Inside AI Orchestra 0.4.0: BYOK Security, Extension Broker, and Cloud Vault

Modern developer tools frequently ask for an unacceptable trade-off: give up your source code and API credentials to a proprietary cloud proxy, or lose access to cutting-edge AI coordination.

AI Orchestra 0.4.0 takes the opposite stance: Zero Trust BYOK (Bring Your Own Key).

The Three Pillars of 0.4.0

1. Strict Client-Side BYOK: Your OpenAI, Anthropic, Google, and xAI API keys live strictly in your local environment or encrypted browser storage. They never traverse our database tables.
2. Extension Host Capability Broker: Rather than giving AI models unrestricted raw bash execution, AI Orchestra uses VS Code's vscode.lm.tools registry as a capability broker. Tools like Git status, diff, staging, and diagnostic inspection are mediated with explicit user confirmation gates.
3. Revision-Locked Targeted Edits: Overwriting a 3,000-line file to change 4 lines is dangerous. AI Orchestra generates cryptographic SHA-256 target line locks. If the file changed on disk between read and write, the write is refused before corruption can happen.

// Every cloud and local write is guarded by cryptographic revision locks
interface RevisionGuard {
  targetPath: string;
  expectedHash: string;
  lineRanges: [startLine: number, endLine: number][];
  replacementDigest: string;
}

Dual-Engine Web App & Extension

With the release of our Web Chat workspace at /app, developers can run multi-agent sessions directly in the browser while maintaining full synchronization with their local projects via Supabase Vault.

Whether you are in the terminal, inside VS Code, or on a laptop browser, the room rules remain identical: you chair, they collaborate, and every dollar of API spend is metered live.