Codvian for VS Code (preview)

The Codvian coding agent in your editor. It works with the open project, proposes file changes and commands for your approval, and uses your Codvian account or your own provider keys. This is a pre-release build and is not published to the Marketplace.

Features

• Agent panel. Chat in the Codvian sidebar. Answers stream as they are written, code is highlighted, and each answer lists the files Codvian read or changed.
• Project-aware. Codvian knows the open folder, the active file and your selection, and reads more files only when a question needs them.
• You approve changes. File edits open as a diff with Apply and Reject. Commands are shown before they run, with Run once, Allow for this session and Reject. A change to a file you edited in the meantime is refused.
• Modes.
  • Manual asks before every change.
  • Plan reads and plans only.
  • Auto runs only the categories you trusted for this workspace: editing files, creating files, running tests, builds and linters, or running other commands.
• Models. Codvian models (billed in Codvian credits), or your own key for Anthropic, Google Gemini, OpenAI, OpenRouter, DeepSeek, Groq, Mistral, xAI, about 30 more OpenAI-compatible providers, LM Studio, Ollama, or a custom endpoint. Reasoning effort is offered only where the provider documents it (OpenAI, OpenRouter).
• History. Conversations are saved automatically and reopen after a restart. Search, rename, archive or delete them from the History button.

Always refused

Codvian never reads or sends .env files, private keys, certificates, cloud and SSH credential folders, or registry token files. It never touches files outside the workspace and never deletes files. It always refuses to publish, deploy, push, run database migrations, delete recursively or use elevated rights. No mode or trust setting changes this. In an untrusted workspace it reads nothing.

Data and privacy

• Codvian models: your messages, attached context and the file contents Codvian reads are sent to the Codvian API (api.codvian.com), which forwards them to the model provider. Request metadata is recorded for your account's usage: model, token counts, credits, timing, extension version, platform and a random per-installation id.
• Your own keys: requests go directly from VS Code to that provider and are billed by it. Codvian does not receive them.
• Stored on this computer: your Codvian session and provider keys are kept in the OS keychain (VS Code SecretStorage). Conversation history is kept in VS Code's workspace storage, never in your repository. Deleting a conversation removes it from this computer only.
• The extension sends no separate analytics. Its Output log never contains prompts, file contents or keys.

Privacy policy: https://codvian.com/privacy/ · Terms: https://codvian.com/terms/ · Security: https://codvian.com/security/

Privacy and data handling

Stored locally on this computer. Nothing below leaves your machine unless you send a request.

• Conversation history — in VS Code's global storage, per account (history/<account>/), never in your repository. Deleting a conversation removes it from this computer only.
• Checkpoints — before Codvian's file tools first touch a file in an answer, a copy is saved so you can Undo; kept in global storage (checkpoints/, file-backups/), only on local storage.
• Workspace index — file metadata, symbols and imports (index/), never file text and never sensitive, generated or git-ignored files.
• Installed skills — the instructions file only, in Codvian's storage; your own skills in ~/.codvian/skills and the project's .codvian/skills.

Sent to the Codvian server (api.codvian.com), only for Codvian models. Your messages, the context you attach and the files Codvian reads are sent to the Codvian API, which forwards them to the model provider.

• Run summaries — after each Codvian-gateway run, one minimal summary is sent: the model id, how many model and tool calls ran, failures by error code, timing and the credits the gateway reported. It NEVER includes your prompts, file paths or file contents. It is off when VS Code's global telemetry is off, and off when codvian.telemetry.runSummaries is false. See your own totals with Codvian: Show Your Usage Analytics.

Your own provider keys (BYOK). Requests go directly from VS Code to that provider and are billed by it; the Codvian server does not receive them.

Secrets. Your Codvian session, API key and any MCP ${secret:NAME} header values and MCP OAuth tokens are kept only in VS Code SecretStorage (the OS keychain) — never in settings, logs or the webview. The Output log never contains prompts, file contents or keys.

Signing in

Click Continue with Google in the Codvian sidebar, sign in, and approve Codvian for VS Code. This uses OAuth 2.0 with PKCE and a local 127.0.0.1 callback, and the extension contains no client secret. Browser sign-in works in local VS Code windows. It does not work in Remote SSH, WSL, Dev Containers or Codespaces.

Advanced: Codvian: Sign In with an API Key accepts a key from the Codvian dashboard.

Development

Requirements: Node.js 20 or later and VS Code 1.100 or later.

npm ci
npm run build            # dev bundle into dist/
npm run typecheck
npm run lint
npm run test:unit        # Node test runner, no VS Code needed
npm run test:webview     # the built panel in headless Chrome
npm run test:integration # starts a separate VS Code test instance
npm run package          # production VSIX into dist-vsix/

Third-party licences of the bundled packages are in ThirdPartyNotices.txt. Support: https://codvian.com/contact/.