The Editor has the chat of Code - OSS: the Chat view, inline chat in an editor and terminal chat. Neural Inverse does not ship the Copilot extension. Instead, chat answers with the models you connect on the Models page, through a built-in participant called Neural Inverse, and agent sessions run in the agent host.
You need at least one connected model. Until you have one, the Editor offers to connect a provider ("Neural Inverse uses your own models").
Chat and inline chat
The built-in Neural Inverse participant answers with the default Chat model you chose on the Models page. It uses the conversation and the files and selections you attach. An attached file larger than 256 KiB is cut so one file cannot fill the model's context.
Inline chat edits the selected region of a file: the model returns only the replacement code, and you review the change in place.
Agent sessions in the Editor
New chats in the Editor start as agent sessions (the setting chat.editor.localAgent.enabled is off by default, because the Code - OSS local agent needs the Copilot extension). An agent session runs on your connected models with workspace tools:
| Tool | What it does |
|---|---|
| Read File | Reads a file in the workspace (large files in parts, 2000 lines by default) |
| List Directory | Lists a folder in the workspace |
| Find Files | Finds files by name |
| Search Text | Searches file contents |
| Edit File | Edits or creates a file in the workspace |
Every tool works only inside the open workspace folders. A request stops after 40 rounds of tool calls, so a confused model cannot loop forever.
Review and keep edits
Edits an agent makes go through chat's editing session. Each change is shown as a diff for you to review: choose Keep or Undo per change. Keeping an agent's changes is itself an action your organisation's policy decides, so it can need approval. See Approvals and signatures.
Agent engines
Sessions run in the agent host, a separate process the Editor starts. It can run several engines:
| Engine | Setting | Default | Notes |
|---|---|---|---|
| Claude (Claude Agent SDK) | chat.agentHost.claudeAgent.enabled | on | Changing it needs the agent host to restart. |
| Codex | chat.agentHost.codexAgent.enabled | off | Runs only on a ChatGPT or OpenAI Codex account, never on connected models. Sign in to ChatGPT under Subscriptions on the Models page before you turn it on. |
| Connected models | chat.agentHost.byokModels.enabled | on | Makes the models you connect available to new agent sessions. |
On macOS, one agent host serves both the Editor and the Agents app and keeps running when you quit either. On Windows and Linux each app has its own host unless NI_SHARED_AGENT_HOST=1 is set in the environment.
To hand a task to the Agents app instead, run Open Agents Window (Ctrl+Shift+A, or Cmd+Shift+A on macOS). It opens the Agents app with the current folder. With a screen reader active the shortcut is Ctrl+Shift+Alt+A (Cmd+Shift+Alt+A). On Linux, Ctrl+Shift+A in a writable editor stays Toggle Block Comment.
How each agent action is decided
Before an agent acts, the governance decision point decides the action: the tool, each shell command after full parsing, each file read or written, each host contacted, each MCP server and the model. There are three answers:
- Allowed: it happens.
- Needs approval: you are asked, with the rule and the reason. In a session nobody attends, this is a refusal.
- Denied: it does not happen; the reason and the rule are shown.
Commands are classified after shell parsing, never by their first word: chaining, pipes, subshells, wrappers such as env, sudo or timeout, sh -c, PowerShell and absolute paths do not hide a command. What cannot be analysed (eval, a program name from a variable, encoded PowerShell) needs a person.
Even with no organisation policy, an agent can never change policy files, approval records, git hooks, CI and task files, shell profiles, or the audit and governance folders without a person. Writes outside the workspace need a person too.
For Claude, organisation rules become Claude permission rules, bypass mode is turned off and denied MCP servers are removed; a hook decides each tool call before it runs. For Codex, rules set its approval policy, sandbox mode and network access. A rule an engine version cannot enforce is reported as unsupported, never dropped; a mandatory rule an engine cannot enforce blocks that engine for the session. An engine version that governance does not know is treated as enforcing nothing.
Under an organisation policy, the auto-approval settings (chat.tools.global.autoApprove, chat.tools.edits.autoApprove, chat.tools.urls.autoApprove, chat.tools.terminal.enableAutoApprove, chat.tools.terminal.autoApprove) are governed: they take their value only from managed policy. On a personal install they stay yours. See Organisation policy.
What goes into a prompt
Besides your message and attachments, a chat request in the Editor can carry:
- Organisation context retrieved from your organisation's spaces, as data with numbered citations. See Organisation context.
- Agent instruction files (CLAUDE.md, AGENTS.md and the like) as your organisation layers them, and your repository's own
AGENTS.mdwhen the organisation's set has no repository layer. - The live compliance state of a governed repository from Checks: the signed packs in force, the requirements you declared and their blast radius, and the open obligations. Agents can read their obligations with the
complianceStatustool and declare a requirement withdeclareRequirement. See Checks.
Agent terminals
Terminals the agent host starts for agents do not inherit your credentials: environment variables whose names or values look like credentials (for example *_TOKEN, *_SECRET, AWS_* except region and profile) are withheld, and tool results are redacted before they reach a model. Your own integrated terminals are unchanged. See Secrets and agent terminals.
What is recorded
Every agent session, prompt and tool call, and every governance decision, is recorded in the device's activity record, for every engine, through the engines' own hooks. Prompts and responses are stored as digests unless your organisation sets the capture level to full. See Activity Log and audit upload.