NEAR AI for Copilot

Use models from NEAR AI Cloud in the native Visual Studio Code Chat and GitHub Copilot model picker, with TEE-backed providers shown by default.

The extension selects TEE providers from NEAR AI's current model catalog, streams responses from the OpenAI-compatible Chat Completions API, and supports agent tool calls and image input when the selected model advertises those capabilities. Models owned by ordinary proxied providers are not shown.

Setup

1. Create an API key in the NEAR AI Cloud dashboard.
2. In VS Code, run Chat: Manage Language Models from the Command Palette.
3. Select NEAR AI and enter the API key. VS Code stores the value as a secret.
4. Enable the NEAR AI models you want to see in the model picker.
5. Open Chat and select a model from the NEAR AI group.

Commands

• NEAR AI: Refresh Models reloads the model catalog.
• NEAR AI: Toggle Non-TEE Models switches between the default TEE-only catalog and all ready chat models, then refreshes the model picker.
• NEAR AI: Open Dashboard opens the NEAR AI Cloud dashboard for keys, credits, and usage.

Non-TEE models are hidden by default. The toggle command persists the choice in the near-ai.showOtherModels machine setting. Models outside the nearai and attested 3p owner groups can have different privacy and retention guarantees.

The extension waits 10 seconds for initial chat activity or answer text, then retries automatically up to twice if no text has appeared. It also retries transient connection failures and retryable server errors before showing any text. Once text starts, it allows 20 seconds between stream events; a stalled or disconnected partial answer is not restarted. Invalid gateway or response-signature evidence never triggers a new completion. Retrying before the first text can create another billed generation if the earlier request reached NEAR AI. Configure near-ai.inactivityTimeoutSeconds to change the initial wait, or set it to 0 to disable timeouts and automatic retries. Response-signature verification has a separate 30-second timeout and retries retryable signature lookup failures for the same completion ID. If that check times out after a complete response, the extension marks the response unverified and lets Copilot continue, including with completed tool calls. A rejected signature still fails the request.

Supported behavior

• Dynamic model discovery and capability metadata, with TEE-backed providers shown by default
• Streaming text responses
• Copilot agent tool calls and tool results
• Image input for models that advertise image support
• Request cancellation
• Configurable inactivity timeout
• Exact usage collection from NEAR AI after inference
• Pre-request token estimation calibrated from returned prompt usage
• Preflight gateway quote verification and exact-byte streamed response signature verification

Reasoning tokens are included in API usage when the model reports them, but private reasoning content is not rendered as answer text. The public VS Code provider API does not currently guarantee that exact provider usage is displayed in Copilot's context-window indicator.

Privacy and billing

Requests are billed to your NEAR AI Cloud account. The extension sends conversation context, tool schemas, tool results, and attached supported images to NEAR AI Cloud only when you select a NEAR AI model.

The NEAR AI catalog contains both TEE-hosted models and models proxied to ordinary third-party providers. Catalog owner labels are discovery metadata, not cryptographic evidence about a model. The extension requires a verified gateway signature over the client-visible stream; it does not claim a complete model-to-gateway-to-response chain.

Before each completion, the official NEAR AI Node SDK verifies fresh gateway evidence, including the Intel TDX quote, nonce, signing identity, RTMR3 event-log replay, raw app_compose to MRCONFIGID binding, and the gateway TLS peer's SPKI on the evidence connection. It pins the attested SPKI for the completion and signature requests. The extension uses the SDK's documented TCB policy, which accepts UpToDate and OutOfDate; advisory IDs are reported by test:gateway but are not individually allowlisted. The SDK also verifies returned NEAR model evidence when its metadata says attestation is supported. This policy does not verify build provenance for the measured gateway images; that is a separate check described in the image provenance documentation.

The extension sends the catalog model ID with x-no-aliasing: true, keeps text streaming, and calls the SDK's verifyResponse() after consuming the complete stream. An alias rejected by the gateway fails the request. After the SDK verifies a gateway signature over the exact request and response bytes and reports gateway TLS binding as verified, it appends ✓ NEAR AI response verified to the final text response. Verified tool-call responses omit the marker; tool calls are released after verification succeeds or its deadline expires. On a signature timeout, the extension displays ✗ NEAR AI response not verified (signature check timed out) and lets the completed response continue. Missing or invalid required evidence produces an error. A provider_tee signature is rejected by this gateway-signature policy even when its model evidence verifies. The indicator does not claim that a model-serving TEE generated the upstream response or that the gateway images came from a particular source repository. Quote collateral retrieval requires network access and fails closed when unavailable. See the gateway attestation, TLS binding, and response signature documentation.

Development

npm install
npm run check

For an opt-in live API smoke test, copy .env.example to .env, set NEAR_API_KEY, and run:

npm run test:live

Run npm run test:gateway to check a fresh gateway quote, TLS binding, TCB status, and advisories without sending a billed completion. It prints only verification metadata.

Pass a model ID to diagnose a specific catalog entry:

npm run test:live -- deepseek/deepseek-v4.1-flash

The live test prefers the inexpensive z-ai/glm-5.3-flash model, disables reasoning, and performs one short streamed completion plus one forced tool-call request. If that model is unavailable, it uses the lowest-priced ready tool-capable model in the live catalog. These requests consume a small amount of account credit. .env files are excluded from version control and VSIX packages.

Press F5 in VS Code to launch an Extension Development Host. To create an installable package:

npm run package

The package is written to near-ai-for-copilot.vsix. The build type-checks with tsc, then bundles the extension and its runtime dependencies with esbuild. The VSIX includes the bundled JavaScript and icon, without node_modules or compiler files.

License

MIT