Bloodloss: Bloodstream

An independent, opt-in native VS Code companion for manual, bounded, read-only context-source checks. Version 0.1.6, extension ID shark-labs.bloodloss-agent-workspace.

The Bloodloss Activity Bar container opens one Bloodstream view with the original skull and a script-free dashboard. Nothing runs until you scan. An explicit scan explains observed instruction files, agent/skill definitions and inexpensive MCP configuration/provider evidence. This is not Copilot's assembled prompt, a live activity monitor, or a complete inventory of its context. The native color-theme picker remains available.

Bloodstream works without the Bloodloss theme. Neither package requires, installs or activates the other. The separate Bloodloss 0.1.3 theme and both file-icon sets are unchanged and runtime-free.

Before replacing an older companion

External hooks installed by a previous Bloodstream version can keep running after that extension is replaced, disabled or uninstalled. This companion cannot pause, disconnect or remove them and does not edit external configuration.

Before upgrading:

1. If the older companion is still available, use its Bloodstream: Disconnect Local Observer command before replacing it.
2. Inspect the user-managed external hook configurations you previously configured. Remove only entries previously added by Bloodstream; preserve unrelated hooks, configuration and user data. Do this before installing the new companion. If the old command is unavailable or reports incomplete cleanup, make the targeted removal manually.
3. Do not assume replacing the VSIX proves that external capture has stopped. Verify the relevant producer's effective hook configuration yourself.

Old state is not read, migrated or deleted by 0.1.6. Existing consent, history, pins, helper files and other prior state are not restored or cleaned up. This reset removes functionality from the extension, not data from your machine. Do not delete an entire hooks/configuration or storage directory as an upgrade step.

Install and open Bloodstream

Requires VS Code 1.137.0 or newer within the 1.x line (engines.vscode: ^1.137.0).

1. Check Manage > Profiles in the intended VS Code or Insiders window. Editions and profiles have separate extension selections.
2. After completing any older-hook cleanup above, install Bloodloss: Bloodstream by shark-labs from the Extensions view, or use Extensions: Install from VSIX... with a trusted, inspected bloodloss-agent-workspace-0.1.6.vsix. Follow the native reload prompt.
3. Open the Bloodloss skull-and-drop Activity Bar entry, or use View: Open View... to find Bloodstream. The existing view ID is preserved; the former Vitals heading is now Bloodstream.
4. Optionally install the separate bloodloss-0.1.3.vsix. Use Preferences: Color Theme and Preferences: File Icon Theme to select Bloodloss and either Bloodloss File Icons or Bloodloss Agent File Icons independently. Existing selections are not changed automatically.

There is no first-run invitation, onboarding, setup flow or demo. Opening a view performs only minimal registration/rendering. The companion runs in the UI extension host (extensionKind: ["ui"]) and has no explicit activationEvents: VS Code infers activation from its contributed views and commands. There is no onStartupFinished. No agent, task, MCP server, external Node runtime or workspace trust grant is needed to view the initial state. Activation, opening/restoring the view and using the appearance picker do not read sources or query tools.

Repository users can instead use npm run install:local from the repository root for explicit editor/profile/package selection. That development-only helper is not part of either VSIX and does not perform older-hook cleanup.

Native appearance pickers

The paint-can and file status shortcuts on the right appear after opening Bloodstream or running either appearance command. They open VS Code's native color-theme and file-icon-theme pickers. Matching buttons are also available in the view's title toolbar and through Bloodstream: Choose Color Theme / Bloodstream: Choose File Icon Theme in the Command Palette. No left-side BLOODSTREAM status item is registered.

Choose any installed theme or file icon theme, or press Escape to cancel. The companion does not write appearance settings itself; selection and cancellation belong to the independent native pickers.

If a status item is hidden, use the status bar's context menu to enable Bloodstream Color Theme or Bloodstream File Icon Theme. Their positions relative to other extensions are controlled by VS Code. These shortcuts belong to the companion, not the static theme package.

If something is missing

• No sidebar: confirm shark-labs.bloodloss-agent-workspace is enabled in the intended editor/profile and reload if requested. Restore a hidden Bloodloss Activity Bar entry using its context menu.
• No old cards, extra views, commands or live activity: expected in 0.1.6. The former setup, observer, collection, review, history, task, MCP execution and profile commands remain removed. Source checks now require an explicit health scan; they do not restore those features.
• Wrong colors or icons: use the native Preferences: Color Theme and Preferences: File Icon Theme commands independently. The companion does not select or require Bloodloss.
• Marketplace behavior differs: the previously verified public companion 0.1.1 is a historical runtime preview, not 0.1.6. Check the actual installed version rather than inferring it from the name.

Manual source health

Select Scan beside the compact Bloodstream heading. After scanning it becomes Scan again; while scanning it becomes Cancel. The native view-title toolbar and Command Palette remain available:

• Bloodstream: Scan / Refresh Health starts one bounded read-only scan. Refresh runs the same checks again; repeated invocation does not queue scans.
• Bloodstream: Cancel Health Scan cancels further work. Hiding the view, changing workspace folders or disposing the extension also cancels the scan.
• Bloodstream: Open Health Source, labeled Choose source... in the panel, offers a bounded native source picker, then opens an observed, controller-owned URI in the editor. Instruction text cannot supply arbitrary command arguments or unrelated paths.
• Bloodstream: Export Scan Results to Markdown, also available as Export Markdown inside All scan details, saves the last retained snapshot using VS Code's Save dialog. Choose a .md filename. Export never scans again; cancellation writes nothing. A scan/workspace change while choosing a destination requires a fresh export.

The first screen shows compact scan-time workspace location, trust, VS Code version, timestamp and coverage. Workspace location is not agent execution location. Check these shows up to three source checks or unclassified findings, ordered by severity (stable within a severity). Parse/read/encoding failures are source checks; known visibility, unsupported-format and budget limitations are separate. Unknown finding codes remain visible without claiming the source is invalid. Partial scan stays visible even when there are no source checks. No source problems detected in scanned locations is not a Copilot health verdict; empty incomplete discovery instead says No sources observed; scan incomplete.

Found in scanned locations expands in place as Instructions, Agents & skills (separate counts) and MCP (configuration-file count). These are observed candidates, not active agents, loaded skills or running servers. Found does not mean used by this chat. Expanded MCP details distinguish parsed configurations and configured server-name entries, which are not necessarily unique servers. Counts use the full retained snapshot, not displayed rows; unavailable and incomplete tool/declaration inventories are labeled explicitly.

All scan details contains the remaining bounded findings, workspace folders (up to eight; export includes all retained folders), coverage, declarations, registered tools, repetition, performance and export/source-picker actions. Source rows appear only in their category disclosures. Choose source... opens a picker, not the affected finding directly; some finding paths refer to directories or locations absent from the picker. Source/export actions are disabled while scanning. Native disclosures support keyboard activation and visible focus, with native theme colors and textual status.

Results are as of last scan; not live. Reopening may restore the in-memory snapshot without rereading files. Failed/cancelled attempts do not turn older measurements into fresh success; results are not saved across sessions. Expandable details may collapse when the document is recreated.

Markdown export and privacy

The report includes scan time, VS Code version, workspace/trust evidence, extensions known to the current extension host (ID, version, kind and activation state), findings, all retained source records (not only the 100 panel detail rows), measurements, MCP server names, declaration/tool evidence and bounded repeated-line locations. VS Code's stable API does not expose a separate enabled/disabled extension flag; inactive does not mean disabled. The report cannot recover anything omitted by scan limits. Export after a cancelled/failed refresh uses the previous snapshot's timestamp, never the failed attempt's time. Export and source selection are unavailable while scanning.

No file bodies, tool schemas, MCP endpoints, arguments, headers or environment values are exported. Source paths, folder names and server/tool names may be private: review the report before sharing. Metadata is escaped as literal Markdown text, not executable links or raw HTML. Results still are not automatically persisted across sessions; only an explicit export writes the user-selected file. Save/permission errors are shown without provider payloads.

The presentation follows the official VS Code webview UX guidance and command URI guidance. Evidence labels follow the distinction between custom instructions, custom agents and on-demand agent skills. Use the native customizations/debug tools for applicability and runtime evidence, not these inventory counts.

What the evidence means

Zero describes only a completed measurement within its stated scope. Missing permissions, an unavailable profile location or an empty tool registry never mean "nothing loaded", "no MCPs running" or "healthy". Workspace and User/shared sources remain separate; legacy/profile coverage is not inferred. Agent files are not active agents; skill bodies are on-demand candidates, not always-loaded context. Overlapping source URIs are deduplicated with their discovery origins retained; different authorities and workspace locations remain distinct.

Instruction metrics use successfully decoded UTF-8 text:

• Bytes: actual bytes returned by the accepted read, not the earlier stat.
• Lines: split on CRLF, CR or LF; empty text is zero, and a trailing newline contributes a trailing empty line.
• Words: non-whitespace runs (\S+), not linguistic word segmentation.
• Code points: Unicode code points, including whitespace and a retained BOM, not UTF-16 code units.
• Rough tokens: ceil(codePoints / 4).

The token estimate is an English-text heuristic, not model tokenization, prompt consumption or a context-budget meter. Largest-file measurements are inspectable indicators, not validated quality thresholds. There is no instruction-density warning or overall health score.

Exact repetition counts eligible lines after trimming both ends and replacing each whitespace run with one space; case and punctuation remain significant. Exclude empty lines, ATX headings (# through ###### followed by whitespace or end-of-line with at most three leading spaces), Setext headings and their =/- underline lines, initial --- frontmatter through a --- or ... closing delimiter, and fenced code. A BOM is ignored only when recognizing the initial frontmatter delimiter. Fences are at least three backticks or tildes, indented at most three spaces, and close with the same character, at least the opening length and no non-whitespace suffix. An unclosed frontmatter or fence excludes the remainder. These are explicit line rules, not a full Markdown or YAML parser. This is not fuzzy similarity, semantic conflict detection or a model assessment. Repetition ratio = occurrences beyond the first / eligible line occurrences; a zero denominator is not applicable. Duplicate summaries retain at most 100 groups and 100 locations per group, with informational truncation when details are omitted. The bounded result retains source locations rather than displaying instruction bodies. Agent and skill inventories use paths and stat sizes without reading their bodies. No YAML metadata is parsed, and declared metadata/applicability remain unevaluated.

Sources, exclusions and limits

Supported workspace conventions include root and bounded nested AGENTS.md, CLAUDE.md/CLAUDE.local.md, .github/copilot-instructions.md, .github/instructions, .claude/rules, .github/agents, .claude/agents, and .github/skills, .claude/skills, .agents/skills. Agents and SKILL.md are classified separately from instructions; skill support files are not inventory entries. Matching .agent.md and .instructions.md files are also recognized during bounded workspace traversal. MCP sources include root .vscode/mcp.json and .mcp.json. JSONC supports comments/trailing commas; malformed documents and unsupported top-level shapes produce explicit findings, not a false zero-server success. Supported MCP documents have exactly one of the top-level servers or mcpServers objects, with object-valued server definitions; this is not full server-schema validation.

The recognized settings are chat.instructionsFilesLocations, chat.agentFilesLocations and chat.agentSkillsLocations, inspected per resource. Only enabled entries in supported path-to-boolean objects are used; glob and variable expressions are not expanded. These host settings are trust-restricted and may be marked deprecated; recognizing a supported value does not establish current-harness applicability. Unsupported settings yield a coverage gap, not invented defaults. Documented personal customization locations under .copilot, .claude and .agents are probed only when the local home/host is unambiguous and trust permits it. The personal probes are .copilot/instructions, .claude/rules, .copilot/agents, .claude/agents, .copilot/skills, .claude/skills, .agents/skills, .claude/CLAUDE.md and .copilot/mcp-config.json. These and permitted explicit user-owned source locations are User/shared, never a claim to have found the active profile. Current scans do not enumerate active/legacy profile storage or infer profile ownership of a supplied path. Bloodstream does not crawl profiles or derive them from extension storage.

Exclude VCS internals, dependencies, generated/build outputs and caches by case-insensitive directory basename: .git, .hg, .svn, node_modules, bower_components, vendor, dist, build, out, coverage, .next, .nuxt, .cache, .vscode-test, .host-test, __pycache__, .venv, venv, target, bin, obj, .copilot, sessions and history directories encountered during traversal. Explicit personal .copilot probes above are separate narrowly scoped roots. Ordinary source files are not read for density calculations or counted toward the artifact threshold. Workspace-authored outside-workspace paths and symlinks are skipped; there is no whole-disk/home crawl. Parent repositories, plugin-bundled and organization sources, unavailable legacy profiles, remote personal folders and internally discovered context remain coverage gaps. The scanner's bounded exclusion policy is not Copilot's search policy; findFiles does not automatically apply search.exclude.

Each MCP source displays at most its first 10 observed server names; origins and repetition locations also have ten-entry previews with displayed/retained counts. Collapsing a disclosure does not bypass these bounds: its HTML is still rendered. Export preserves all retained nested values. Use Choose source... to inspect an original source; the panel never renders full configuration or sensitive connection values. Instructions remain ordered largest first; other lists retain snapshot order.

Overflow uses native error foreground/border and a textual label. It diagnoses the scan budget, not a broken Copilot installation. Public workspace.fs.readFile reads whole files: accepted-text budgets are not a hard provider-memory bound, and in-flight reads cannot be forcibly aborted. Cancellation stops new work; late completions are fenced from updating a disposed view or newer snapshot. Another scan waits for old bounded work to drain. Ancestor/target checks reject observed symlinks before reads, but public workspace.fs has no atomic no-follow read. A provider or filesystem changing between the check and read remains a boundary limitation, not a verified race-free containment guarantee. Additional discovery guards limit nesting to 128 levels and processed directory entries to 100,000 per directory. Roots, findings, declarations and tool inventories are bounded at 1,000 entries; MCP name extraction processes at most 1,000 server entries across the entire scan, with 256-character limits on server/provider/tool names. Exhausted name coverage is incomplete, not a measurement of zero servers in a later configuration. Omissions and unsupported entries produce coverage findings rather than unqualified completeness.

Supported public API capability matrix

The supported baseline is stable @types/vscode 1.137.0 and engine ^1.137.0. Availability below is an API contract, not a claim that every host/provider scenario has passed a native test.

Remote/virtual workspaces use URI-based APIs where supported, with partial coverage on provider failures. Remote personal discovery is not supported. Restricted Mode never prompts for trust or bypasses it. Native MCP: List Servers, Chat: Open Customizations, and Developer: Open Agent Debug Logs can offer complementary host information; open them yourself via the Command Palette. Availability depends on host version and installed features. Some diagnostics need explicitly enabled logging. Bloodstream never enables logging or changes settings. Check in VS Code provides text guidance only, not discovered command shortcuts. Bloodstream does not call undocumented internal commands or scrape their state. Reference: the VS Code API and customization overview.

Privacy and upgrade boundary

Bloodstream disables webview scripts, uses narrow media roots and a restrictive CSP, and has no message handlers. Command URIs are allowlisted to four owned, argument-free scan/cancel/source/export actions; source content cannot create actions or select paths. Only explicit scans read supported source files and snapshot inexpensive metadata. There are no watchers, recurring timers, startup/idle/background scans, persistent content caches, observer hooks, history/review processing, editor decorations, task execution, tool/provider invocation, network/model requests, telemetry or settings writes. Explicit Markdown export is the only result-file write and uses a native Save dialog.

MCP results contain only server names, format and source location. Command arguments, environment values, headers, input defaults, credentials and full endpoint URLs are never rendered or logged. Instruction bodies and tool schemas/descriptions are not displayed. Dynamic text/attributes are escaped. jsonc-parser 3.3.1 is the sole production dependency, bundled in-process for JSONC parsing; it adds no external service or executable.

The companion does not inspect, migrate, delete or resume older user state. It cannot control previously installed external hooks. See Before replacing an older companion above; disabling the companion is not external-hook cleanup. Restricted Mode does not require a trust bypass for the view or local checks. A local host test is not certification of every remote host, platform or accessibility surface.

Independent development and local packaging

Use Node.js 22+, npm and a supported installed VS Code desktop host. From companion, restore locked development dependencies with npm ci on a fresh checkout, then run:

npm run typecheck
npm test
npm run test:host
npm run test:visual
npm run package
npm run check:package
npm run test:packaged

npm test covers metadata, appearance, script-free shell, explicit-scan lifecycle, source provenance, metrics, Markdown export, redaction and bounded-load regressions. Removed observer, onboarding and history tests are not evidence for this feature. Host tests must use isolated profiles and extensions directories, never the normal user profile. That isolation does not isolate USERPROFILE/HOME: native scan-test hosts must also point those environment variables at synthetic fixture homes so explicit test scans cannot inspect personal customization content. The source-host run and installed-VSIX run are distinct checks; package and inspect the exact current artifact before the latter.

The current host runner retains --visual, --restricted, --packaged and --legacy-theme; it no longer supports --onboarding-only. For additional isolated evidence after packaging and inspection:

node scripts\test-host.mjs --packaged --visual
node scripts\test-host.mjs --packaged --restricted

For optional paired-theme checks, set COMPANION_THEME_VSIX to an inspected theme archive. Use COMPANION_INSTALL_ORDER=theme-first or companion-first to exercise each order in disposable profiles. --legacy-theme is only for an original theme 0.1.0 archive without agent icons; it is not the current-theme scenario. A run without a theme archive checks the companion independently. Visual acceptance includes in-view keyboard scan/export, save cancellation and persisted report checks, native scan/cancel/open actions, overflow text, narrow widths, keyboard navigation, light/dark/high-contrast modes and 200% zoom. Host assertions and responsiveness measurements are separate from screenshots. Do not treat a synthetic fixture as proof of signed-in Copilot context coverage.

The release artifact is bloodloss-agent-workspace-0.1.6.vsix. Inspect its allowlisted payload for the single bundle, manifest, public documentation, third-party notices, license and approved original media, with no observer helper, unbundled dependencies, test tooling, profiles, source data or prior VSIXs. Build guards inspect esbuild's metafile: only the eight owned runtime source modules and used jsonc-parser distribution modules, only vscode as an external runtime import, and at most 128 KiB uncompressed. The exact archive file allowlist is unchanged; no node_modules or metafile is shipped. Bundling prefers the parser's published ESM entry so its implementation modules are included rather than leaving UMD-relative runtime requires. The root theme has its own validation and package boundary; never include the companion in its archive. Only the PNG thumbnail, Activity Bar glyph, quiet skull and view CSS are packaged as media. Obsolete skull-state and wound artwork is not shipped.

The packaged THIRD_PARTY_NOTICES.txt reproduces the pinned parser's MIT license from its installed package. Development tools are excluded from the VSIX.

Record actual command results and host versions for each candidate. Historical preview measurements and release checks do not validate the new scan. Record actual activation, scan/cancellation/render timings, memory and bundle size, and explicitly identify untested remote/profile/provider scenarios. A passing smoke test is not a complete visual/accessibility review, and local packaging does not authorize installation into a normal profile or publication.