BIBER AI Assistant

BIBER AI Assistant is a secure VS Code client for testing BIBER as a Copilot-style local/remote coding assistant. The Marketplace icon is packaged from media/icon.png, using the supplied BIBER AI logo artwork, and the Activity Bar uses media/activity-icon.svg for a crisp VS Code sidebar entry. Version 0.3.0 adds a visible Activity Bar chat-agent view with inline setup, connection testing, and a first prompt box before direct file mutation is enabled.

After installing, click the BIBER icon in the Activity Bar or click the BIBER status bar item. The Chat Agent panel opens with endpoint, model, API key, test, and prompt controls in one place. The API key is stored in VS Code SecretStorage and is not written to settings or output.

The first command surface is intentionally small:

• BIBER: Open Chat Agent focuses the Activity Bar chat-agent panel.
• BIBER: Setup API Connection guides endpoint, model, and key setup.
• BIBER: Set API Key stores the user API key in VS Code SecretStorage.
• BIBER: Clear API Key removes the stored key.
• BIBER: Test API Connection calls /v1/agent/capabilities without sending repository data and prints a redacted readiness summary.
• BIBER: Plan Change calls the planning-only /v1/agent/orchestration/plan endpoint.
• BIBER: Show Output opens the redacted BIBER output channel.

The extension targets the OpenAI-compatible BIBER API base URL configured in biber.openaiBaseUrl, defaulting to:

https://api.beaverapi.com/v1

For a private Vast SSH tunnel during development, set:

http://127.0.0.1:8000/v1

Do not point the extension at the raw vLLM provider URL.

Security Contract

The extension must protect the BIBER API and the user's code workspace:

• Store API keys only in VS Code SecretStorage.
• Never write API keys to settings, files, terminal output, or the output panel.
• Require HTTPS for remote API URLs; allow HTTP only for localhost/127.0.0.1.
• Use explicit user commands only; startup activation updates local UI state but does not call BIBER or run background repository scans.
• Send no file contents in the first MVP orchestration command.
• Send only bounded workspace-relative path hints and a bounded instruction.
• Enforce a local per-minute request limit before calling BIBER.
• Enforce single-flight requests so repeated clicks do not fan out.
• Enforce request timeouts with AbortController.
• Avoid automatic retry storms; failed calls should stop and show one error.
• Validate the API connection with capabilities before using orchestration.
• Keep OpenAI mentor disabled by default and do not expose admin APIs.

These client-side controls are not a substitute for server-side protections. The BIBER API must still enforce authentication, per-key quotas, server-side rate limits, payload size limits, logging redaction, and abuse monitoring.

Current Limitation

The Activity Bar Chat Agent view is the first interactive BIBER editor surface, not a fully autonomous coding agent yet. The current orchestration call is a planning contract test. It is useful for editor integration because it verifies API keys, URL configuration, path hints, repo planning output, and user-facing workflow. It does not yet implement streaming chat, background indexing, or direct multi-file apply in VS Code.

Use BIBER: Test API Connection first after installing or changing the API URL/key. It should show the BIBER service/version/model plus server-side guard metadata such as payload caps and rate limits. If that check fails, do not run orchestration from the extension until the API URL, key, or server is fixed.

Local Development

Install dependencies only when you are actively developing the extension:

npm ci
npm run compile

Then open this folder in VS Code and run the extension host. Keep the first live tests against a private tunnel or a low-quota per-user API key.

From the repository root, the same build can be checked with:

python scripts/biber_vscode_extension_compile_smoke.py

Package and install-test the VSIX into an isolated temporary VS Code profile with:

python scripts/biber_vscode_extension_package_smoke.py

To test the same API readiness flow without launching VS Code, run:

python scripts/biber_vscode_extension_connection_smoke.py \
  --base-url http://127.0.0.1:8000/v1

Set BIBER_API_KEY first. The smoke calls only /v1/agent/capabilities, sends no repository data, sends the same BIBER client identity headers as the extension, and redacts secret-like fields from its artifact.

To test the same orchestration planning flow without launching VS Code, run:

python scripts/biber_vscode_extension_orchestration_smoke.py \
  --base-url http://127.0.0.1:8000/v1 \
  --changed-path docs/BIBER_ONLY_WORKSPACE.md

That smoke calls only /v1/agent/orchestration/plan, sends bounded path hints and a bounded instruction, sends no file contents, and verifies that the response remains planning-only with no model request, GitHub save, training, or OpenAI mentor call.

Marketplace

The Marketplace extension ID is:

flat-electronics-canada.biber-ai-assistant

See the repository release checklist for packaging and publishing steps: https://github.com/selvasmallive/biber-ai-platform/blob/biber/mvp-resume-20260712/docs/BIBER_VSCODE_MARKETPLACE_RELEASE.md