SLOPGUARD — AI Dependency Firewall for VS Code

The Pre-Install AI Dependency Control Plane & Supply-Chain Firewall for VS Code. Sits directly between AI coding assistants (GitHub Copilot, Cursor, Claude Code, Gemini Code Assist, Windsurf) and external package registries to detect and prevent package hallucinations, typosquatting attacks, and malicious dependencies before installation or execution.

🏛 Architecture

The SLOPGUARD VS Code extension is a lightweight, zero-trust Developer Experience (DX) and presentation client. It delegates all security analysis, registry resolution, and policy enforcement to the authoritative slopguard-ai engine.

      VS CODE EXTENSION (Client / Presentation / DX Layer)
           │
           ├─► Inline Diagnostics (Squigglies & Hover Tooltips)
           ├─► Activity Bar TreeView (Dependencies & Phantoms)
           ├─► Quick Fixes (1-Click Propose & Replace)
           ├─► Webview Panel (Evidence Dossier & Evidence Graph)
           └─► Status Bar Indicator (🛡 Live Metrics)
                   │
                   ▼ (Primary: REST API localhost:8000 | Fallback: Local CLI)
      SLOPGUARD CORE ENGINE (Python Package: slopguard-ai)
           │
     EXTRACT ──► IDENTITY ──► VERIFY ──► EVIDENCE ──► TRUST ──► MEMORY ──► POLICY GATE
                                                                             │
                                                                   ALLOW / HOLD / BLOCK

⚡ Prerequisites & Setup

SLOPGUARD relies on the official slopguard-ai Python control plane for package verification and policy evaluation.

1. Install the Backend Engine

pip install slopguard-ai

(Alternatively, in active project virtual environments: .venv/Scripts/slopguard or venv/bin/slopguard are detected automatically).

2. Choose Connection Mode

High-Speed REST API Mode (Recommended): Launch the local background daemon for millisecond-latency cached evaluations:
```
slopguard serve
# API server listening at http://127.0.0.1:8000
```
CLI Fallback Mode (Zero-Config): If the REST server is not running, the extension automatically invokes the local slopguard CLI command transparently (slopguard scan <file> --json).

🌟 Key Features

1. Inline Diagnostics & Squigglies

Real-time inline feedback across Python (.py), JavaScript/TypeScript (.js, .ts), and manifests (requirements.txt, pyproject.toml, package.json):

BLOCK (Error 🔴): Unresolvable package hallucinations (HTTP 404), active malicious typosquats, critical CVE advisories, or newly registered phantom packages.
HOLD / ALERT (Warning 🟡): Registry connectivity timeouts, rate limits (HTTP 429), or weak provenance packages requiring manual human review.
ALLOW (Information 🔵): Authenticated packages with confirmed multi-version release histories and canonical alias mappings (e.g., import cv2 → opencv-python).

2. Quick Fixes & Repair Center

1-Click Repair: Hover over a highlighted typosquat and press Ctrl+. (Cmd+. on macOS) to replace it with the verified canonical package.
Mandatory Rescan Guarantee: Applying any repair immediately triggers a fresh scan; code is never assumed safe until validated by the policy gate.

3. Activity Bar Sidebars

Dependency Control Plane: Categorized tree view of all evaluated packages in the current file or workspace (Verified, Review Required, Blocked) with confidence scores and policy reasons.
Temporal Phantom Watchlist: Persistent tracking of unresolvable packages over time, recording first-seen timestamps, observation counts, and alerting when a dormant hallucination suddenly appears on registries (APPEARED state).

4. Interactive Evidence Dossier & Graph

Inspect the complete audit trail for any evaluated dependency:

Registry Metadata: Official status, total releases, latest published version, publication timestamps.
Source & Provenance: Verified repository linkage (GitHub/GitLab), author/maintainer metadata.
Vulnerability Advisories: Real-time Google OSV database matching for specific targeted versions.
Visual Evidence Graph: Interactive topological representation of the trust decision chain.

5. Status Bar Monitor

Compact summary in the bottom status bar:

🛡 SLOPGUARD: 18 ✓ | 3 ⚠ | 2 🚫

Clicking the status bar item opens the SLOPGUARD Control Center or web dashboard.

⌨️ Contributed Commands

Access these commands via the VS Code Command Palette (Ctrl+Shift+P / Cmd+Shift+P):

Command	Identifier	Description
SLOPGUARD: Scan Current File	`slopguard.scanCurrentFile`	Trigger manual security scan of the active editor.
SLOPGUARD: Scan Workspace	`slopguard.scanWorkspace`	Discover and scan all dependencies across the project.
SLOPGUARD: Verify Dependency	`slopguard.verifyDependency`	Interactive prompt to query live registry evidence for any package name.
SLOPGUARD: Show Evidence	`slopguard.showEvidence`	Open the interactive Evidence Dossier Webview for a dependency.
SLOPGUARD: Find Repair	`slopguard.findRepair`	Show repair candidates and quick-fixes for flagged dependencies.
SLOPGUARD: Rescan	`slopguard.rescan`	Clear local cache and re-evaluate all active project dependencies.
SLOPGUARD: Open Dashboard	`slopguard.openDashboard`	Open the full SLOPGUARD web control dashboard in browser.
SLOPGUARD: Refresh	`slopguard.refresh`	Reload sidebar tree views and status bar metrics.
SLOPGUARD: Configure	`slopguard.configure`	Quick jump to extension configuration settings.

⚙️ Configuration Settings

Customize behavior under Settings (Ctrl+, -> search slopguard):

Setting	Default	Description
`slopguard.server.url`	`http://localhost:8000`	Base URL for the SLOPGUARD REST API daemon.
`slopguard.cli.path`	`slopguard`	Path or executable name for CLI fallback mode.
`slopguard.autoScan`	`true`	Automatically scan active files upon opening.
`slopguard.scanOnSave`	`true`	Automatically trigger scan whenever a file is saved.
`slopguard.policyProfile`	`STRICT_CI`	Policy enforcement profile: `DEVELOPMENT`, `STRICT_CI`, or `ENTERPRISE`.
`slopguard.exclude`	`["/node_modules/", "/.venv/", ...]`	Glob patterns to ignore during workspace scanning.
`slopguard.openDashboardAfterScan`	`false`	Automatically open the browser dashboard when workspace scan finishes.

🔒 Security & Privacy Boundaries

Local-First Verification: Source code is evaluated against your local slopguard-ai engine (http://localhost:8000 or local CLI). Source code is never uploaded to third-party servers or AI vendors.
Strict Webview Content Security Policy (CSP): The Evidence Dossier runs in a sandboxed Webview with scripts restricted to local extension bundles. All user and registry strings are entity-escaped to prevent XSS.
Safe Subprocess Execution: The CLI client uses child_process.execFile with structured arguments, avoiding arbitrary shell command execution.
Denial-of-Service Protection: File scanning is constrained to 10MB to prevent memory exhaustion on oversized files.

⚠️ Limitations

Engine Dependency: This extension requires slopguard-ai installed in your Python environment or on PATH. It does not contain an embedded Python runtime.
Pre-Install Scope: SLOPGUARD is a static pre-install analysis and firewall tool. It does not hook or intercept arbitrary terminal commands (like raw pip install <pkg> run in external terminals) unless invoked through SLOPGUARD gating wrappers or IDE workflows.
Ecosystem Coverage: Currently supports Python (PyPI) and JavaScript/TypeScript (npm). Additional ecosystems (crates.io, Maven, Go modules) are on the roadmap.

🔧 Troubleshooting

Symptom	Cause	Solution
"SLOPGUARD backend unavailable"	Local daemon is not running and CLI was not found on PATH.	Run `pip install slopguard-ai`, or launch `slopguard serve`, or set `slopguard.cli.path` to the absolute path of your Python executable/venv.
"Could not locate token in active editor"	The active editor tab was changed or closed before clicking Apply Repair.	Keep the target code file open in the active editor tab when applying repairs.
Rate limit / Timeout warning (HOLD)	Upstream PyPI or npm registry encountered network latency.	Policy enforces a fail-safe HOLD posture. Run `slopguard.rescan` once network connectivity is restored.

📦 Installation Options

VS Code Marketplace: Search for SLOPGUARD or vishaldubey2210.slopguard-ai in the Extensions view (Ctrl+Shift+X).
From VSIX: Download slopguard-ai-0.1.0.vsix and install via:
```
code --install-extension slopguard-ai-0.1.0.vsix
```

🔗 Links & Resources

GitHub Repository: https://github.com/Vishaldubey2210/win_if_you_can
Backend PyPI Package: https://pypi.org/project/slopguard-ai/
Issue Tracker: https://github.com/Vishaldubey2210/win_if_you_can/issues

📄 License

Licensed under the Apache License, Version 2.0.

SLOPGUARD — AI Dependency Firewall

vishal kumar