Secure Continue.dev (Zero Trust Enterprise Fork)

Project Overview & Fork Purpose

This repository is a security-hardened fork of Continue.dev. It is designed to provide an enterprise-grade AI coding assistant that operates in a strictly offline, Zero Trust model.

The Promise: No code, snippets, or prompts ever leave your environment. All analytics, telemetry, and remote API calls are physically blocked at the JVM level.

---

🛡️ Security Guarantees & Threat Model

Threat	Mitigation	Implementation
Data Exfiltration	Blocks all outbound socket creation.	NetworkBlocker
Proxy Tunneling	Detects and fails on proxy env vars/flags.	SecurityBootstrapValidator
DNS Leakage	Prohibits name resolution for external hosts.	NetworkBlocker
Telemetry Pathways	Physically blocks all analytics endpoints.	NetworkBlocker
Developer Override	Fail-fast if security perimeter cannot be established.	FailFastStartupGuard

Fail-Fast Implementation

If the system detects a potential security breach (e.g., an intercepting proxy is present), the plugin follows a Fail-Fast strategy, invoking Runtime.getRuntime().halt(1) immediately, bypassing shutdown hooks.

---

🏗️ Architecture Overview

The project follows Hexagonal Architecture principles to enforce a one-way trust boundary from the core logic to the infrastructure.

ASCII Architecture Diagram

      +-----------------------------------------------------------+
      |                      INFRASTRUCTURE                       |
      |   +------------------+             +------------------+   |
      |   | Inbound Adapter  |             | Outbound Adapter |   |
      |   | (IntelliJ / VS)  |             | (Local Model)    |   |
      +---+--------|---------+-------------+--------^---------+---+
                   |                                |
      +------------|--------------------------------|-------------+
      |            |          APPLICATION           |             |
      |   +--------v----------+             +--------|---------+   |
      |   |     UseCase       |             |     Service     |   |
      |   +--------|----------+             +--------^---------+   |
      +------------|--------------------------------|-------------+
                   |                                |
      +------------|-------------+------------------|-------------+
      |            |             |                  |             |
      |   +--------v----------+  |         +--------|---------+   |
      |   |      Port         |  |         |      Policy     |   |
      |   | (Inbound)         |  |         | (Network Block) |   |
      |   +-------------------+  |         +-----------------+   |
      |                          |                               |
      |                       DOMAIN                             |
      +-----------------------------------------------------------+

See ARCHITECTURE.md for detailed layer responsibilities.

---

🚀 How the Flow Works

1. Startup: The plugin initializes via a dedicated activity/entry point.
2. Security Audit: SecurityBootstrapValidator scans for proxies and unauthorized JVM flags.
3. Lockdown: NetworkBlocker installs a global SecurityManager to override all networking.
4. Validation: FailFastStartupGuard verifies the perimeter; if breached, the process halts.
5. Orchestration: Only after lockdown is the Spring context and model orchestration loaded.

---

🛠️ Build & Installation

Prerequisites

• Java: JDK 17+
• Node.js: v18+ (for VS Code packaging)

Build All Installers (ZIP & VSIX)

./gradlew buildAll

Individual Platform Commands

• Build Core: ./gradlew build
• Run Security Tests: ./gradlew verify
• Package VS Code Plugin: ./gradlew vsCodePackage
• Build IntelliJ Plugin: ./gradlew buildPlugin

📖 For detailed step-by-step build instructions, see BUILD.md

---

🧪 Testing Strategy

All security mitigations are validated via deterministic automated tests.

./gradlew verify

This task executes the full verification suite, asserting that every network attempt results in a SecurityException.

---

🤝 Contributing & Community

We welcome contributions that respect our Zero Trust model.

• Syncing with Upstream: See CONTRIBUTING.md for workflows.
• Code of Conduct: Please adhere to our CODE_OF_CONDUCT.md during interactions.
• Reporting Issues: Use our Issue Template for clear bug reports.
• Pull Requests: Follow the Pull Request Template for submissions.

---

🤝 Integration with Upstream

This project is a downstream fork. It preserves the core UI and logic of Continue.dev while injecting a proprietary security layer. We maintain compatibility by isolating enhancement to the infrastructure and bootstrap layers.