The Problem

Opening an unfamiliar codebase and figuring out which files matter, what depends on what, and where a change will break things is slow work. codeflow compresses that into a single browser tab: paste a GitHub URL, get an interactive dependency graph, blast-radius estimates, and a health score without installing anything.

What This Does

The entire application is one self-contained file, index.html. It runs 100% client-side, makes API calls directly from the browser to GitHub, and never uploads code anywhere. The README documents eight features: dependency graphing, blast-radius analysis, code ownership via git history, a security scanner (hardcoded secrets, SQL injection, eval()), pattern detection, an A–F health score, a commit-frequency heatmap, and PR impact analysis. All of it is delivered from a single HTML file with no build step, no package.json, and no dependencies.

This is a fork of braedonsaunders/codeflow (5,080 stars upstream). The clone URL is https://github.com/moses-y/codeflow.

How It Is Wired

The repository contains exactly three files: README.md, index.html, and screenshot.png. There is no module graph to trace and no call-graph data was produced by static analysis — the wiring lives entirely inside one HTML file, so the internal structure is opaque without opening it. What is known: execution starts by loading index.html in a browser, and the only external touch point is the GitHub API (and optionally a user-supplied Personal Access Token for private repos). There is no server, no database, no filesystem writes, and no build pipeline. The blast radius of any change to this repo is effectively the single index.html file — which is also the risk: any edit touches the whole application.

How To Use It

The README documents two paths, used verbatim:

# Clone the repo
git clone https://github.com/braedonsaunders/codeflow.git

# That's it! Just open index.html in your browser
open index.html

A hosted version is available at https://codeflow-five.vercel.app/. For private repositories, create a GitHub Personal Access Token with repo scope and paste it into the token field in the UI. There is no configuration file, no environment setup, and no install step — the README states "no npm install" explicitly.

Real-World Use

An engineer joining a mid-sized TypeScript project can paste the repo URL, click the file with the highest coupling score, and see exactly which modules break if it changes. Before a refactor, run PR impact analysis on the proposed diff to get a concrete blast-radius count. The value is in the zero-friction loop: URL in, map out, no account, no data leaves the machine.

Code Health & Issues

The following comes from the pipeline's static analysis, not opinion:

  • Med — No test files detected — untested code paths, repository-wide.
  • Med — No CI/CD pipeline — no automated build or test gate, no .github/ or CI config.
  • Med — No LICENSE file — unclear usage/redistribution rights at root. Note the README displays an MIT badge, but no license file exists in the tree; that is a discrepancy worth resolving before any reuse.

Additional structural observations: no Dockerfile, no lockfile, no committed secrets. With a single 3-file repository, the absence of tests and CI is proportionate — but it means there is no regression safety net for the one file that is the whole product.

The Bottom Line

A genuinely useful zero-setup utility for visualizing GitHub repos, and the single-file design makes it trivially portable. The trade-off is that the entire product is one un-tested HTML file with no license file despite an MIT badge — fine as a reference or internal tool, not something to build production infrastructure on without adding tests and clarifying licensing.