Text Editor AI Agents: How They Edit and Run Your Code

A text editor AI agent is a language model wired into your editor with permission to act. It reads and edits files in your project and can run commands in a terminal, then reports back what it changed. You give it a task in plain English; it plans the steps and carries them out while you watch the diff grow.

That is the whole idea, and it is a big shift from autocomplete. A completion suggests the next line. An agent rewrites a function across five files, then runs the tests to check its own work. This guide covers how the editing works under the hood and how to keep the thing from doing something you will regret.

What a text editor AI agent is, in AI assisted coding terms

AI assisted coding comes in two flavours. Assistive tools answer questions and suggest code that you paste in. Agents take actions themselves, in a loop, until the task looks done.

The loop has three moving parts:

• The model is the reasoning engine that decides what to do next.
• The tools are the actions it is allowed to take, such as reading a file or running a shell command.
• The harness is the program that connects the two. It sends your request to the model, executes the tool calls the model asks for, and feeds the results back in. Your editor is the harness.

VS Code's own documentation says agents can edit code and run terminal commands, and call external services on top. Both abilities are useful. Both are also ways for a confident model to break your afternoon.

The distinction matters because the quality of an agent depends heavily on the harness. The same model can feel brilliant in one editor and clumsy in another, depending on what context it is given and how its edits are applied. If you want the deeper architecture behind this split, Agentic AI Engineering covers reasoning loops and tool design from first principles.

How a coding agent edits a file without rewriting it

The short version: the agent sends a find-and-replace request, and the editor applies it. Rewriting a whole 900-line file to change one line would be slow and expensive, so modern agents edit surgically.

Anthropic's text editor tool documentation shows how this works for Claude. The tool is called str_replace_based_edit_tool, and it has four commands:

• view reads a file, or a line range of it, or lists a directory.
• str_replace swaps one exact piece of text for another.
• create writes a new file.
• insert adds text after a given line number.

The interesting one is str_replace. The model supplies an old_str that, in Anthropic's words, "must match exactly, including whitespace and indentation," plus the new_str to put in its place. If the text appears twice, the edit fails and the model has to include more surrounding lines until the match is unique. That one rule explains a lot of agent behaviour you may have seen, like an agent re-reading a file it read a minute ago. It is checking that its memory of the indentation is correct.

The tool also runs on your side. Claude only asks for the edit; your application, or your editor, performs it and returns the result. Anthropic's best-practice notes say to validate file paths against directory traversal and to back up important files before allowing edits.

Tab characters versus spaces, then, is now a problem two species argue about.

Text editor AI agent examples: VS Code, Zed and terminal agents

Here is how the main options compare day to day.

VS Code tracks agent edits in a working set. Keep clears the pending-review state, and Undo reverts the change without rewinding the conversation. One catch is easy to miss: edits the agent makes through terminal commands or scripts do not appear in that working set at all. If the agent ran a sed command, the review panel will not show it.

Zed takes a similar approach with profiles. Write enables editing and running commands; Ask is read-only for codebase questions; Minimal turns project tools off. Zed also hosts outside agents through the Agent Client Protocol, an open standard for plugging a coding agent into any editor that supports it. Its registry lists Claude and Codex among others, so you can keep Zed's interface and bring the agent you prefer.

Claude Code started in the terminal and moved outward. For a beginner-level walkthrough of how it works, Claude AI for Beginners covers vibe coding with Claude Code from a standing start.

Claude coding vs other AIs: does the model matter?

It matters, and less than people think. Model choice decides how well the agent plans and how often it gets an edit right first time. The harness decides what the agent can see and how safely it acts.

Most editors now let you pick. Zed accepts its own hosted models and your own API keys among others, including local models through Ollama or LM Studio. VS Code offers several harnesses behind the same chat panel. That makes a fair comparison cheap: give two models the same small, real task in your own repository and compare the diffs.

Local models deserve a note. They keep code on your machine, which some teams require, but agent loops are demanding: the model has to follow tool formats precisely across dozens of steps. Our guide to running a local LLM covers the hardware side. Expect a smaller local model to stall on multi-file tasks that a frontier model handles in one pass.

Every model will tell you the refactor is complete. Every model is an optimist about its own work.

Vibe coding security: approvals, sandboxes and prompt injection

An agent that can run terminal commands can run the wrong one. The defences are approval prompts and sandboxing, backed by your own review.

The VS Code approvals documentation sets out a scale of permission levels. At one end, Manual permissions, the default, asks before tool calls according to your approval settings. At the other, Allow all runs every tool call without confirmation. The docs warn that tool results "can also contain prompt injection attempts," meaning text inside a file or web page written to trick the agent into running harmful commands. They also call terminal auto-approval "a best-effort convenience" and say it should never be treated as a security boundary.

Zed's tool permissions work on the same principle. The default is to confirm, and you can write per-tool rules that always allow or always deny commands matching a pattern. Deny rules win over the others, so a rule blocking destructive commands holds even if you allow everything else.

Three settings are worth changing on day one:

• Keep the default confirm-first mode until you know how the agent behaves in your repository.
• Block edits to secrets files. VS Code supports this with chat.tools.edits.autoApprove set to false for patterns like **/.env.
• Turn on sandboxing where the editor offers it, so terminal commands cannot reach the network or files outside the project.

Checkpoints help with mistakes in files. They do not reverse terminal commands or deployments. Treat any approval that touches something outside the repository as final.

An AI assisted coding routine that keeps you in charge

Agents are fast, and speed hides mistakes. A short routine keeps the gains without letting the codebase drift into something nobody understands.

1. Start from a clean commit, so every agent change is one git diff away.
2. Write the task with file paths and a definition of done, such as "tests in tests/billing pass."
3. Let the agent run the tests itself, and read the failures it reports.
4. Review every hunk before you keep it. Reject anything you cannot explain.
5. Commit in small steps, with a message you wrote.

Step four is the one people skip. The agent wrote the code, but you are the one who answers for it in code review, and in the pager rotation. Our piece on whether software engineers will be replaced by AI argues that this judgment is the part of the job that is growing.

Pick one editor, keep approvals on for a week, and watch which commands the agent asks to run. You will learn more about its habits in that week than from any benchmark. And when it asks permission to delete node_modules, you can decide for yourself whether that is an attack or a kindness.