Permissions and data flow
What leaves your machine, what stays local, and which actions need an explicit human decision — including the licence question people skip.
🎯 For Security and DPO reviewers
- Say exactly what leaves a workstation
- Name which actions need a human decision
- Check a component licence before redistribution
Two separate questions get confused all the time: what may the assistant do on my machine, and what data leaves it. This page answers both, in the order that matters.
🧭 What leaves your machine
Only what you send:
| You send | Where it goes | Why |
|---|---|---|
| The question text | Tvijo service → model route | The model must read it |
Context you attach (+, selection) |
Same | It is part of the prompt |
| A knowledge-base file you upload | Stored for your account | You asked for it to be searchable |
| Task metadata (tokens, cost, model) | Usage ledger | So the receipt exists |
The client does not scan your project, index your disk, or upload files in the background. Knowledge-base upload is a single explicit action with narrow rules: one UTF-8 regular file inside the current working directory, up to 512 KiB; symlinks, binary content, credential-like filenames and text that looks like an inline credential are rejected.
🧭 What stays local
- Login state and transcripts:
~/.config/dshrempub/, written atomically with owner-only permissions (0600files,0700directories). - No provider API key is collected by the editor at all.
- Credentials are bound to the service URL you signed in with — a credential from one endpoint is not valid at another.
Treat a session file as you would a shell history: it can contain sensitive prompts. Do not share it, and do not commit it.
🔹 What an automated worker may touch
When a task can act (read files, run a command, write a patch), the action falls into a class. The class — not the model's confidence — decides whether a human must approve:
| Class | Examples | Default |
|---|---|---|
| Read-only | Inspect a repository, run a status command, read logs | Allowed |
| Repository write | Edit files in a working copy, write a report | Allowed inside the task's scope |
| Remote mutation | Deploy, restart a service, change a public endpoint | Explicit decision |
| Money path | Trading keys, payments, billing, real order placement | Explicit decision, fail-closed |
Two consequences worth stating plainly:
- A write-capable agent needs an owned working copy. In a shared tree, one worker's cleanup can delete another worker's uncommitted file. Parallel lanes get separate copies and disjoint paths.
- "The agent decided to deploy" is never an acceptable sentence. Remote and money actions are named by a human before they happen.
🔹 Licensing is part of data governance
A public repository is not automatically Open Source, and "I can read it" is not "I can ship it":
- The
dshrempubpackage metadata isUNLICENSED; a public licensing decision is still pending. - TvijoCode is built from Code - OSS sources with their own licence and bundles third-party extensions from Open VSX, each with its own terms.
- Removing licence notices, or redistributing a build internally, can breach terms even when the source is public.
Check each component's licence before redistribution. If that sentence is inconvenient, it is still true.
🚧 When this does NOT work
- Regulated personal data. Do not send it to a shared route without a written agreement that names the data class and the retention rule.
- Secrets in prompts. Redact them. A prompt is data you have published to a service.
- A shared workstation. Owner-only file permissions protect you from other users, not from root.
- A "public" repository as a licence. It is not one.
➡️ Next
- Recovery after a failed run — what to do when a task stops halfway.
- Costs, budgets and limits — the receipt and the ledger.
- Running a pilot — the gates to agree before a team starts.
Sources
Each source was opened by a human on the date shown. Product behaviour is described from this deployment, not from marketing material.
🔗 Article connections
Open the full knowledge graph ↗Next steps
Related reading
DSHREM robustness audit, October 2026
Six defects found in cancellation, retry, fallback and cost accounting. One money bug is fixed and covered by tests; five remain open with exact locations.
Getting startedTvijoCode: what the test build does and does not do
A VS Code build with the Tvijo extension embedded, Windows x64 only for now, unsigned, no auto-update — and a clear list of what you give up.
Costs, access and recoveryRecovery after a failed, stuck or uncertain run
No automatic paid retries, an uncertain task blocks further spend, and reconcile never resends inference. The exact commands to get unstuck.
Getting startedInstall the Tvijo extension in your editor
Ask about a selection without leaving VS Code: the same account, the same capped task, the same receipt — and no API key stored in the editor.
💬 Comments