task-x

Open source, MIT licensed, running on your own keys

Your repository. Your model. Your rules.

A coding agent for VS Code, not tied to a vendor. A Rust runtime, 44 tools, and undo that keeps your edits.

Install Read the docs
install 
# from the latest release
$ code --install-extension task-x.vsix

# from a clone of this repo
$ make add

Built, not promised

Each of these ships in this repository today. The test suites run against mock providers, so trying it does not need a paid key.

Any provider

Claude through Claude Code, OpenAI, OpenAI-compatible endpoints, and Ollama, which is found by itself.

  • A model per task kind with routes
  • Opt-in fallback providers
  • Keys live in SecretStorage only

Team mode

The lead plans a dependency graph. Ready steps run as parallel subagents, each writer in its own git worktree.

  • Merges through the edit log
  • A lane per subagent, with cost and Stop
44built-in tools

Read, search, exact-match edits with stale detection, git, validation, and commands. Every tool declares a schema and a permission class.

Best of N

Two to four models do the same task in separate worktrees. The Compare panel shows results side by side; Keep applies one and discards the rest.

Night Mode

For free or local models that drop requests: an unfinished run retries until it lands.

  • Think splits the work into todo.md
  • Loop works it one item at a time

Context engine

A .gitignore-aware index, Tree-sitter symbols, a dependency graph, and retrieval inside a token budget.

  • Reads CLAUDE.md and Copilot instructions
  • Compresses history automatically

Reviewable by default

Each edit lands on the timeline with its diff. Keep or Undo one edit, a file, or everything; the log survives a restart, and your own concurrent edits survive the undo.

Extends without edits

Skills with /name, lifecycle hooks, and MCP servers. It imports the servers you already set up in Claude Desktop, Claude Code, Copilot, and the Copilot CLI, local and remote.

Two parts, one protocol

The loop is not JavaScript in a webview. It is a binary speaking versioned JSON-RPC over stdio, so the UI and the runtime are tested apart, and both agree on one version constant.

docs/protocol.md · agent/run 
// the client starts a task; the runtime streams events back
{ "method": "agent/run", "params": { "prompt": "…", "chatMode": "agent" } }
{ "method": "agent/event", "params": { "event": { "type": "toolStarted", "tool": "read_file" } } }
{ "method": "agent/event", "params": { "event": { "type": "fileChanged", "path": "src/app.ts" } } }
{ "method": "agent/event", "params": { "event": { "type": "done", "stopReason": "endTurn" } } }

// 26 event types; a breaking change bumps PROTOCOL_VERSION in two files

How it fits together

Provider code stays in its own module; everything else sees only shared types, so a new provider touches two files.

runtime/

The Rust runtime: index, providers, the tools, the sandbox, the edit log, and the agent loop. Tokio, JSON-RPC over stdio.

extension/

The TypeScript extension: chat, approvals, the provider dialog, the compare panel, and the editor commands. Its RPC client never imports vscode, so plain Node tests it.

What it refuses to do

Enforced in the runtime, not requested in a prompt. Repository text cannot change the policy.

  • Workspace only

    File access stays inside the open folder. Traversal, symlink escapes, and .git internals are refused.

  • Every command is sandboxed

    sandbox-exec on macOS, bwrap on Linux. Commands write only to the workspace, temp folders, and build caches.

  • Atomic, then undoable

    Edits write atomically with rollback. A per-workspace log records every change, so review and undo work after a restart.

  • Destructive needs an allow

    Deletes and installs run only when you list them in task-x.agent.allowTools. A session grant covers a tool for one run.

  • Web pages are untrusted

    web_fetch reads public sites only, refuses loopback, private, and cloud-metadata addresses, and checks every redirect.

Documentation

Design notes for the parts worth reading before you trust them.

Runtime protocolMethods, events, and the version rule ProvidersAdding one, routing, fallback Workspace contextIndex, symbols, retrieval SecurityPolicy, sandbox, secrets Skills, hooks, MCPExtend without rebuilding RoadmapVerified, and not verified yet

On the word done. An item is marked verified only after a test or a manual check proves it. Team mode against real models, and the extension inside a real VS Code window, have so far run against mock providers. The roadmap lists them as unverified rather than finished.