EbivAI for Visual Studio Code

EbivAI is the Visual Studio Code companion for ebivai.com. It connects the first folder in your open workspace to the EbivAI web app so you can share selected context and apply AI-assisted changes without moving your project out of VS Code.

Features

• Sign in, save multiple EbivAI accounts and switch between them.
• Connect the active local workspace to the EbivAI web app in real time.
• Package selected repository context with Repomix include and exclude patterns.
• Create, update, delete and revert files through EbivAI workspace workflows.
• Run locally approved project actions in selected workspace directories and return their output.
• Protect supported application messages with an end-to-end encrypted channel.

Requirements

• Visual Studio Code 1.100 or later.
• An EbivAI account and an internet connection to use the web app.
• An open local folder or workspace.
• Node.js and npm when packaging repository context with Repomix or running npm-based workflows.

The Marketplace extension already contains the public service configuration required to connect to EbivAI.

Optional Workflow Tools

The Marketplace extension does not require environment files or manual service configuration.

• Node.js, npm and npx are required for Repomix and npm-based build commands.
• Any executable referenced by a locally approved action must be installed locally.

Workspace Behavior

• EbivAI operates on the first folder when a multi-root VS Code workspace is open.
• The web app initiates context, file and build operations; VS Code displays progress, errors and command output.
• File inventory requests skip common generated folders and are capped for very large workspaces.

Extension Settings

The extension does not currently add user-configurable VS Code settings. Sign-in, connection status and account switching are managed from the EbivAI activity bar view.

Known Issues

• Workspace operations require the EbivAI web app to be open with the same account.
• If the sidebar remains disconnected, reload the VS Code window and refresh the web app.
• Multi-root workspaces currently use only the first workspace folder.
• Large file inventories may be truncated and omit generated directories.

Release Notes

0.9.4

Historical release highlights (local template features have since been removed):

• Added a dedicated transparent monochrome PNG for the VS Code activity-bar and sidebar icon.

• Reliable Realtime reconnection and queued workspace responses.

• Correlated file deployment and revert operations.

• Server-provided, tier-aware Repomix packing limits.

• Template project branches, project checkout and built preview support.

Installation

1. Open the Extensions view in Visual Studio Code.
2. Search for EbivAI.
3. Select the extension published by ebivai.
4. Choose Install.

The Marketplace extension identifier is ebivai.ebivai.

After installation, open a local folder and select the EbivAI icon in the activity bar.

Getting Started

1. Open the local folder that you want EbivAI to use.
2. Select the EbivAI icon in the VS Code activity bar.
3. Sign in with your EbivAI email address and password.
4. Open ebivai.com and sign in with the same account.
5. Wait until the extension is shown as connected and encrypted.
6. Select the connected VS Code workspace in the EbivAI web app.

Keep VS Code and the EbivAI web app open while workspace operations are running.

Working with Your Workspace

Share repository context

Use the EbivAI web app to package workspace content with Repomix include and exclude patterns. Before transfer, the extension checks the packing limit for your account; oversized packing is not sent. The local .vscode-allowed-instructions gateway is always excluded, even when requested explicitly. The extension also adds it to the workspace's .gitignore and checks the generated JSON before sending any chunks. Use forward-slash paths in packing patterns.

Apply and revert file changes

EbivAI can create, overwrite or delete files in the connected workspace. The web workflow can also send file contents that restore an earlier deployment.

Important: File operations are applied when the web app sends them. Commit or back up important work before deploying generated changes.

Protected deployment files

The extension hardcodes a protected-path list. Deployment and separate deletion requests cannot create, overwrite or delete these files, including through the correlated revert workflow. A request's operation type cannot disable this check.

When a batch includes protected files, the extension skips them and continues deploying the other files. VS Code displays a security warning, and the web app receives the rejected paths and a manual-update notice. Only confirmed deployed files enter deployment history or update the web app's workspace context. Review and apply protected-file changes manually in VS Code.

The web app does not maintain or receive a copy of the protection list. File inventory and Repomix packaging additionally exclude .vscode-allowed-instructions; other protected source files can still be shared as context.

Run project commands

Create .vscode-allowed-instructions in the first workspace folder's root. Open it normally in VS Code, edit it as plain text and save it. Each executable rule must occupy one line, with an action followed by a colon and its exact terminal command:

# Commands trusted on this machine
build:npm run build
lint:npm run lint
test:npm test

The frontend sends action names in its commands script: for example, build, or lint followed by build on separate lines. The extension translates each name into the terminal command configured locally. action_type (currently log) is legacy metadata and does not select or authorize commands. Each executable frontend line must exactly match a case-sensitive local action name. Extra whitespace, arguments, inline comments, raw shell commands and chaining are rejected. Colons within local terminal commands are supported. Multiple rules for one action execute their distinct commands in file order; script actions execute in script order.

Blank lines and full-line comments beginning with #, //, :: or REM are ignored. Inline comments are not stripped. Malformed local rules, unknown actions, empty scripts or any unmatched script line reject the whole request before any command runs. When the file is absent, the only accepted action is build, resolved to npm run build. An existing empty file allows nothing; existing rules replace, rather than extend, that default.

Git revert-all/discard-all is not built in. Git commands can run only through action mappings explicitly saved in this file, with the same validation as other commands.

For a different project, use a different local mapping, such as build:pnpm build or build:dotnet build. The frontend still sends only build. In the web app's Build Scripts settings, put action names in Script Content, not terminal commands or action:command rules. The script's display name does not control execution. The same rule applies to the interactive terminal and automated post-deploy scripts. Existing web scripts containing npm run build must be changed to build for VS Code; server scripts continue to contain ordinary shell commands.

Directories must resolve to existing directories inside the workspace. Execution stops on the first command failure, without proceeding to later commands or directories. Validation and execution errors are returned to the web app. Logs are also available in the VS Code Output panel under the legacy “Repochat” channel name.

The extension automatically appends /.vscode-allowed-instructions to the workspace's .gitignore. It hides the gateway from inventory and packing, blocks remote file changes to it. Deployment-history reverts restore file contents without running Git.

Server-side Template Projects and Previews

Use the web app's server-side Docker workflow for template repositories, project creation, project switching and previews.

The extension does not run template setup commands, manage template project branches, force-track build output or upload local dist files for previews.

Security

• Account sessions are stored using VS Code Secret Storage.
• After connecting, the extension negotiates an ECDH P-256 shared key and supports AES-256-GCM encrypted application messages.
• Connection coordination, including presence and the current workspace path, is sent separately through the EbivAI Realtime channel.
• Confirm that EbivAI reports the workspace as connected and encrypted before transferring source content.

Current deployment protection list

Names are matched case-insensitively at every directory depth, with both / and \ path separators recognized. A matching path component is blocked, so protected directories and all their descendants are protected too.

• Instructions: .vscode-allowed-instructions
• Node.js manifests and locks: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml
• Rust manifests and locks: Cargo.toml, Cargo.lock
• Java build files: pom.xml, build.gradle
• Go manifests and locks: go.mod, go.sum
• Python dependency configuration: requirements.txt, pyproject.toml
• IDE and Git paths, including descendants: .vscode, .git
• Environment files: .env, .env.local

Deployment also rejects absolute paths, parent traversal, Windows alternate-data streams and ambiguous trailing-dot/space names, non-local workspaces, and symbolic or hard-link aliases. Separate deletion requests use the same protected-path guard. The console allowlist is not an execution sandbox: approved commands run with your local permissions and can modify files or expose secrets in their output. Review every local rule and the scripts it invokes. Locally approved commands, including Git commands, can modify protected files despite the deployment guard.

Privacy and Safety

Depending on the workflow you start, the extension may send:

• The current workspace path for connection and workspace selection.
• Relative file paths, sizes and modification times for workspace inventory.
• Source content selected for Repomix packaging.
• Build command output and error logs.

Only connect devices and browser sessions that you trust. Treat generated file operations and build commands as local code execution.

The extension does not upload the entire workspace automatically. Source content is transferred when you start a context-sharing workflow from EbivAI.

For account and product information, visit ebivai.com.