CodeVitals

Continuously analyze your workspace and dev environment — get a transparent health score and one-click fixes, right inside VS Code.

Think GitHub Insights meets npm doctor, built into the editor.

---

Why CodeVitals

Dev environments drift — outdated extensions, mismatched Node versions, missing .gitignore entries, committed secrets, bloated node_modules. Individually these are minor. Together, they're the reason "works on my machine" happens. CodeVitals watches for all of it in one place, scores it transparently, and fixes what's safe to fix automatically.

Features

• 📊 Live health score (0–100) — every point gained or lost is traced to a named, explained issue or bonus. Nothing is a black box.
• 🔍 8 independent scanners — Environment, Extensions, Workspace, Dependencies, Git, Performance, Security, Team Consistency
• ⚡ One-click fixes — every fix is previewed before it touches your files or settings; bulk "Fix Safe Issues" only ever runs the genuinely safe ones
• 🖥️ Native-feeling dashboard — score gauge, category cards, search/filter, expandable issue detail, health trend graph, full dark/light theme support
• 📌 Ambient visibility — sidebar summary view and status bar score, so you don't have to remember to check
• 📤 Export to JSON (CI/tooling), Markdown (PRs/Slack), or a standalone printable HTML report
• 🔄 Background monitoring with a configurable rescan interval

Dashboard

Made with ❤️ by AnandShah for the developer community

Screenshot of the native-feeling dashboard showing the live health score gauge, category cards, trend graph, issue details, and one-click fixes.

Installation

From the Marketplace:

1. Open the Extensions view in VS Code (Ctrl+Shift+X / Cmd+Shift+X)
2. Search for CodeVitals
3. Click Install

From the command line:

code --install-extension AnandShah.codevitals

Getting started

1. Open any workspace folder in VS Code.
2. Run CodeVitals: Open Dashboard from the Command Palette (Ctrl+Shift+P / Cmd+Shift+P), or click the pulse icon in the Activity Bar.
3. CodeVitals runs its first scan automatically and shows your score, broken down by category.
4. Expand any issue for its impact, estimated fix time, and documentation link. Click Fix this where a one-click fix is available.
5. Use Fix Safe Issues to bulk-apply every fix that's safe to run unattended.

Commands

Command	Description
CodeVitals: Open Dashboard	Open the main health dashboard webview
CodeVitals: Run Scan	Run a full scan without opening the dashboard
CodeVitals: Rescan	Re-run all scanners and refresh the dashboard
CodeVitals: Fix Safe Issues	Bulk-apply every fix flagged as safe
CodeVitals: Export Report	Export the current report as JSON, Markdown, or HTML
CodeVitals: Compare Workspace	Compare the two most recent scans in history
CodeVitals: Generate Team Report	Open a Markdown report ready to share with your team
CodeVitals: Toggle Background Monitoring	Turn periodic background rescans on or off

Configuration

Setting	Default	Description
workspaceHealth.autoScanOnStartup	true	Scan automatically when a workspace opens
workspaceHealth.backgroundMonitoring	false	Periodically rescan in the background
workspaceHealth.backgroundMonitoringIntervalMinutes	30	Interval for background rescans
workspaceHealth.requiredNodeVersion	""	Override the expected Node major version
workspaceHealth.disabledScanners	[]	Skip specific scanner categories
workspaceHealth.showStatusBarItem	true	Show/hide the status bar score

Health score algorithm

Every category scanner returns issues (deductions) and bonuses (additions). The score starts at 100 and every scoreImpact is applied, clamped to [0, 100]:

Score	Rating
91–100	Excellent
81–90	Good
61–80	Fair
41–60	Poor
0–40	Critical

Example deductions/bonuses implemented today:

Item	Points
Committed .env file	−20
Node version mismatch	−12
Missing lockfile	−12
.gitignore missing node_modules	−8
Disabled Workspace Trust	−8
Missing .gitignore	−6
Deprecated extension installed	−6
DevContainer configured	+6
Full team-consistency file coverage	+6
Git identity fully configured	+5

If an issue doesn't specify an explicit point value, the engine falls back to a severity-based default (critical −12, warning −5, info −2) — no issue is ever silently free.

Architecture

src/
  extension.ts              Activation entry point — wires services, commands, background timer
  commands/index.ts          Registers all 8 commands; thin — delegates to services
  scanner/
    baseScanner.ts           Abstract base: timing + error containment for every scanner
    environmentScanner.ts    Node/npm/pnpm/yarn/bun/git/docker/python/java/kubectl/az/aws
    extensionScanner.ts      Conflicting/deprecated/disabled/missing-recommended extensions
    workspaceScanner.ts      .vscode/settings|launch|tasks|extensions.json, devcontainer
    dependencyScanner.ts     package.json, lockfiles, node_modules size, npm outdated
    gitScanner.ts            user config, .gitignore, hooks, large tracked files
    performanceScanner.ts    watcher/search exclusions, large folders, file counts
    securityScanner.ts       committed .env, secret patterns, npm audit, SSH config
    teamScanner.ts           .editorconfig/.nvmrc/devcontainer drift across the team
  health/
    scoreEngine.ts            Aggregates all issues/bonuses into a 0–100 score + rating
    recommendationEngine.ts   Prioritizes issues (severity → score impact) for the UI
  services/
    scanOrchestrator.ts       Runs all enabled scanners concurrently, builds the HealthReport
    fixService.ts             One-click fix registry — preview-then-apply, safe vs. unsafe
    exportService.ts          JSON / Markdown / HTML report generation
    historyService.ts         Persists score-over-time in workspaceState
  dashboard/
    DashboardPanel.ts         Owns the main webview panel + message protocol
    SummaryViewProvider.ts    Sidebar activity-bar webview view
    StatusBar.ts              Status bar score item
  webview/
    main.js, style.css        Vanilla JS/CSS dashboard UI (no framework, tight CSP)
  types/index.ts              Shared contracts: Issue, ScanResult, HealthReport, messages
  utils/                       exec.ts (safe shell calls), fs.ts (safe JSON/dir-size reads)
  test/                        Unit tests (pure logic) + integration test (activation)

Design decisions

• Scanners are a plugin system, not a hardcoded list. Every scanner implements the same Scanner interface and returns a ScanResult. ScanOrchestrator just iterates whatever's registered in createDefaultScanners(). Adding a 9th category means writing one new file and adding one line — see DEVELOPMENT.md.
• Score logic lives with detection logic. Each Issue/Bonus carries its own scoreImpact, decided at the point where the scanner already has full context (e.g. "3 unused extensions" scales its own deduction). scoreEngine.ts is a small, pure, unit-tested aggregator — fully transparent, since HealthScore.breakdown lists every named contribution.
• Fixes are safe by construction. preview is a required field, shown in a confirmation modal before anything runs. The safe flag gates what bulk "Fix Safe Issues" is allowed to touch — anything that changes shell environment or uninstalls something stays a single-issue, explicitly confirmed action.
• One scanner's error never breaks the dashboard. BaseScanner.scan() catches everything; a missing CLI tool becomes errored: true on that one result, and the other 7 categories render normally.
• The webview is dependency-free by design. No framework, no build step — just HTML/CSS/JS, so the Content-Security-Policy can be locked to a single nonce'd local script with no remote or inline sources.

Testing

npm test

Two layers: fast pure-logic unit tests (score math, export formatting — no VS Code API needed) and one integration test that runs inside a real headless VS Code instance to verify activation and command registration. See DEVELOPMENT.md for details on extending either.

Security considerations

• The security scanner's secret-pattern check is a fast, low-noise sanity check over a handful of common config files — not a substitute for a dedicated secret-scanning tool.
• .env detection checks whether the file is tracked by git, not just present — a gitignored .env is expected and not flagged.
• All shell commands run through a wrapper with a timeout that never throws; a missing or slow CLI tool degrades gracefully rather than crashing a scan.
• Fixes never delete files or run destructive commands automatically — every fix is additive or hands off to a VS Code UI surface for explicit confirmation.
• The webview's CSP has no unsafe-eval, no remote script sources, and a per-load nonce.

Roadmap

• AI-generated issue explanations and fix suggestions
• Remote-SSH / WSL / Dev Container-aware scanning
• Workspace snapshots and an "automatic repair" mode
• Shared team/CI baseline comparisons
• Configurable scheduled scans

See CHANGELOG.md for what's shipped, and open an issue to suggest what's next.

Contributing

Contributions are welcome — new scanners, new fixes, bug reports, or documentation improvements. See CONTRIBUTING.md and DEVELOPMENT.md to get started.

License

MIT © Anand Shah