🔦 Lumen

AI coding assistant for VSCode — smart chat, plan mode, autopilot, MCP support, and live diffs.

Lumen embeds a full-featured AI coding agent into VSCode. Works out of the box with felgof (get an API key at felgof.ru) or any OpenAI-compatible endpoint.

UI available in English and Russian.

✨ Features

• 🎚 Three work modes — Assistant / Plan / Autopilot — one click to switch.
• 🛡 Multi-layer permission gate — configurable glob-based auto-approve; hardcoded protection for .env, .git/, *.pem, *.key and destructive operations.
• 🔌 Model Context Protocol (MCP) — plug in your own MCP servers; tools are auto-discovered.
• 📋 Project rules — .md files with frontmatter, filtered by applyTo glob per active file.
• 🌐 Web search — Jina + DuckDuckGo; agents can hit the internet when needed.
• 💬 Streaming chat — live thinking, real-time todos with a progress bar, expandable agent timelines.
• ✍️ Live file-write preview — watch the model stream code directly into the target file with per-hunk Accept / Revert.
• 📌 Sticky todo panel — multi-step plans stay pinned above the message list so you never lose track.
• 🧠 Prompt caching — compatible providers are billed at cache-read rates (~10% of input), cutting cost on long sessions.
• 🗜 Automatic context compaction — when the window fills up, the session is summarized and trimmed automatically (or on demand via /compact).
• 💰 Detailed usage breakdown — the cost indicator shows input / output / cache-read / cache-write tokens separately, straight from provider usage frames.
• ⏮ Checkpoints — snapshot the workspace before bulk changes and roll back with one click.
• 📎 Attachments — files, images, code selection; Ctrl+Shift+L sends the current selection to chat.
• 🔄 Network resilience — up to 30 retries with backoff, online-event wake-up, connection-lost banner.
• 🔐 Security — API key in VSCode SecretStorage, outbound secret redactor, SSRF guard, obfuscated production bundle.

🚀 Quick Start

1. Get an API key at felgof.ru.
2. Install the extension from the VS Code Marketplace.
3. Set your API key — two ways:
   • Command Palette: Ctrl+Shift+P → Lumen: Set API Key → paste.
   • Or open Settings → Provider → API Key and paste there.
4. Click the Lumen icon in the Activity Bar (left sidebar).
5. Ask a question — the agent will answer.

The key is stored in the system SecretStorage (Keychain on macOS, Credential Manager on Windows, libsecret on Linux) and is never written to disk in plaintext.

⚙️ Settings

All settings live under Lumen: Settings (or the gear icon in the chat header).

🎯 Work Modes

Assistant (default)

Safe, interactive mode. Before every:

• shell command,
• file write / edit,
• MCP tool call,

Lumen asks for your confirmation. Auto-approve rules are configured via a glob map (**/*.ts: allow, **/secret.ts: deny). Sensitive paths (.env, .git/, *.pem, *.key) always require explicit consent — even if your auto-approve map says **.

Plan

Mode for larger tasks. Lumen drafts a detailed plan in .lumen/plans/<date>-<slug>.md, shows it in a VSCode preview tab, and waits for your approval.

• Approved → automatically switches to Assistant and starts executing the plan.
• Not approved → edit the plan directly in the file or the chat.

Autopilot

Fully autonomous mode. Lumen executes the entire plan without step-by-step confirmation. Ideal for long tasks, migrations, and bulk refactors.

Destructive operations are blocked even in Autopilot:

• rm -rf /, rm -rf ~,
• git push --force to protected branches,
• deletion of .git/, .env, system directories,
• arbitrary execution of suspicious shell pipelines.

For those, the agent must return control to the user.

🔌 Custom Provider

Lumen supports any OpenAI-compatible API. In Provider settings pick Custom and fill in:

• Base URL — endpoint (https://.../v1 or equivalent),
• Model — model ID provided by the service,
• API Key — authorization (stored in SecretStorage),
• Models URL (optional) — if the provider exposes its model list at a separate URL.

Example configurations

💰 Cost & Context

The indicator in the chat header shows:

• Context fill — how much of the model's window is used (turns warning at 60%, danger at 85%).
• Usage breakdown — input, output, cache-read and cache-write tokens separately, taken directly from the provider's usage frames.
• One-click compaction — when context gets tight, run /compact or press the indicator to summarize the session and free up space. Lumen can also compact automatically when you cross the threshold.

Prompt caching is supported transparently for compatible providers: repeated prompt prefixes are billed at cache-read rates (~10% of input cost), which noticeably lowers the bill on long conversations.

🔐 Security & Privacy

• API keys live in VSCode SecretStorage — never in settings.json, never in the shipped VSIX.
• Redactor scans outgoing prompts for token shapes (sk-…, ghp_…, AKIA…) and substitutes [REDACTED] — even if you accidentally paste a key into chat.
• SSRF guard blocks agent requests to private IP ranges (10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, …) and cloud metadata endpoints.
• Destructive-op guard blocks dangerous shell patterns (rm -rf /, fork bombs, force-push to protected branches) in every mode, including Autopilot.
• Obfuscated production bundle — the extension JavaScript is processed by javascript-obfuscator before publishing.
• Consent-based telemetry — no code, prompts, or responses are sent to third-party servers without your explicit consent.

⌨️ Commands & Hotkeys

Full list: Palette → Ctrl+Shift+P → type Lumen:.

📚 Resources

• Website & API keys: felgof.ru
• Model Context Protocol spec: modelcontextprotocol.io

🗣️ Community

Questions, bug reports, feature requests, and discussions happen on our Telegram channel:

📢 t.me/felgof

Release announcements, usage guides, and examples live there as well.

📝 License

Proprietary. Copyright © 2026 Felgof. All rights reserved.

🇷🇺 Для русскоязычных

Интерфейс расширения полностью переведён — переключите язык в Settings → Behavior → Language на «Русский». Сообщество и поддержка — в Telegram: t.me/felgof.