--- title: "Chat and agent sessions" --- # Chat and agent sessions How chat, inline chat and agent sessions work in the Editor, which agent engines run them, how edits are reviewed, and how organisation policy decides each agent action. The Editor has the chat of Code - OSS: the Chat view, inline chat in an editor and terminal chat. Neural Inverse does not ship the Copilot extension. Instead, chat answers with the models you connect on the [Models](https://neuralinverse.com/docs/editor/models/) page, through a built-in participant called Neural Inverse, and agent sessions run in the agent host. You need at least one connected model. Until you have one, the Editor offers to connect a provider ("Neural Inverse uses your own models"). ## Chat and inline chat The built-in **Neural Inverse** participant answers with the default **Chat** model you chose on the Models page. It uses the conversation and the files and selections you attach. An attached file larger than 256 KiB is cut so one file cannot fill the model's context. Inline chat edits the selected region of a file: the model returns only the replacement code, and you review the change in place. ## Agent sessions in the Editor New chats in the Editor start as agent sessions (the setting `chat.editor.localAgent.enabled` is off by default, because the Code - OSS local agent needs the Copilot extension). An agent session runs on your connected models with workspace tools: | Tool | What it does | |---|---| | Read File | Reads a file in the workspace (large files in parts, 2000 lines by default) | | List Directory | Lists a folder in the workspace | | Find Files | Finds files by name | | Search Text | Searches file contents | | Edit File | Edits or creates a file in the workspace | Every tool works only inside the open workspace folders. A request stops after 40 rounds of tool calls, so a confused model cannot loop forever. ### Review and keep edits Edits an agent makes go through chat's editing session. Each change is shown as a diff for you to review: choose **Keep** or **Undo** per change. Keeping an agent's changes is itself an action your organisation's policy decides, so it can need approval. See [Approvals and signatures](https://neuralinverse.com/docs/editor/approvals/). ## Agent engines Sessions run in the agent host, a separate process the Editor starts. It can run several engines: | Engine | Setting | Default | Notes | |---|---|---|---| | Claude (Claude Agent SDK) | `chat.agentHost.claudeAgent.enabled` | on | Changing it needs the agent host to restart. | | Codex | `chat.agentHost.codexAgent.enabled` | off | Runs only on a ChatGPT or OpenAI Codex account, never on connected models. Sign in to ChatGPT under **Subscriptions** on the Models page before you turn it on. | | Connected models | `chat.agentHost.byokModels.enabled` | on | Makes the models you connect available to new agent sessions. | On macOS, one agent host serves both the Editor and the Agents app and keeps running when you quit either. On Windows and Linux each app has its own host unless `NI_SHARED_AGENT_HOST=1` is set in the environment. To hand a task to the Agents app instead, run **Open Agents Window** (Ctrl+Shift+A, or Cmd+Shift+A on macOS). It opens the Agents app with the current folder. With a screen reader active the shortcut is Ctrl+Shift+Alt+A (Cmd+Shift+Alt+A). On Linux, Ctrl+Shift+A in a writable editor stays Toggle Block Comment. ## How each agent action is decided Before an agent acts, the governance decision point decides the action: the tool, each shell command after full parsing, each file read or written, each host contacted, each MCP server and the model. There are three answers: - **Allowed**: it happens. - **Needs approval**: you are asked, with the rule and the reason. In a session nobody attends, this is a refusal. - **Denied**: it does not happen; the reason and the rule are shown. Commands are classified after shell parsing, never by their first word: chaining, pipes, subshells, wrappers such as `env`, `sudo` or `timeout`, `sh -c`, PowerShell and absolute paths do not hide a command. What cannot be analysed (`eval`, a program name from a variable, encoded PowerShell) needs a person. Even with no organisation policy, an agent can never change policy files, approval records, git hooks, CI and task files, shell profiles, or the audit and governance folders without a person. Writes outside the workspace need a person too. For Claude, organisation rules become Claude permission rules, bypass mode is turned off and denied MCP servers are removed; a hook decides each tool call before it runs. For Codex, rules set its approval policy, sandbox mode and network access. A rule an engine version cannot enforce is reported as unsupported, never dropped; a mandatory rule an engine cannot enforce blocks that engine for the session. An engine version that governance does not know is treated as enforcing nothing. Under an organisation policy, the auto-approval settings (`chat.tools.global.autoApprove`, `chat.tools.edits.autoApprove`, `chat.tools.urls.autoApprove`, `chat.tools.terminal.enableAutoApprove`, `chat.tools.terminal.autoApprove`) are governed: they take their value only from managed policy. On a personal install they stay yours. See [Organisation policy](https://neuralinverse.com/docs/editor/organisation-policy/). ## What goes into a prompt Besides your message and attachments, a chat request in the Editor can carry: - **Organisation context** retrieved from your organisation's spaces, as data with numbered citations. See [Organisation context](https://neuralinverse.com/docs/editor/context/). - **Agent instruction files** (CLAUDE.md, AGENTS.md and the like) as your organisation layers them, and your repository's own `AGENTS.md` when the organisation's set has no repository layer. - **The live compliance state** of a governed repository from Checks: the signed packs in force, the requirements you declared and their blast radius, and the open obligations. Agents can read their obligations with the `complianceStatus` tool and declare a requirement with `declareRequirement`. See [Checks](https://neuralinverse.com/docs/editor/checks/). ## Agent terminals Terminals the agent host starts for agents do not inherit your credentials: environment variables whose names or values look like credentials (for example `*_TOKEN`, `*_SECRET`, `AWS_*` except region and profile) are withheld, and tool results are redacted before they reach a model. Your own integrated terminals are unchanged. See [Secrets and agent terminals](https://neuralinverse.com/docs/editor/secrets/). ## What is recorded Every agent session, prompt and tool call, and every governance decision, is recorded in the device's activity record, for every engine, through the engines' own hooks. Prompts and responses are stored as digests unless your organisation sets the capture level to `full`. See [Activity Log and audit upload](https://neuralinverse.com/docs/editor/activity-log/).