TuerSS AI Agent for VS Code

A coding agent powered by TuerAI Hazel, signed in to your own TuerSS account and paid from your own plan credits. It explains code, inspects a workspace, writes a plan.md and builds from it, changes only the lines you highlight, runs build and test commands, reads the real output, and fixes what actually failed.

Agent mode

Agent mode is the default. Describe what you want and Hazel creates and edits real files in your workspace (new folders are created for you), shown live as file cards you can expand. For a new project it writes a complete, runnable set of files with a README. If a long reply is cut off mid-file, the extension asks for that file again in full instead of writing half of it. After files are written it runs your project's own build or check once (for example npm run build, python -m py_compile, go build, cargo check) and gives Hazel the real output to fix, up to two attempts. Commands follow tuerss.allowCommands, and you can turn the check off with tuerss.verifyAfterBuild. Switch to Ask for answers that never change files.

Staying connected

Sign-in sends an access token to VS Code through a one-time approval in your browser; no password is ever typed into the editor. The extension renews that token once at a time and only ends your session when TuerSS itself refuses it, so a network hiccup never signs you out. Approvals (writing files, running commands) appear as cards inside the panel. If something does not work, press Test connection: it checks your login, account, credits, model access and a live Hazel reply, and names the step that fails. The same trail is written to Output › Official TuerSS AI Agent (it never contains tokens).

1. Download the newest .vsix from this repository (tuerss-ai-agent-0.13.0.vsix), or build it with npx @vscode/vsce package --no-dependencies.
2. In VS Code open Extensions → … → Install from VSIX….
3. Open the TuerSS view in the secondary (right) sidebar, then choose Open TuerSS on the right, or press Ctrl/Cmd+Alt+T.
4. Choose Sign in. A browser tab opens showing exactly what the extension will be able to do with your account. Press Allow access and the panel connects itself. Press Sign in again at any time for a fresh link. Disconnect it under Settings → Active sessions and connected apps.

An API token works instead, via TuerSS: Set API Token. Create one in TuerSS Settings and never commit it.

What it does

• A real answer surface. Answers render as markdown: headings, lists, tables of reasoning, and proper code blocks with a language label, Copy, and Insert (drops the snippet at your cursor, or over your selection). Nothing the model writes can inject HTML into the panel.
• Diff counts on every change. After a build you get a chip per file with +added −removed and its status (created, modified, deleted, selection). Click one to open that file.
• An activity log. Reading the workspace, thinking, running a command, reviewing: each step is collected in a collapsible card, newest line always visible.
• One model. Every request runs on TuerAI Hazel, on your account. The panel shows your remaining credits.
• Conversations. A list on the left: switch between threads, start a new one, delete one. Each maps to a TuerSS chat thread, so history survives closing the panel, reloading the window and restarting VS Code.
• Selection edits. Highlight code, press Ctrl/Cmd+Alt+K or right-click → Change the Highlighted Selection. Hazel returns a replacement for exactly those lines and the rest of the file is untouched.
• Runs commands. The agent can ask to run a build, a test suite or a tool. You see the exact command and approve it; it then reads the real stdout and stderr and fixes the actual cause. Run & fix picks a command from your package.json scripts, Makefile, Cargo, Go or pytest setup, runs it, repairs what failed and runs it again.
• Reviews its own work. Before anything is written, a second Hazel pass reads the proposed files for syntax, imports, wrong paths, deleted working code and secrets in source, and reports ok, risky or wrong. Anything but ok asks you before applying. Turn it off with tuerss.reviewBeforeApply.
• Understands your environment. It reads the names of the keys in your .env files, never the values, and tells you which keys .env.example documents but your .env does not set.
• Works on anything. Frontend, backend, bots, CLIs, libraries, scripts, DevOps, tests. A TuerSS website project link is optional; general-purpose repositories stay local.
• Keeps working while you type. Send another instruction mid-answer and it queues. Stop cancels the active response, including while it is still reading your workspace.

Safety

• No client secret, and no local port. Sign-in is a polled device flow with PKCE: the extension keeps a verifier that never leaves your machine, the browser only marks the request approved, and only a caller holding that verifier can redeem it. Requests are single use and expire in ten minutes.
• A trusted workspace is required before any file is read or changed.
• File writes and deletes ask for confirmation, are path-traversal checked and refuse symlinked destinations.
• Commands never run silently. Each one shows its exact text and waits for you; tuerss.allowCommands: never disables them entirely.
• .git, node_modules, build output, .env variants and credential files are skipped, and API keys, passwords, bearer tokens, JWTs and private keys are redacted before anything is sent.
• The assembled prompt is held under the API limit by construction, so a large workspace cannot produce a failed request half way through a build.

Roblox / Luau mode

Open a Roblox project (Rojo or plain .luau / .lua files) and the agent switches on Roblox rules automatically (tuerss.robloxMode: auto, on, off).

• Instant checking, no installs. Every Luau script it writes is checked immediately for unclosed end/until, !=, &&, ||, ++, assignment inside conditions, unfinished strings, and deprecated APIs (wait, spawn, delay, tick, :connect, Instance.new(class, parent), game.Workspace).
• It fixes what it finds. Problems are sent back to Hazel with the exact file, line and the current code, the fix is written and the script is re-checked, then it reports "Fixed" only when the check passes.
• Check Roblox (Luau) scripts (menu or command palette) scans the whole workspace and fixes every problem.
• Understands your project. It reads default.project.json to learn where server, client and shared code belongs, and follows Roblox practice: server-side validation of remotes, safe DataStore calls, cleaning up connections, task.* scheduling, --!strict modules.

Self-recovery

A dropped connection or empty reply is retried automatically. A failed build, test or script check is fixed up to three times, each attempt seeing the real error, the current files and what was already tried, with maximum reasoning on the later attempts.

Privacy and data handling

• Requests go only to your TuerSS account (tuerss.com) and are answered by TuerAI Hazel. No other third party receives your code.
• Secrets are redacted before anything is sent. .env values are never read into prompts: the agent sees key names only and writes values you supply straight to disk.
• No telemetry is collected by the extension. Tokens are kept in VS Code SecretStorage.
• Updates are verified with an Ed25519 signature before installing, and can be turned off with tuerss.autoUpdate.

Deploy to Vercel

Open the menu (☰) and choose Deploy to Vercel…. Connect Vercel once, pick an existing project or create a new one, choose preview or production, and the extension deploys and links the result.

Settings

If the install fails

UpdateMetadata: ... EPERM: operation not permitted means VS Code extracted the package and then could not rewrite extension/package.json to add its own metadata. That happens when an entry in the .vsix is read-only. npm run package forces every entry to 0644 and npm test fails the build if any entry is not writable, so a package built here cannot cause it.

If it still happens with a package from elsewhere:

1. Close every VS Code window, including terminals running code.
2. Reopen VS Code once so it purges any folder listed in .vscode/extensions/.obsolete, then close it again.
3. Install from a terminal: code --install-extension <path to .vsix> --force.
4. If it persists, exclude %USERPROFILE%\.vscode from your antivirus real-time scan and retry.

Development

npm test       # agent logic, panel UI, and package integrity
npm run package  # builds the .vsix with no dependencies and no network

Press F5 in a VS Code extension development window to run it locally.

Automatic updates

Installed copies check https://www.tuerss.com/extension/latest.json shortly after VS Code starts and every six hours. A newer release is downloaded, its SHA-256 and Ed25519 signature are verified against the public key built into the extension, and only then installed (VS Code asks you to reload). Change this with the tuerss.autoUpdate setting (install, ask or off), or run TuerSS: Check for Updates.

To release a new version (maintainers): bump version in package.json, then run

npm run publish:update -- "What changed"

That builds the .vsix, signs it with the private key in .signing/update-signing.pem (git-ignored; keep a backup and never commit it) and writes both files into frontend/public/extension/. Commit and push; once Vercel deploys, every installed copy updates itself. Never reuse or share the signing key: it is the only thing that stops someone else from shipping code into your users' editors.

Secrets

The agent never reads .env values. Environment files are described by key name only, secrets in your messages and workspace snapshot are redacted before anything is sent, and when the agent needs a real value (a bot token, an API key) it opens a private input box and writes the value straight into .env on your computer. Diffs and saved history mask env values.