@vincemakes/kiso-web 0.52.0 → 0.53.0

package/dist/main/agent.js

@@ -27,6 +27,10 @@ class WebAgent extends Agent {
         return session;
     }
 }
+/** The system prompt a Work's agent is built with: the terminal's prompt for the folder (its project instructions included), and the tier's note. */
+export function promptOf(workspace, tier) {
+    return [composeSystemPrompt(workspace, protectedFiles()), modeSystemPrompt(tier)].join("\n\n");
+}
 export function createWebAgent(options) {
     const { store, workspace, model } = options;
     const root = () => workspace;
@@ -40,13 +44,11 @@ export function createWebAgent(options) {
         ...(options.toolLimits !== undefined ? { limits: options.toolLimits } : {}),
     };
     const window = model.kind === "profile" ? model.contextWindow : undefined;
-    const prompt = composeSystemPrompt(workspace, protectedFiles());
-    const modeNote = modeSystemPrompt(options.tier());
     const definition = {
         model: model.kind === "adapter" ? model.model : model.profile.model,
         store,
         workspace,
-        systemPrompt: modeNote === undefined ? prompt : `${prompt}\n\n${modeNote}`,
+        systemPrompt: promptOf(workspace, options.tier()),
         toolRules: CODING_TOOL_RULES,
         tools: [...createCodingTools(toolOptions)],
         // the terminal's chain, in its order: the guards that deny speak first

package/dist/main/artifacts.js

@@ -1,10 +1,16 @@
-import { closeSync, fstatSync, openSync, readSync, statSync } from "node:fs";
-import { extname, isAbsolute, join, relative, resolve } from "node:path";
+import { closeSync, copyFileSync, existsSync, fstatSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, statSync } from "node:fs";
+import { basename, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { resolveInside } from "./files.js";
 /**
  * What a tool call made that the page can show, each "best effort, never a guess": an image block of its result; an artifact
  * file a successful write or edit touched; or, for a command, a path its text or its output head names that is inside the
  * folder, of an artifact type, exists, and changed at or after the step began. No folder scan, no watcher.
+ *
+ * A picture a command made OUTSIDE the folder (a browser tool saving a screenshot under /tmp: owner 2026-11-03, the screenshot
+ * must show in the stream) is kept as a copy in the Work's own `<id>.files/`, under the result's `log:` address: the page only
+ * ever reads the copy, never the outside path. Only a raster picture (no svg: it can carry script), named by the command or its
+ * output, changed during the step, at most KEEP_MAX bytes; it is copied once, so a later file of the same name does not replace
+ * it. This widens the 2026-10-31 rule "a file named outside the folder is not taken" for pictures only.
  */
 const KINDS = {
     ".png": "image", ".jpg": "image", ".jpeg": "image", ".gif": "image", ".webp": "image", ".svg": "image",
@@ -14,23 +20,57 @@ const KINDS = {
 const NAMED = /[\w@+./-]+\.(?:png|jpe?g|gif|webp|svg|html?|md|pdf|csv|mp4|webm|mov|mp3|wav)\b/gi;
 /** a file's clock and the log's may differ by the file system's granularity */
 const SLACK_MS = 50;
+const KEPT = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp" };
+const KEEP_MAX = 10 * 1024 * 1024;
+/** where a kept copy lives: the Work's own folder of files beside its log */
+const keptDir = (dir, workId) => join(dir, `${workId}.files`);
 export const artifactKind = (path) => KINDS[extname(path).toLowerCase()];
-/** `root`: the folder's real path. */
-export function artifactsOf(event, workId, call, root) {
+/** `root`: the folder's real path; `dir`: the sessions directory, where a picture made outside the folder is kept. */
+export function artifactsOf(event, workId, call, root, dir) {
     const out = [];
-    const ref = (n, kind, uri, mediaType) => {
-        out.push({ id: `${event.callId}:${n}`, workId, callId: event.callId, kind, uri, ...(mediaType !== undefined ? { mediaType } : {}) });
+    const ref = (n, kind, uri, mediaType, name) => {
+        out.push({ id: `${event.callId}:${n}`, workId, callId: event.callId, kind, uri, ...(mediaType !== undefined ? { mediaType } : {}), ...(name !== undefined ? { name } : {}) });
     };
-    if (Array.isArray(event.content))
+    if (Array.isArray(event.content)) {
+        const blocks = event.content.filter((b) => b.type === "image").length;
+        let k = 0;
         event.content.forEach((b, n) => {
-            if (b.type === "image" && ((b.sourceType === "base64" && b.data !== undefined) || b.url?.startsWith("https:") === true))
-                ref(n, "image", `log:${event.seq}/${n}`, b.mediaType);
+            if (b.type !== "image" || !((b.sourceType === "base64" && b.data !== undefined) || b.url?.startsWith("https:") === true))
+                return;
+            // an image block has no file name: the tool, the result's number and, of several, its place
+            const ext = (b.mediaType ?? "image/png").split("/")[1]?.replace("jpeg", "jpg") ?? "png";
+            ref(n, "image", `log:${event.seq}/${n}`, b.mediaType, `${call?.name ?? "image"}-${event.seq}${blocks > 1 ? `-${(k += 1)}` : ""}.${ext}`);
         });
+    }
     if (event.isError || call === null)
         return out;
+    let kept = 0;
+    const outside = (full, since) => {
+        const ext = extname(full).toLowerCase();
+        if (KEPT[ext] === undefined || out.some((a) => a.id === `${event.callId}:${full}`))
+            return;
+        const name = `${event.seq}-k${kept}${ext}`;
+        const copy = join(keptDir(dir, workId), name);
+        try {
+            if (!existsSync(copy)) {
+                const stat = statSync(full);
+                if (!stat.isFile() || stat.mtimeMs < since - SLACK_MS || stat.size > KEEP_MAX)
+                    return;
+                mkdirSync(keptDir(dir, workId), { recursive: true });
+                copyFileSync(full, copy);
+            }
+        }
+        catch {
+            return;
+        }
+        ref(full, "image", `log:${event.seq}/k${kept}`, KEPT[ext], basename(full));
+        kept += 1;
+    };
     const file = (raw, since) => {
         const rel = relative(root, isAbsolute(raw) ? raw : resolve(root, raw));
         const kind = artifactKind(rel);
+        if (rel.startsWith("..") && isAbsolute(raw) && since !== null)
+            return outside(raw, since);
         if (kind === undefined || rel.startsWith("..") || out.some((a) => a.uri === `file:${rel}`))
             return;
         try {
@@ -53,7 +93,7 @@ export function artifactsOf(event, workId, call, root) {
     return out;
 }
 /**
- * Image blocks of results, read from the session's log: an index of seq to the byte range of its line, built once per log and
+ * Image blocks of results and of the person's own lines, read from the session's log: an index of seq to the byte range of its line, built once per log and
  * extended as it grows, so a request reads one event, never the whole log.
  */
 export class LogImages {
@@ -62,14 +102,28 @@ export class LogImages {
     constructor(dir) {
         this.#dir = dir;
     }
-    /** The n-th block of the result at `seq`: its bytes, an https address to pass on, or null. */
+    /** The n-th block of the result or the line at `seq`: its bytes, an https address to pass on, or null; `k<n>`: the n-th
+     *  picture of that result kept from outside the folder. */
     block(sessionId, seq, n) {
+        if (typeof n === "string") {
+            const name = (() => {
+                try {
+                    return readdirSync(keptDir(this.#dir, sessionId)).find((f) => f.startsWith(`${seq}-${n}.`));
+                }
+                catch {
+                    return undefined;
+                }
+            })();
+            const type = name === undefined ? undefined : KEPT[extname(name)];
+            return name === undefined || type === undefined ? null : { type, bytes: readFileSync(join(keptDir(this.#dir, sessionId), name)) };
+        }
         const file = join(this.#dir, `${sessionId}.jsonl`);
         const at = this.#index(file).get(seq);
         if (at === undefined)
             return null;
+        // a tool's result, or the person's own line (a picture pasted into the composer)
         const event = JSON.parse(read(file, at[0], at[1]).toString("utf8")).event;
-        const b = event.type === "tool_result" && Array.isArray(event.content) ? event.content[n] : undefined;
+        const b = (event.type === "tool_result" || event.type === "user_input") && Array.isArray(event.content) ? event.content[n] : undefined;
         if (b?.type !== "image")
             return null;
         if (b.sourceType === "base64" && b.data !== undefined)

package/dist/main/context.js

@@ -0,0 +1,20 @@
+import { kisoHome } from "@vincemakes/kiso-runtime";
+import { tiersFor } from "@vincemakes/kiso-runtime/internal";
+import { CODING_TOOL_RULES, composeSystemPrompt, SYSTEM_PROMPT } from "@vincemakes/kiso-code/policy";
+import { createCodingTools } from "@vincemakes/kiso-tools-node";
+import { promptOf, protectedFiles } from "./agent.js";
+/** What the Work's requests always carry, in bytes, for the rail's Context breakdown (an estimate the page labels as one), and where
+ *  compaction starts and must happen for the stated window (the runtime's own tiers; null without a stated window). */
+export function contextParts(workspace, tier, window) {
+    const bytes = (s) => Buffer.byteLength(s, "utf8");
+    const prompt = promptOf(workspace, tier);
+    const instructions = Math.max(0, bytes(composeSystemPrompt(workspace, protectedFiles())) - bytes(SYSTEM_PROMPT));
+    const tools = createCodingTools({ workspaceRoot: workspace, excludeRoots: [kisoHome()], secretEnvNames: [], protectedFiles: protectedFiles() });
+    const tiers = window === null ? null : tiersFor(window, 0);
+    return {
+        system: bytes(prompt) - instructions + CODING_TOOL_RULES.reduce((n, r) => n + bytes(r.line) + 1, 0),
+        instructions,
+        tools: { count: tools.length, bytes: tools.reduce((n, t) => n + bytes(JSON.stringify({ name: t.name, description: t.description, parameters: t.parameters })), 0) },
+        compaction: tiers === null ? null : { starts: tiers.soft, must: tiers.hard },
+    };
+}

package/dist/main/desk-api.js

@@ -1,7 +1,12 @@
 import { realpathSync, statSync } from "node:fs";
 import { basename } from "node:path";
 import { canonicalPath, claimProjectDir, projectDirFor } from "@vincemakes/kiso-code/config";
-import { deskRead } from "./fs-routes.js";
+import { atFiles, deskRead, SAFE_ID } from "./fs-routes.js";
+import { contextParts } from "./context.js";
+import { rename } from "./names.js";
+import { forkWork } from "./fork.js";
+import { WORK_ACTS, workAct } from "./works.js";
+import { commit, gitOf, openPr, prDraft } from "./git.js";
 import { existing, Refusal, resolveInside } from "./files.js";
 import { artifactKind } from "./artifacts.js";
 import { listDirs, validateFolder } from "./folders.js";
@@ -32,6 +37,88 @@ export async function deskApi(ctx, req, url) {
     const space = where === null || where === "" ? ctx.current : ctx.spaceFor(where);
     const post = req.method === "POST";
     try {
+        if (path === "/desk/at-files") {
+            if (space === null)
+                return json(404, {});
+            return req.method === "GET" ? json(200, atFiles(space)) : json(405, {});
+        }
+        if (path === "/desk/context") {
+            if (space === null)
+                return json(404, {});
+            const session = url.searchParams.get("session") ?? undefined;
+            let window = null;
+            try {
+                const m = ctx.settings.model(session === undefined ? undefined : { sessionId: session, sessionsDir: space.dir });
+                window = m.kind === "profile" ? (m.contextWindow ?? null) : null;
+            }
+            catch {
+                // no model: the parts are still known, the compaction sizes are not
+            }
+            return req.method === "GET" ? json(200, contextParts(space.workspace, ctx.settings.tierOf(session), window)) : json(405, {});
+        }
+        if (path === "/desk/git") {
+            if (space === null)
+                return json(404, {});
+            return req.method === "GET" ? json(200, url.searchParams.has("draft") ? await prDraft(space.workspace) : await gitOf(space.workspace)) : json(405, {});
+        }
+        if (path === "/desk/commit" || path === "/desk/pr") {
+            if (!post)
+                return json(405, {});
+            if (space === null)
+                return json(404, {});
+            const body = await readJson(req);
+            if (path === "/desk/commit")
+                return json(200, await commit(space.workspace, str(body["message"]) ?? "", Array.isArray(body["paths"]) ? body["paths"].filter((p) => typeof p === "string") : []));
+            return json(200, await openPr(space.workspace, str(body["title"]) ?? "", str(body["body"]) ?? ""));
+        }
+        if (path === "/desk/rename") {
+            if (!post)
+                return json(405, {});
+            if (space === null)
+                return json(404, {});
+            const body = await readJson(req);
+            const session = str(body["session"]) ?? "";
+            if (!SAFE_ID.test(session) || !space.store.ids().includes(session))
+                return json(404, {});
+            return json(200, { name: rename(space.dir, session, str(body["name"]) ?? "") });
+        }
+        if (path === "/desk/fork") {
+            if (!post)
+                return json(405, {});
+            if (space === null)
+                return json(404, {});
+            const body = await readJson(req);
+            const session = str(body["session"]) ?? "";
+            if (!SAFE_ID.test(session))
+                return json(404, {});
+            const atSeq = typeof body["atSeq"] === "number" ? body["atSeq"] : undefined;
+            return json(200, { id: forkWork(space, ctx.settings, session, atSeq).id });
+        }
+        if (path === "/desk/work") {
+            if (!post)
+                return json(405, {});
+            if (space === null)
+                return json(404, {});
+            const body = await readJson(req);
+            const session = str(body["session"]) ?? "";
+            const act = str(body["act"]) ?? "";
+            if (!SAFE_ID.test(session) || !WORK_ACTS.includes(act))
+                return json(404, {});
+            workAct(space, ctx.settings, session, act);
+            return json(200, { ok: true });
+        }
+        if (path === "/desk/task-stop") {
+            if (!post)
+                return json(405, {});
+            if (space === null)
+                return json(404, {});
+            const body = await readJson(req);
+            const session = str(body["session"]) ?? "";
+            const task = str(body["task"]) ?? "";
+            if (!SAFE_ID.test(session) || !SAFE_ID.test(task) || !space.store.ids().includes(session))
+                return json(404, {});
+            return json(200, { stopped: space.tasks.managerFor(session).stop(task, "person") });
+        }
         if (path === "/desk/fs/tree" || path === "/desk/fs/file" || path === "/desk/task-log") {
             if (space === null)
                 return json(404, {});
@@ -43,11 +130,11 @@ export async function deskApi(ctx, req, url) {
             return post ? json(200, { found: existing(realpathSync(space.workspace), (await readJson(req))["paths"]) }) : json(405, {});
         }
         // an image block of a result, from the Work's log: its bytes, or an https address passed on
-        const image = /^\/desk\/image\/([A-Za-z0-9._-]+)\/(\d+)\/(\d+)$/.exec(path);
+        const image = /^\/desk\/image\/([A-Za-z0-9._-]+)\/(\d+)\/(\d+|k\d+)$/.exec(path);
         if (image !== null) {
             if (space === null || req.method !== "GET" || !space.store.ids().includes(image[1]))
                 return json(404, {});
-            const b = space.images.block(image[1], Number(image[2]), Number(image[3]));
+            const b = space.images.block(image[1], Number(image[2]), image[3].startsWith("k") ? image[3] : Number(image[3]));
             if (b === null)
                 return json(404, {});
             return "url" in b ? { status: 302, body: null, headers: { location: b.url } } : { status: 200, body: b.bytes, headers: { "content-type": b.type, "x-content-type-options": "nosniff", "cache-control": "private, max-age=86400" } };
@@ -66,19 +153,51 @@ export async function deskApi(ctx, req, url) {
             ctx.previews.close(String((await readJson(req))["url"] ?? ""));
             return json(200, { ok: true });
         }
+        // the line the person may send next after the run that ended at `seq` (asked once, after that run; "" for none)
+        if (path === "/desk/followup") {
+            if (space === null)
+                return json(404, {});
+            if (req.method !== "GET")
+                return json(405, {});
+            const session = url.searchParams.get("session") ?? "";
+            const seq = Number(url.searchParams.get("seq"));
+            if (!space.store.ids().includes(session) || !Number.isInteger(seq))
+                return json(404, {});
+            return json(200, { line: await space.followUp(session, seq) });
+        }
         if (path === "/desk/env") {
             if (space === null)
                 return json(404, {});
-            return req.method === "GET" ? json(200, folderInfo(space.workspace, ctx.settings.tierOf(url.searchParams.get("session") ?? undefined))) : json(405, {});
+            if (req.method !== "GET")
+                return json(405, {});
+            const session = url.searchParams.get("session") ?? undefined;
+            const fork = session === undefined ? undefined : ctx.settings.forkOf(session);
+            return json(200, { ...folderInfo(space.workspace, ctx.settings.tierOf(session)), ...(fork === undefined ? {} : { fork: { parent: fork.parent, title: fork.title, at: fork.at } }) });
         }
         if (path === "/desk/history")
             return req.method === "GET" ? json(200, await ctx.history.snapshot({ key: ctx.current.key, dir: ctx.current.dir }, url.searchParams.get("fresh") ?? undefined)) : json(405, {});
         if (path === "/desk/settings") {
-            if (post)
-                ctx.settings.apply((await readJson(req)));
+            let session = url.searchParams.get("session") ?? undefined;
+            if (post) {
+                const patch = (await readJson(req));
+                // a patch for one Work is answered with that Work's settings
+                session ??= patch.session;
+                const before = patch.session === undefined ? undefined : ctx.settings.workOf(patch.session);
+                const work = ctx.settings.apply(patch);
+                // a Work's model changed: rebuild it from its log so its next run uses it; a run in flight refuses, and the choice is put back
+                if (work !== null && space !== null && space.opened().has(work)) {
+                    try {
+                        await space.service.reopen(work);
+                    }
+                    catch {
+                        ctx.settings.restoreWork(work, before);
+                        return json(409, { message: "a run is going: switch the model when it ends" });
+                    }
+                }
+            }
             else if (req.method !== "GET")
                 return json(405, {});
-            return json(200, ctx.settings.snapshot(url.searchParams.get("session") ?? undefined));
+            return json(200, ctx.settings.snapshot(session));
         }
         if (path === "/desk/folder" && post) {
             const workspace = validateFolder((await readJson(req))["path"]);

package/dist/main/env.js

@@ -96,6 +96,8 @@ export async function startFromEnv(options = {}) {
         ...(options.port !== undefined ? { port: options.port } : {}),
         ...(process.env["KISO_WEB_TOKEN"] !== undefined ? { token: process.env["KISO_WEB_TOKEN"] } : {}),
         sanitizer: process.env["KISO_WEB_SANITIZER"] === "default" ? "default" : "web",
+        followUps: process.env["KISO_WEB_FOLLOWUP"] !== "off",
+        titles: process.env["KISO_AUTO_TITLE"] !== "off",
         ...(Number.isFinite(keepalive) && keepalive > 0 ? { keepaliveMs: keepalive } : {}),
         ...(process.env["KISO_WEB_MIN_FG_MS"] !== undefined && Number.isFinite(minFg) ? { toolLimits: { minForegroundMs: minFg } } : {}),
     });

package/dist/main/fork.js

@@ -0,0 +1,25 @@
+import { ForkRefusedError } from "@vincemakes/kiso-runtime";
+import { Refusal } from "./files.js";
+/**
+ * Fork a Work: the runtime's SessionStore.fork (one rule for the terminal, the web app and the products, plan fork rev 2),
+ * after the run that ended at `atSeq` (absent: the last). The runtime copies the log to that run's end, writes the fork's
+ * sidecar (the parent's profile, "… (fork)", its origin) and gives the fork note to the model with the fork's first input,
+ * after the copied history: never in the system prompt, where it cost the fork's first request the whole history's cache
+ * (0% against 88% measured on co). The host still remembers the lineage for the forks it made before.
+ */
+export function forkWork(space, settings, parent, atSeq) {
+    if (!space.store.ids().includes(parent))
+        throw new Refusal(404, "no such Work in this folder");
+    let made;
+    try {
+        made = space.store.fork(parent, atSeq === undefined ? {} : { afterSeq: atSeq });
+    }
+    catch (error) {
+        if (error instanceof ForkRefusedError)
+            throw new Refusal(409, error.message.replace(/session/g, "Work"));
+        throw error;
+    }
+    const fork = { parent, title: made.origin.title, atSeq: made.origin.afterSeq, at: made.origin.at };
+    settings.forked(parent, made.id, fork);
+    return { id: made.id, fork };
+}

package/dist/main/fs-routes.js

@@ -1,12 +1,13 @@
-import { realpathSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { readdirSync, realpathSync } from "node:fs";
 import { listDir, readPreview, readTaskLog, Refusal } from "./files.js";
 /**
- * The read doors of the page: a Work's folder (a tree, a file) and a
- * background task's log. GET only, behind the host's guard; every path is
+ * The read doors of the page: a Work's folder (a tree, a file, the list the
+ * composer's @ picks from) and a background task's log. GET only, behind the host's guard; every path is
  * judged by files.ts, a task id only by the task manager of a session that
  * exists in the Work's folder.
  */
-const SAFE_ID = /^[A-Za-z0-9._-]+$/;
+export const SAFE_ID = /^[A-Za-z0-9._-]+$/;
 export function deskRead(url, space) {
     try {
         const rel = url.searchParams.get("path") ?? "";
@@ -35,3 +36,34 @@ export function deskRead(url, space) {
         return { status: 500, body: { code: "internal", message: "unreadable" } };
     }
 }
+const AT_CAP = 2000;
+const AT_SKIP = new Set([".git", "node_modules", ".kiso", "dist", "build", ".next", ".venv", "__pycache__"]);
+/** The files `@` can name, as the terminal lists them: git's own list (tracked and untracked, ignores honoured), else a bounded walk; `truncated` when the cap cut it. */
+export function atFiles(space) {
+    let files;
+    try {
+        files = execFileSync("git", ["ls-files", "-c", "-o", "--exclude-standard"], { cwd: space.workspace, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 1 << 24, timeout: 3000 }).split("\n").filter((p) => p !== "");
+    }
+    catch {
+        files = [];
+        const walk = (dir, prefix) => {
+            try {
+                for (const e of readdirSync(dir, { withFileTypes: true })) {
+                    if (files.length > AT_CAP)
+                        return;
+                    if (AT_SKIP.has(e.name))
+                        continue;
+                    if (e.isDirectory())
+                        walk(`${dir}/${e.name}`, `${prefix}${e.name}/`);
+                    else if (e.isFile())
+                        files.push(`${prefix}${e.name}`);
+                }
+            }
+            catch {
+                // an unreadable directory adds nothing
+            }
+        };
+        walk(space.workspace, "");
+    }
+    return { files: files.slice(0, AT_CAP), truncated: files.length > AT_CAP };
+}

package/dist/main/git.js

@@ -0,0 +1,117 @@
+import { execFile } from "node:child_process";
+import { Refusal } from "./files.js";
+/**
+ * The rail's Changes from git, and the one write it can make on the person's word: commit the files they ticked, push the branch
+ * and open a pull request with `gh`. Reads are bounded (a timeout each, nothing on a folder outside git); the writes run only
+ * from the dialog's confirm (POST), never by themselves, and refuse what they cannot do in words.
+ */
+const run = (cwd, cmd, args, timeout = 3000) => new Promise((resolve, reject) => execFile(cmd, [...args], { cwd, timeout, maxBuffer: 1 << 23, env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GH_PROMPT_DISABLED: "1" } }, (err, out, errOut) => (err === null ? resolve(out) : reject(new Error((errOut || err.message).trim())))));
+const tryRun = (cwd, cmd, args, timeout) => run(cwd, cmd, args, timeout).then((o) => o.trim(), () => null);
+let ghSignedIn = null;
+/** `gh auth status`, asked once per host process: a sign-in does not come and go between two clicks. */
+const ghReady = (cwd) => (ghSignedIn ??= tryRun(cwd, "gh", ["auth", "status"], 5000).then((o) => o !== null));
+async function baseOf(cwd) {
+    const head = await tryRun(cwd, "git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]);
+    if (head !== null)
+        return head.replace(/^origin\//, "");
+    for (const name of ["main", "master"])
+        if ((await tryRun(cwd, "git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`])) !== null)
+            return name;
+    return null;
+}
+/** The changed paths and their two-letter codes (`git status -z`: NUL-separated, so a path with a space or a quote is read whole; a rename gives its new path). */
+async function statusOf(cwd) {
+    const out = (await run(cwd, "git", ["status", "--porcelain=v1", "-z", "--untracked-files=all"]).catch(() => "")).split("\0");
+    const map = new Map();
+    for (let i = 0; i < out.length; i++) {
+        const e = out[i];
+        if (e.length < 4)
+            continue;
+        map.set(e.slice(3), e.slice(0, 2));
+        if (e[0] === "R" || e[0] === "C")
+            i += 1; // the old path follows a rename or a copy
+    }
+    return map;
+}
+/** The base as a ref to compare with: origin's copy when there is one (what the PR is judged against), else the local branch. */
+const baseRef = async (cwd, base) => ((await tryRun(cwd, "git", ["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${base}`])) !== null ? `origin/${base}` : base);
+export async function gitOf(cwd) {
+    const none = { repo: false, branch: null, base: null, ahead: 0, files: [], dirty: false, canPr: false, pr: null };
+    if ((await tryRun(cwd, "git", ["rev-parse", "--is-inside-work-tree"])) !== "true")
+        return none;
+    const branch = await tryRun(cwd, "git", ["symbolic-ref", "--short", "HEAD"]);
+    const base = await baseOf(cwd);
+    const ref = base === null ? null : await baseRef(cwd, base);
+    const fork = ref === null ? null : await tryRun(cwd, "git", ["merge-base", ref, "HEAD"]);
+    const ahead = ref === null ? 0 : Number((await tryRun(cwd, "git", ["rev-list", "--count", `${ref}..HEAD`])) ?? 0);
+    const dirty = await statusOf(cwd);
+    const numstat = fork === null ? "" : await run(cwd, "git", ["diff", "--numstat", "-z", "--no-renames", fork]).catch(() => "");
+    const files = new Map();
+    for (const entry of numstat.split("\0").filter((l) => l !== "")) {
+        const [a, r, path] = entry.split("\t");
+        files.set(path, { path, added: a === "-" ? null : Number(a), removed: r === "-" ? null : Number(r), state: "modified", dirty: dirty.has(path) });
+    }
+    for (const [path, code] of dirty) {
+        const state = code.includes("?") || code.includes("A") ? "new" : code.includes("D") ? "deleted" : "modified";
+        files.set(path, { ...(files.get(path) ?? { path, added: null, removed: null }), state, dirty: true });
+    }
+    const remote = await tryRun(cwd, "git", ["remote", "get-url", "origin"]);
+    const canPr = branch !== null && base !== null && branch !== base && remote !== null && (await ghReady(cwd));
+    let pr = null;
+    if (canPr) {
+        const json = await tryRun(cwd, "gh", ["pr", "view", "--json", "number,title,url,state,statusCheckRollup"], 6000);
+        if (json !== null) {
+            const p = JSON.parse(json);
+            const checks = p.statusCheckRollup ?? [];
+            pr = { number: p.number, title: p.title, url: p.url, state: p.state, checks: { total: checks.length, done: checks.filter((c) => c.status === "COMPLETED").length, failed: checks.filter((c) => c.conclusion === "FAILURE").length } };
+        }
+    }
+    return { repo: true, branch, base, ahead, files: [...files.values()], dirty: dirty.size > 0, canPr, pr };
+}
+/** Commit the files the person ticked, with their message: those paths only (never `git add -A`), so nothing they did not see is committed. */
+export async function commit(cwd, message, paths) {
+    if (message.trim() === "")
+        throw new Refusal(400, "a commit needs a message");
+    if (paths.length === 0)
+        throw new Refusal(400, "no file was chosen");
+    const listed = await statusOf(cwd);
+    const strange = paths.filter((p) => !listed.has(p));
+    if (strange.length > 0)
+        throw new Refusal(400, `not a changed file of this folder: ${strange.join(", ")}`);
+    await run(cwd, "git", ["add", "--", ...paths]);
+    await run(cwd, "git", ["commit", "-m", message, "--", ...paths]).catch((e) => {
+        throw new Refusal(409, `git refused the commit: ${e.message}`);
+    });
+    return { sha: (await run(cwd, "git", ["rev-parse", "--short", "HEAD"])).trim() };
+}
+/** Push the branch and open its pull request into the base; refused with the reason when the folder cannot. */
+export async function openPr(cwd, title, body) {
+    const g = await gitOf(cwd);
+    if (!g.canPr || g.branch === null || g.base === null)
+        throw new Refusal(409, "a pull request needs a branch other than the base, a remote named origin, and gh signed in");
+    if (g.dirty)
+        throw new Refusal(409, "commit the changes first: a pull request carries commits, not the working tree");
+    if (g.ahead === 0)
+        throw new Refusal(409, `${g.branch} has no commit that ${g.base} does not have`);
+    if (title.trim() === "")
+        throw new Refusal(400, "a pull request needs a title");
+    await run(cwd, "git", ["push", "-u", "origin", "HEAD"], 60_000).catch((e) => {
+        throw new Refusal(409, `git push failed: ${e.message}`);
+    });
+    const out = await run(cwd, "gh", ["pr", "create", "--base", g.base, "--head", g.branch, "--title", title, "--body", body], 60_000).catch((e) => {
+        throw new Refusal(409, `gh pr create failed: ${e.message}`);
+    });
+    const url = out.trim().split("\n").pop() ?? "";
+    return { number: Number(/\/pull\/(\d+)/.exec(url)?.[1] ?? 0), url };
+}
+/** The dialog's starting draft from the branch's own commits: one commit gives its subject; several, the branch's name and a list. */
+export async function prDraft(cwd) {
+    const g = await gitOf(cwd);
+    if (g.base === null)
+        return { title: "", body: "" };
+    const ref = await baseRef(cwd, g.base);
+    const subjects = ((await tryRun(cwd, "git", ["log", "--format=%s", `${ref}..HEAD`])) ?? "").split("\n").filter((s) => s !== "").reverse();
+    if (subjects.length === 1)
+        return { title: subjects[0], body: "" };
+    return { title: (g.branch ?? "").replace(/^[^/]*\//, "").replace(/[-_]/g, " "), body: subjects.map((s) => `- ${s}`).join("\n") };
+}

package/dist/main/history.js

@@ -13,16 +13,33 @@ import { sessionFolders } from "@vincemakes/kiso-code/config";
  */
 const MIN_AGE_MS = 3_000;
 const MAX_ROWS = 400;
-/** The folder's files as one string: it changes when a log is added or written. */
+/** What the host knows about a Work it holds open: a run live, or waiting for an answer. */
+/** A delegated child's parent (the longest id of its folder that `sub-<id>-` starts with: a parent id may have any shape) and its
+ *  role (what follows the task's number; a role starts with a letter, a hex delegation id may be all digits); nothing for any
+ *  other session. */
+export function delegated(id, ids) {
+    if (!id.startsWith("sub-"))
+        return {};
+    const parent = ids.filter((p) => p !== id && id.startsWith(`sub-${p}-`)).sort((a, b) => b.length - a.length)[0];
+    const role = /-\d+-(\D.*)$/.exec(id.slice(4 + (parent?.length ?? 0)))?.[1];
+    return { ...(parent === undefined ? {} : { parent }), ...(role === undefined ? {} : { role }) };
+}
+/** The folder's files as one string: it changes when a log is added or written, or a Work's name file (`<id>.meta.json`, the
+ *  runtime's titles read it) is written by a rename. */
 function printOf(dir) {
     let count = 0;
     let bytes = 0;
     let newest = 0;
     for (const name of readdirSync(dir)) {
-        if (!name.endsWith(".jsonl"))
+        const meta = name.endsWith(".meta.json");
+        if (!name.endsWith(".jsonl") && !meta)
             continue;
         try {
             const s = statSync(join(dir, name));
+            if (meta) {
+                newest = Math.max(newest, s.mtimeMs);
+                continue;
+            }
             if (s.size === 0)
                 continue;
             count += 1;
@@ -38,13 +55,15 @@ function printOf(dir) {
 export class History {
     #home;
     #live;
+    #marksOf;
     #reads = new Map();
     #queue = [];
     #worker = null;
     #inflight = null;
-    constructor(home, live) {
+    constructor(home, live, marksOf = () => ({})) {
         this.#home = home;
         this.#live = live;
+        this.#marksOf = marksOf;
     }
     /** `fresh` names a folder whose listing is read again now, whatever its age. */
     async snapshot(current, fresh) {
@@ -67,8 +86,13 @@ export class History {
             if (read === undefined)
                 continue;
             const key = basename(folder.dir);
+            const ids = read.metas.map((m) => m.id);
             for (const meta of read.metas) {
                 rows.push({
+                    // a fork's parent: the store's own record (any app made it), else the host's (forks it made before)
+                    ...(meta.forkedFrom !== undefined ? { parent: meta.forkedFrom } : {}),
+                    ...this.#marksOf(meta.id),
+                    ...delegated(meta.id, ids),
                     id: meta.id,
                     key,
                     folder: basename(folder.workspace),
@@ -103,18 +127,21 @@ export class History {
         this.#inflight = dir;
         const print = printOf(dir);
         const worker = (this.#worker ??= new Worker(new URL("./history-worker.js", import.meta.url)));
+        // both listeners go when either answers: one read, one pair (the worker lives across reads, so a kept listener piles up)
         const done = (message) => {
             worker.off("message", done);
+            worker.off("error", failed);
             // an unreadable folder is remembered empty: it is tried again when its files change
             this.#reads.set(dir, { print, metas: message.metas ?? [], at: Date.now() });
             this.#inflight = null;
             this.#pump();
         };
-        worker.on("message", done);
-        worker.once("error", (error) => {
+        const failed = (error) => {
             this.#worker = null;
             done({ dir, error: error.message });
-        });
+        };
+        worker.on("message", done);
+        worker.on("error", failed);
         worker.postMessage({ dir });
     }
     close() {