RepoGate VS Code Extension

RepoGate is a powerful VS Code extension that acts as a security gatekeeper for your project's dependencies. It monitors dependency changes in real-time and validates them against your organization's security policies through the RepoGate platform.

Installation

From VS Code Marketplace

The easiest way to install RepoGate is directly from the VS Code Marketplace:

1. Open VS Code
2. Go to Extensions (Ctrl+Shift+X or Cmd+Shift+X)
3. Search for "RepoGate"
4. Click Install

Or install directly from the VS Code Marketplace.

From VSIX File

If you have a VSIX file for manual installation:

1. Download the latest .vsix file
2. Open VS Code
3. Go to Extensions (Ctrl+Shift+X or Cmd+Shift+X)
4. Click the ... menu → Install from VSIX...
5. Select the downloaded file
6. Reload VS Code

Quick Start

1. Configure API Token

After installation, you'll be prompted to configure your API token. This token connects your VS Code extension to your organization's RepoGate platform:

1. Click "Open Settings" when prompted
2. Or manually navigate: File → Preferences → Settings → Search "RepoGate"
3. Set your API Token (stored securely in VS Code SecretStorage)
4. Set your API URL (default: https://api.repogate.io/api/v1)

2. Test Connection

Verify your setup is working correctly:

1. Open Command Palette (Ctrl+Shift+P or Cmd+Shift+P)
2. Run: RepoGate: Test Connection
3. Or click [Test Connection] link in Settings

3. Initial Scan

On first activation, RepoGate automatically performs an initial scan of your workspace. This process:

• Scans all existing dependencies in your workspace
• Sends them to the /queue endpoint for baseline review
• Establishes a baseline inventory of current dependencies
• Starts monitoring for any future changes

API Setup

To connect your VS Code extension to the RepoGate platform, you need to configure two essential settings:

API Token

Your API token authenticates your requests to the RepoGate platform. To obtain and configure your token:

1. Log in to your RepoGate dashboard at app.repogate.io
2. Navigate to Settings → API Tokens
3. Generate a new token or copy an existing one
4. In VS Code, open Command Palette and run RepoGate: Set API Token
5. Paste your token when prompted

API URL

The API URL points to your RepoGate instance. The default value is https://api.repogate.io/api/v1 for cloud-hosted instances. If you're using a self-hosted or enterprise instance, update this URL to match your deployment.

Settings

Configure RepoGate behavior through VS Code Settings (Ctrl+, or Cmd+,):

Commands

Access these commands via Command Palette (Ctrl+Shift+P or Cmd+Shift+P):

How It Works

Initialization Flow

When you first install RepoGate or open a workspace with the extension enabled, the following initialization sequence occurs:

1. First Install: Extension scans all existing packages and sends them to the /queue endpoint
2. Baseline Established: The RepoGate platform receives an inventory of current dependencies
3. Watchers Start: File watchers activate only after a successful scan
4. Continuous Monitoring: The extension watches for any dependency changes

When You Add a New Dependency

When you add a new dependency to your project, RepoGate follows this workflow:

1. Detection: Extension detects changes in package.json, pom.xml, or build.gradle
2. Request: Sends POST /dependencies/request with package information
3. Polling: Checks status via POST /dependencies/check every 10 seconds
4. Notification: Shows approval or denial status to the developer
5. Diagnostics: Adds an entry to the VS Code Problems panel

When You Remove a Denied Package

If you remove a package that was previously denied:

1. Detection: Extension detects package removal
2. Notification: Sends POST /dependencies/update with removal information
3. Confirmation: Shows "Platform has been notified" message
4. Cleanup: Removes diagnostic from Problems panel

Status Values

RepoGate uses several status values to communicate the approval state of dependencies. Understanding these statuses helps you know what action to take:

User Interface

Status Bar

The status bar indicator appears in the bottom-right corner of VS Code and shows the current connection status:

• $(check) RepoGate - Connected and monitoring
• $(sync~spin) RepoGate - Checking dependencies
• $(error) RepoGate - Connection error
• $(circle-slash) RepoGate - Disabled (no token configured)

When there are pending or denied packages, counts are shown: RepoGate (2 pending, 1 denied)

Click the status bar item to open the Output channel for detailed logs.

Problems Panel

Denied and pending packages appear in the VS Code Problems panel with different severity levels:

• Error (red): Denied packages that must be removed
• Warning (yellow): Pending or not found packages
• Info (blue): Packages currently being scanned

Notifications

RepoGate shows notifications for important events:

• Approved: Silent (logged only, no interruption)
• Denied: Error notification with "View Details" button
• Pending: Info notification
• Scanning: Info notification
• Removed: Confirmation notification (for denied packages)

Supported Package Managers

RepoGate currently monitors the following package ecosystems and their associated files:

Security & Privacy

Token Storage

RepoGate uses VS Code's SecretStorage API to store your API token securely. This provides:

• Encryption: Tokens are encrypted at rest
• Automatic Migration: Tokens previously stored in plain settings are automatically migrated to SecretStorage
• Secure Access: Only the RepoGate extension can access stored tokens

Logging & Data Sanitization

All sensitive data is automatically redacted from logs, including:

• API tokens
• Passwords
• Authentication headers

Best Practices

• Always use HTTPS API URLs in production environments
• Rotate API tokens regularly
• Limit token permissions to only what's necessary
• Never commit API tokens to version control

Troubleshooting

"No API token configured"

Solution:

1. Open Settings → Search "RepoGate"
2. Run command RepoGate: Set API Token
3. Enter your API token
4. Run RepoGate: Test Connection to verify

"Connection failed"

Possible Causes:

• RepoGate service not running
• Wrong API URL or port
• Invalid API token
• Network or firewall issues

Solution:

1. Verify the RepoGate service is running
2. Check the API URL in settings
3. Run RepoGate: Test Connection command
4. Check the Output channel for detailed error messages

"Bootstrap failed"

Cause: Initial package scan failed

Solution:

1. Check API connection status
2. Run RepoGate: Test Connection
3. Run RepoGate: Scan Now to retry the scan

Packages not being monitored

Solution:

1. Check that repogate.enabled is set to true
2. Verify API token is configured
3. Check Output channel for errors
4. Ensure the file is not in node_modules or other excluded directories

Requirements

• VS Code: Version 1.85.0 or higher
• RepoGate API: Running instance with valid token
• Network: Access to RepoGate API server

Known Limitations

• Manual Installation: Developers can still install packages via command line. The extension monitors changes but doesn't block installation.
• Transitive Dependencies: Only direct dependencies are monitored. Transitive dependencies are not currently tracked.
• Offline Mode: Requires network connection to the RepoGate API.
• NPM Only: Maven and Gradle watchers are planned but not yet implemented.

Support & Resources

Need help? We're here to assist you:

• Documentation: https://repogate.io/docs
• Email Support: support@repogate.io
• GitHub Repository: SectorFlow/repogate-extension-vscode
• Report Issues: GitHub Issues

License

MIT License - See LICENSE file for details.