What is vscode-reviewer?

A review agent for the VS Code extension that connects the editor to the Fallow language server. It checks activation, commands, settings, issue navigation, status displays, executable lookup, and the language-server connection.

Use it when changing the extension's commands, settings, sidebar or tree views, status bar, executable discovery, or language-server integration.

It helps prevent editor features from failing silently, pointing to the wrong files, leaking processes, or confusing users.

How fallow-rs/fallow configures Claude Code and Codex

About the project

Fallow is a command-line static-analysis tool that builds a dependency graph of TypeScript and JavaScript code to identify unused code, duplication, circular dependencies, complexity hotspots, boundary violations, and styling drift. It is for developers reviewing codebases and verifying changes, with catalogue entries that add agent, editor, and workflow integrations.

fallow-rs/fallow · 5,273 stars · on GitHub · docs.fallow.tools

Reuse

Borrowing it

Nothing to install: this file belongs to fallow-rs/fallow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/fallow-rs/fallow/main/.agents/agents/vscode-reviewer.md

Clone the repo

git clone --depth 1 https://github.com/fallow-rs/fallow

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/fallow-rs/fallow/vscode-reviewer/github.svg)](https://agentmods.dev/agents/fallow-rs/fallow/vscode-reviewer)

Your own site

<a href="https://agentmods.dev/agents/fallow-rs/fallow/vscode-reviewer"><img src="https://agentmods.dev/badge/agents/fallow-rs/fallow/vscode-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/fallow-rs/fallow/vscode-reviewer"><img src="https://agentmods.dev/badge/agents/fallow-rs/fallow/vscode-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 26 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,249 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00026	$0.01249
Opus 5.5	$0.00010	$0.00500
Sonnet 5.5	$0.00005	$0.00250
Haiku 4.5	$0.00003	$0.00125

Measured 1mo ago against content hash b8f49b024a85, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

vscode-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/agents/vscode-reviewer.md · 66 lines

How it starts

The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Review changes to fallow's VS Code extension. This is the editor integration layer that connects VS Code to the fallow LSP server.

What to check

Activation correctness: Extension should activate on workspace open (not on every file), deactivate cleanly. No leaked processes or file handles
Binary resolution chain: Settings path -> node_modules -> PATH -> cached download -> auto-download. Each step must fail gracefully to the next. Version mismatch detection between extension and binary
Command registration: All commands in package.json must have implementations. Command palette titles must be clear ("Fallow: Analyze Project" not "Run Analysis")
Settings design: Settings must have descriptions, valid defaults, and correct types. Enum settings need enumDescriptions. Settings changes should take effect without restart where possible
Tree view UX: Issues grouped logically (by type, by file). Click-to-navigate must open the correct file at the correct line. Empty state when no issues found
Status bar: Show analysis state (running/done/error), issue count. Click action should be useful (open output, re-run, or open sidebar)
LSP client lifecycle: Handle server crashes gracefully (auto-restart with backoff). Don't flood the user with error dialogs. Show meaningful status during restart
Diagnostic mapping: LSP diagnostics must map to VS Code's severity levels correctly. Quick fixes must produce valid edits. Code lens must not flicker during analysis
Auto-download: Platform detection, version pinning, progress indication, retry on network failure. Never silently download without user consent (respect autoDownload setting)
package.json: engines.vscode minimum version, activation events, contributes section completeness

Surface-specific checks

For each VS Code extension diff, walk this list in addition to the generic checks above:

VS Code dist/ bundle is NOT committed (build output only): editors/vscode/dist/ is gitignored. Do not flag a source change for "missing dist rebuild", and reject any diff that re-adds dist/extension.js or dist/extension.js.map to version control. The shipped VSIX is built fresh from src/ by CI (.github/workflows/ci.yml: pnpm build) and the release pipeline (vscode-prep: pnpm build then pnpm package), so the marketplace consumer always sees current source. A stale committed bundle used to recur (#902/#903/#907/#908 and the 7267aada type-only .map drift) precisely because the artifact was tracked; untracking it removed the failure class. Source still needs pnpm run build to pass locally as a compile check, but nothing under dist/ should ever appear in git status.
VS Code generated contracts regenerated when docs/output-schema.json changes: any diff touching docs/output-schema.json OR any file under editors/vscode/ requires running pnpm run check:contracts to confirm the committed editors/vscode/src/generated/output-contract.d.ts and npm/fallow/types/output-contract.d.ts are in sync with the schema. The codegen runs as a CI job in .github/workflows/*.yml; a stale generated file passes local cargo test + pnpm run lint (tsc --noEmit ignores upstream-schema-vs-generated drift) but fails CI's check:contracts job. Run alongside pnpm run lint:
```
if git diff origin/main..HEAD --name-only | grep -qE '^(docs/output-schema\.json|editors/vscode/)'; then
  (cd editors/vscode && pnpm run lint 2>&1 | tail -3 && pnpm run check:contracts 2>&1 | tail -3)
fi
```
Caught 2026-05-12 on PR #340 (issue #334): added four FixAction enum variants + available_in_catalogs to docs/output-schema.json but did not regenerate editors/vscode/src/generated/output-contract.d.ts; local pnpm run lint passed because the hand-written re-export wrapper compiles fine against the stale generated file, but CI's check:contracts job flagged the drift. Fix landed as commit 00645dc5. The two pnpm commands serve different purposes: pnpm run lint validates the TS source against itself, pnpm run check:contracts validates the generated files are byte-equivalent to a fresh regen from the schema.

Read the full file on GitHub · 66 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed b8f49b024a85
1mo ago Changed · +13 lines 82492007fb40
2mo ago First seen · 53 lines · 26 tokens per session scan A c0b8bba35a87

Subscribe to this mod's changes

vscode-reviewer is an agent published in the GitHub repository fallow-rs/fallow (5,273 stars, last pushed today), licensed MIT. It adds 26 tokens to every session and 1,249 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review cli code-quality dead-code developer-tools javascript oxc

fallow: Agent for Claude Code

Borrowing it

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

What to check

Surface-specific checks

What this file has done since we first saw it

Other agents, from other repositories

alignment-classifier

mz-reviewer

mz-mapper

reviewer

Validate

code-reviewer