Salesforce DevPilot Pack
Working name. Check the trademark and Marketplace name before you publish.
A Salesforce developer pack for VS Code. It installs the standard Salesforce tooling and adds its own features, built around a Change Impact Analyzer, that cover the work from coding to release. Analysis runs locally: no code leaves your machine, and the only org call is the optional validation deploy.
What's in the pack
| Area |
Provided by |
| Apex, LWC, Aura, SOQL, org browser, deploy/retrieve |
Salesforce Extension Pack (installed automatically) |
| Formatting, XML, linting |
Prettier, Red Hat XML, ESLint (installed automatically) |
| Change Impact Analyzer |
DevPilot |
| One-click Health Check |
DevPilot |
| One-click Release Check |
DevPilot |
| Apex Log Analyzer |
DevPilot |
| Test Intelligence |
DevPilot |
| GitLab / Jenkins reports |
DevPilot CLI (no npm dependencies) |
Features
Change Impact Analyzer
Command palette → DevPilot: Change Impact: Branch vs Base (also: Uncommitted Changes, This File)
- Scans the SFDX project (Apex classes and triggers, LWC, Aura, Flows, Visualforce, objects, fields, validation rules, permission sets and profiles) and builds a dependency graph.
- Reads the changed files from Git and follows dependents up to the configured depth (default 3).
- Shows every affected component with its dependency path, for example
Region__c → AccountService → accountList.
- Gives a risk score from 0 to 100 (LOW / MEDIUM / HIGH), weighted by component type (triggers and flows weigh more), depth, deletions and findings.
- Findings: SOQL or DML inside loops, deleted components that are still referenced, tests without assertions,
SeeAllData=true, changed Apex with no test, and changes to security metadata.
- Recommended tests: test classes that reference the changed or affected code, plus naming conventions (
FooTest, Foo_Test). Run them in one click.
- The status bar shows the current risk. Reports can be exported to Markdown or JSON in
.devpilot/reports/.
Right-click any Salesforce file and choose Show Dependencies of This File to see what it uses and what uses it.
Health Check
Checks the sf CLI, Node, Git and Java (JDK 11/17/21 for the Apex Language Server), sfdx-project.json and its package directories, the pinned API version, .forceignore, whether .gitignore excludes .sf/.sfdx, the default org connection and API compatibility, scratch org expiry, and the recommended extensions. Every failed check comes with a fix.
Release Check
Gives a GO / REVIEW / NO-GO verdict based on: risk score, high-severity findings, test evidence, assertion quality, destructive changes (and whether a destructiveChanges.xml exists), and security metadata. Optionally it runs sf project deploy validate with only the related tests and checks code coverage against the threshold.
Apex Log Analyzer
Open a .log file, or pick one, and run DevPilot: Analyze Apex Log. You get exceptions with plain-language explanations (for example "Too many SOQL queries"), governor-limit usage bars, the slowest operations, and repeated SOQL queries that point to a query inside a loop.
Test Intelligence
For the whole project: weak tests (no or few assertions, SeeAllData) and Apex classes or triggers with no related test, largest first.
CI/CD: GitLab and Jenkins
Run DevPilot: Generate GitLab / Jenkins Integration. It writes a pipeline snippet and can copy the CLI into tools/devpilot/. The CI only needs Node.
node tools/devpilot/cli/devpilot.js impact --base origin/main --format md --out devpilot/impact.md --fail-on high
node tools/devpilot/cli/devpilot.js release --format html --out devpilot/release.html [--validate --target-org UAT]
node tools/devpilot/cli/devpilot.js health --no-org
node tools/devpilot/cli/devpilot.js tests
node tools/devpilot/cli/devpilot.js log path/to/apex.log
The CLI detects the base branch automatically from CI_MERGE_REQUEST_TARGET_BRANCH_NAME (GitLab) or CHANGE_TARGET (Jenkins). Exit code 1 means a gate failed, so you can mark the build unstable or block the merge request. The GitLab snippet can also post the Markdown report as a merge request comment if you provide DEVPILOT_TOKEN.
Settings
| Setting |
Default |
|
salesforceDevPilot.baseBranch |
origin/main |
Ref to compare against |
salesforceDevPilot.impactDepth |
3 |
Dependency levels to follow |
salesforceDevPilot.coverageThreshold |
75 |
Coverage gate for validation deploys |
salesforceDevPilot.reportFolder |
.devpilot/reports |
Export location |
salesforceDevPilot.healthCheck.checkOrg |
true |
Include org auth checks |
salesforceDevPilot.runHealthCheckOnStartup |
false |
Run automatically on open |
Develop / try it
- Open this folder in VS Code.
- Press F5. A new window opens on
test/fixtures/sample-project. Open the DevPilot icon in the activity bar.
- Engine tests:
npm test (Node 18+, no install needed).
- Package:
npm run package creates a .vsix. Install it with Extensions → … → Install from VSIX.
There is no build step and there are no runtime dependencies: it is plain CommonJS.
How the analysis works (and its limits)
The analysis is static and based on patterns, not a full Apex compiler. It resolves class references by name, SOQL FROM objects, __c field tokens, LWC @salesforce/apex and @salesforce/schema imports, <c-*> composition, Flow apex actions, record-trigger objects and fields, Visualforce controllers, and permission set grants. Dynamic SOQL, Type.forName and references to standard fields are not resolved. Treat the results as a strong guide, not a proof. Namespaced managed-package references are out of scope for now.
Roadmap
- Org comparison and configuration drift between two orgs
- Optional AI explanations (opt-in, privacy-first)
- Line-level diagnostics in the Problems panel
