VS Code
Microsoft's own build. The reference implementation, including Remote-SSH, WSL, containers and Codespaces.
Install
Extensions view (Ctrl+Shift+X), search Vulnetix, install the one published by vulnetix. Or:
code --install-extension vulnetix.vulnetix
You can also download the VSIX from the Vulnetix Open VSX listing, then choose Extensions: Install from VSIX from the Command Palette.
Remote development
The extension declares itself a workspace extension. In any remote session it runs where your files are, not on your laptop. That is deliberate: the scanner needs to see the real node_modules, the real git history and the real file tree, and an extension running locally against a remote workspace would be scanning nothing.
| Mode | Behaviour |
|---|---|
| Remote - SSH | Full. The CLI is downloaded to the remote machine’s storage directory. Sign-in opens a browser through VS Code’s port forwarding and works normally. |
| WSL | Full. Provisioning picks the Linux build, which is statically linked and runs on any distribution. |
| Dev Containers | Full. See below for making first open instant. |
| GitHub Codespaces | Full. Note that a 2-core machine is slower to warm up; the progress indicator distinguishes warming from stuck. |
| vscode.dev / github.dev | Reduced. See browser-based editors. |
Dev Containers
By default the CLI downloads on first use inside the container, and a rebuilt container downloads it again. Two adjustments make that instant:
// .devcontainer/devcontainer.json
{
"postCreateCommand": "curl -fsSL https://cli.vulnetix.com/install.sh | sh",
"mounts": [
// Rule packs and the vulnerability cache survive a rebuild.
"source=vulnetix-cache,target=/home/vscode/.cache/vulnetix,type=volume",
"source=vulnetix-home,target=/home/vscode/.vulnetix,type=volume"
],
"customizations": {
"vscode": { "extensions": ["vulnetix.vulnetix"] }
}
}
Settings sync
Settings sync carries your Vulnetix configuration between machines. It does not carry your credential: that lives in the OS keychain via secret storage and is deliberately per-machine. Sign in once per machine.