web: a folder cannot configure the editor

Workspace Trust is off in a tab, so a setting without a scope was read from the
folder's .vscode/settings.json as if the user wrote it. Measured in the real
workbench: levelcode.cloud.endpoint, levelcode.ai.baseURL, agent.autopilot,
verify.command and commandTimeout all came back as the folder's values, and the
session token goes to whatever https host the endpoint names.

The browser manifest now makes every setting application-scoped except a short,
double-entered list of display preferences. The desktop manifest is untouched.

Author: ndemianc

docs/WEB.md

@@ -274,6 +274,13 @@ causing the effect). Use another registrable domain.
 - **Keys of the user's own** (BYOK) are stored the same way and used from the tab to the provider the
   user chose; no LevelCode call is involved (the end-to-end check asserts it). The provider must
   accept requests from a web page; Anthropic's is called with its browser-access header.
+- **A folder does not configure the editor.** Workspace Trust is off in a tab, so a setting with no scope is read
+  from the folder's `.vscode/settings.json` as if the user had written it. That would let a folder name the account
+  host the session token is sent to (`levelcode.cloud.endpoint`), the provider's base URL, Autopilot, or the budgets.
+  The browser manifest makes every `levelcode.*` setting `application`-scoped except an explicit list of display
+  preferences (`WORKSPACE_SETTINGS_OK` in `web/ai-extension/manifest.js`, double-entered in `manifest.test.js`).
+  The desktop manifest is untouched. Measured in the real workbench 2026-10-11 (unscoped: all three came back as the
+  folder's values; `application`-scoped: the defaults).
 - **The scratch workspace and the extension's private state are on the extension host's origin**, in
   IndexedDB. With the host isolated they are not readable from the editor's page, by design.
 

web/ai-extension/manifest.js

@@ -29,6 +29,35 @@ const REMOVED_SETTINGS = new Set([
 	'levelcode.ai.ollama.model',
 ]);
 
+/**
+ * The settings a FOLDER may set. Everything else is application-scoped in the browser edition.
+ *
+ * The workbench in a tab runs with Workspace Trust off (web/lib/config.mjs), and a setting with no scope is read from the
+ * workspace's .vscode/settings.json when there is one. A folder opened from the computer, or a project the agent was
+ * asked to read, could then set the account host (levelcode.cloud.endpoint: the session token goes to whatever https
+ * host that names), the provider's base URL, Autopilot, the step and token budgets, the verify command. Measured in
+ * the real workbench by the shell review (2026-10-11). 'application' scope makes the workbench ignore the workspace's
+ * value, so only the user's own settings count.
+ *
+ * Default-deny: a setting added to the desktop manifest later is application-scoped here until someone puts it on
+ * this list, and web/test/unit/manifest.test.js fails if one is on it that does not exist.
+ *
+ * Only things that change what is shown, or which of the open files are offered as context, are listed.
+ */
+const WORKSPACE_SETTINGS_OK = new Set([
+	'levelcode.ai.includeActiveFile',
+	'levelcode.ai.chat.autoContext',
+	'levelcode.ai.chat.autoContextMaxFiles',
+	'levelcode.ai.chat.scopeToActiveProject',
+	'levelcode.ai.chat.workspaceMap',
+	'levelcode.ai.chat.startLocation',
+	'levelcode.ai.chat.fontSize',
+	'levelcode.ai.chat.maxImagesPerMessage',
+	'levelcode.ai.chat.proseWidth',
+	'levelcode.ai.chat.groupActivity',
+	'levelcode.ai.diagrams.enabled',
+]);
+
 const WELCOME = {
 	id: 'welcome',
 	title: 'Welcome to LevelCode',
@@ -80,6 +109,9 @@ function toWebManifest(pkg, opts) {
 		const sections = Array.isArray(c.configuration) ? c.configuration : [c.configuration];
 		for (const s of sections) {
 			for (const k of Object.keys(s.properties || {})) { if (REMOVED_SETTINGS.has(k)) { delete s.properties[k]; } }
+			for (const [k, def] of Object.entries(s.properties || {})) {
+				if (!WORKSPACE_SETTINGS_OK.has(k) && def && typeof def === 'object' && !def.scope) { def.scope = 'application'; }
+			}
 		}
 	}
 	c.walkthroughs = [JSON.parse(JSON.stringify(WELCOME))];
@@ -89,4 +121,4 @@ function toWebManifest(pkg, opts) {
 	return out;
 }
 
-module.exports = { toWebManifest, REMOVED_COMMANDS, REMOVED_SETTINGS, WELCOME };
+module.exports = { toWebManifest, REMOVED_COMMANDS, REMOVED_SETTINGS, WORKSPACE_SETTINGS_OK, WELCOME };

web/test/unit/manifest.test.js

@@ -85,6 +85,28 @@ test('settings that need a shell, a disk or a local model server are not offered
 	assert.ok('levelcode.cloud.endpoint' in props && 'levelcode.ai.providerMode' in props, 'the settings the sign-in depends on are still here');
 });
 
+test('no setting a folder can set decides where the session goes, what runs, or how much is spent', () => {
+	// Workspace Trust is off in the tab, so a folder's .vscode/settings.json is read as if the user wrote it, unless the
+	// setting is application-scoped. Default-deny: everything is, except an explicit list of display preferences.
+	const props = Object.assign({}, ...(Array.isArray(m.contributes.configuration) ? m.contributes.configuration : [m.contributes.configuration]).map((s) => s.properties));
+	const open = Object.keys(props).filter((k) => !props[k].scope).sort();
+	assert.deepStrictEqual(open, [...web.WORKSPACE_SETTINGS_OK].sort(), 'a setting a folder can set that is not on the list: ' + open.filter((k) => !web.WORKSPACE_SETTINGS_OK.has(k)).join(', '));
+	for (const k of web.WORKSPACE_SETTINGS_OK) { assert.ok(k in props, k + ' is on the workspace list but is not a browser setting: stale entry'); }
+	// The list is written out here as well on purpose: opening a setting to folders is a decision, made in two places.
+	assert.deepStrictEqual([...web.WORKSPACE_SETTINGS_OK].sort(), [
+		'levelcode.ai.chat.autoContext', 'levelcode.ai.chat.autoContextMaxFiles', 'levelcode.ai.chat.fontSize', 'levelcode.ai.chat.groupActivity',
+		'levelcode.ai.chat.maxImagesPerMessage', 'levelcode.ai.chat.proseWidth', 'levelcode.ai.chat.scopeToActiveProject', 'levelcode.ai.chat.startLocation',
+		'levelcode.ai.chat.workspaceMap', 'levelcode.ai.diagrams.enabled', 'levelcode.ai.includeActiveFile',
+	]);
+	for (const k of ['levelcode.cloud.endpoint', 'levelcode.cloud.apiUrl', 'levelcode.ai.baseURL', 'levelcode.ai.provider', 'levelcode.ai.providerMode',
+		'levelcode.ai.agent.autopilot', 'levelcode.ai.agent.maxSteps', 'levelcode.ai.agent.maxTokens', 'levelcode.ai.skills.enabled']) {
+		assert.strictEqual(props[k].scope, 'application', k);
+	}
+	// the desktop manifest is not touched by any of it
+	const dprops = Object.assign({}, ...(Array.isArray(desktop.contributes.configuration) ? desktop.contributes.configuration : [desktop.contributes.configuration]).map((s) => s.properties));
+	assert.strictEqual(dprops['levelcode.cloud.endpoint'].scope, undefined);
+});
+
 test('the browser binds a key the browser lets through', () => {
 	assert.ok(m.contributes.keybindings.some((k) => k.command === 'levelcode.ai.focus' && k.key === 'ctrl+alt+i' && /isWeb/.test(k.when)));
 });