chatforge (VS Code extension)

The on-machine agent. Receives signed task envelopes from the relay over an outbound authenticated websocket, executes them in your workspace, pauses on screen lock, and opens GitHub PRs.

What lives here

File	Purpose
`src/extension.ts`	Activation: config, secrets, wiring (connection ↔ runner ↔ lock monitor)
`src/auth.ts`	Entra sign-in via VS Code's Microsoft auth provider (scope TODO)
`src/agent/connection.ts`	Outbound websocket client: fresh token per attempt, backoff reconnect, envelope signature verification
`src/agent/taskRunner.ts`	Step executor (shell/edit/test), pause/resume/cancel, approval request flow, secret redaction
`src/approvals/policy.js`	Default-deny approval policy + read-only allowlist
`src/lock/monitor.js`	Spawns the lock-monitor helper over stdio; pauses/resumes the runner
`src/github/pr.js`	PR creation via `gh` CLI (preferred) or GitHub REST API; token from SecretStorage

Develop

node --check src/extension.js   # syntax check (no build step)
npm test          # node --test

Press F5 — Extension Development Host opens with the extension loaded.

Configure

Settings (teamsCodeAgent.*):

relayUrl — wss://<relay-host>/ws (required)
machineId — reported to the relay (default default)
approvalPolicy — default-deny (shipped) or permissive

First run prompts for:

Microsoft sign-in (device/account picker; token goes to the relay only)
Envelope signing key — the relay's ENVELOPE_SIGNING_KEY, stored in VS Code SecretStorage (OS keychain-backed), never in settings
GitHub token — fine-grained PAT, stored in SecretStorage, asked only when creating a PR

Lock-pause

The extension spawns resources/lock-monitor/<os>/lock-monitor[.exe] (see packages/lock-monitor). On locked the runner pauses immediately (in-flight process group killed, step checkpointed) and reports paused-lock; on unlocked it resumes automatically. Manual /pause from Teams is separate and needs /resume.

ChatForge