Neelverse SF 2.0 is an autonomous AI engineering extension for VS Code. It combines a sidebar chat, workspace implementation tools, Salesforce CLI operations, and async-job tracking.

What changed in 0.7.0

Workspace file actions resolve real paths, so a symlink inside the workspace cannot reach files outside it.
Salesforce CLI and local npm/npx/node processes run without a shell, so arguments are never re-interpreted.
Every executed command has a hard timeout and a bounded output buffer.
Active-editor context uses path-segment containment instead of a string prefix.
New settings: neelverseSf.execution.sfTimeoutSeconds, neelverseSf.execution.processTimeoutSeconds, neelverseSf.execution.maxOutputBytes.

What changed in 0.6.x

AI is now provided automatically through the authenticated Neelverse relay.
The server uses Claude Opus 5 (claude-opus-5) by default.
Users only enter the Neelverse activation code; no Kiro Gateway, Kiro CLI, endpoint, model, or API key is required locally.
The gateway credential and model selection stay server-side.

After activation, open the Neelverse sidebar and start working. AI requests are sent to https://vscode.lalitpandit.in with the activation token stored in VS Code SecretStorage.

What changed in 0.4.0

Added a direct Kiro CLI provider. The extension starts the locally authenticated kiro-cli process, sends prompts over stdin, and consumes the model response without storing a Kiro credential.
Added Kiro model discovery and selection from the models available to the signed-in Kiro account.
Added configurable provider priority:
- VS Code AI → Kiro CLI → external API, or
- Kiro CLI → VS Code AI → external API.
Added a sandboxed Kiro workspace agent with no Kiro tools or MCP servers; all file and Salesforce actions remain executed and verified by the extension.
Added Kiro connection verification, timeout, executable-path, and model settings.

Previously added in 0.3.0

Added activation-code licensing through https://vscode.lalitpandit.in.
All engineering, AI, Salesforce, model-selection, and configuration functions stay locked until the extension has a valid activation.
Activation tokens are stored in VS Code SecretStorage; activation codes are not stored locally.
The license is revalidated on startup, before work, during agent iterations, and every five minutes.
An expired or remotely revoked code stops the extension at the next validation. Validation fails closed if the licensing service cannot be reached after the local five-minute validation window.
Installation limits are enforced by a privacy-preserving hash of VS Code's opaque machine identifier.

Activation

Install the VSIX.
Run Neelverse SF 2.0: Activate Extension or click Activate in the sidebar.
Enter the code issued by Neelverse.

The activation server is fixed to https://vscode.lalitpandit.in; it is not an end-user configuration setting. A working internet connection is required for periodic validation.

Previously added in 0.2.0

Removed the old Salesforce-only request restriction. The chat can answer general questions and help with general project work.
Added a Neelverse activity-bar container and a Hermes-style persistent sidebar chat.
Uses the available/user-selected VS Code Language Model first and by default.
An OpenAI-compatible endpoint is now an optional fallback, not the first choice.
Added acceptance-criteria-driven autonomous development:
- workspace inspection
- blocking clarification questions
- dependency-aware planning
- iterative file creation and modification
- Salesforce CLI execution
- local npm/npx/node validation
- real-result feedback and repair loops
- plan persistence in .neelverse/plans/latest.md
Added model selection, new-chat, progress, and status controls.

AI access

The extension uses one provider: the Neelverse AI relay. The relay validates the activation token, applies server-side limits, and forwards the request to the private Kiro Gateway using claude-opus-5. The VSIX contains no gateway URL or gateway credential.

Execution safety

File operations cannot escape the open workspace, including via symlinks.
Local process execution is limited to npm, npx, and node.
Salesforce CLI and local processes run without a shell.
Each command is terminated at its configured timeout.
Captured output is truncated at the configured byte limit.

Autonomous project development

Open the Neelverse icon in the Activity Bar and write, for example:

Build a complete Salesforce partner onboarding system based on these acceptance criteria:
AC1 ...
AC2 ...
AC3 ...

The agent will:

inspect the open workspace;
ask only materially blocking questions;
save an implementation plan;
create the full Salesforce DX metadata/code/tests;
run supported local and Salesforce CLI validation;
analyze real failures and continue fixing;
stop only when complete, blocked, or at the configured autonomous-step limit.

If the step limit is reached, send continue in the same chat.

Executable capabilities

Workspace: list, read, write, and delete files, with path traversal blocked.
Local validation: npm, npx, and node processes inside the workspace.
Salesforce CLI: query, retrieve, deploy/validate, Apex tests, data operations, Experience Cloud/background jobs, and other sf subcommands produced by the agent.
Async jobs: deploy (0Af), Apex tests (707), and Experience/background jobs (08P) are captured for later status checks.

Commands

Neelverse SF 2.0: Activate Extension
Neelverse SF 2.0: License Status
Neelverse SF 2.0: Remove Local Activation
Neelverse SF 2.0: Open Chat
Neelverse SF 2.0: New Chat
Neelverse SF 2.0: Natural Language Command
Neelverse SF 2.0: Run SOQL Query
Neelverse SF 2.0: Retrieve Metadata
Neelverse SF 2.0: Deploy Metadata
Neelverse SF 2.0: Run Apex Tests
Neelverse SF 2.0: Job Status

Installation

code --install-extension neelverse-sf-vscode-0.7.0.vsix

Or use VS Code → Extensions → ... → Install from VSIX.

Requirements

VS Code 1.90 or later
An open workspace/folder for autonomous project development
Salesforce CLI (sf) for live-org operations
An authenticated Salesforce org, default alias dev-org unless changed
Internet access to vscode.lalitpandit.in for activation and AI relay requests
A valid Neelverse SF 2.0 activation code and internet access to vscode.lalitpandit.in

Safety boundaries

The old Salesforce-topic restriction has been removed. Execution still has technical safety boundaries:

file operations cannot escape the open workspace;
symlinks that point outside the workspace are rejected;
local processes are limited to npm/npx/node;
executed commands run without a shell and are bounded by a timeout and output limit;
secrets stay in VS Code SecretStorage;
Salesforce output is sanitized by default;
command success is never inferred before actual tool output is returned.

Neelverse SF 2.0