[Hanjo92]

Problem and behavior

NoPilot's Agent mode previously produced planning text, and chat responses could be applied to whichever editor/selection was active later. This change pins the request's document URI, version, and range, and adds a bounded execution flow: inspect workspace files → propose reviewed edits → obtain approval → run separately approved verification → feed the actual result back to the model.

Implementation and safeguards

• Ask and Inline Chat use immutable diffs, per-file review, and final explicit approval. Stale documents and conflicting buffers are rejected; changing editors does not retarget a response.
• Agent can list, read, and search one trusted local workspace, then propose exact replacements in up to five previously read files. Path traversal, symlinks, hidden files, credential extensions, dependency/build directories, and conflicting document aliases are rejected.
• Verification offers only root package.json scripts test, lint, compile, and build. Approval shows the script, working directory, proposed buffer saves, and side effects. Existing user edits are not auto-saved. Changed package.json or buffers invalidate approval.
• Scripts run via npm --ignore-scripts run <name> with pre/post hooks disabled, a 120-second timeout, bounded output, and cancellation of the process group. Approved project scripts run with the user's permissions and are not sandboxed; they may modify files or access the network.
• Stop/panel-close/provider-switch cancellation, late-response suppression, repeated-action/error limits, a 12-model-call ceiling, and bounded context prevent unattended loops. Ask excludes other open files and Agent history.
• All six existing provider adapters use a validated JSON action protocol; native tool calling is not required.
• Added a read-only-permissions GitHub Actions workflow for typecheck, lint, tests, build, and Extension Host harness typechecking. No prior CI workflow existed.

Validation

• GitHub Actions CI run 36863966695: passed for head commit 35b319ad66b307f6b5a0376a65f7ebddd19bc780. All validation steps completed successfully.

• npm run compile, npm run lint, npm run build, and git diff --check: passed.

• npm test: 201 tests passed (191 compiled tests + 10 runtime tests).

• Extension Host harness typecheck: passed.

• npm run test:extension-host: 10 integration scenarios passed in installed VS Code 1.131.0, using a temporary profile/workspace. Real document, diff, workspace-edit, save, and local npm APIs were exercised; model responses and approval choices were test doubles.

• Integration scenarios cover original-target application after editor switching, stale documents, late results after cancellation, multi-file conflicts, cancelling review, approved two-file patch/save/test/result feedback, denied commands, package.json changes during approval, preservation of existing user edits, and path aliases.

• Changed-file credential/artifact scan found no credentials, temporary logs, dependency trees, or generated bundles to commit.

Current limits

• No live/paid model requests were made. Real model compliance, output quality, and provider-side cancellation remain unverified.
• Existing regular UTF-8 files only, up to 64 KiB each; no creation, deletion, renames, remote-workspace support, or arbitrary shell tools.
• Command verification currently supports macOS/Linux. Extension Host integration was run locally on macOS; CI runs the non-GUI suite and typechecks the host harness.
• State is in memory and does not resume after restart. Cancellation does not undo already approved changes, saves, or command effects. VS Code Auto Save may save approved buffer edits.

Draft for review; no merge, deployment, or release is requested.