DevPilot

The full vector logo is in media/devpilot.svg.

DevPilot is an AI-powered code quality and development assistant for VS Code. It does not just find errors — it helps you from analysis to fixing, testing and documentation, in any language.

Supported languages

Python, C, C++, JavaScript, TypeScript, JSX, TSX, Java, C#, Go, Rust, PHP, Ruby, Swift, Kotlin, Dart, Lua, SQL, HTML, CSS, R, Scala, Perl and Jupyter Notebook (.ipynb) — all through one built-in engine. HTML, CSS, SQL and Jupyter have dedicated analyzers (see below), not the generic code engine. External tools are optional extras, never requirements:

If a tool is not installed, DevPilot still scans with its built-in analyzers. No language is ever "unsupported" just because a tool is missing.

Features

1. Code analysis & bug detection

• Static analysis, bug detection, naming-convention checks
• Unused variable and unused function detection
• Undefined-variable detection (in print / console.log / println style calls)
• Type issues from Mypy / ESLint / compiler output
• Cyclomatic complexity, code quality (long functions, long lines, deep nesting, magic numbers), duplicate-code detection
• Security checks: eval/exec, unsafe C functions, hardcoded secrets, SQL-injection patterns, unsafe deserialization
• HTML: unclosed/mismatched tags, duplicate id, img without alt, deprecated tags
• CSS: duplicate selector/property, empty rule, !important, unused CSS variable
• SQL (full): procedures/functions/views/tables, unused procedures, SELECT *, DELETE/UPDATE without WHERE, table without PRIMARY KEY, JOIN without ON
• Jupyter: code-cell scanning with issues mapped to the exact .ipynb line, cross-cell variables are not falsely flagged as unused/undefined

2. AI-powered assistance

• Explain an issue, explain selected code, root-cause (bug) analysis
• AI code review, security review, optimization and refactoring
• Context-aware: related files (imports / includes) are sent with a fix request, truncated so prompts stay small

3. AI providers

OpenAI, Google Gemini, Anthropic Claude and Groq. API keys are stored in VS Code Secret Storage (DevPilot: Configure AI Provider) — never in settings files, never in your code.

4. Intelligent fixing — always in the original file

• Fix this (inline / Quick Fix lightbulb), Fix all in file, Fix current issue
• Multiple fix candidates: a deterministic local fix first (where one is safe, e.g. bare except: → except Exception:), then AI candidates
• Confirmation before applying (configurable), syntax validation before applying (py_compile, node --check, gcc/g++ -fsyntax-only, delimiter balance for other languages)
• Applied through WorkspaceEdit, saved automatically, then the file is re-scanned and remaining / skipped / failed fixes are reported
• No temporary or separate diff document replaces the original file.

5. Testing & validation

• Generate tests (AI, or a local template when no AI is configured) — pytest, Jest/Vitest, JUnit, go test, cargo test, PHPUnit, and more. Choose a mode: Full, Edge cases only, Input validation only, or Regression only (Generate Edge Case Tests etc. are separate commands too)
• Run tests with the detected runner, with passed / failed / skipped counts in the DevPilot output channel
• Testing tools: tick tools in Settings (devpilot.test.enabledTools) or via DevPilot: Configure Test Tools, and they auto-run on DevPilot: Run Tests — Playwright, Selenium, Cypress, Postman, Bruno, Insomnia, RestAssured, Appium, Maestro, Testim, Mabl, GitHub Copilot, Apache JMeter, K6, Jira, TestRail, Xray, Zephyr. Runnable tools run their real command; SaaS/management tools are reported as external, never as a fake pass. Custom commands go in devpilot.test.customCommands
• Run the current file for a runtime check (Python, Node, Go, Ruby, PHP, Lua, Perl, R, Scala, C/C++, Java, Rust, and Jupyter notebooks via extracted Python)
• Export Scan Report (DevPilot: Export Scan Report) — Markdown or JSON report
• Verify a fix: re-scan and compare before / after, optionally run tests

6. Documentation

• Generate documentation for a whole file (AI docstrings / JSDoc / Go / Rustdoc comments, or local doc comments when no AI is configured)
• Generate a README from the project's real files (no invented commands)

7. Native VS Code interface

• DevPilot sidebar with Actions, Project Health, and issue categories (Bugs, Naming, Type, Security, Quality, Testing, Documentation)
• Problems panel integration, inline diagnostics, Code Actions / Quick Fix, QuickPick interactions, native notifications, automatic theme support

Workflow

Scan → Diagnose → Explain → Suggest → Preview & Apply → Test → Verify → Document

Quick start

1. Install the extension (from the .vsix in this repo, or from source with F5).
2. Open a project, then run DevPilot: Scan Project (Ctrl+Alt+S) or DevPilot: Scan Current File from the DevPilot sidebar.
3. Click an issue in the sidebar to jump to it, or use the lightbulb (Quick Fix) on a flagged line.
4. Optional: run DevPilot: Configure AI Provider and paste an API key — it is stored securely by VS Code. Without it, static analysis, local fixes, local docs and local test templates still work.
5. Try DevPilot: Generate Tests, DevPilot: Run Tests and DevPilot: Generate Documentation on an open file.

Settings

Legacy setting names from v0.1.0 (devpilot.pythonPath, devpilot.enableRuff, etc.) are still read as fallbacks.

Commands

Scan Project, Scan Current File, Fix Current Issue, Fix All Issues in File, Auto Fix with AI, Suggest Fixes, Explain Issue, Explain Selected Code, Generate Tests, Run Tests, Run Current File, Verify Fix, Generate Documentation, Generate README, Optimize Code, Refactor Code, AI Code Review, Security Review, Configure AI Provider, Remove Stored AI Key, Open Settings — all under the DevPilot: prefix in the Command Palette.

Development

npm install
npm run compile        # builds dist/extension.js with esbuild
npm run test:analysis  # pure analyzer checks (no VS Code needed)

Press F5 in VS Code to launch the Extension Development Host.

Known limitations

• Built-in undefined-variable detection is deliberately conservative: it flags names used in print/log-style calls that are never assigned in the same file. Cross-file globals are not assumed, to avoid false positives.
• AI fixes are only as good as the model and the context supplied; that is why every fix is syntax-checked, confirmed, and re-scanned.
• Running a single C# file directly is not supported — use dotnet test / dotnet run for C# projects instead. C/C++/Java/Rust single files are compiled to a temp binary and run.

License

MIT — see LICENSE.