[ndemianc]

What

On the desktop, a folder's .vscode/settings.json could set every LevelCode AI setting, and its value won over the user's. So a repository could:

• switch the agent to Autopilot;
• send the chat, and the user's API key, to a server it names (levelcode.ai.baseURL);
• set a verify command that runs after the agent's next edit (levelcode.ai.verify.command). That command never asks, even in Default Approvals.

Restricted Mode did not stop it. VS Code applies restrictedConfigurations only for an extension that declares untrustedWorkspaces.supported: 'limited', and levelcode-ai declares true. The browser edition closed this on 2026-10-11 (WORKSPACE_SETTINGS_OK). The desktop manifest was left as it was.

This PR does on the desktop what the browser already does. Every levelcode-ai setting is application-scoped (user settings only), except the same eleven display and context preferences.

Commits

1. test(agent): scripts/folder-settings-editor-check.js opens the dev build as a separate instance on a folder that tries all three, and checks the result.
   • Two stand-in providers run on localhost, the user's and the folder's, and script the same turn.
   • It runs twice: once trusted (Workspace Trust off), once in Restricted Mode.
   • A display preference set by the folder (chat.fontSize) is the positive control.
   • On develop it fails 10 checks, the same in both modes.
2. fix(agent):
   • "scope": "application" on the 33 settings that had no scope. sessions.dir stays machine, and the MCP settings were already application.
   • A new suite, test/settingsScope.test.js. It is default-deny: it fails on any folder-settable setting that is not on the list. It also fails on a scope the editor does not know, because VS Code's parseScope reads a misspelt one as window, which a folder can set. And it fails if the desktop and browser lists differ.
   • web/test/unit/manifest.test.js no longer requires the desktop manifest to have no scopes.
   • Updates to docs/WEB.md and to the comment in web/ai-extension/manifest.js.
3. docs: starts the next release's RELEASE-NOTES.md with this change. It covers what changes for someone who set one of these settings in a project on purpose, and that application-scoped settings are shared by all profiles. A comment at the top says draft-release-notes.mjs --write would replace the file, so merge instead, and that the updater and init settings (below) come first.

What a folder may still set

levelcode.ai.includeActiveFile, levelcode.ai.diagrams.enabled, and levelcode.ai.chat. autoContext, autoContextMaxFiles, scopeToActiveProject, workspaceMap, startLocation, fontSize, maxImagesPerMessage, proseWidth, groupActivity. This is the browser's WORKSPACE_SETTINGS_OK, which the owner chose on 2026-10-19.

Verified

The real editor (macOS, the dev build), before and after:

Check (each in a trusted folder and in Restricted Mode)	develop	this PR
The folder's chat.fontSize applies (positive control)	ok	ok
The approvals pill shows the user's choice	Autopilot	Default Approvals
Requests go to the user's provider	folder's, 3 of 3	user's
The user's key never reaches the folder's server	sent, 3 of 3	never
The agent's command asks first	ran, no card	card, skipped, not run
The folder's verify command does not run	ran	did not run

• settingsScope: 4 cases. I put back seven defects one at a time (autopilot unscoped, a misspelt scope, window scope, sessions.dir unscoped, a new setting with no scope, a listed setting locked on the desktop only, autopilot added to the browser list). The suite caught all seven.
• ./scripts/test-extensions.sh: 128 test files pass on macOS. I did not run them on Linux (Docker was not answering on this Mac), so this PR's test.yml run is the first Linux run. The new suite reads JSON and uses no timers.

Not verified

• Where the session token goes (levelcode.cloud.endpoint, apiUrl) works the same way, but I only read it. The editor check has no signed-in session to send.
• Profiles: application-scoped settings are shared by every profile. A non-default profile's own value is ignored, and an edit made from that profile goes to the Default profile. I read this in VS Code's source (PROFILE_SCOPES, isSettingAppliedForAllProfiles) and did not run it. The same goes for the faded hint shown on an ignored value in a project's settings.json (preferencesRenderers.ts).

Not in this PR (owner's decision)

These can still be set by a folder:

• levelcode-updater's levelcode.update.url, enabled and intervalHours. With url, the editor itself can offer an update whose Download opens the folder's link.
• levelcode.init.enabled.

They are left for a separate change, and the release notes' TODO says to fix them before tagging. The npp-pack's six editing preferences stay folder-settable on purpose.

Conflicts with #112

#112 (Ask When Risky, draft) rewrites levelcode.ai.agent.autopilot's description, on the line after the one where this PR adds its scope. To resolve, keep #112's text and add "scope": "application". I resolved it that way in a scratch copy, where settingsScope, the web manifest suite, agentReview and agentReviewGate all pass. With both merged, the get('agent.autopilot') fallback in #112's readApprovalMode() reads only the user's value, with no change needed in #112.

[Copilot]

🟢 Approval recommended

The scope restrictions consistently enforce the intended boundary, supported by targeted regression checks and no identified blocking issues.

No open issues 🎉

What changed in this PR

Prevents desktop workspace settings from overriding sensitive LevelCode AI configuration, aligning desktop behavior with the browser edition.

Changes:

• Makes 33 settings application-scoped while preserving eleven folder-settable display and context preferences.
• Adds scope regression tests and a real-editor check covering trusted and restricted workspaces.
• Documents migration to user settings and cross-profile behavior.

File	Description
web/​test/​unit/​manifest.test.js	Checks desktop scope exceptions against the browser allowlist.
web/​ai-extension/​manifest.js	Documents the shared desktop/browser boundary.
RELEASE-NOTES.md	Explains the security change and migration implications.
extensions/​levelcode-ai/​test/​settingsScope.test.js	Guards allowed scopes and desktop/browser parity.
extensions/​levelcode-ai/​scripts/​folder-settings-editor-check.js	Checks workspace isolation in the real editor.
extensions/​levelcode-ai/​package.json	Restricts sensitive settings to application scope.
docs/​WEB.md	Documents desktop alignment and verification.

_{Review effort: Balanced}