Bloodloss: Bloodstream

An independent, opt-in native VS Code companion for manual, bounded, read-only context-source checks. Version 0.1.5, extension ID shark-labs.bloodloss-agent-workspace.

The Bloodloss Activity Bar container opens one Bloodstream view with the original skull and a script-free dashboard. Nothing runs until you scan. An explicit scan explains observed instruction files, agent/skill definitions and inexpensive MCP configuration/provider evidence. This is not Copilot's assembled prompt, a live activity monitor, or a complete inventory of its context. The native color-theme picker remains available.

Bloodstream works without the Bloodloss theme. Neither package requires, installs or activates the other. The separate Bloodloss 0.1.3 theme and both file-icon sets are unchanged and runtime-free.

Before replacing an older companion

External hooks installed by a previous Bloodstream version can keep running after that extension is replaced, disabled or uninstalled. This companion cannot pause, disconnect or remove them and does not edit external configuration.

Before upgrading:

1. If the older companion is still available, use its Bloodstream: Disconnect Local Observer command before replacing it.
2. Inspect the user-managed external hook configurations you previously configured. Remove only entries previously added by Bloodstream; preserve unrelated hooks, configuration and user data. Do this before installing the new companion. If the old command is unavailable or reports incomplete cleanup, make the targeted removal manually.
3. Do not assume replacing the VSIX proves that external capture has stopped. Verify the relevant producer's effective hook configuration yourself.

Old state is not read, migrated or deleted by 0.1.5. Existing consent, history, pins, helper files and other prior state are not restored or cleaned up. This reset removes functionality from the extension, not data from your machine. Do not delete an entire hooks/configuration or storage directory as an upgrade step.

Install and open Bloodstream

Requires VS Code 1.137.0 or newer within the 1.x line (engines.vscode: ^1.137.0).

1. Check Manage > Profiles in the intended VS Code or Insiders window. Editions and profiles have separate extension selections.
2. After completing any older-hook cleanup above, install Bloodloss: Bloodstream by shark-labs from the Extensions view, or use Extensions: Install from VSIX... with a trusted, inspected bloodloss-agent-workspace-0.1.5.vsix. Follow the native reload prompt.
3. Open the Bloodloss skull-and-drop Activity Bar entry, or use View: Open View... to find Bloodstream. The existing view ID is preserved; the former Vitals heading is now Bloodstream.
4. Optionally install the separate bloodloss-0.1.3.vsix. Use Preferences: Color Theme and Preferences: File Icon Theme to select Bloodloss and either Bloodloss File Icons or Bloodloss Agent File Icons independently. Existing selections are not changed automatically.

There is no first-run invitation, onboarding, setup flow or demo. Opening a view performs only minimal registration/rendering. The companion runs in the UI extension host (extensionKind: ["ui"]) and has no explicit activationEvents: VS Code infers activation from its contributed views and commands. There is no onStartupFinished. No agent, task, MCP server, external Node runtime or workspace trust grant is needed to view the initial state. Activation, opening/restoring the view and using the appearance picker do not read sources or query tools.

Repository users can instead use npm run install:local from the repository root for explicit editor/profile/package selection. That development-only helper is not part of either VSIX and does not perform older-hook cleanup.

Native color-theme picker

The paint-can status shortcut on the right appears only after opening Bloodstream or running Bloodstream: Choose Color Theme. It opens VS Code's native color-theme picker, as does the paint-can button in the view's title toolbar or the Command Palette command. No left-side BLOODSTREAM status item is registered.

Choose any installed theme, or press Escape to cancel. The companion does not write appearance settings itself; selection and cancellation belong to the native picker. File icons are separate.

If the status item is hidden, use the status bar's context menu to enable Bloodstream Color Theme. Its position relative to other extensions is controlled by VS Code. This shortcut belongs to the companion, not the static theme package.

If something is missing

• No sidebar: confirm shark-labs.bloodloss-agent-workspace is enabled in the intended editor/profile and reload if requested. Restore a hidden Bloodloss Activity Bar entry using its context menu.
• No old cards, extra views, commands or live activity: expected in 0.1.5. The former setup, observer, collection, review, history, task, MCP execution and profile commands remain removed. Source checks now require an explicit health scan; they do not restore those features.
• Wrong colors or icons: use the native Preferences: Color Theme and Preferences: File Icon Theme commands independently. The companion does not select or require Bloodloss.
• Marketplace behavior differs: the previously verified public companion 0.1.1 is a historical runtime preview, not 0.1.5. Check the actual installed version rather than inferring it from the name.

Manual source health

Use the native view-title toolbar or Command Palette:

• Bloodstream: Scan / Refresh Health starts one bounded read-only scan. Refresh runs the same checks again; repeated invocation does not queue scans.
• Bloodstream: Cancel Health Scan cancels further work. Hiding the view, changing workspace folders or disposing the extension also cancels the scan.
• Bloodstream: Open Health Source offers a bounded native source picker, then opens an observed, controller-owned URI in the editor. Instruction text cannot supply arbitrary command arguments or unrelated paths.

Results are grouped as Instructions, Agents & Skills, and MCP & Source Coverage, with source scope, provenance and the last explicit scan time. Results are as of last scan; not live. Reopening may restore the in-memory snapshot without rereading files. Failed/cancelled attempts do not turn older measurements into fresh success; results are not saved across sessions. Expandable details may collapse when the document is recreated.

What the evidence means

Zero describes only a completed measurement within its stated scope. Missing permissions, an unavailable profile location or an empty tool registry never mean "nothing loaded", "no MCPs running" or "healthy". Workspace and User/shared sources remain separate; legacy/profile coverage is not inferred. Agent files are not active agents; skill bodies are on-demand candidates, not always-loaded context. Overlapping source URIs are deduplicated with their discovery origins retained; different authorities and workspace locations remain distinct.

Instruction metrics use successfully decoded UTF-8 text:

• Bytes: actual bytes returned by the accepted read, not the earlier stat.
• Lines: split on CRLF, CR or LF; empty text is zero, and a trailing newline contributes a trailing empty line.
• Words: non-whitespace runs (\S+), not linguistic word segmentation.
• Code points: Unicode code points, including whitespace and a retained BOM, not UTF-16 code units.
• Rough tokens: ceil(codePoints / 4).

The token estimate is an English-text heuristic, not model tokenization, prompt consumption or a context-budget meter. Largest-file measurements are inspectable indicators, not validated quality thresholds. There is no instruction-density warning or overall health score.

Exact repetition counts eligible lines after trimming both ends and replacing each whitespace run with one space; case and punctuation remain significant. Exclude empty lines, ATX headings (# through ###### followed by whitespace or end-of-line with at most three leading spaces), Setext headings and their =/- underline lines, initial --- frontmatter through a --- or ... closing delimiter, and fenced code. A BOM is ignored only when recognizing the initial frontmatter delimiter. Fences are at least three backticks or tildes, indented at most three spaces, and close with the same character, at least the opening length and no non-whitespace suffix. An unclosed frontmatter or fence excludes the remainder. These are explicit line rules, not a full Markdown or YAML parser. This is not fuzzy similarity, semantic conflict detection or a model assessment. Repetition ratio = occurrences beyond the first / eligible line occurrences; a zero denominator is not applicable. Duplicate summaries retain at most 100 groups and 100 locations per group, with informational truncation when details are omitted. The bounded result retains source locations rather than displaying instruction bodies. Agent and skill inventories use paths and stat sizes without reading their bodies. No YAML metadata is parsed, and declared metadata/applicability remain unevaluated.

Sources, exclusions and limits

Supported workspace conventions include root and bounded nested AGENTS.md, CLAUDE.md/CLAUDE.local.md, .github/copilot-instructions.md, .github/instructions, .claude/rules, .github/agents, .claude/agents, and .github/skills, .claude/skills, .agents/skills. Agents and SKILL.md are classified separately from instructions; skill support files are not inventory entries. Matching .agent.md and .instructions.md files are also recognized during bounded workspace traversal. MCP sources include root .vscode/mcp.json and .mcp.json. JSONC supports comments/trailing commas; malformed documents and unsupported top-level shapes produce explicit findings, not a false zero-server success. Supported MCP documents have exactly one of the top-level servers or mcpServers objects, with object-valued server definitions; this is not full server-schema validation.

The recognized settings are chat.instructionsFilesLocations, chat.agentFilesLocations and chat.agentSkillsLocations, inspected per resource. Only enabled entries in supported path-to-boolean objects are used; glob and variable expressions are not expanded. These host settings are trust-restricted and may be marked deprecated; recognizing a supported value does not establish current-harness applicability. Unsupported settings yield a coverage gap, not invented defaults. Documented personal customization locations under .copilot, .claude and .agents are probed only when the local home/host is unambiguous and trust permits it. The personal probes are .copilot/instructions, .claude/rules, .copilot/agents, .claude/agents, .copilot/skills, .claude/skills, .agents/skills, .claude/CLAUDE.md and .copilot/mcp-config.json. These and permitted explicit user-owned source locations are User/shared, never a claim to have found the active profile. Current scans do not enumerate active/legacy profile storage or infer profile ownership of a supplied path. Bloodstream does not crawl profiles or derive them from extension storage.

Exclude VCS internals, dependencies, generated/build outputs and caches by case-insensitive directory basename: .git, .hg, .svn, node_modules, bower_components, vendor, dist, build, out, coverage, .next, .nuxt, .cache, .vscode-test, .host-test, __pycache__, .venv, venv, target, bin, obj, .copilot, sessions and history directories encountered during traversal. Explicit personal .copilot probes above are separate narrowly scoped roots. Ordinary source files are not read for density calculations or counted toward the artifact threshold. Workspace-authored outside-workspace paths and symlinks are skipped; there is no whole-disk/home crawl. Parent repositories, plugin-bundled and organization sources, unavailable legacy profiles, remote personal folders and internally discovered context remain coverage gaps. The scanner's bounded exclusion policy is not Copilot's search policy; findFiles does not automatically apply search.exclude.

Each MCP source displays at most its first 10 observed server names with an explicit displayed/observed count. Use native Open Health Source to inspect the original configuration beyond that display limit; the view does not render the full configuration or its sensitive values. Retained duplicate-summary limits above do not bypass the overall 100-row rendering budget.

Overflow uses native error foreground/border and a textual label. It diagnoses the scan budget, not a broken Copilot installation. Public workspace.fs.readFile reads whole files: accepted-text budgets are not a hard provider-memory bound, and in-flight reads cannot be forcibly aborted. Cancellation stops new work; late completions are fenced from updating a disposed view or newer snapshot. Another scan waits for old bounded work to drain. Ancestor/target checks reject observed symlinks before reads, but public workspace.fs has no atomic no-follow read. A provider or filesystem changing between the check and read remains a boundary limitation, not a verified race-free containment guarantee. Additional discovery guards limit nesting to 128 levels and processed directory entries to 100,000 per directory. Roots, findings, declarations and tool inventories are bounded at 1,000 entries; MCP name extraction processes at most 1,000 server entries across the entire scan, with 256-character limits on server/provider/tool names. Exhausted name coverage is incomplete, not a measurement of zero servers in a later configuration. Omissions and unsupported entries produce coverage findings rather than unqualified completeness.

Supported public API capability matrix

The supported baseline is stable @types/vscode 1.137.0 and engine ^1.137.0. Availability below is an API contract, not a claim that every host/provider scenario has passed a native test.

Remote/virtual workspaces use URI-based APIs where supported, with partial coverage on provider failures. Remote personal discovery is not supported. Restricted Mode never prompts for trust or bypasses it. Native MCP: List Servers, Chat: Open Customizations, and Developer: Open Agent Debug Panel can offer complementary host information; open them yourself. Bloodstream does not call undocumented internal commands or scrape their state. Reference: the VS Code API and customization overview.

Privacy and upgrade boundary

Bloodstream disables webview scripts and command URIs, uses narrow media roots and a restrictive CSP, and has no message handlers. Only explicit scans read supported source files and snapshot inexpensive metadata. There are no watchers, recurring timers, startup/idle/background scans, persistent content caches, observer hooks, history/review processing, editor decorations, task execution, tool/provider invocation, network/model requests, telemetry or settings writes.

MCP results contain only server names, format and source location. Command arguments, environment values, headers, input defaults, credentials and full endpoint URLs are never rendered or logged. Instruction bodies and tool schemas/descriptions are not displayed. Dynamic text/attributes are escaped. jsonc-parser 3.3.1 is the sole production dependency, bundled in-process for JSONC parsing; it adds no external service or executable.

The companion does not inspect, migrate, delete or resume older user state. It cannot control previously installed external hooks. See Before replacing an older companion above; disabling the companion is not external-hook cleanup. Restricted Mode does not require a trust bypass for the view or local checks. A local host test is not certification of every remote host, platform or accessibility surface.

Independent development and local packaging

Use Node.js 22+, npm and a supported installed VS Code desktop host. From companion, restore locked development dependencies with npm ci on a fresh checkout, then run:

npm run typecheck
npm test
npm run test:host
npm run test:visual
npm run package
npm run check:package
npm run test:packaged

npm test covers metadata, appearance, script-free shell, explicit-scan lifecycle, source provenance, metrics, redaction and bounded-load regressions. Removed observer, onboarding and history tests are not evidence for this feature. Host tests must use isolated profiles and extensions directories, never the normal user profile. That isolation does not isolate USERPROFILE/HOME: native scan-test hosts must also point those environment variables at synthetic fixture homes so explicit test scans cannot inspect personal customization content. The source-host run and installed-VSIX run are distinct checks; package and inspect the exact current artifact before the latter.

The current host runner retains --visual, --restricted, --packaged and --legacy-theme; it no longer supports --onboarding-only. For additional isolated evidence after packaging and inspection:

node scripts\test-host.mjs --packaged --visual
node scripts\test-host.mjs --packaged --restricted

For optional paired-theme checks, set COMPANION_THEME_VSIX to an inspected theme archive. Use COMPANION_INSTALL_ORDER=theme-first or companion-first to exercise each order in disposable profiles. --legacy-theme is only for an original theme 0.1.0 archive without agent icons; it is not the current-theme scenario. A run without a theme archive checks the companion independently. Visual acceptance includes native scan/cancel/open actions, overflow text, narrow widths, keyboard navigation, light/dark/high-contrast modes and 200% zoom. Host assertions and responsiveness measurements are separate from screenshots. Do not treat a synthetic fixture as proof of signed-in Copilot context coverage.

The release artifact is bloodloss-agent-workspace-0.1.5.vsix. Inspect its allowlisted payload for the single bundle, manifest, public documentation, third-party notices, license and approved original media, with no observer helper, unbundled dependencies, test tooling, profiles, source data or prior VSIXs. Build guards inspect esbuild's metafile: only the seven owned runtime source modules and used jsonc-parser distribution modules, only vscode as an external runtime import, and at most 128 KiB uncompressed. The exact archive file allowlist is unchanged; no node_modules or metafile is shipped. Bundling prefers the parser's published ESM entry so its implementation modules are included rather than leaving UMD-relative runtime requires. The root theme has its own validation and package boundary; never include the companion in its archive. Only the PNG thumbnail, Activity Bar glyph, quiet skull and view CSS are packaged as media. Obsolete skull-state and wound artwork is not shipped.

The packaged THIRD_PARTY_NOTICES.txt reproduces the pinned parser's MIT license from its installed package. Development tools are excluded from the VSIX.

Record actual command results and host versions for each candidate. Historical preview measurements and release checks do not validate the new scan. Record actual activation, scan/cancellation/render timings, memory and bundle size, and explicitly identify untested remote/profile/provider scenarios. A passing smoke test is not a complete visual/accessibility review, and local packaging does not authorize installation into a normal profile or publication.