feat(vscode): Configurable daemon mode in extension

docs/CONFIGURATION.md

@@ -575,11 +575,11 @@ rejected with no file write.
 ## VS Code Extension
 
 The VS Code extension:
-- Connects to the daemon automatically
+- Connects to the daemon selected by `abbenay.daemonMode` (`auto`, `embedded`, `standalone`, `remote`, or `disabled`; default: `auto`)
 - Provides workspace paths for workspace-level config
 - Registers configured models with VS Code's Language Model API
 
-No configuration is stored in the extension itself.
+`auto` preserves existing behavior: a configured `abbenay.daemonAddress` selects a remote daemon; otherwise the extension connects to a local daemon and starts one if needed. `embedded` uses the extension-bundled daemon and an isolated local IPC runtime. `standalone` connects to an already-running local daemon without starting one. `remote` requires `abbenay.daemonAddress` and never starts a local process. `disabled` skips daemon connection/startup and Language Model API registration; the Abbenay extension view and commands remain available but disconnected. Changes to the mode reconnect the extension to the selected instance.
 
 ## CLI Configuration
 

docs/decisions.md

@@ -970,3 +970,34 @@ CLI namespace. Fail-closed on unrecognized tokens closes that hole without
 breaking no-token local DX. Tracked as
 [issue #71](https://github.com/redhat-developer/abbenay/issues/71).
 
+---
+
+## DR-053: VS Code daemon connection modes
+
+**Date:** 2026-10-21
+**Decision:** Add an `abbenay.daemonMode` VS Code setting with `auto`, `embedded`,
+`standalone`, and `remote` options; default to `auto` to preserve current behavior.
+`embedded` starts/attaches to the bundled daemon using isolated local IPC,
+`standalone` only attaches to a running local daemon, and `remote` requires a
+configured gRPC address. `disabled` leaves extension commands and views visible
+but skips daemon connection, startup, and Language Model API registration. Changing
+the mode reconnects the extension.
+**Rationale:** Users need to explicitly select which Abbenay instance the VS Code
+extension uses, especially to test the bundled daemon without accidentally
+attaching to an existing system daemon or silently starting a local process. A
+disabled mode lets dependent extensions ship Abbenay without forcing users to
+activate its daemon or language-model provider.
+
+---
+
+## DR-054: Patch VS Code test-tool transitive vulnerabilities
+
+**Date:** 2026-10-21
+**Decision:** Upgrade the VS Code test CLI and VSCE to releases compatible with
+the repository's Node.js 22.12+ floor, and apply npm overrides for patched
+`diff` and `serialize-javascript` versions scoped only to the test CLI's Mocha
+subtree.
+**Rationale:** The prior test-tool dependency tree included known vulnerable
+versions, including high-severity serialization and denial-of-service issues.
+The scoped overrides preserve the runtime API surface of Mocha and avoid
+upgrading unrelated consumers, while allowing the repository audit hook to pass.