miniSara AI Agent — VS Code (Preview / Early Access)

Status: Preview / Early Access — v0.1.0

miniSara AI Agent is available as a public Preview. It is intended for evaluation and feedback. APIs, configuration keys, on-disk formats, and behavior may change before v1.0.0. Do not rely on it for production workloads.

What miniSara is

miniSara AI Agent is a local, workspace-scoped AI software-engineering agent for Visual Studio Code. The extension boots a local RPC server process on your machine that hosts the miniSara Agent Core. The extension itself never talks to a large-language-model provider directly and never holds security authority — it is a strict UI / RPC client.

miniSara is designed around three principles:

1. Explicit user consent for every file change. Nothing is written to your workspace without a diff preview and an approval prompt.
2. Workspace containment. The agent operates strictly inside the currently trusted VS Code workspace folder.
3. Credentials never touch the wire. API keys live in VS Code's SecretStorage and are passed only via the child-process environment of the local RPC server — never over JSON-RPC, never into logs.

What miniSara can do

• Run an AI coding agent against your currently open workspace via the miniSara: Run Agent command.
• Stream assistant responses live in VS Code.
• Propose file mutations, present a diff preview, and apply them only after you approve.
• Run verification steps after mutations, and perform bounded self-healing repair rounds if verification fails.
• Surface Agent diagnostics into the VS Code Problems panel without touching your native TypeScript / ESLint diagnostics.
• Attach the current file, selection, and dirty-editor state to a run as untrusted context.
• Be cancelled at any time via miniSara: Stop Agent.

Capability status legend

To be honest about maturity, capabilities are labelled:

• IMPLEMENTED — code exists in this release.
• VALIDATED — additionally covered by real installed-VS-Code end-to-end tests in this release.
• EXPERIMENTAL — implemented but subject to change or reduced reliability; use with caution.
• PLANNED — not present in this release; do not rely on.

Requirements

• Visual Studio Code ^1.85.0.
• Node.js >=20 available on your system if the extension host does not already provide it. The bundled RPC server is spawned as a Node child process.
• A trusted workspace folder. miniSara refuses to run in untrusted workspaces or without a bound workspace folder.
• For the OpenAI or Anthropic providers, a valid API key issued by the respective provider. For the Ollama provider, a locally reachable Ollama instance.

Installation from VSIX

1. Download minisara-ai-agent-0.1.0.vsix.
2. In VS Code, open the Command Palette and run Extensions: Install from VSIX....
3. Select the downloaded .vsix file.
4. Reload VS Code if prompted.

Alternatively, from a terminal:

code --install-extension minisara-ai-agent-0.1.0.vsix

Basic usage

1. Open a trusted workspace folder in VS Code.
2. Configure a provider (see below).
3. Open the Command Palette and run miniSara: Start Agent. The status bar / output should report a ready RPC server.
4. Run miniSara: Run Agent and describe the task in natural language.
5. Observe streamed responses. When the agent proposes a file mutation, review the diff and click Approve or Reject.
6. Use miniSara: Stop Agent at any time to cancel.

Lifecycle commands:

• miniSara: Run Agent — start a run against the active workspace.
• miniSara: Start Agent — spawn the local RPC server.
• miniSara: Stop Agent — gracefully stop the local RPC server (also cancels any in-flight run).
• miniSara: Restart Agent — stop and start cleanly.
• miniSara: Agent Status — show the current lifecycle state.
• miniSara: Configure Provider — select Ollama, OpenAI, or Anthropic.
• miniSara: Configure Credentials — securely store the selected provider's API key in VS Code SecretStorage.

Workspace trust

miniSara fully obeys VS Code's Workspace Trust model:

• In an untrusted workspace, no RPC server is spawned and no Agent Core operation runs. Lifecycle commands report the trust state and take no action.
• Granting trust transitions the extension to inactive, from which it can be started.
• Revoking trust or closing the workspace shuts the local RPC server down immediately.
• Multiple workspace folders are never merged. Multi-root configurations require an explicit selection.

Provider configuration

Choose one provider at a time via the miniSara.provider setting:

Ollama (local)

1. Install and run Ollama locally.
2. Pull a model, for example: ollama pull qwen2.5-coder:7b.
3. Set miniSara.provider = "ollama" and miniSara.model = "qwen2.5-coder:7b".
4. Ollama requires no API key. No credential is stored.

OpenAI

1. Set miniSara.provider = "openai" and choose a supported miniSara.model (for example, gpt-4o or a compatible identifier).
2. Store your API key in VS Code SecretStorage via the extension's provider-configuration flow — do not paste keys into settings.json.
3. The key is passed only into the RPC server child process's environment and is never sent across JSON-RPC or written to the output channel.

Anthropic

1. Set miniSara.provider = "anthropic" and choose a supported miniSara.model (for example, a claude-3-5-* identifier).
2. Store your API key in VS Code SecretStorage via the extension's provider-configuration flow.
3. The same credential-isolation guarantees apply as for OpenAI.

Switching providers restarts the RPC server. Credentials for inactive providers are not shared with the active one.

Credential handling — SecretStorage explanation

• API keys are stored using VS Code SecretStorage, which delegates to the operating system's secure credential store (Windows Credential Manager, macOS Keychain, or an appropriate Linux secret service).
• Keys are read from SecretStorage in the extension host and injected into the RPC server's child-process environment only.
• Keys are never placed on JSON-RPC messages between the extension and the RPC server.
• Keys are never written to the miniSara output channel.
• Keys are not included in Agent diagnostics, approval prompts, or diff previews (secret redaction is active on those surfaces).
• Keys are not included in the VSIX or in any tests, logs, or reports.

Approval behavior

• Every proposed file mutation triggers an approval prompt containing a redacted diff preview and a description of the change.
• You can Approve or Reject each proposal.
• Rejection results in zero unauthorized mutation.
• Approval is per-proposal — it does not grant blanket authority.
• Approval cannot grant permissions the agent does not already have (approval consumes, but never escalates, tool authority).
• Duplicate or stale approval requests use a first-decision-wins policy; cancellation invalidates outstanding prompts.

File mutation and diff behavior

• Mutations are always presented as a diff against the current file content.
• Sensitive files are suppressed from context and from mutation surfaces.
• Mutations are performed only after explicit approval.
• Failed post-mutation verification may trigger a bounded self-healing repair round; repair rounds are isolated from one another and from the original run.

Verification / self-healing

• After mutating changes, the agent may run configured verification.
• If verification fails, a bounded repair round may attempt to fix the regression.
• Repair rounds cannot weaken tests or bypass approval.

Streaming

• Enabled by default (miniSara.stream = true).
• Text deltas and tool-activity events are streamed in order without duplication.
• Raw tool arguments and raw tool results are never rendered directly to the user.
• Disabling streaming does not change agent behavior — only the presentation of the response.

Cancellation

• Press Stop (or run miniSara: Stop Agent) at any time.
• Cancellation propagates to the RPC server and the Agent Core.
• In-flight LLM streaming and tool execution stop according to the supported semantics of the active provider or tool.
• The UI returns to a usable state after cancellation.
• A second cancellation, or a workspace change during a run, is safe.

Diagnostics

• miniSara owns a dedicated miniSara diagnostic collection in the Problems panel.
• Agent diagnostics are cleared when the server stops, restarts, or the workspace changes.
• Your native TypeScript, ESLint, and other-extension diagnostics are never modified by miniSara.

Editor context

• The current file, selection, and dirty-editor state can be attached to a run as untrusted input.
• Editor context cannot grant permissions, bypass approval, execute tools, or modify security policy.
• Workspace-relative paths are used; absolute host paths are avoided in agent-visible artifacts.
• Sensitive-file suppression is enforced.

Security model (user-facing summary)

• Local execution. All agent orchestration happens on your machine inside the local RPC server. Only the configured LLM provider is contacted remotely, according to that provider's own protocol.
• Workspace containment. The agent cannot escape the trusted workspace folder.
• Command policy. The agent's shell-command surface blocks shell metacharacter injection and dangerous commands.
• Approval authority. Only you can authorize a mutation. Rejection is always safe.
• No credential leakage. See the SecretStorage section above.
• Untrusted inputs. Editor context, diagnostics, and repository context are treated as untrusted data that cannot escalate authority.

Validation status

• Windows: VALIDATED. Real installed-VS-Code end-to-end validation (activation, lifecycle, run, streaming, cancellation, approval, mutation, diagnostics, credentials, restart) was performed on Windows for this release.
• macOS: NOT YET VALIDATED for this release. Behavior is unverified; use at your own risk and please report findings.
• Linux: NOT YET VALIDATED for this release. Behavior is unverified; use at your own risk and please report findings.

Additional platforms will be marked as validated only after real installed-VS-Code testing on those platforms.

Known limitations

• Preview / Early Access. Behavior may change before v1.0.0.
• Windows-only validated at this time (see above).
• The Context Engine is lexical only in this release — no embeddings and no vector search.
• The response quality depends on the selected LLM provider and model.
• Approvals are per-proposal; there is no persistent "trust this kind of change" grant.
• Some cancellation semantics depend on the provider's or tool's ability to stop mid-operation.
• No JetBrains / IntelliJ / WebStorm plugin is included.
• No image, video, or media generation is included.

Reporting issues

Please report issues, unexpected behavior, and Preview feedback through the project's issue tracker. Do not attach real API keys, tokens, credentials, or .env files to reports.

Preview / Early Access disclaimer

miniSara AI Agent v0.1.0 is a Preview release. It is provided as-is for evaluation. Do not rely on it for production workloads. Interfaces, configuration keys, on-disk formats, storage locations, and behavior may change before v1.0.0 without notice.