Pimp My IDE / Garage Dispatch
← Back to garage
September 18, 2026 · AI editors / repository privacy / egress

Your working tree is not the whole car.

An editor may need a few files to answer a prompt. That does not make the repository’s object database, LFS cache, reflogs, and global app configuration fair cargo. Treat every cloud feature like a border crossing: weigh the load, name the destination, and make refusal work.

THE TAKE: “Uses your code” is not a useful consent surface. A serious coding tool should disclose payload, trigger, destination, retention, key ownership, and the consequence of saying no—before the first archive leaves the machine.
Roll onto the Customs Scale ↓

The payload is the product decision.

A reverse-engineering report on ZCode says the signed-in desktop app packaged a commercial workspace into encrypted snapshots and attempted to upload them to Aliyun OSS. In the author’s inspected manifest, .git/lfs, .git/objects, and .git/logs made up 86.6% of a 345 MB payload; the report also says two settings that sounded relevant controlled training authorization and server indexing, not capture and upload.[1]

Those are one researcher’s findings on one inspected client, not an independent audit of every version or a court finding. The evidence is still specific enough to force the right design question: what exactly crosses the line between local context and remote custody?

.git is a time machine, not metadata dust.

Git’s own book describes .git/objects as the object database: a content-addressable store from which earlier file versions can be recovered. Trees preserve names and structure; commits point at trees and parents. Copy that database and you are not merely sending today’s source—you are moving a large part of the project’s lineage.[2]

GitHub’s secret-scanning documentation makes the security consequence plain from another angle: it scans the entire Git history on all branches for credentials, and tells users to rotate exposed credentials immediately. A key deleted from the working tree can remain alive in history. “We did not upload the current secrets file” is therefore not the same claim as “we did not upload recoverable old secrets.”[3]

Encryption in transit answers who can intercept the truck. It does not answer who owns the cargo at the destination.

Make the boundary visible before cleverness.

VS Code 1.138 is useful contrast, not a privacy certificate. Its release notes say agent SDKs are downloaded on demand and now present a download offer whenever the SDK is missing; they also expose a local Dev Container path so an agent can use project dependencies inside a named environment. The same release expands cross-app sessions and desktop-app access, which makes visible boundaries more important, not less.[4]

The lesson is not “one editor good, one editor bad.” It is that every new agent surface creates two interfaces: the feature users see and the data movement needed to make it work. Ship only the first and users are asked to approve an architecture through vibes.

Demand a six-line egress contract.

  1. Payload: current files, selected paths, ignored files, Git objects, reflogs, LFS, app config.
  2. Trigger: explicit click, every prompt, task completion, background interval, login.
  3. Destination: service, region, subprocess, storage provider, and any onward processor.
  4. Purpose: inference, indexing, rollback, sync, training, abuse review—or separate switches for each.
  5. Custody: retention, deletion path, encryption-key owner, access log, and export.
  6. Refusal: what still works when remote transfer is denied, plus a testable off switch.

If a tool cannot print that manifest, it is not ready to ask for repository-wide trust. If “off” only changes what happens after upload, label it honestly. The border is the transfer, not the checkbox copy.

Interactive makeover / physical egress manifest

Repository Customs Scale.

Traditional purpose replaced: one vague privacy toggle. Better version: select the actual cargo, watch exposure load change, close three custody contracts, and export a readable boundary receipt. Nothing here grants real network permission.

Weigh the outbound cargo

Select what a hypothetical feature requests. Percentages are teaching weights for scope—not measured bytes or a risk score.

Choose repository cargo classes
EGRESS BLOCKED · no cargo declared

Name the requested payload before asking anyone to approve remote custody.

Custody contract

Close every contract only when the product can answer it. Checked means “documented for review,” not “safe.”

Why it is better: payload and custody stay separate. A narrow working-tree request cannot silently inherit repository history; a complete disclosure still cannot impersonate user approval; and the final receipt is portable outside the settings screen.
Sources read, not vibes
  1. Ferstar — “Inside ZCode: Silently Uploading Your Entire Git History to the Cloud” (September 18, 2026): local artifacts, reverse-engineered upload flow, manifest breakdown, settings behavior, and filesystem mitigation. HN discussion.
  2. Pro Git — Git Objects: Git’s object database, blobs, trees, commits, and recovery of earlier content.
  3. GitHub Docs — Secret scanning: entire-history scanning, credential exposure, rotation, and remediation boundary.
  4. Visual Studio Code 1.138 release notes (September 16, 2026): on-demand agent SDK disclosure, local Dev Container sessions, expanded Codex harness, cross-app sessions, and desktop-app reach.

Source boundary: source 1 is a researcher’s technical account and was not independently reproduced for this dispatch. Sources 2–4 establish Git semantics and current product behavior; they do not validate the ZCode findings. The six-line contract and Customs Scale are Pimp My IDE editorial synthesis, not a vendor policy or security certification.