Neelverse SF 2.0 for VS Code

Neelverse SF 2.0 is an autonomous AI engineering extension for VS Code. It combines a sidebar chat, workspace implementation tools, Salesforce CLI operations, and async-job tracking.

What changed in 0.7.0

• Workspace file actions resolve real paths, so a symlink inside the workspace cannot reach files outside it.
• Salesforce CLI and local npm/npx/node processes run without a shell, so arguments are never re-interpreted.
• Every executed command has a hard timeout and a bounded output buffer.
• Active-editor context uses path-segment containment instead of a string prefix.
• New settings: neelverseSf.execution.sfTimeoutSeconds, neelverseSf.execution.processTimeoutSeconds, neelverseSf.execution.maxOutputBytes.

What changed in 0.6.x

• AI is now provided automatically through the authenticated Neelverse relay.
• The server uses Claude Opus 5 (claude-opus-5) by default.
• Users only enter the Neelverse activation code; no Kiro Gateway, Kiro CLI, endpoint, model, or API key is required locally.
• The gateway credential and model selection stay server-side.

After activation, open the Neelverse sidebar and start working. AI requests are sent to https://vscode.lalitpandit.in with the activation token stored in VS Code SecretStorage.

What changed in 0.4.0

• Added a direct Kiro CLI provider. The extension starts the locally authenticated kiro-cli process, sends prompts over stdin, and consumes the model response without storing a Kiro credential.
• Added Kiro model discovery and selection from the models available to the signed-in Kiro account.
• Added configurable provider priority:
  • VS Code AI → Kiro CLI → external API, or
  • Kiro CLI → VS Code AI → external API.
• Added a sandboxed Kiro workspace agent with no Kiro tools or MCP servers; all file and Salesforce actions remain executed and verified by the extension.
• Added Kiro connection verification, timeout, executable-path, and model settings.

Previously added in 0.3.0

• Added activation-code licensing through https://vscode.lalitpandit.in.
• All engineering, AI, Salesforce, model-selection, and configuration functions stay locked until the extension has a valid activation.
• Activation tokens are stored in VS Code SecretStorage; activation codes are not stored locally.
• The license is revalidated on startup, before work, during agent iterations, and every five minutes.
• An expired or remotely revoked code stops the extension at the next validation. Validation fails closed if the licensing service cannot be reached after the local five-minute validation window.
• Installation limits are enforced by a privacy-preserving hash of VS Code's opaque machine identifier.

Activation

1. Install the VSIX.
2. Run Neelverse SF 2.0: Activate Extension or click Activate in the sidebar.
3. Enter the code issued by Neelverse.

The activation server is fixed to https://vscode.lalitpandit.in; it is not an end-user configuration setting. A working internet connection is required for periodic validation.

Previously added in 0.2.0

• Removed the old Salesforce-only request restriction. The chat can answer general questions and help with general project work.
• Added a Neelverse activity-bar container and a Hermes-style persistent sidebar chat.
• Uses the available/user-selected VS Code Language Model first and by default.
• An OpenAI-compatible endpoint is now an optional fallback, not the first choice.
• Added acceptance-criteria-driven autonomous development:
  • workspace inspection
  • blocking clarification questions
  • dependency-aware planning
  • iterative file creation and modification
  • Salesforce CLI execution
  • local npm/npx/node validation
  • real-result feedback and repair loops
  • plan persistence in .neelverse/plans/latest.md
• Added model selection, new-chat, progress, and status controls.

AI access

The extension uses one provider: the Neelverse AI relay. The relay validates the activation token, applies server-side limits, and forwards the request to the private Kiro Gateway using claude-opus-5. The VSIX contains no gateway URL or gateway credential.

Execution safety

• File operations cannot escape the open workspace, including via symlinks.
• Local process execution is limited to npm, npx, and node.
• Salesforce CLI and local processes run without a shell.
• Each command is terminated at its configured timeout.
• Captured output is truncated at the configured byte limit.

Autonomous project development

Open the Neelverse icon in the Activity Bar and write, for example:

Build a complete Salesforce partner onboarding system based on these acceptance criteria:
AC1 ...
AC2 ...
AC3 ...

The agent will:

1. inspect the open workspace;
2. ask only materially blocking questions;
3. save an implementation plan;
4. create the full Salesforce DX metadata/code/tests;
5. run supported local and Salesforce CLI validation;
6. analyze real failures and continue fixing;
7. stop only when complete, blocked, or at the configured autonomous-step limit.

If the step limit is reached, send continue in the same chat.

Executable capabilities

• Workspace: list, read, write, and delete files, with path traversal blocked.
• Local validation: npm, npx, and node processes inside the workspace.
• Salesforce CLI: query, retrieve, deploy/validate, Apex tests, data operations, Experience Cloud/background jobs, and other sf subcommands produced by the agent.
• Async jobs: deploy (0Af), Apex tests (707), and Experience/background jobs (08P) are captured for later status checks.

Commands

• Neelverse SF 2.0: Activate Extension
• Neelverse SF 2.0: License Status
• Neelverse SF 2.0: Remove Local Activation
• Neelverse SF 2.0: Open Chat
• Neelverse SF 2.0: New Chat
• Neelverse SF 2.0: Natural Language Command
• Neelverse SF 2.0: Run SOQL Query
• Neelverse SF 2.0: Retrieve Metadata
• Neelverse SF 2.0: Deploy Metadata
• Neelverse SF 2.0: Run Apex Tests
• Neelverse SF 2.0: Job Status

Installation

code --install-extension neelverse-sf-vscode-0.7.0.vsix

Or use VS Code → Extensions → ... → Install from VSIX.

Requirements

• VS Code 1.90 or later
• An open workspace/folder for autonomous project development
• Salesforce CLI (sf) for live-org operations
• An authenticated Salesforce org, default alias dev-org unless changed
• Internet access to vscode.lalitpandit.in for activation and AI relay requests
• A valid Neelverse SF 2.0 activation code and internet access to vscode.lalitpandit.in

Safety boundaries

The old Salesforce-topic restriction has been removed. Execution still has technical safety boundaries:

• file operations cannot escape the open workspace;
• symlinks that point outside the workspace are rejected;
• local processes are limited to npm/npx/node;
• executed commands run without a shell and are bounded by a timeout and output limit;
• secrets stay in VS Code SecretStorage;
• Salesforce output is sanitized by default;
• command success is never inferred before actual tool output is returned.