Inside AI Orchestra 0.4.0: BYOK Security, Extension Broker, and Cloud Vault

Modern developer tools frequently ask for an unacceptable trade-off: give up your source code and API credentials to a proprietary cloud proxy, or lose access to cutting-edge AI coordination.

AI Orchestra 0.4.0 takes the opposite stance: keys stay on the device or as ciphertext, and the extension makes no inference proxy calls.

The Three Pillars of 0.4.0

1. Keys stay on the device or as ciphertext. Extension keys stay in VS Code's secret storage. A signed-in browser can keep keys in local storage, which is not encrypted, or in Key Vault as ciphertext. Server Proxy passes a key through per request and does not store it. The extension makes no inference proxy calls.
2. Extension Host Capability Broker: Rather than giving AI models unrestricted raw bash execution, AI Orchestra uses VS Code's vscode.lm.tools registry as a capability broker. Tools like Git status, diff, staging, and diagnostic inspection are mediated with explicit user confirmation gates.
3. Revision-Locked Targeted Edits: Overwriting a 3,000-line file to change 4 lines is dangerous. AI Orchestra generates cryptographic SHA-256 target line locks. If the file changed on disk between read and write, the write is refused before corruption can happen.

// Every cloud and local write is guarded by cryptographic revision locks
interface RevisionGuard {
  targetPath: string;
  expectedHash: string;
  lineRanges: [startLine: number, endLine: number][];
  replacementDigest: string;
}

Dual-Engine Web App & Extension

With the release of our Web Chat workspace at /app, developers can run multi-agent sessions directly in the browser while maintaining full synchronization with their local projects via Supabase Vault.

Whether you are in the terminal, inside VS Code, or on a laptop browser, the room rules remain identical: you chair, they collaborate, and every dollar of API spend is metered live.