Obsigen Forge · as of 2026-10-22 · Early Access

Obsigen on your computer.
Forge for VS Code. Runtime without an IDE.

The Obsigen agent in a VS Code panel. Confirmations only for commands that could break something - everything else runs in the OS sandbox (macOS and Linux), and one click undoes the file changes of any turn.

Join Early Access Book a demo

In Early Access, the extension is distributed as a .vsix file.

Changelog System architecture

EXPLORER

src
validators
email.ts
taxId.ts U
OrderForm.tsx M
api.ts
tests
package.json
NOTES.md

OBSIGEN FORGE

Tax-ID validation in checkout

MacBook-Proshop-demo

Reading the order form and existing validators.
Read 3 filesOrderForm.tsx · validators/ · api.ts
editvalidators/taxId.ts+24−0syntax ✓
editOrderForm.tsx+6−2syntax ✓
Run npm test?

RunSkipTo terminal

$ npm testsandbox

Tests: 14 passed · 2.1 s
Changed 2 files · 2:32 PMUndo turn
Plan 4/4

Turn in progress…Turn finished - send the next requestCodeGenius

interface simulation · sample data

13 → 1¹

confirmation cards in a typical turn. The folder guard and the OS sandbox replace the confirmations that protected nothing.

1Features

Code and Plan modes - in Plan mode the agent first presents its intent and only then changes files.
Attachments: selection, file, image, document.
Run / Skip / To terminal - a card only for commands that could break something.
“What I changed” after every turn; one click undoes the file changes of the whole turn.
Syntax check after every save - TS/JS, Python, PHP, Lua, Bash and HTML (6 languages²); project verification after the turn.

For engineers

Command classes R/A/D/X (read, append, delete, execute); network modes off | localhost | on.

2Safeguards

safeguard	what it does
workspace boundary (`realpath`)	the extension works only inside the workspace; symbolic links that point outside it are rejected
excluded secrets	`.env` files and files recognised as keys or tokens are kept out of the turn
folder guard R / A / D / X	classifies commands: read, append, delete, execute; confirmation only for classes that carry risk
OS sandbox	macOS Seatbelt, Linux bubblewrap; on Windows the OS sandbox is in preparation - until then Forge asks for confirmation more often
network: off \| localhost \| on	off by default; localhost for testing; full access only when deliberately turned on
environment variable scrubbing	variables recognised as secrets reach neither the model nor the log
commands outside the fence	docker, ssh, gh, installers, git fetch, sudo - always with confirmation
protection of changes made outside the turn	a file changed outside the turn (`mtime`) is not overwritten without confirmation
device token	in SecretStorage / the system keychain; one per device, revocable from the account panel

Tests: 37/37 extension tests³.

3Obsigen Runtime

Obsigen Runtime is a single file that runs on your computer. It lets Obsigen work on local files without copying folders to a server. It opens one outbound connection and does not listen on any port. It runs commands inside a fence enforced by the operating system, and one command undoes the file changes of any turn. It runs only when you start it, is not a system service and connects only to your tenant - never to GRID.

Obsigen Runtime is asking for consent

Run a command in the “Quality” folder?

python3 causes.py complaints-2026.xlsx

The command sees only the shared folders.

DenyRun

interface simulation · sample data

Runtime sits between your files and your tenant and is the only component of the system with access to your disk.

Folders are shared one at a time, with the share command. The path is resolved with realpath; the home directory and the file system root are rejected, so the whole disk cannot be shared by mistake.
17 credential locations⁴ are masked before every command: SSH and GPG keys, cloud and cluster credentials, the password manager, .netrc, .git-credentials, the Docker configuration, and Chrome, Firefox and Brave browser profiles. Directories get an empty filesystem; files get a link to /dev/null.
By default, a command sees only the loopback interface. Network access is a per-folder setting, and environment variables that look like secrets are removed unless you specify otherwise.
The local technical log - without file contents - is deleted automatically after seven days.

A shared core for Forge and Runtime

Forge and Runtime use a single device-core module: file rules, the fence, undo copies and confirmations.

4OS fence

Command restrictions are enforced by the operating system, not by our code - they apply regardless of what the command does and which processes it starts along the way.

The reach of a single command. Writes only in open folders, the temporary directory and tool caches; the rest of the disk is read-only; credential locations are masked; the network is limited to loopback. Every child process inherits the fence.

We do not ask you to trust our code. We show what the system allows it to do.

0 listening ports⁵

The connection is always initiated by Runtime - there is no entry point from outside.

1 dependency⁶

in the production release. No native modules, a single file.

17 credential locations⁴

masked before every command (macOS and Linux).

Five guarantees

You can check three of them yourself, on your own computer.

Runtime does not open a port

The connection to the tenant is established by Runtime, never the other way around. Without a listening socket nobody can connect to Runtime from outside - neither from the internet nor from the local network. To verify: lsof -i -P | grep obsigen shows nothing in the LISTEN state.

The operating system enforces the fence

On macOS it is Seatbelt, on Linux bubblewrap. The restrictions apply to the command and to every process it starts.

Credentials are masked

The usual places for keys and passwords - SSH, cloud, the password manager - are masked regardless of the command. A directory appears empty; a file appears as /dev/null.

The file changes of every turn can be undone

A copy is made before every write, and each turn has its own manifest. obsigen-runtime undo restores files in reverse order and removes those that did not exist before. pause stops work at any moment, and audit shows the day's history - all locally.

Windows: Forge today

On Windows, file work is handled by Forge, with confirmations in the editor. Obsigen Runtime and an OS sandbox for Windows are in preparation.

5Runtime boundaries

Runtime is the only component of Obsigen with access to your disk, which is why we describe its boundaries precisely.

boundary	what crosses it	what remains on this side
Your disk → Runtime	only the contents of shared folders	the rest of the disk - Runtime cannot see it
Runtime → your tenant	what the turn requires: file content, command output, search results	the folder is neither copied nor synced
Command → disk	writes in open folders, the temporary directory and tool caches	the rest of the disk is read-only; credentials are invisible
Command → network	loopback only, by default	network access is a per-folder setting
Runtime → local log	paths, hashes, exit codes, step labels	file contents and command output are not recorded
Runtime → GRID	nothing - no such connection exists	Runtime connects only to your tenant

6Commands and platforms

Obsigen Runtime commands

 $ obsigen-runtime login            # authorize in the browser; one token per device
$ obsigen-runtime share ~/Reports  # folder shown in the app as “on my computer”
$ obsigen-runtime audit --today    # what Obsigen did on this computer today
$ obsigen-runtime undo             # undo the last turn
$ obsigen-runtime pause            # pause until resumed

consent in a native dialog on the device: Run / Skip / To terminal;
results saved in your Obsigen folder;
macOS available and Debian available - native consent dialogs (zenity on Debian); Windows in preparation - until then, Forge in VS Code does the work on Windows;
0 listening ports⁵ - a test in the repository checks that no Runtime source file listens.

7What sets Forge apart

company documents and data in context, not just code: an ERP specification, a spreadsheet, a technical drawing;
visual check by the Obsigen Magnify module, plus verification;
company glossary - abbreviations such as WZ (goods issue note) and MPK (cost center), system names - picked up from conversations;
data on dedicated infrastructure, consent on the device;
usage in the app panel: model, tokens and time of every task.

Forge is an extension, not a fork of VS Code or a separate Electron app. It does not run in the background and is not a remote desktop - it connects only to your tenant.

Demo · 45 min

See Obsigen on your own example

We show Obsigen live, online, on a document you bring - with no confidential data. Then a quote and deployment on dedicated infrastructure.

Book a demo Let's talk

step 1Demo · 45 minonline, on your example
step 2A one-page quotewithin two business days
step 3Deployment and team starta dedicated tenant and team accounts

Footnotes

Obsigen Forge tests 2026-09-06 · typical Forge turn; folder guard and OS sandbox
code review 2026-09-08 · TS/JS · Python · PHP · Lua · Bash · HTML - syntax check after every file write
test reports 2026-09-06/07 · 2026-09-07 · Obsigen Forge
Runtime 0.5.0 release §1 · 2026-09-23 · credential locations masked before every command (SSH, GPG, AWS, GCP, Azure, Kubernetes, password manager, .netrc, .git-credentials, Docker, browser profiles) - where the OS provides the fence
Runtime automated test 2026-09-08 · Obsigen Runtime: automated test - no component listens on a port
Runtime 0.5.0 release §2 · 2026-09-23 · external dependency in the production release; no native modules, one file