ide extension development

This study identifies a critical security vulnerability in the VS Code extension ecosystem: cross-extension interactions can lead to unauthorized leakage of sensitive data—including passwords and API keys. To address this, we propose the first automated risk detection framework specifically designed for VS Code extensions, integrating static program analysis, NLP-driven interpretation of configuration files and documentation, API call graph construction, and fine-grained sensitive data flow tracking. We conduct a large-scale empirical evaluation across 27,261 real-world extensions and, for the first time, quantify that 8.5% (2,325) exhibit credential-level leakage risks—spanning multiple attack vectors such as command invocation, user input handling, and configuration file reading. This work constitutes the first systematic, large-scale empirical study on IDE extension security, establishing both a methodological foundation and empirical evidence to guide secure plugin ecosystem governance.

Programming education often diverges from industrial practice, leaving students ill-prepared in critical development skills such as debugging and static analysis. To address this gap, we propose “IDE-integrated instruction”—a novel pedagogical paradigm that embeds structured curricula directly into JetBrains IDEs via a custom plugin, enabling learners to acquire skills within authentic development environments. As the first systematic empirical study of its kind, we employ semi-structured interviews and qualitative thematic analysis to evaluate the approach. Results demonstrate significant improvements in tool proficiency and practical awareness, with strong learner acceptance. Our key contributions are: (1) establishing the feasibility of using production-grade IDEs as primary instructional platforms; (2) identifying three core challenges—curriculum design, real-time feedback mechanisms, and deep integration with IDE features; and (3) providing a reusable methodological framework and empirical evidence to bridge the education–industry divide.

Web accessibility issues are often identified late in development, leading to high remediation costs. Method: This work proposes a “shift-left” approach by designing and implementing a VS Code extension that deeply integrates large language models (LLMs) to perform real-time static analysis of HTML, CSS, and ARIA code during coding, detecting accessibility violations and generating actionable, production-ready fixes. Contribution/Results: It is the first to embed LLMs natively into the IDE workflow for accessibility assurance, leveraging domain-specific prompt engineering and rule-based parsing to enhance semantic understanding. Evaluation shows the plugin generates highly accurate, executable repair code; however, detection accuracy on structurally complex pages remains an area for improvement. By moving accessibility validation from testing into the coding phase, this approach significantly reduces the risk of accessibility defects persisting into production.

This work proposes an end-to-end co-optimization framework to address the limitations of AI-powered programming assistants in enterprise development environments, particularly concerning latency, suggestion quality, and user experience. The framework jointly refines the user interface, backend systems, and underlying AI models—including code completion and natural language–to–code transformation components. By establishing a developer-centric iterative experimentation platform that integrates A/B testing and behavioral analytics, the approach was deployed at scale within Google. The deployment yielded significant improvements in code completion accuracy and adoption rates of the Transform Code feature, resulting in measurable gains in developer productivity.

Current AI assistant features in IDEs exhibit a significant misalignment with developers’ authentic needs, necessitating a systematic understanding of heterogeneous user requirements. Method: We conducted semi-structured interviews with 35 practitioners—comprising AI adopters, attriters, and non-users—to empirically construct the first human-AI interaction design space for IDE-integrated AI assistants. Through thematic coding and cross-cohort comparative analysis, we identified fundamental divergences across user groups along five dimensions: reliability, privacy, personalization, proactivity, and ethical concerns. Contribution/Results: We propose a role-driven, five-dimensional design framework—encompassing technical robustness, interaction modality, goal alignment, skill abstraction, and cognitive offloading—alongside 12 actionable design guidelines. This work advances IDE AI tools toward greater reliability, contextual awareness, privacy-by-design, and seamless workflow integration.

This study addresses the unique challenges faced by non-developer-led knowledge communities—such as Obsidian—in maintaining sustainable plugin ecosystems, a domain lacking systematic understanding. Through an empirical investigation of 396 plugins, combining repository mining, large language model–driven topic modeling, and pull request analysis, this work presents the first systematic characterization of such ecosystems. It identifies six functional theme categories and reveals active software evolution patterns. Furthermore, the research proposes an analytical framework tailored for plugin maintenance in mixed-skill communities, articulating three strategic directions and six key research questions. The findings demonstrate that even non-developer communities can cultivate plugin ecosystems with discernible engineering structure and long-term sustainability.

This work addresses the limited accessibility of large language model (LLM) and agent workflow development for engineers without machine learning expertise, primarily due to the absence of integrated testing, debugging, and reproducibility capabilities. To bridge this gap, the authors propose a novel IDE-native AI observability workflow, implemented as the AI Toolkit plugin for JetBrains IDEs. This approach seamlessly embeds trace capture and evaluation into standard run/debug cycles, enabling automatic hierarchical trace logging during execution, one-click dataset persistence, and a pluggable, unit-test-like evaluation framework. By minimizing environment setup and context-switching overhead, the solution facilitates routine evaluation and immediate trace visualization. Empirical data from the initial PyCharm release demonstrates high adoption, sustained usage, and low churn, confirming that IDE-integrated tooling effectively lowers the barrier to entry for non-ML developers.

The dominant programming languages support nothing but linear text to express domain-specific geometric ideas. What is needed are hybrid languages that allow developers to create visual syntactic constructs so that they can express their ideas with a mix of textual and visual syntax tailored to an application domain. This mix must put the two kinds of syntax on equal footing and, just as importantly, the extended language must not disrupt a programmer's typical workflow. This means that any new visual syntax should be a proper language extension that is composable with other language features. Furthermore, the extensions should also preserve static reasoning about the program. This paper presents Hybrid ClojureScript the first such hybrid programming language. Hybrid ClojureScript allows programmers to add visual interactive syntax and to embed instances of this syntax within a program's text. An enhanced hybrid IDE can then display these embedded instances as mini-GUIs that programmers interact with, while other IDEs will show a textual representation of the syntax. The paper argues the necessity of such an extensibility mechanism, demonstrates the adoptability of the design, and discusses what might be needed to use the design in other languages.

Current AI-powered programming assistants predominantly rely on linear chat interfaces, which hinder developers’ ability to non-linearly explore multiple solution paths and trace code modifications. To address this limitation, this work proposes EvoGraph—the first IDE plugin that models AI-assisted programming as an interactive development graph. EvoGraph explicitly captures the history of prompts, AI responses, and code changes in a graph structure, enabling branch exploration, state comparison, and rollback. By integrating automated history tracking, graph-based visualization, and state management, the approach provides a structured representation of human–AI collaboration. User studies demonstrate that EvoGraph significantly reduces cognitive load, enhances the safety and efficiency of iterative exploration, and strengthens developers’ understanding of and control over AI-generated code.

This work addresses the lack of personalization in existing code intelligence systems, which typically disregard individual developer differences. The authors propose VirtualME, a novel framework that leverages an IDE-embedded infrastructure to continuously capture developer behavior and construct a four-dimensional profile encompassing technical stack, capabilities, behavioral habits, and learning styles. For the first time, this profile is integrated into a code-based question-answering system to deliver personalized assistance. The approach combines log-level behavior extraction, multi-agent task recognition, and a rule-engine-driven profiling model, augmented with a large language model to generate tailored responses. Experimental evaluation on a real-world developer trajectory benchmark demonstrates that VirtualME achieves an average improvement of 33.80% across five evaluation dimensions, significantly outperforming general-purpose baselines.