OpenSoyce VS Code Extension

Deterministic doctrine + LLM code review inside VS Code. Connects to the OpenSoyce CLI over stdio MCP or calls it directly. Supports codex and claude reviewers.

Install

From VSIX (released)

1. Download opensoyce-0.3.0.vsix from the releases page.
2. In VS Code: Extensions → ... → Install from VSIX… → select the file.
3. Reload the window when prompted.

From source (this checkout)

cd packages/vscode-extension
npm ci
npx tsc -p .          # compiles to dist/extension.js
npm run package       # produces opensoyce-0.3.0.vsix via @vscode/vsce

Then install the produced .vsix as above.

Configure

Open File → Preferences → Settings (or Ctrl+,) and search opensoyce.

Reviewer login

The extension never collects credentials or launches sign-in implicitly.

• Codex: Run codex login in a terminal on this machine once. The extension reads the existing login.
• Claude: Run claude auth login in a terminal on this machine once.

MCP server configuration (optional)

OpenSoyce also exposes its review tools over stdio MCP. To configure any MCP client (including VS Code's native MCP support):

{
  "mcpServers": {
    "opensoyce": {
      "command": "node",
      "args": ["/absolute/path/to/opensoyce/scripts/phase0/mcpServer.mjs"],
      "env": {
        "RONINOS_MCP_PROVIDER": "codex"
      }
    }
  }
}

See MCP reviewer selection for Claude selection, host login requirements, and validation limits.

Commands

Open the Command Palette (Ctrl+Shift+P / Cmd+Shift+P) and search "OpenSoyce":

Results

When a review finishes:

1. Output channel — "OpenSoyce" panel shows the full verdict, per-engine violation counts, and each finding with file/line/reason/remediation.
2. Diagnostics — Findings appear as red/yellow/gray squiggles in the editor, grouped by file.
3. Notifications — "BLOCKED" shows as an error toast; warnings as warnings; clean reviews as info.

Each finding includes:

• Contract ID (e.g. ARCH-SEC-SSRF-01, prototype_pollution, non_constant_time_comparison)
• File and line
• Explanation and remediation
• Whether it came from doctrine (deterministic), deep semantic slice (AST rules), or Ghost Engine (LLM via Codex/Claude)

Onboarding a repository

Before reviewing a PR for the first time, run OpenSoyce: Onboard Repository and enter owner/repo. This mines your repository's ADRs, rejected PRs, and reverts over HTTP (zero-clone — no source is copied locally) and seeds doctrine contracts for your stack. The repository is then ready for PR reviews.

If you already ran onboarding and want to re-seed contracts after new rejected PRs or ADRs, enable opensoyce.forceReonboard or use --force-reonboard on the CLI.

How it compares to the RoninOS VS Code extension

The RoninOS package includes a codeguard VS Code extension (roninos-package/vscode-extension/). OpenSoyce's extension is a separate implementation that:

• Uses the OpenSoyce MCP server (stdio) with an automatic fallback to direct CLI invocation.
• Supports both Codex and Claude reviewers, selectable per-review or in settings.
• Integrates onboarding (opensoyce onboard) from within the extension.
• Runs deep semantic rules (SSRF, TOCTOU, prototype pollution, timing attack, CORS) as deterministic AST checks before the LLM, so defects are caught with deterministic confidence rather than LLM guesswork.
• Keeps zero-false-positive behavior: every block corresponds to a real doctrine contract, deep semantic finding, or LLM-verified defect.

Limitations

• VS Code only — no GitHub App automatic PR commenting is proven yet. Use the CLI (roninos.mjs review-pr) or this extension for on-demand review.
• CLI required — the extension delegates to packages/cli/dist/cli.js. Install the OpenSoyce CLI package first or point opensoyce.cliPath at a built checkout.
• Reviewer login required — Codex or Claude must be logged in on the host before LLM findings appear. Setup itself makes no model call.
• Recall gaps — QML, shell scripts, markdown docs, WebSocket-specific bugs, and Python CFD/numeric code are not yet covered by doctrine or deep semantic rules. The flywheel loop (review → reject → learn → promote → enforce) closes these gaps over time as misses are seeded into doctrine contracts.

Troubleshooting

Uninstall

In VS Code: Extensions → find "OpenSoyce" → gear icon → Uninstall. The extension writes no configuration outside VS Code settings and makes no model calls during setup.

Related docs

• OpenSoyce MCP reviewer selection — MCP server configuration, reviewer selection, host login requirements, and validation limits.
• CLI onboarding — terminal-based onboarding flow and pilot sequence.
• OpenSoyce product spine — product identity and architecture.