Overview

In enterprise codebases, critical comments blur into the background. Open questions, technical debt, urgent bugs, and security requirements get buried in thousands of lines of code.

CommentGlow transforms passive comments into active, visually differentiated cues. It provides line-by-line precision highlighting across single-line and multiline comments, safe hover tooltips, and an interactive Comment Explorer Activity Bar view with instant global search and category filtering—all running on pure native JavaScript with zero external runtime dependencies.

Key Features

• 🎨 Adaptive Line-by-Line Highlighting: Unlike legacy extensions that tint entire multiline blocks with a single color, CommentGlow highlights each marker line independently inside multiline comments.
• 📂 Interactive Comment Explorer TreeView: Browse all comments across open editors grouped by category (TODO, FIXME, CRITICAL, etc.) with 1-click jump to file and line.
• 🔍 Instant Search & Category Filtering: Filter comments by keyword query or restrict the tree view to specific markers via Command Palette shortcuts.
• 🛡️ Hardened & Security-First Architecture: Audited against ReDoS, command injection, prototype pollution, and CSS injection. Read the complete Security Policy.
• ⚡ Blazing Fast Performance: Parses 10,000 comments in under 40ms with per-document debouncing, zero regex backtracking, and automatic 2MB safety bypass.
• 🌐 Multi-Language Support: Seamlessly highlights C-style (//, /* */), Hash-style (#), Dash-style (--), and HTML-style (<!-- -->) comments across 30+ languages.
• 🔒 String-Literal Safety: Lexical scanning automatically ignores comment markers found inside string literals ("...", '...', `...`) and regular expressions.
• 🛠️ Deeply Customizable: Add custom markers, override colors, change font weights, adjust categories, or disable unwanted markers directly in settings.json.

Supported Markers

CommentGlow comes pre-configured with curated, developer-focused markers:

Pro Tip: Word markers are case-insensitive (TODO, Todo, todo) and support bracketed syntax ([TODO], [!], [FIXME]).

Supported Languages & Syntax

CommentGlow includes optimized lexical analyzers for all mainstream syntax formats:

1. Line Comments (//, #, --)

// TODO: Implement refresh token rotation
// FIXME: Resolve race condition in payment webhook
// ! Critical: Validate HMAC signature prior to execution
// ? Should this cache be persisted in Redis cluster?
// * Important: Load environment secrets before bootstrap
// # Refactor: Extract shared validation helper

2. Single-Line Block Comments (/* ... */)

/* TODO: Optimize connection pool allocation */
/* ! Critical: Sensitive credential leak guard */
/* ? Needs peer review for concurrency */
/* * Important: Must adhere to ISO-8601 formatting */

3. Multiline Block Comments (Independent Line Highlighting)

Each line within a block comment is evaluated and colored independently:

/*
 * Normal prose line remains in standard comment color
 * TODO: Add end-to-end integration tests for checkout flow
 * ! Verify idempotency key is verified before capture
 * ? Should we apply exponential backoff on network failures?
 * * Important: Keys must remain strictly inside vault
 * # Refactor: Consolidate duplicate middleware handlers
 * FIXME: Null pointer check missing on optional payload
 * NOTE: Stripe timestamps are always UTC
 * Trailing prose line remains in default editor color
 */

4. Language Syntax Coverage

5. JSDoc Intelligence

Standard JSDoc comments (/** ... */) receive specialized handling. Structural asterisks (such as continuation lines on @param, @returns, and descriptions) are never falsely classified as * (IMPORTANT) markers. However, genuine markers inside JSDoc (e.g. * TODO: add validation) are still highlighted accurately.

Comment Explorer & Interactive Features

1. Activity Bar Comment Explorer

Open the dedicated Comment Explorer in the VS Code Activity Bar (Ctrl+Shift+E / Cmd+Shift+E or via command palette) to inspect all active markers across open files:

COMMENT EXPLORER
├── 🟡 TODO (14)
│   ├── auth.js:42 — Implement refresh token rotation
│   ├── api.js:89 — Add cursor-based pagination
│   └── payment.js:154 — Support multi-currency checkout
├── 🔴 CRITICAL (3)
│   ├── security.js:18 — Validate HMAC signature prior to dispatch
│   └── crypto.js:94 — Prevent storing private keys in RAM
├── 🔴 FIXME (5)
├── 🔵 QUESTION (8)
├── 🟣 IMPORTANT (6)
└── 🟠 REFACTOR (4)

Clicking any comment item instantly focuses the document and navigates your cursor directly to the target line and column.

2. Hover Tooltips

Hover over any highlighted marker in the editor to inspect an inert, secure tooltip displaying marker identity, category, and description.

3. Command Palette Quick Actions

Access CommentGlow features quickly using Ctrl+Shift+P / Cmd+Shift+P:

Configuration

Customize CommentGlow by modifying your VS Code settings.json:

{
  "commentglow.enable": true,

  "commentglow.disabledMarkers": [
    "QUESTION"
  ],

  "commentglow.markers": [
    {
      "name": "TODO",
      "color": "#eab308"
    },
    {
      "name": "BUG",
      "token": "BUG",
      "type": "word",
      "color": "#ef4444",
      "fontWeight": "bold",
      "description": "Known bug or defect",
      "category": "bug"
    },
    {
      "name": "AUDIT",
      "token": "@",
      "type": "symbol",
      "color": "#10b981",
      "fontWeight": "bold",
      "description": "Security audit required",
      "category": "critical"
    }
  ]
}

Settings Reference

Marker Object Schema

• name (string, required): Unique identifier for the marker (e.g. "AUDIT").
• token (string, required): String or character to match (max 50 chars).
• type (string, required): "word" for word boundaries or "symbol" for character prefixes.
• color (string, required): Hex (#rrggbb), RGB/RGBA, HSL, or named CSS color. Malicious or invalid CSS values safely fall back to #d3c935.
• fontWeight (string, optional): "normal", "bold", or standard numeric weight (100-900). Default: "bold".
• description (string, optional): Tooltip description displayed on hover. Max 200 chars.
• category (string, optional): Grouping identifier in Comment Explorer (task, bug, critical, question, important, refactor, or custom).
• enabled (boolean, optional): Whether this marker is actively highlighted. Default: true.

Security & Hardening

CommentGlow adheres to a strict zero-trust threat model designed for untrusted repositories and malicious workspace configurations.

Complete details are documented in our Security Policy & Architecture Document (SECURITY.md).

Core Security Guarantees

1. Zero Network Egress: CommentGlow performs zero outbound HTTP/HTTPS or socket connections. No telemetries, no third-party APIs.
2. Zero Process Execution: Never spawns child processes, shell commands, or external binaries.
3. Inert Hover Cards (VULN-01): Tooltips strictly enforce isTrusted = false and supportHtml = false. Command injection URIs and raw HTML tags are sanitized and neutralized.
4. ReDoS & Token Defense (VULN-02): Tokens are bounded to <= 50 characters. Regular expressions use safe string escaping (escapeRegExp). Linear HTML scanners prevent catastrophic regex backtracking (WEAK-01).
5. Memory Bloat Defense (WEAK-02): Comment previews are capped at <= 303 characters, and raw text is capped at <= 5003 characters to prevent heap exhaustion.
6. Prototype Pollution Immunity: Custom marker merge logic explicitly rejects __proto__, constructor, and prototype keys.
7. Strict CSS Sanitization (WEAK-05): Colors and font weights are validated against strict whitelists before injection into editor decoration types.

Run the automated 20-scenario security test suite:

npm run test:security

Performance & Benchmarks

CommentGlow is engineered for near-instant execution in massive monorepos:

• 10,000 Comments Parsed: Completed in < 40ms without heap degradation.
• 1.9MB Single Document Scan: Completed in < 60ms.
• Oversized Document Protection: Files exceeding 2MB are automatically bypassed to protect the VS Code Extension Host thread.
• Per-URI Debouncing: Edits are debounced at 100ms per active document URI, ensuring zero keystroke lag during rapid typing.

Testing & Quality Assurance

The extension maintains comprehensive automated test coverage validated via Node.js's native test runner:

# Run all test suites (50 total test scenarios)
npm run test:all

# Run the 20-scenario security & hardening regression suite
npm run test:security

# Run the 30-scenario functional parser & index suite
npm run test:unit

# Run static analysis and ESLint verification
npm run lint

Contributing & Development

We welcome contributions! To set up CommentGlow locally:

1. Clone the repository:

   git clone https://github.com/ansh35/CommentGlow.git
   cd commentglow
   

2. Install development dependencies:

   npm install
   

3. Launch Extension Development Host:
   • Open the project in VS Code.
   • Press F5 (or run Run > Start Debugging).
   • A new Extension Development Host window will launch with CommentGlow loaded.
4. Test Live Markers:
   • Open demo.js or demo.py in the Host window to test markers live in real time.
5. Verify Tests:
   • Run npm run test:all before submitting pull requests.

License

This project is licensed under the MIT License.