Somali AI Connect for VS Code

Hagaha degdegga ah ee Af-Soomaaliga

Extension-kan wuxuu isku xiraa Somali AI Connect SDK iyo Cloudflare AI Gateway. Waxaa ku jira dashboard, dejinta provider-ka Cloudflare, tijaabada xidhiidhka AI, habaynta tusaalaha browser-ka maxalliga ah, iyo Abuur AI oo sameeya app bilow ah.

Tijaabi extension-ka inta aanu Marketplace-ka ka soo bixin

Fur repository-ga Somali AI Connect oo dhan VS Code, fur terminal PowerShell, oo socodsii:

Set-Location .\vscode-extension
npm.cmd install
npm.cmd run compile

VS Code ku fur galka vscode-extension ama ku isticmaal workspace-ka xididka repository-ga, kadib taabo F5 si uu u furmo Extension Development Host. Gudaha daaqadda cusub, ka fur dashboard-ka Somali AI Connect. Extension-kan wali laguma daabicin VS Code Marketplace; ha u qaadan inuu yahay rakibid dadweyne.

Ku xidh Cloudflare, kadibna samee app

1. Deji somaliAiConnect.cloudflare.oauthClientId adigoo isticmaalaya Cloudflare OAuth client-kaaga. Faahfaahinta scopes iyo loopback callback waxay ku qoran yihiin qaybta Ingiriisiga ee hoose. OAuth flow-gu lama xaqiijin adeeg Cloudflare oo dhab ah ilaa login/callback-ku si guul leh u dhammaado.

2. Dashboard-ka ka dooro Ku xidh, ku dhammee browser-ka, kadib dooro Cloudflare account iyo AI Gateway. Waxaad ka abuuri kartaa Gateway cusub.

3. Cloudflare Dashboard > AI > AI Gateway > Provider Keys ku habee provider key-gaaga. Extension-ku ma ururiyo ama ma kaydiyo provider keys.

4. Ku socodsii Tijaabi xidhiidhka AI si aad u xaqiijiso OpenRouter. Run token-ka Cloudflare AI Gateway waxaa lagu kaydiyaa VS Code SecretStorage, waligiisna laguma qoro browser files.

5. Ka fur Command Palette (Ctrl+Shift+P) oo dooro Somali AI Connect: Abuur AI. Geli magaca app-ka, nooca mashruuca, provider-ka, model-ka, iyo galka waalidka ee mashruuca cusub. App-ku wuxuu adeegsadaa SDK-ga iyo Worker template-ka hadda jira, wuxuuna ku daraa prompt-yo Af-Soomaali ah.

6. Galka app-ka cusub laba terminal ka fur. Terminalka koowaad:

   npm.cmd install
   npm.cmd run worker:dev
   

   Terminalka labaad:

   npm.cmd run dev
   

   Fur URL-ka Vite soo bandhigo, badanaa http://localhost:5173. Token-ku wuxuu ku jiraa worker/.dev.vars, oo .gitignore ku jiro. Ha u dirin token/API key browser-ka, hana deploy-gareyn Worker-kan si dadweyne.

Extension-ku wuxuu adeegsadaa VS Code localization bundles-ka. Ingiriisigu waa qoraalka asalka ah; package.nls.so.json iyo l10n/bundle.l10n.so.json ayaa Somali u tarjuma marka display language-ka VS Code yahay so. Adeegso amarka Configure Display Language ee VS Code si aad ugu kala beddesho so iyo en; haddii Somali aanu ka muuqan xulashooyinka luqadda ee VS Code, rakib language pack taageera so ka hor intaadan dooran.

Tusaalaha browser-ka ee repository-ga iyo dejinta maxalliga ah waxay ku sharraxan yihiin hagaha browser-ka. App-ka Abuur AI iyo tusaalaha browser-ka waa qalab tijaabo maxalli ah. Tijaabo otomaatig ah ama config la sameeyey ma caddaynayaan in live AI inference guulaystay.

Cloudflare OAuth setup

This extension uses Cloudflare OAuth's Authorization Code flow with PKCE (S256) as a native/public OAuth client (token endpoint authentication none). This is separate from Cloudflare's client visibility setting. Do not enter or embed an OAuth client secret. Cloudflare says a client secret is for a server that can keep it confidential.

1. In the Cloudflare dashboard, open Manage Account > OAuth clients and create an OAuth client. Choose the Authorization Code grant and configure PKCE with S256 and token endpoint authentication none.
2. The extension binds an HTTP listener only to 127.0.0.1 and asks the operating system for an available ephemeral port. The callback is generated at runtime, for example http://127.0.0.1:49152/oauth/callback; the actual URI is shown in VS Code when you click Connect.
3. Configure the OAuth client scopes requested by the extension: aig.read aig.write account-settings.read. Do not add offline_access; Cloudflare rejected that scope for the registered OAuth client. Cloudflare's OAuth client guide says to fetch available scope IDs with GET https://api.cloudflare.com/client/v4/oauth/scopes; verify these IDs are available to the account and client before testing. Creating an AI Gateway requires Cloudflare's AI Gateway Write permission. The extension requests aig.write, but verify its mapping to that permission in the authenticated OAuth scope catalog; a denied create request will ask you to confirm the permission and reconnect.
4. Put the OAuth Client ID in VS Code setting somaliAiConnect.cloudflare.oauthClientId. The generated client secret is not used by this public-client flow.
5. To let users outside the client owner's Cloudflare account authorize it, change the client's visibility to public. This is separate from using none as the token authentication method. Cloudflare requires a client name, logo, client URL, scopes, and verified ownership of the client URL's domain before a client can be made public. Changing visibility to public is permanent; keep it private for testing within its owning account.

Dynamic port limitation

Cloudflare requires redirect URLs to be registered on the OAuth client. Its published documentation does not establish whether it permits a variable port for http://127.0.0.1 loopback callbacks. Register the actual URI shown by the extension only if the Cloudflare client configuration accepts it. The ephemeral port changes on each attempt, so if Cloudflare requires an exact, pre-registered fixed port, this implementation is incompatible: a redirect registered for one attempt will not match the next. In that case, OAuth needs a separately designed fixed-port callback or HTTPS relay. Do not claim or treat OAuth as working unless Cloudflare accepts the generated redirect and a real login/callback succeeds. This project does not deploy a relay.

Cloudflare documents these endpoints:

• Authorization: https://dash.cloudflare.com/oauth2/auth
• Token: https://dash.cloudflare.com/oauth2/token

Its OIDC discovery document advertises S256 PKCE and token endpoint authentication method none. See Cloudflare's OAuth client creation and integration guides for registration and protocol requirements.

Tokens and expiration metadata are stored in VS Code SecretStorage. Connect and Disconnect also clear the unused client-secret key left by earlier extension versions. OAuth has not been verified against a real Cloudflare login and callback; successful browser authorization and API verification are required before the dashboard reports Connected.

Refresh tokens are optional: the extension stores and uses one only if Cloudflare includes it in the token response. If an access token expires and no refresh token is available, reconnect the Cloudflare account.

Creating an AI Gateway

Gateway creation asks for cache TTL, rate-limiting interval and limit, and whether cache should be invalidated when gateway settings change. These values are required by Cloudflare's Create Gateway API; the extension does not supply defaults. Enter non-negative whole numbers for the numeric settings. Cloudflare must confirm creation before the gateway is selected in the workspace.

Provider keys (BYOK)

The extension does not collect or transmit provider API keys. Although it can verify Cloudflare OAuth access and read provider configuration metadata, the official Secrets Store Create API documents API Email + API Key authentication and Secrets Store Write permission. Cloudflare's Secrets Store access-control guide describes dashboard user roles and API-token permissions, but does not document OAuth bearer-token support or a corresponding OAuth scope for writing secrets. The existing extension OAuth token therefore cannot be assumed to authorize the full BYOK sequence. Somali AI Connect deliberately fails closed instead of asking for a Global API Key, an API token, or an unverified credential.

Use the dashboard alternative: select a provider card's Set up in Cloudflare action, open AI > AI Gateway > Provider Keys for the selected gateway, and add or rotate the OpenRouter key there using alias cf-aig-byok-alias. Cloudflare's BYOK guide says the dashboard creates and names the Secrets Store secret automatically. Its API sequence, if used by a separately authorized integration, is to create the Secrets Store secret first, then create the gateway's provider configuration with matching provider_slug and alias. The documented secret name is {gateway_id}_{provider_slug}_{alias} (for example my-gateway_anthropic_default) and the secret needs the ai_gateway scope.

This dashboard handoff is not a successful save by the extension. No provider key was entered or transmitted by Somali AI Connect, and no real Cloudflare secret save was performed or verified.

Testing OpenRouter inference

Select an account and gateway, then choose Test AI Connection. On the first run, enter a Cloudflare AI Gateway Run token in the VS Code password input. Choose whether to reuse the saved token or replace it on subsequent runs. The token is stored only in VS Code SecretStorage; it is sent from the extension host to the selected Cloudflare gateway in the cf-aig-authorization header. The test calls OpenRouter with model openai/gpt-4o-mini, without an OpenRouter Authorization header, and sends cf-aig-byok-alias: cf-aig-byok-alias so Cloudflare uses the configured BYOK key. The assistant's actual response appears in the dashboard.

Configure the local browser example

After selecting an account and gateway, run Test AI Connection once if no Run token has been saved yet. Then run Somali AI Connect: Configure Local Browser Example from the Command Palette. It retrieves the existing token from SecretStorage without asking for it again, merges the selected account, gateway, token, and BYOK alias into the Worker template's ignored .dev.vars, and generates examples/browser/config.js with only browser-safe configuration. If that generated file already exists, the extension asks before replacing it. Repository detection searches each workspace folder and its parents for the SDK, Worker, and browser example. In an Extension Development Host it also checks the extension's development location if no workspace folder matches. If multiple repositories match, select the intended one in the prompt.

The generated .dev.vars is local development configuration. The Worker allows inference only through its loopback development mode; deployed non-loopback requests remain rejected. Do not copy its Run token into browser files or enable public inference.