VS Code Setup & Day-One Safety

The two-panel setup

You don't need anything fancy: VS Code's built-in terminal (Ctrl+`) running claude is the professional setup. Two things happen automatically that make it powerful:

  • Files update live. When Claude edits a file you have open, the editor tab updates in front of you — you literally watch the work happen.
  • Every change becomes a reviewable diff. The Source Control panel (the branch icon in the left sidebar) lists each modified file; click one and VS Code shows old vs. new, side by side.

Reading the diff — your seatbelt

After Claude finishes a task, before you commit anything:

  1. Open the Source Control panel and look at the list of changed files first. Does it match the task you gave?
  2. Click each file: red lines were removed, green lines were added. You don't have to understand every line — you're checking the shape of the change.
  3. An unexpected file in the list is a question, not a commit. Ask Claude why it touched that file before you accept anything.

This review habit is the single biggest difference between people who stay in control of an AI-built codebase and people who get lost in one. (Committing itself is a Git skill — our Add & Commit chapter covers it both ways.)

Optional: the Claude Code extension

The VS Code marketplace has an official Claude Code extension that adds a panel-based UI with inline diffs. It's genuinely nice — and genuinely optional. Terminal + Source Control is complete; try the extension later if you're curious, not because you must.

Guardrail 1 — protect your main branch

You're about to let an agent run git commands while you're still learning Git. The cheap insurance: tell VS Code your main branch is off-limits for direct commits, so work lands on feature branches you can review and merge deliberately.

  1. Open Settings (Ctrl+,) and search for branch protection.
  2. Under Git: Branch Protection, click Add Item.
  3. Add master, then add main.

From now on VS Code will stop accidental commits on those branches and nudge you onto a new branch instead. (Branches feel abstract at first — our Branches chapter makes them concrete.)

Guardrail 2 — .gitignore your secrets

Do this before any AI touches the repo. The classic beginner disaster isn't broken code — it's an API key committed to Git and pushed to a public repository. Prevent it structurally: open the file called .gitignore in your project root (create it if missing) and make sure it contains: 

# secrets — never committed
.env
.env.*

# Claude Code local settings
.claude/settings.local.json

Your keys live in .env, Git never sees them, and Claude reads them from there if a task truly needs them. If a secret ever does leak into a commit, treat it as burned: rotate the key (generate a new one and revoke the old), don't just delete the file. The Ignore Files chapter explains the pattern syntax.

Why structure beats discipline: one day you'll paste a key into a file at 1 a.m., mid-excitement, and forget it's there. Habits fail in moments like that — a .gitignore written on day one doesn't.

Up next: the twelve controls you'll use every day — including the one command (/init) to run before anything else, and Plan Mode, the feature that saves beginners from most wrong turns.

FAQ

Frequently Asked Questions

Do I need the VS Code extension to use Claude Code?
No. Running claude in VS Code's built-in terminal plus reviewing changes in the Source Control panel is a complete, professional setup. The official extension adds a panel UI with inline diffs — nice to have, not required.
How do I see exactly what Claude changed?
Open the Source Control panel (branch icon): every modified file is listed, and clicking one shows a side-by-side diff — red lines removed, green lines added. Review this before every commit.
What is branch protection and why add master and main?
A VS Code setting (Git: Branch Protection) that stops direct commits on the branches you list, nudging you onto a feature branch instead. With an agent running git commands while you're still learning, it's cheap insurance.
Which files must never reach Git?
.env and anything holding API keys or tokens, plus .claude/settings.local.json. Add them to .gitignore before any AI touches the repo — and if a secret ever leaks into a commit, rotate the key rather than just deleting the file.