Vestige splits AI code diffs into reviewable chunks

Vestige is a VS Code extension that integrates AI diff review into the developer's existing workflow. When an AI agent, git pull, or bulk edit changes code, Vestige detects it and offers to open the Splash Zone — a panel showing the change broken into ordered review cards. Each card displays a blast radius (what the change can reach or break), an inline or split diff, a one-line LLM-generated summary, an Explain action for deeper context, and accept/revert controls.

The extension works by scanning and parsing a folder locally — no LLM calls — to build a call graph (tracking function calls within the codebase) and a file-dependency graph (tracking which files depend on which). When you click the Vestige icon or run "Vestige: Open Graph", two tabs appear: Repo Graph (showing function calls) and Feature (showing feature clusters). You can click any node to jump to the relevant code. The call and dependency graphs are deterministic, computed locally, and cached so they don't re-run or re-bill work already done.

For language support, TypeScript/JavaScript, Python, Go, and Java are supported out of the box; the parsers ship as tree-sitter compiled to WebAssembly, so no separate install is needed. Other file types are treated as plain nodes in the dependency graph. The tool offers a five-step walkthrough ("Vestige: Getting Started") that walks you through mapping your project, reading the graphs, reviewing a change, judging the blast radius, and explaining and deciding.

On privacy and data, Vestige keeps code structure completely local — call-graph, dependency-graph, and blast-radius analysis run 100% on your machine and nothing about code structure is sent to the backend. However, two features do send code snippets to the Vestige backend (hosted on AWS, which calls OpenAI): Explain Selection (sends the selected code snippet) and change-review summaries (sends the changed-code snippets for each chunk in the Splash Zone). Feature-cluster analysis sends pre-computed summaries, not raw source. Nothing is sent unless you actively use one of these features, and there is no telemetry or analytics. The first release (v0.1.0) has known limitations: single-root workspaces only, re-parsing on file change is not yet incremental (fine for small/medium repos but slow for large monorepos), and the blast radius is only as good as the static call graph — dynamic dispatch and reflection can escape it.

Vestige addresses a real pain point in modern development: AI agents and LLMs can change large amounts of code in a single operation, but reviewing those changes is hard without tooling that surfaces what was touched and what could fail. The extension's core innovation is separating static analysis (building call graphs and dependency graphs locally, without LLM involvement) from LLM-generated context (summaries, explanations, feature-cluster names). This split makes the impact analysis deterministic and cached, so blast-radius detection does not depend on LLM hallucination and does not incur repeated backend costs.

The privacy model is explicit: code structure never leaves the machine, and only code snippets you explicitly ask to explain or summarize are sent to the backend (which calls OpenAI). This design appeals to developers who want to review AI changes carefully but cannot risk sending raw code structure to cloud services. The first-launch limitations (language support, single-root workspaces, non-incremental re-parsing, and the caveat that dynamic dispatch can escape the static graph) are transparent and reasonable for a v0.1.0 release, though they constrain adoption in large monorepos and polyglot projects.