SigmaShake SSG — VS Code Extension

AI governance for VS Code. Manage rules, review pending approvals, and monitor AI tool usage — right inside your editor.

What is SSG?

SigmaShake SSG is a local AI governance engine. It runs as a background daemon and evaluates every tool call made by your AI coding assistant (Claude Code, Cursor, Copilot, etc.) against your .rules files — blocking, logging, or asking for approval in real time.

This extension brings the full SSG experience into VS Code:

• Pending Approvals sidebar — approve or deny AI actions without leaving the editor
• Rules sidebar — browse, toggle, and manage all your governance rules
• Audit Log sidebar — see every AI tool call and its decision, live
• Embedded dashboard — full SSG dashboard in a VS Code panel
• Status bar — daemon health and pending count always visible
• .rules language support — syntax highlighting, snippets, folding

Features

Pending Approvals

When an AI tool call hits an ASK rule, it pauses and waits for your decision. The sidebar shows all pending items with the tool name, input preview, and the rule that triggered. Allow or Deny with one click — or save as a permanent Always Allow / Always Deny autopilot rule.

Rules Management

All your .rules files in one tree, grouped by source file. Each rule shows its decision type (color-coded), target capability, and priority. Toggle rules enabled/disabled directly from the tree.

Audit Log

A live view of the last 50 AI tool evaluations. See which tools were called, what decision was made, which rule matched, and how long evaluation took.

Embedded Dashboard

Open the full SSG dashboard panel inside VS Code (SSG: Open Dashboard or click the status bar). Identical to the SigmaShake Desktop app — all pages, live charts, and hub integration — but embedded as a VS Code panel.

.rules Language Support

.rules files get full language support:

• Syntax highlighting for keywords (DENY, IF, AND), decision verbs, operators, strings
• Auto-closing brackets and quotes
• Code folding per rule block
• Snippets — type rule-deny, rule-allow, rule-log, rule-ask, rule-force + Tab

Requirements

SSG daemon must be running. The extension connects to ssg serve on 127.0.0.1:5599 (configurable). If you don't have SSG installed:

pnpm add -g @sigmashake/ssg
ssg init
ssg serve

Or download SigmaShake Desktop which manages the daemon automatically.

Setup

1. Install and start the SSG daemon (ssg serve)
2. Install this extension

That's it. On localhost the extension auto-reads the daemon's auth token from ~/.sigmashake/dashboard.token, so the sidebar populates without any manual configuration. If the daemon rotates its token (every 30 days), the extension picks up the new value on the next request — no reload needed.

Remote daemons (ssg.daemonHost set to a non-loopback address) require a manually pasted token: run SSG: Set Auth Token… and choose "Paste a token". The file fallback only applies to loopback addresses (127.0.0.1, localhost, ::1, 0.0.0.0) where the local token file is authoritative.

Troubleshooting: if the sidebar is empty and the status bar shows $(shield) SSG $(key), the daemon rejected the token. Run SSG: Show Auth Diagnostics — it prints the resolved daemon URL, the token source, and the live probe state to the "SigmaShake SSG" Output channel. SSG: Clear Stored Token resets to the file-fallback path in one click.

Extension Settings

Commands

Reporting bugs

Run SSG: Report a Bug… from the Command Palette. The extension collects:

1. Category (bug, feature request, question, incident)
2. Severity (P1–P4)
3. Subject and description
4. Your contact email (remembered locally for next time)

It POSTs the form to your local SSG daemon at /api/support/feedback, which:

• Attaches a redacted diagnostic bundle (recent evals, daemon version, rule count, OS, never tool inputs)
• Authenticates you against sigmashake-support using the credential ssg auth login already stored at ~/.sigmashake/
• Creates a real support ticket — you'll get a tkt_* ID back and an email confirmation

The "View ticket" button in the success notification opens accounts.sigmashake.com/support/tickets/<id> so you can follow the thread.

If you'd rather skip the dialog, the same daemon endpoint is what the ssg support CLI and the SSG Desktop "Send feedback" form use.

Supported AI Clients

SSG governs tool calls from any client that integrates with it:

• Claude Code (Anthropic) — hooks + MCP server
• Cursor — MCP server
• GitHub Copilot — MCP server
• Any MCP-compatible client

Security & data handling

• Auth tokens are stored in VS Code's SecretStorage, backed by your OS keychain (Keychain on macOS, Secret Service on Linux, Credential Vault on Windows). Tokens never appear in settings.json or workspace state.
• All network calls are scoped to your local SSG daemon (127.0.0.1 by default). The extension never reaches out to any third-party service directly — bug reports are forwarded through the daemon's HMAC-signed support proxy.
• WebView CSP locks the embedded dashboard panel to the daemon origin: default-src 'none'; frame-src http://<daemon>; connect-src http://<daemon>; script-src 'nonce-<random>'. No remote scripts or styles are loaded.
• Diagnostic bundles attached to bug reports include daemon version, OS, rule count, recent eval summaries, and the active dashboard route. Tool-call inputs are redacted before forwarding.
• Source-available — the extension's TypeScript source is mirrored at sigmashakeinc/vscode from the SigmaShake monorepo. Audit any release by diffing the published .vsix against the tagged source.

To report a security issue privately, see SECURITY.md or email security@sigmashake.com (PGP key on the policy page).

Links

• sigmashake.com — Product homepage
• sigmashake.com/vscode — VS Code extension landing page
• Documentation — Extension docs and reference
• Rules Hub — Community rule collections
• Support — File a ticket; AI auto-triage replies in minutes
• Discord — Community

License

Proprietary — © SigmaShake. All rights reserved. See LICENSE for terms.