QuantsMind AI Coder

QuantsMind AI Coder is a Visual Studio Code extension that turns your AI provider into a project-aware coding assistant with explicit context control and approval-first file changes.

Publisher: quantsmind (QuantsMind)
Extension ID: quantsmind.quantsmind-vscode-ai-coder
Version: 1.0.0
Requires: VS Code 1.95.0 or newer (desktop)

The extension runs entirely in VS Code. There is no backend service, database, telemetry, or account requirement. Workspace content is never sent unless you explicitly attach it and press Send or start an agent task.

Highlights

Nine built-in provider profiles: OpenAI-compatible, OpenAI, Groq, OpenRouter, Ollama, LM Studio, llama.cpp, vLLM, and Google Gemini.
OpenAI-compatible /chat/completions support, plus a Gemini adapter.
Streaming responses with a Stop control, cancellation, and total request timeouts.
Explicit context attachment from selections, the active file, or retrieved workspace files.
Local workspace index with technology detection and relevance ranking.
Approval-first multi-file change plans with per-file review, diffs, backups, and undo.
Allowlisted validation commands with no shell execution.
Per-profile API-key storage in VS Code SecretStorage.
Strict redaction of credentials, tokens, and secrets in prompts, errors, and logs.

Provider support

Profile ID	Adapter	Default endpoint	Default model	Credential
`openai-compatible`	OpenAI-compatible	`https://api.openai.com/v1`	`gpt-4o-mini`	Required for remote endpoints; optional on loopback
`openai`	OpenAI-compatible	`https://api.openai.com/v1`	`gpt-4o-mini`	Required
`groq`	OpenAI-compatible	`https://api.groq.com/openai/v1`	`llama-3.3-70b-versatile`	Required
`openrouter`	OpenAI-compatible	`https://openrouter.ai/api/v1`	`openai/gpt-4o-mini`	Required
`ollama`	OpenAI-compatible	`http://localhost:11434/v1`	`llama3.1`	Not required (local)
`lm-studio`	OpenAI-compatible	`http://localhost:1234/v1`	`local-model`	Not required (local)
`llama-cpp`	OpenAI-compatible	`http://localhost:8080/v1`	`llama`	Not required (local)
`vllm`	OpenAI-compatible	`http://localhost:8000/v1`	`llama3`	Not required by default; set a key if your server requires one
`gemini`	Gemini	Fixed Google endpoint	`gemini-2.0-flash`	Required

Notes:

All OpenAI-compatible profiles reuse the same adapter. The profile selects endpoint defaults, credential behavior, and capability reporting.
Gemini uses the fixed Google Generative Language endpoint. Base URL overrides are not used for Gemini.
Remote endpoints must use HTTPS. Plain HTTP is accepted only for localhost, 127.0.0.1, and ::1, and can be disabled.
Each profile stores its API key under a separate SecretStorage key.
Model discovery and a connection test are available for every profile.
QuantsMind: Select Model can discover models from the provider or accept a manually entered model ID.

Requirements

VS Code 1.95.0 or newer, desktop edition.
For cloud profiles: a valid provider API key and network access.
For local profiles: a running local server with a loaded model.
Node.js is only needed when building or testing from source.

Installation

Once the extension is published to the Visual Studio Marketplace, install it with:

code --install-extension quantsmind.quantsmind-vscode-ai-coder

You can also install the published VSIX directly:

code --install-extension quantsmind-vscode-ai-coder-1.0.0.vsix

Reload the window if VS Code requests it. Open the QuantsMind icon in the Activity Bar, or run QuantsMind: Open Chat from the Command Palette.

Configure

Run QuantsMind: Select Provider Profile and choose a profile.
Run QuantsMind: Set API Key and paste the provider key. The input is masked and the value is stored in VS Code SecretStorage.
Run QuantsMind: Configure Provider to set the base URL, model, timeout, and other options. Provider settings are application-scoped.
Run QuantsMind: Test Provider Connection to verify reachability, authentication, and model availability.
Optionally run QuantsMind: Select Model to discover or enter a model.

OpenAI-compatible endpoint

Set quantsmind.provider.baseUrl to the API root, for example https://api.openai.com/v1. The extension appends /chat/completions.

Local model example

For an Ollama server on port 11434:

{
  "quantsmind.provider.baseUrl": "http://127.0.0.1:11434/v1",
  "quantsmind.provider.model": "llama3.1"
}

Plain HTTP is accepted only for localhost, 127.0.0.1, and ::1. Remote endpoints must use HTTPS. You can disable loopback HTTP with quantsmind.provider.allowInsecureLocalhost.

Settings

Setting	Default	Scope	Purpose
`quantsmind.provider.type`	`openai-compatible`	application	Provider profile
`quantsmind.provider.baseUrl`	`https://api.openai.com/v1`	application	API root URL
`quantsmind.provider.model`	`gpt-4o-mini`	application	Model identifier
`quantsmind.provider.requestTimeoutMs`	`120000`	application	Total request timeout
`quantsmind.provider.maxOutputTokens`	`2048`	application	`max_tokens` value
`quantsmind.provider.temperature`	`0.2`	application	Sampling temperature
`quantsmind.provider.stream`	`true`	application	Prefer SSE streaming
`quantsmind.provider.allowInsecureLocalhost`	`true`	application	Permit loopback HTTP
`quantsmind.context.excludeGlobs`	`[]`	resource	Additional exclusion globs
`quantsmind.context.maxFileSizeKb`	`256`	resource	Per-file size limit
`quantsmind.context.maxTotalChars`	`48000`	resource	Total attached characters
`quantsmind.context.maxFiles`	`20`	resource	Maximum attachments per request
`quantsmind.workspace.maxIndexedFiles`	`5000`	resource	Local index size cap
`quantsmind.workspace.maxRetrievedFiles`	`8`	resource	Files attached per retrieval
`quantsmind.workspace.retrievalMaxChars`	`40000`	resource	Retrieved-context budget
`quantsmind.agent.maxSteps`	`6`	resource	Provider calls per agent task
`quantsmind.agent.maxRepairIterations`	`1`	resource	Repair passes after failure
`quantsmind.agent.timeoutMs`	`180000`	resource	Agent task step timeout
`quantsmind.commands.allowlist`	five npm commands	resource	Approved validation commands
`quantsmind.commands.timeoutMs`	`120000`	resource	Validation command timeout
`quantsmind.commands.maxOutputChars`	`120000`	resource	Captured output cap

Provider settings are application-scoped so a workspace cannot redirect your stored credential to a different host. Built-in exclusions for secrets, credentials, SSH keys, dependencies, and build output cannot be removed; user patterns add to them.

Commands

QuantsMind: Open Chat
QuantsMind: New Chat
QuantsMind: Explain Selection
QuantsMind: Ask About Selection
QuantsMind: Generate Code Suggestion
QuantsMind: Attach Active File to Chat
QuantsMind: Set API Key
QuantsMind: Clear API Key
QuantsMind: Configure Provider
QuantsMind: Select Model
QuantsMind: Select Provider Profile
QuantsMind: Test Provider Connection
QuantsMind: Show Log
QuantsMind: Summarize Workspace
QuantsMind: Attach Relevant Workspace Files
QuantsMind: Start Agent Task (Plan Changes)
QuantsMind: Show Change History
QuantsMind: Show Menu (hidden from the Command Palette; backs the status bar item)

Approval-first changes

Run Start Agent Task and describe the change.
The extension selects relevant local files and asks the provider for a JSON change plan.
Review the summary, per-file warnings, and unified diffs in the chat view.
Approve selected files or reject the plan. Nothing has been written yet.
Approved files are written with workspace containment and per-file backups.
Optionally run an allowlisted validation command.
If validation fails, request a bounded repair plan and review it again.
Undo restores backups; conflicting files are reported and left untouched.

Security model

Explicit sending. Nothing leaves VS Code until you attach content and press Send or start an agent task.
Explicit context. Only the selection, active file, user-picked files, or locally retrieved workspace files are candidates.
Approval before writes. Plans are never applied automatically. Approval is per file and per task.
Credential isolation. Keys live in SecretStorage under per-profile keys. There is no API-key setting. Logs pass every line through redaction.
Redaction. Exact stored credentials, masked credential forms, JWTs, bearer tokens, and URL userinfo are replaced before context is sent. Error bodies and logs are redacted too.
Endpoint validation. HTTPS is required remotely; loopback HTTP is opt-in. URLs with embedded credentials, query strings, or fragments are rejected.
Contained writes. Change paths must be relative, symlink-free, and inside the workspace. Windows drive-relative paths, alternate data streams, traversal, and UNC paths are rejected.
Controlled execution. Only allowlisted commands run, without a shell, with a sanitized environment, output caps, timeouts, and cancellation.
Webview lockdown. Strict CSP, nonce-based scripts, no remote assets, and no inline executable scripts.

See SECURITY.md for reporting and the full threat model.

Known limitations

Tool and function calling are not supported. Tool-call responses are rejected with a clear error.
Only the OpenAI-compatible /chat/completions shape and the Gemini adapter are supported. Provider SDKs, the Responses API, and native Anthropic or Gemini protocols are not implemented beyond the Gemini adapter.
Live provider interoperability was not tested in the v1.0.0 GA campaign. Automated tests use a loopback mock server. Use QuantsMind: Test Provider Connection with a disposable key before relying on a provider.
Text-only chat. Image, audio, and multimodal inputs are not supported.
The plan format is strict JSON. Models that cannot follow it can produce an invalid_response or plan-parse error.
Text files only for changes. Binary edits are not possible.
Multi-root workspaces and web or remote hosts are not fully exercised.
There is no telemetry, crash reporting, update service, backend, or database.
The extension does not publish, tag, or deploy anything itself.

Release qualification

The v1.0.0 code was qualified with:

425 unit tests.
46 integration tests on VS Code 1.95.0.
4 packaged runtime tests.
VSIX archive inspection and isolated install verification.
GitHub Actions CI on Ubuntu, Windows, and macOS.

Provider tests use a loopback mock server. Live cloud or local provider interoperability was not tested in the GA campaign.

Documentation

Development

npm ci
npm run compile
npm run lint
npm run verify:deps
npm run test:unit
npm run test:integration
npm run package
npm run verify:vsix

The integration suite launches an isolated VS Code instance and uses a local OpenAI-compatible mock server. No external credential is required for the test suite.

Packaging

npm run package produces quantsmind-vscode-ai-coder-1.0.0.vsix locally. npm run verify:vsix validates the archive contents. npm run test:packaged installs the VSIX into an isolated VS Code instance and verifies activation and basic interaction.

Independence

The source tree is a single npm package. There are no Git submodules, no monorepo tooling, no Python runtime, no third-party QuantsMind SDK, and no dependency on another QuantsMind project. All runtime code is TypeScript compiled to CommonJS for the VS Code extension host.

License

MIT. See LICENSE.