VS Code extension
Context · workspace trust · approvals · commands · mutations · redaction · recovery
Visible trust boundaries
AI reasoning. Local authority.
WebCodingAgent separates the eligible AI connection supplying model responses from the VS Code extension that can access and change your repository. No component receives more power than its job requires.
Three components, hard boundaries
Authority stays close to the thing it protects.
The wcagent service coordinates tasks. Desktop VS Code owns repository access and execution. For eligible web-account integrations, the browser connector transports prompts and responses without exporting provider cookies or credentials.
wcagent service
Plans · workflows · risk policy · task state · audit events · coordination
Browser connector
Eligible provider exchange · provider session stays in profile · no repository access
Local execution
Requests do not become actions by themselves.
The extension independently validates every tool request before anything reaches the repository. Ask-for-approval mode pauses each command and mutation in the conversation; full access remains bounded to the active task and local policy.
Workspace confinement
Lexical and real paths must remain inside the repository, including protection against symlink escapes.
Conflict-safe writes
Existing-file edits require the SHA-256 returned by an earlier read and apply atomically.
Visible approvals
Commands and mutations can stop for explicit approval without losing the rest of the task.
Secret boundaries
Credential-shaped values are redacted before supported tool output reaches the cloud.
Cancellation
Long-running commands stay observable and can be cancelled from the same task UI.
Independent policy
Execution-environment limits are enforced again in VS Code, not trusted from a cloud label.
Browser authentication
Provider credentials stay in your browser.
For an eligible web-account integration, the connector uses a provider account already authenticated in your browser. Normal wcagent protocols return model text and bounded runtime metadata—not passwords, cookies, authentication headers, or full browser-session payloads.
Outbound pairing
The browser connector requests work over its paired channel; the wcagent service does not open an inbound path to your machine.
No repository access
The connector can manage validated worker tabs for the selected AI provider but cannot read or mutate workspace files.
Explicit provider choice
You choose the eligible connection that supplies the task’s model responses, and connector activity remains visible and reversible.
No silent fallback
Signed-out, provider-limited, or uncertain sessions pause with a typed error instead of switching accounts or reporting success.
Provider controls
wcagent cannot override a provider.
wcagent does not increase, reset, conceal, or bypass usage limits. It does not defeat authentication, CAPTCHAs, safety systems, geographic restrictions, or other technical access controls.
Authorization depends on the provider
Use only a provider, account type, and connection method whose applicable terms permit its use with wcagent.
Model access is not included
wcagent does not sell or resell access to an AI model. You supply and maintain your AI account separately.
Limits pause the connection
If a provider refuses or limits a request, wcagent reports that result and cannot make the provider accept it.
Your provider agreement still applies
Provider availability, charges, usage limits, account settings, policies, and terms remain in force.
Evidence and governance
Know what the system knew—and what it did.
Policy decisions, approvals, local tool results, model routes, and completion evidence remain attached to the task. Hash-linked audit records make later review possible without pretending that an audit log replaces secure execution.
01
Requested and observed models stay separateThe interface does not claim a specific model unless the connector can observe it.
02
Completion holds are explicitMissing tests, failed builds, and unresolved specialist findings prevent a clean finish.
03
Recovery avoids accidental replayStable IDs and durable journals distinguish completed actions from work still safe to resume.