CoAssist-Code

CoAssist-Code is a VS Code desktop extension for BYOK AI-assisted source review. It sends selected source context directly to an OpenAI-compatible provider, displays structured findings, and lets you review proposed replacements in native diff editors before applying them. There is no CoAssist backend or telemetry.

Install and configure

Use VS Code 1.140 or later. To build a local VSIX, use Node.js 22 or later:

npm install
npm run package

In VS Code, choose Extensions: Install from VSIX and select the generated coassist-code-0.1.0.vsix. Alternatively, open this repository and press F5 to launch the Extension Development Host.

Open the CoAssist-Code Activity Bar view. Select Configure provider or open Settings and select Configure, then enter the provider's base URL, model name and temperature. For example, https://api.example.com/v1 becomes https://api.example.com/v1/chat/completions. Select Set API key to enter a key using a VS Code password input, then use Settings > Test connection. These values are examples; obtain a real endpoint, model and key from your provider.

The key is stored using VS Code SecretStorage, subject to the security of your local VS Code environment. It is not stored in ordinary settings or sent to the webview. Provider settings may be configured in VS Code Settings; do not put credentials in the endpoint URL, query string, or custom headers. Use HTTPS for remote providers. Provider retention and training policies are governed by the provider, not CoAssist-Code.

The endpoint may include query parameters or end in /chat/completions. For a nonstandard complete URL, enable coAssist.provider.fullEndpoint. An optional api-version query parameter can be set using coAssist.provider.apiVersion. Custom headers, request properties, response content path, maximum output tokens and timeout are optional settings. Reserved authorization and transport headers cannot be overridden. Built-in model, messages, temperature, stream and max_tokens take precedence over extra request properties; max_tokens is omitted when its setting is zero. Streaming is enabled by default; disable Stream provider reasoning under Settings if your provider does not support it or you use a custom response content path. A standard non-streaming JSON response is also accepted. Redirects are rejected to prevent forwarding credentials to another endpoint. Compatibility depends on the provider's actual API and supported parameters.

Review workflow

Choose a scope and select Analyze:

• Current File sends only the active file.
• Current File with Open Editors includes the active file and eligible open text tabs.
• All Open Editors includes eligible open text tabs and does not scan the workspace.
• Current File & Current Workspace keeps the active file first and adds bounded, eligible workspace files, prioritizing relative JavaScript/TypeScript imports, the same directory and selected configuration files.

Current-file and open-editor requests send the selected source to the configured provider without a confirmation for every request. Workspace requests ask once before sharing relevant source files; approval is remembered across restarts for that workspace and provider. Use Settings > Reset workspace approvals to revoke remembered approvals. A different workspace or provider requires separate approval. The sidebar displays the files in the current request and records included and omitted files with the result. Unsaved editor contents are used.

The sidebar shows one current analysis. Re-analyze clears the previous result, including unapproved suggestions, and starts a fresh review. Each proposed change has visible Open diff, Approve and Reject actions. Approve all validates the pending changes and asks for confirmation. Approved changes are applied using VS Code workspace edits and saved. If a target already has unsaved edits, you must confirm before the extension applies the change and saves the entire document, including those edits. If saving fails, the extension reports which files remain unsaved; the applied change remains available to undo. Independent findings remain pending when another change is approved, and edits outside a suggestion's tracked range are preserved. A suggestion becomes stale if its target is edited or can no longer be tracked safely. Overlapping changes cannot be applied together.

Settings > Undo last change reverses the most recent CoAssist transaction in the current session. Undo changes the editor buffer; save the document to persist the reversal. If the file has changed, a single replacement is reversed only when its surrounding context is unique; otherwise undo stops with a conflict. Grouped changes require their files to remain exactly as applied. This cannot guarantee recovery after arbitrary external edits. VS Code's normal editor undo is also available.

Expand Review prompt to edit the preloaded review instructions, then select Save prompt. The sidebar updates an existing workspace-level prompt if present, otherwise the user-level prompt. Reset to default restores the default at that scope. The extension adds its required safety and structured-response instructions to your prompt. While a request runs, the sidebar shows its status and displays reasoning only when the provider supplies it; reasoning is not fabricated and may be truncated for display.

Automatic mode

Manual mode is the default. Enabling Automatic under sidebar Settings requires confirmation that selected source context will be sent to the configured provider; setting coAssist.actionMode directly to automatic also opts in. Edits reset an inactivity timer (10 seconds by default), and the sidebar counts down until the next analysis. A request runs only if the triggering file is still active. Automatic re-analysis pauses while the current review has pending or stale changes, so it does not discard them; resolve them or explicitly select Re-analyze. Switching files or disabling automatic mode cancels a queued run. Use Cancel to cancel a request. Automatic mode never approves or applies changes. The sidebar displays the selected request context while it is running.

Settings

Search for coAssist in VS Code Settings. Main settings include:

Sidebar changes are written to user settings; workspace settings may override them. The extension supports HTTP for local providers, but HTTP does not protect credentials or source in transit.

Privacy and limitations

Source is sent only to the configured endpoint when you run a request or explicitly enable automatic mode. Common generated directories, .env files, private-key extensions, credential files, and lockfiles are excluded by default; configure additional exclusions appropriate to your project. Exclusion patterns support *, ** and ?; they are not a complete gitignore implementation. Workspace discovery checks Git ignore rules using git check-ignore when available; if that check fails, manual requests require a separate remembered approval and automatic workspace analysis stops. VS Code exclusion rules are not all enforced. Inspect the displayed file list and configure exclusions for sensitive files. Symlinks resolving outside a workspace are excluded from workspace context and edits. Workspace approval is stored as a hash of the workspace and provider endpoint, not source content or API keys.

Only existing-file, uniquely identifiable text replacements are supported; file creation, deletion, arbitrary commands and automatic modification are not supported. Suggestions are tracked through editor changes during the session; if the extension cannot safely reconstruct a target after an untracked change or a long gap, it marks the suggestion stale rather than guessing. Workspace ranking uses simple relative-import and location heuristics, not a full import graph or inferred standards database. Context uses a character budget rather than model-specific tokenization; an oversized active file is rejected rather than truncated. Changes outside an open workspace cannot be applied. Source snapshots and the current analysis are kept in memory for the session and are not persisted across restarts.

Troubleshooting

• Missing configuration: set endpoint, model and key, then test the connection.
• HTTP 400 or incompatible streaming data: check provider settings and try disabling Stream provider reasoning. HTTP 401/403: check credentials and model access. HTTP 404: check endpoint and model. HTTP 413: reduce the context budget. HTTP 429 or 5xx: wait and retry.
• Invalid analysis JSON: use a model that reliably follows the JSON contract or retry; malformed findings are not applied.
• Stale or ambiguous patch: re-analyze and review the new diff.
• Open Output: CoAssist-Code for diagnostics. Prompts, source contents, headers, API keys and provider responses are not intentionally logged.

Development

npm install
npm run compile
npm run lint
npm run test:unit
npm run test:integration
npm run package

Integration tests run in an isolated VS Code extension host against a small fixture workspace and a local mock provider. The test runner normally downloads VS Code; set VSCODE_TEST_EXECUTABLE to an existing VS Code executable to use that installation instead. A live provider is not needed for the automated tests.