vscode-reviewer

vscode-reviewer is an agent for Codex from fallow-rs/fallow. It costs 26 tokens per session (1,248 once invoked), scanned A, original, MIT.

A review agent for the VS Code extension that connects the editor to the Fallow language server. It checks activation, commands, settings, issue navigation, status displays, executable lookup, and the language-server connection.

In plain words
What is it for?
Use it when changing the extension's commands, settings, sidebar or tree views, status bar, executable discovery, or language-server integration.
Why use it?
It helps prevent editor features from failing silently, pointing to the wrong files, leaking processes, or confusing users.

Agent for Codex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/fallow-rs/fallow/vscode-reviewer
Clone the repo
git clone --depth 1 https://github.com/fallow-rs/fallow

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for vscode-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/fallow-rs/fallow/vscode-reviewer.svg)](https://agentmods.dev/agents/fallow-rs/fallow/vscode-reviewer)
Your own site
<a href="https://agentmods.dev/agents/fallow-rs/fallow/vscode-reviewer"><img src="https://agentmods.dev/badge/agents/fallow-rs/fallow/vscode-reviewer.svg" alt="Measured on agentmods" height="20"></a>
Per session 26 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,248 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00026 $0.01248
Opus 5 $0.00013 $0.00624
Sonnet 5 $0.00005 $0.00250
Haiku 4.5 $0.00003 $0.00125

Measured today against content hash 82492007fb40, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

vscode-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/agents/vscode-reviewer.md · 66 lines

How it starts

The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Review changes to fallow's VS Code extension. This is the editor integration layer that connects VS Code to the fallow LSP server.

What to check

  1. Activation correctness: Extension should activate on workspace open (not on every file), deactivate cleanly. No leaked processes or file handles
  2. Binary resolution chain: Settings path -> node_modules -> PATH -> cached download -> auto-download. Each step must fail gracefully to the next. Version mismatch detection between extension and binary
  3. Command registration: All commands in package.json must have implementations. Command palette titles must be clear ("Fallow: Analyze Project" not "Run Analysis")
  4. Settings design: Settings must have descriptions, valid defaults, and correct types. Enum settings need enumDescriptions. Settings changes should take effect without restart where possible
  5. Tree view UX: Issues grouped logically (by type, by file). Click-to-navigate must open the correct file at the correct line. Empty state when no issues found
  6. Status bar: Show analysis state (running/done/error), issue count. Click action should be useful (open output, re-run, or open sidebar)
  7. LSP client lifecycle: Handle server crashes gracefully (auto-restart with backoff). Don't flood the user with error dialogs. Show meaningful status during restart
  8. Diagnostic mapping: LSP diagnostics must map to VS Code's severity levels correctly. Quick fixes must produce valid edits. Code lens must not flicker during analysis
  9. Auto-download: Platform detection, version pinning, progress indication, retry on network failure. Never silently download without user consent (respect autoDownload setting)
  10. package.json: engines.vscode minimum version, activation events, contributes section completeness

Surface-specific checks

For each VS Code extension diff, walk this list in addition to the generic checks above:

  • VS Code dist/ bundle is NOT committed (build output only): editors/vscode/dist/ is gitignored. Do not flag a source change for "missing dist rebuild", and reject any diff that re-adds dist/extension.js or dist/extension.js.map to version control. The shipped VSIX is built fresh from src/ by CI (.github/workflows/ci.yml: pnpm build) and the release pipeline (vscode-prep: pnpm build then pnpm package), so the marketplace consumer always sees current source. A stale committed bundle used to recur (#902/#903/#907/#908 and the 7267aada type-only .map drift) precisely because the artifact was tracked; untracking it removed the failure class. Source still needs pnpm run build to pass locally as a compile check, but nothing under dist/ should ever appear in git status.
  • VS Code generated contracts regenerated when docs/output-schema.json changes: any diff touching docs/output-schema.json OR any file under editors/vscode/ requires running pnpm run check:contracts to confirm the committed editors/vscode/src/generated/output-contract.d.ts and npm/fallow/types/output-contract.d.ts are in sync with the schema. The codegen runs as a CI job in .github/workflows/*.yml; a stale generated file passes local cargo test + pnpm run lint (tsc --noEmit ignores upstream-schema-vs-generated drift) but fails CI's check:contracts job. Run alongside pnpm run lint:
    if git diff origin/main..HEAD --name-only | grep -qE '^(docs/output-schema\.json|editors/vscode/)'; then
      (cd editors/vscode && pnpm run lint 2>&1 | tail -3 && pnpm run check:contracts 2>&1 | tail -3)
    fi
    
    Caught 2026-05-12 on PR #340 (issue #334): added four FixAction enum variants + available_in_catalogs to docs/output-schema.json but did not regenerate editors/vscode/src/output-contract.d.ts; local pnpm run lint passed because the hand-written re-export wrapper compiles fine against the stale generated file, but CI's check:contracts job flagged the drift. Fix landed as commit 00645dc5. The two pnpm commands serve different purposes: pnpm run lint validates the TS source against itself, pnpm run check:contracts validates the generated files are byte-equivalent to a fresh regen from the schema.

Read the full file on GitHub · 66 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +13 lines 82492007fb40
  2. 4d ago First seen · 53 lines · 26 tokens per session scan A c0b8bba35a87

Subscribe to this mod's changes

vscode-reviewer is an agent published in the GitHub repository fallow-rs/fallow (4,443 stars, last pushed today), licensed MIT. It adds 26 tokens to every session and 1,248 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.