ export function locateSession(home, id, except) {
  * repeated move is a no-op.
  */
 export function sessionFiles(id) {
-    return [join("traces", `${id}.jsonl`), `${id}.meta.json`, `${id}.lock`, `${id}.jsonl`];
+    return [join("traces", `${id}.jsonl`), `${id}.meta.json`, `${id}.environment.json`, `${id}.environment.json.lock`, `${id}.lock`, `${id}.jsonl`];
 }
 export function moveSessionFiles(fromDir, toDir, id, files = sessionFiles(id)) {
     let moved = 0;

package/dist/replay.js

@@ -23,6 +23,7 @@ import { echoText } from "@vincemakes/kiso-tui-cells/render";
 import { bandHeader } from "@vincemakes/kiso-tui-cells/strings";
 import { cappedWaitLine, taskNoticeLines, taskNoticeRows, taskWhat } from "./task-notice.js";
 import { isForkNote } from "@vincemakes/kiso-runtime/internal";
+import { isEnvironmentNote } from "@vincemakes/kiso-runtime";
 /** How many turns stay on screen in full. */
 const FULL_TURNS = 2;
 /** A user turn's opening line, or null when this input does not open one
@@ -34,7 +35,7 @@ function askOf(e) {
         return null;
     const via = e.via;
     // a fork's first input carries the fork note before the person's words: the model's, not the line they typed
-    const content = Array.isArray(e.content) ? e.content.filter((b) => !(b.type === "text" && isForkNote(b.text ?? ""))) : e.content;
+    const content = Array.isArray(e.content) ? e.content.filter((b) => !(b.type === "text" && (isForkNote(b.text ?? "") || isEnvironmentNote(b.text ?? "")))) : e.content;
     const text = typeof via?.line === "string" ? via.line : echoText(content);
     return text.trim() === "" ? null : text;
 }

package/dist/shell-facts.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The directories a line moves the shell to, in order, when the call that ran it did not fail: the literal `cd <path>` commands of a line
+ * that is one `&&` chain, so every one of them ran (`cd /nonexistent; echo hello` exits 0 without having moved, and so does
+ * `false && cd /x && ls || true`). Relative paths resolve against `base`, then against the previous `cd`; `~` is `home`. An option, a
+ * variable or a word the host's shell cannot spell stops the reading there.
+ */
+export declare function cdTargets(line: string, base: string, home: string): readonly string[];
+/** Whether the line is one `&&` chain that ENDS in `gh pr create`: what its output ends with is the pull request it made (a mention in an echo, a `||` branch, or a command after it that prints another URL, is not one). */
+export declare function isGhPrCreate(line: string): boolean;

package/dist/shell-facts.js

@@ -0,0 +1,46 @@
+/**
+ * Two facts a UI may read from a shell line, conservatively: literal words only, and what the reader cannot read yields nothing.
+ * They are DISPLAY facts (the web page's Recent folders and Repository rows): nothing here grants or refuses anything.
+ */
+import { hostDialect, msysPath, parseShellLooseChecked } from "./shell-words.js";
+const literal = (w) => (w === undefined || w.unknownAt !== -1 || w.variableOnly ? null : w.text);
+/** The commands of a line that is ONE `&&` chain (no `||`, `;`, pipe or group anywhere), or null: only then did every command run when the call did not fail. */
+function chainOf(line) {
+    const { nodes, truncated } = parseShellLooseChecked(line);
+    if (truncated || nodes.some((n, i) => n.kind !== "cmd" || (i > 0 && n.joinedBy !== "&&")))
+        return null;
+    return nodes;
+}
+/**
+ * The directories a line moves the shell to, in order, when the call that ran it did not fail: the literal `cd <path>` commands of a line
+ * that is one `&&` chain, so every one of them ran (`cd /nonexistent; echo hello` exits 0 without having moved, and so does
+ * `false && cd /x && ls || true`). Relative paths resolve against `base`, then against the previous `cd`; `~` is `home`. An option, a
+ * variable or a word the host's shell cannot spell stops the reading there.
+ */
+export function cdTargets(line, base, home) {
+    const chain = chainOf(line);
+    if (chain === null)
+        return [];
+    const out = [];
+    const d = hostDialect(); // the shell's own spelling: Git Bash on Windows (`/c/x`, `C:/x`), POSIX elsewhere
+    let at = base;
+    for (const cmd of chain) {
+        if (literal(cmd.argv[0]) !== "cd")
+            continue;
+        const raw = cmd.argv.length === 2 ? literal(cmd.argv[1]) : null;
+        if (raw === null || raw === "-" || raw.startsWith("-"))
+            break;
+        const word = raw === "~" || raw.startsWith("~/") ? d.path.join(home, raw.slice(2)) : raw;
+        const read = d.msys ? msysPath(word) : { native: word };
+        if ("opaque" in read)
+            break;
+        at = d.path.resolve(at, read.native);
+        out.push(at);
+    }
+    return out;
+}
+/** Whether the line is one `&&` chain that ENDS in `gh pr create`: what its output ends with is the pull request it made (a mention in an echo, a `||` branch, or a command after it that prints another URL, is not one). */
+export function isGhPrCreate(line) {
+    const c = chainOf(line)?.at(-1);
+    return c !== undefined && literal(c.argv[0]) === "gh" && literal(c.argv[1]) === "pr" && literal(c.argv[2]) === "create";
+}

package/dist/shell-words.d.ts

@@ -93,6 +93,8 @@ export declare const HOME_SUBTREES: readonly string[];
 /** The home subtrees for this host: on Windows, AppData too — credentials
  *  and configuration that runs live there (Windows P2). */
 export declare function homeSubtrees(): readonly string[];
+/** Folders the file tools' new reach never enters (ADR-0058 Amendment 19): kiso's own home and the credential homes. */
+export declare function fileStopRoots(home: string, kisoHome: string): readonly string[];
 /** A real path in the case the DISK holds it. The JS realpath keeps the
  *  case it was given, so on a case-insensitive disk `.ENV` stayed `.ENV`
  *  and walked past every name-based predicate (the lead's review, B2). */

package/dist/shell-words.js

@@ -334,6 +334,10 @@ export const HOME_SUBTREES = [".ssh", ".config", ".kiso", ".gnupg", ".aws"];
 export function homeSubtrees() {
     return hostDialect().msys ? [...HOME_SUBTREES, "AppData"] : HOME_SUBTREES;
 }
+/** Folders the file tools' new reach never enters (ADR-0058 Amendment 19): kiso's own home and the credential homes. */
+export function fileStopRoots(home, kisoHome) {
+    return [kisoHome, ...homeSubtrees().map((s) => hostDialect().path.join(home, s))];
+}
 /** A real path in the case the DISK holds it. The JS realpath keeps the
  *  case it was given, so on a case-insensitive disk `.ENV` stayed `.ENV`
  *  and walked past every name-based predicate (the lead's review, B2). */

package/dist/state.d.ts

@@ -10,7 +10,7 @@ import type { TaskDeliveryItem } from "@vincemakes/kiso-core";
 import { kisoHome, type KisoExtension, type StoreRecord } from "@vincemakes/kiso-runtime";
 import type { ReasoningSetting } from "@vincemakes/kiso-runtime/internal";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
-import { type ShellTasks } from "@vincemakes/kiso-tools-node";
+import { type FileAccess, type ShellTasks } from "@vincemakes/kiso-tools-node";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
  *  env vars (KISO_EXTENSIONS_DIR / KISO_MCP_CONFIG / KISO_SKILLS_DIR)
@@ -35,6 +35,8 @@ export declare function codingToolOptions(): {
     readonly excludeRoots: readonly string[];
     readonly secretEnvNames: readonly string[];
     readonly protectedFiles: readonly string[];
+    readonly access: (sessionId: string | undefined) => FileAccess;
+    readonly stopRoots: readonly string[];
     readonly tasks: (sessionId: string | undefined) => ShellTasks | undefined;
     readonly observedRevision: (sessionId: string | undefined, full: string, kind?: "edit" | "write") => string | undefined;
     readonly limits?: {

package/dist/state.js

@@ -12,12 +12,14 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { AT_CAP, AT_SKIP, Dock } from "@vincemakes/kiso-tui";
 import { projectMessages } from "@vincemakes/kiso-core";
-import { kisoHome } from "@vincemakes/kiso-runtime";
+import { kisoHome, readEnvironment } from "@vincemakes/kiso-runtime";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
 import { processTaskBackend, readShowsWholeFile } from "@vincemakes/kiso-tools-node";
 import { collectWriter } from "@vincemakes/kiso-subagent-ext";
 import { canonicalPath, LEGACY_SESSIONS_DIR, projectDirFor, projectLayoutActive } from "./projects.js";
 import { taskNoticeLines, taskWhat } from "./task-notice.js";
+import { getMode } from "./mode.js";
+import { fileStopRoots } from "./shell-words.js";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
  *  env vars (KISO_EXTENSIONS_DIR / KISO_MCP_CONFIG / KISO_SKILLS_DIR)
@@ -49,6 +51,12 @@ let printRun = false;
 export function setPrintRun() {
     printRun = true;
 }
+/** ADR-0058 Amendment 19: the same list the web reads, per call; a delegate child gets none of it. */
+function fileAccess(sessionId) {
+    if ((Number.parseInt(process.env.KISO_SUBAGENT_DEPTH ?? "0", 10) || 0) >= 1)
+        return { added: [], outside: "deny" };
+    return { added: sessionId === undefined || activeStoreDir === "" ? [] : readEnvironment(activeStoreDir, sessionId).added, outside: getMode() === "full-access" ? "allow" : "deny" };
+}
 export function codingToolOptions() {
     // KISO_MIN_FOREGROUND_MS — the test rigs' knob (like KISO_AUTO_DETACH_MS):
     // the least foreground wait (ADR-0058 Amendment 10, default 60 s). The
@@ -66,6 +74,8 @@ export function codingToolOptions() {
         excludeRoots: [kisoHome()],
         secretEnvNames: secretEnvNamesOf(configModels),
         protectedFiles: protectedFiles(),
+        access: fileAccess,
+        stopRoots: fileStopRoots(homedir(), kisoHome()),
         tasks: tasksFor,
         observedRevision: observedRevisionFromLog,
         ...(Object.keys(limits).length > 0 ? { limits } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.53.0",
+	"version": "0.54.0",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -29,19 +29,19 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.53.0",
-		"@vincemakes/kiso-core": "0.53.0",
-		"@vincemakes/kiso-evals": "0.53.0",
-		"@vincemakes/kiso-mcp-ext": "0.53.0",
-		"@vincemakes/kiso-provider-anthropic": "0.53.0",
-		"@vincemakes/kiso-provider-openai": "0.53.0",
-		"@vincemakes/kiso-provider-openai-responses": "0.53.0",
-		"@vincemakes/kiso-runtime": "0.53.0",
-		"@vincemakes/kiso-skills-ext": "0.53.0",
-		"@vincemakes/kiso-subagent-ext": "0.53.0",
-		"@vincemakes/kiso-tools-node": "0.53.0",
-		"@vincemakes/kiso-tui": "0.53.0",
-		"@vincemakes/kiso-tui-cells": "0.53.0"
+		"@vincemakes/kiso-ask-ext": "0.54.0",
+		"@vincemakes/kiso-core": "0.54.0",
+		"@vincemakes/kiso-evals": "0.54.0",
+		"@vincemakes/kiso-mcp-ext": "0.54.0",
+		"@vincemakes/kiso-provider-anthropic": "0.54.0",
+		"@vincemakes/kiso-provider-openai": "0.54.0",
+		"@vincemakes/kiso-provider-openai-responses": "0.54.0",
+		"@vincemakes/kiso-runtime": "0.54.0",
+		"@vincemakes/kiso-skills-ext": "0.54.0",
+		"@vincemakes/kiso-subagent-ext": "0.54.0",
+		"@vincemakes/kiso-tools-node": "0.54.0",
+		"@vincemakes/kiso-tui": "0.54.0",
+		"@vincemakes/kiso-tui-cells": "0.54.0"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",