Codetree

A browser extension for exploring and reviewing GitHub and GitLab repositories from a code tree.

Version 0.4.1 · Chrome / Chromium 140+ · Manifest V3

Browse files, switch branches, review PR/MR changes and open the whole changed file without leaving the request. Codetree runs locally and talks directly to your repository host. No Codetree account, subscription or backend is required.

Preview

These screenshots show Codetree 0.3.1 installed from a local build on public pages (the Codetree repository on GitHub and gitlab-org/cli on GitLab) without an account. Each image joins identical light and dark captures: light above the seam, dark below. Separate light and dark captures are in docs/store/screenshots/.

Description

• Repository file tree with file/folder search, keyboard navigation and branch switching.
• In-page file tabs with saved branch/review positions and separate PR/MR/commit workspaces.
• Changed-file tree for PRs, MRs and commits, with additions/deletions aggregated by folder.
• Inline review comments with authors and links to their discussions.
• View full in native file headers: complete UTF-8 text, highlighted changes and both revision line numbers. Works with a closed sidebar, collapsed files, additions, deletions and unchanged renames.
• Open PR/MR lists with Requested from me, Reviewed by me, Changes requested, Approved and No reviews filters.
• Viewed marks, unlimited local bookmarks, file-icons file and folder icons (Color, Monochrome or Minimal) and configurable code fonts/sizes.
• Left/right docking, pinning per browser window, hover opening and resizing.
• Custom shortcuts, page-display rules, URL exclusions and folder-click preferences.
• Multiple accounts, GitHub Enterprise Server and self-managed GitLab over HTTPS.

See Features for provider differences. This is an independent implementation with original code and interface. File and folder icons come from file-icons/atom; see Third-party notices.

Quick start

1. Download codetree-<version>.zip from GitHub Releases and extract it into a folder.
2. Open chrome://extensions and enable Developer mode.
3. Select Load unpacked and choose the extracted folder containing manifest.json.
4. Open or refresh a GitHub or GitLab repository page.

To run the current source instead, bundle it first and load the generated build/ folder:

git clone https://github.com/ziqq/Codetree.git
cd Codetree
npm ci
npm run build

After updating, click Reload on the extension card and refresh repository tabs. After disabling the extension, refresh tabs to remove the previously injected UI.

Getting started

The edge tab opens the sidebar. Use Files, Pull requests / Merge requests and Bookmarks to switch sections. PR/MR and commit pages initially show changed files; the selector above the tree also provides the repository tree.

In Files, toggle .* to search full paths with a case-insensitive regular expression, for example \.(dart|swift)$ or ^src/. Enter the pattern without / delimiters or flags. Invalid patterns show an error. Search includes loaded entries and combines with Only unviewed; the mode resets when navigating or switching tabs.

Click a tree file to open it in Codetree's in-page workspace; clicking it again activates the existing tab. Changed files show full-file diffs with a Unified / Side-by-side switch, also available in View full. Side-by-side aligns old/new lines and synchronizes scrolling; switching keeps your source position. The layout is shared within the page and resets to Unified on reload. Close tabs with their close buttons, or use Left/Right and Home/End while a file-tab button has focus. Ctrl/Cmd-click still opens the file or native diff in a new browser tab; submodules retain their native navigation. Native comments and review controls remain available below the workspace. View full in a native header or the tree's full-diff action still opens the separate dialog, whose previous/next controls cover all changed files independently of sidebar search.

Switching branches keeps Code's open paths and active file while loading the selected branch; each branch has separate scroll positions. A missing file stays open with Retry and, when available, an action to open it on the default branch. Each PR, MR and commit has a separate workspace; returning restores its tabs and positions. Selecting a branch from a review exits to Code and restores Code's workspace. Reloading the same native route preserves the selected inline tab; navigating to another native file selects that file.

Use Ctrl/Cmd+F or the viewer's search button to find literal text without case sensitivity in the open file or diff. The search covers the complete loaded text, including virtualized rows. Enter / Shift+Enter and the arrow buttons cycle through matches; Escape closes search before closing View full. Diff search includes old and new lines, counting shared context once. Tabs and View full have separate searches, cleared when their file changes; queries stay in page memory. At most 10,000 matches are listed, with a + count when more exist. Native text editors keep their normal find shortcut.

In diffs, the Changes counter and its arrow buttons cycle through blocks of additions/removals separated by unchanged lines. They work in file tabs and View full, in both layouts, revealing off-screen blocks without reloading the file. The counter follows scrolling and keeps the selected block current while it remains visible. Diffs without changed lines show 0 / 0 with disabled arrows.

In PR/MR file tabs and View full, Viewed & next saves the current file's Viewed mark, then opens the next unviewed file in the same viewer. It follows the full listed changed-file order, wraps to earlier files and ignores sidebar search and Only unviewed. An already viewed file offers Next unviewed without another write. Failed marks keep the file open; failed navigation keeps a successful mark and offers a retry. When all listed files are viewed, the current file stays open with a completion message. GitHub uses its available Viewed mode; GitLab marks remain local.

Workspace metadata belongs to the current browser tab, selected account, host and repository. It resets on extension/browser restart and is excluded from Sync. Limits are 32 open files, 256 saved positions and 50 workspaces, with 64 KiB per entry; file text is never stored with this metadata. In-page tabs are new beta behavior; installed-browser smoke verification is pending.

Shortcut	Action
Shift+D	Open or close the sidebar
Shift+S	Open the sidebar and focus search
Arrow keys	Navigate and expand/collapse rows
Enter	Open a file or toggle a folder

These are the defaults; change toggle/search bindings in Settings → Navigation, or leave a binding blank to disable it. Shortcuts do not run while editing an input or contenteditable element.

In Settings → Navigation → Hide on these URLs, enter up to 64 rules, one per line. Existing URL patterns use * for any characters. Prefix a rule with regex: for a JavaScript regular expression, for example regex:/(issues|discussions)(/|\?|$). Expressions have no / delimiters or flags. Both kinds of rule are case-sensitive and match the full URL, including query parameters but excluding the # fragment. Any matching rule hides the sidebar and native View full controls. Invalid expressions prevent saving and identify the line to fix. Rules are included in optional browser Sync.

Accounts

Public repositories work without a token. Open Settings to connect an account for private repositories, review filters and authenticated API limits. Being signed in on the website does not authenticate the extension's API requests. A native View full button remains visible when API access is unavailable and offers account connection/retry guidance.

GitHub device-flow and GitLab PKCE sign-in are enabled with Codetree's registered public client IDs, without a backend or client secret. GitLab callbacks cover the published Chrome extension and the maintainer's current development build; other unpacked extension IDs need their own registered callback. Actual account sign-in and token refresh still need live verification. PAT connections remain available. See OAuth setup.

Provider	Permissions	Server API
GitHub	Fine-grained PAT: selected repositories, Contents: read, Pull requests: read. Classic PAT: repo for private repositories. Organization approval/SSO may apply.	https://api.github.com
GitHub Enterprise Server	Token issued by that server with the corresponding repository access.	Website origin + /api/v3; GraphQL + /api/graphql
GitLab	Personal access token with read_api and project access. Discussions and review filters may require authentication even on public projects.	Website origin + /api/v4

GitHub's Viewed mutation may need additional permission. A failed write reports an error and restores the previous checkbox state. GitLab Viewed marks are local and do not change native GitLab review state.

Choose the provider and its HTTPS website origin in Settings. For a custom server, Chrome requests access to that host during connection. Refresh existing server tabs afterward. Installations under a URL subpath are not supported.

Tokens are verified directly through the chosen host's /user endpoint. Connecting the same host/username replaces its token. Auto uses a matching page username when available, or the host's only account. With multiple accounts and no detected username, select an account in the footer.

Browser Sync

Enable Settings → Browser Sync to synchronize preferences and bookmarks through the browser’s account storage. It is off by default. Credentials, connected accounts, selected account IDs, Viewed marks, repository trees and file contents stay local.

Enabling applies existing remote preferences and merges bookmarks by URL; local bookmark details win for duplicate URLs. Later snapshots use the newest saved timestamp; equal timestamps use the last delivered snapshot. Device clock differences can delay incoming changes until a new local save. Sync has a conservative 8 KiB snapshot limit; quota failures leave local data saved and appear in Settings. Disabling stops this device without deleting local data or the shared copy.

Devices need the same browser ecosystem and extension ID. Chrome and Edge/Firefox/Safari account services do not form a shared account. Unpacked installations may have different extension IDs on different computers; do not treat them as a proven multi-device setup. Firefox/Safari builds and portable file transfer remain outside this delivery.

Large repositories

The tree renders visible rows with a small buffer. GitHub normally loads a recursive tree and falls back to loading folders when its API truncates the response. GitLab loads one folder at a time, including projects in nested namespaces.

Search covers loaded files until Load all folders for search finishes; the sidebar identifies this scope. API requests are deduplicated and cached in bounded service-worker memory. Revision-keyed tree data also persists locally across worker/browser restarts, within 48 entries and a 4 MiB budget. Cached trees expire after 24 hours; expired entries are discarded on the next cache load/write. Cache keys include the host, repository, revision and API account; Refresh and account changes clear it. File text and review comments are not persisted in this cache.

Privacy

Preferences, accounts, tokens, bookmarks, local Viewed marks and the tree cache live in chrome.storage.local for the browser profile. Pinning per window, pending device sign-in and file-tab workspace metadata use trusted session storage. Workspace metadata includes file paths, active tab, route identity and scroll positions; it contains no file text and is not synced. Token storage is restricted to trusted extension contexts. Page/content scripts receive no tokens. Browser Sync sends only preferences/bookmark metadata after explicit opt-in; bookmark URLs/titles can contain private repository names.

Requests go directly to the selected repository API. Tokens stay bound to its API host; redirects and cookie credentials are disabled. There is no analytics, external font download or third-party runtime dependency. See Privacy.

Limitations

• This delivery targets Chrome/Chromium as an unpacked extension. Firefox, Safari and store distribution have not been validated.
• GitHub's PR-files API returns at most 3,000 changed files. GitLab has server diff limits and may omit patches. Incomplete data is identified explicitly.
• Paginated lists fail explicitly beyond 10,000 results, unexpected page sizes or a conservative 32 MiB aggregate budget. API JSON bodies are limited to 32 MiB, OAuth/error bodies to 64 KiB.
• Full-file previews support UTF-8 text up to 2 MiB per revision and 100,000 combined lines. Binary files, other encodings and incomplete patches show an unavailable-preview state with a native diff link. An original lexical highlighter covers common source/config languages; it is not a full grammar parser. Unknown languages and files exceeding its token budget retain complete plain-text diffs.
• PR/MR comparisons use the merge base and request head; commit comparisons use the first parent. Private fork requests need access to both source repositories.
• GitLab review filters depend on supported reviewer/approvals endpoints, server states and token access. Unsupported endpoints report errors. Viewed is local on GitLab and falls back to local mode on GitHub when GraphQL is unavailable.
• Native header integration depends on the provider's page structure. Layout changes may need an adapter update; the sidebar full-file action is also available.
• OAuth requires registered public client IDs and live verification before it is ready to use. Custom servers use PATs. Browser Sync is optional and remains within the browser ecosystem; cross-browser account sync is not implemented. Browser-reserved shortcuts may take priority. In-page tabs are read-only and keep native review controls available; installed-browser verification of the new workspace remains pending.

Project structure

src/
  manifest.json          Chrome MV3 entry points and permissions
  shared/                Preferences, routes/URLs, tree model, diff validation and icons
  background/            Service worker: message broker, storage, cache, API client, accounts
    providers/           GitHub REST/GraphQL and GitLab REST adapters
    oauth/               Public client configuration and trusted OAuth flows
    sync.js              Opt-in browser Sync for preferences and bookmarks
  content/               Content script: Shadow DOM sidebar
    sidebar/             View, layout, file tree, branches, requests, bookmarks
    viewer/              In-page file tabs, full-file diff dialog and syntax highlighting
    native/              View full buttons in native diff headers
  options/               Settings and account management
  icons/                 Original extension icons
vendor/file-icons/       Vendored file-icons/atom rules, styles and fonts
scripts/                 Bundling, validation and deterministic packaging
tests/                   Node.js regression suite
docs/                    Feature details, releases and verification record

Sass compiles the sidebar, native controls and Settings SCSS; esbuild bundles each entry point (background, content, options) into one classic script in build/, which is the unpacked extension and the source of the release ZIP. See Architecture for contexts, messages, storage and the build.

Development

Edit styles in src/content/sidebar.scss, src/content/styles/_themes.scss, src/content/page.scss and src/options/options.scss. npm run build compiles them with Sass; npm run lint:css validates the compiled CSS. The sidebar and full-file viewer follow GitHub/GitLab light or dark themes, including live theme changes. Settings follows the browser/system preference. Sass is a build dependency and is excluded from the extension.

Edit src/, run npm run build and load build/ as an unpacked extension. JavaScript uses ES modules and explicit DOM construction; run npm run format (Prettier) before committing. Node.js/npm provide bundling and checks only; the extension has no runtime dependencies. Python 3 creates the distributable ZIP. make help lists the same commands.

npm ci
npm run verify

CI checks JavaScript/CSS, manifest/CSP/assets, documentation, workflow syntax, locked dependencies and reproducible packaging on push/PR. Stable tags vX.Y.Z or a manual release run repeat the same checks before publishing a GitHub Release containing the runtime ZIP and SHA-256, then submit the ZIP to the Chrome Web Store when configured. Tags must match the manifest/changelog version and publication requires an approved license. See Checks and releases.

Automated checks do not exercise Chrome's installed extension environment. Read Contributing, Verification, Changelog and AGENTS.md.

License

Codetree uses the Codetree Source-Available License 1.0. Read the full LICENSE; it controls over this summary. This is a custom source-available license with commercial restrictions, not an OSI open-source license.

• Free personal and workplace use is allowed, including private repositories and commercial development projects.
• Internal modifications, free forks and pull requests are allowed under the license. Using the tool does not apply its license to your independent projects.
• Monetization of Codetree or covered derivatives is prohibited: sales, subscriptions, paid features, advertising, affiliate revenue, sponsorship, fork-related donations and commercial hosting/support/customization for third parties.
• Renaming a fork, adding features or incorporating covered material into a larger paid product does not remove the restrictions. There is no automatic conversion to a permissive license.
• Salary for ordinary development work and internal deployment/modification for the organization using the tool are allowed. Preserve the license and required notices when sharing covered material.

Separate written permission from the relevant rights holder is required for activities outside these terms. Third-party components retain their own licenses; see Third-party notices.