Repository navigation
Conversation
The scan now reads as a single numbered to-do list grouped by area, with a shape per severity (● ◐ ○) so it still reads without colour, the first task marked as where to start, and a status bar at the end with the report, the gate and the next commands. The numbers are what the new `zomb show <n>` takes: one finding in full, with where, how to fix it, and whether zomb fix does it for you. While it scans, a dot matrix ripples above a checklist of the seven checks, ticking each off as it lands, then collapses to one line. Whole- repo scans end with a calendar of lines added per day and the study's deleted-per-100 numbers drawn as bars; --since leaves both out. zomb fix shows its plan and each step as a checklist, blueprint uses the same headers, and --help gets a block-letter title, the commands in a box and the flags in two columns. Nothing but the terminal text changed: --json, --markdown, the HTML report, the baseline, blueprint.yml, fix's branches and commits, guard, and every exit code are byte-for-byte what they were, checked against the previous commit on the same repos. The Knip warning now prints after the loader, since a line written mid-redraw was drawn over. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
zomb --traffic <file> reads access logs, JSON lines or arrays (Vercel drains and most log shippers) and plain "/path count" exports, .gz or not, and keeps only paths, counts and dates. Each request is credited to the route Next.js would serve it from, so /blog/hello keeps /blog/[slug] alive and /blog/new stays its own route; a locale prefix is ignored. With traffic, a route nobody requested is the finding: "no links and no traffic" (delete-route) when nothing in the repo points to it, "no traffic" when something still links to it. API-only repos are checked too. A file with no readable requests fails rather than calling every route dead, and under a week of traffic gets a warning. Without the flag, every output is what it was. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Each repo gets a settings page with a drain endpoint and token. Vercel drains are checked by their x-vercel-signature, anything else sends the token as a bearer, gzipped or not. zomb keeps a path and a daily count for 90 days, skips static files and caps a repo at 10,000 paths a day. Once a repo has 14 days of it, push and weekly scans pass the last 30 days to zomb --traffic, so the weekly issue lists the routes nobody requests. "Hand issues to Copilot every week" signs the person in again and keeps that token, sealed with AES-256-GCM (ZOMB_SECRET_KEY, or a key generated into DATA_DIR). The weekly job refreshes it one at a time, since a refresh token works once, and assigns the issue as them when .zomb/config.yml says handoff: copilot. A refused or revoked token is deleted, the issue gets its manual line back, and the dashboard says Copilot stopped. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
ZOMB_SANDBOX=docker runs each job's install and scan in a container of the zomb-cloud image, as uid 1000 with no capabilities, no new privileges, 2 GB, 2 CPUs and 512 processes, for at most 10 minutes. The server still fetches the repo, so the GitHub token never enters the container; the checkout (and its traffic file) arrives as a tar on stdin, which also works when the server runs in Docker on the host's socket. Nothing is mounted. ZOMB_SANDBOX_IMAGE and ZOMB_SANDBOX_NETWORK pick the image and the network; the server checks the image at startup. The image now carries the Docker CLI and a /work folder for uid 1000, makes its sources readable whatever their modes in the build context, and starts cloud/server.ts. A .dockerignore keeps node_modules and .git out of the build context. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Knip's entries in package.json named cloud/server.js, research/*.js and test/*.test.js, which no longer exist; the research usage lines and a comment in blueprint.ts did too. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
- dist/ had no baseline.json, so the built CLI crashed on start: the file was loaded with require, which tsc doesn't copy. It is a JSON import now, which tsc emits next to benchmark.js. - process.exit right after printing drops what a pipe hasn't taken yet, and pipes are asynchronous on macOS: zomb --json | jq (or an agent reading stdout) got the first 64 KB. The CLI flushes stdout first. - In a repo that doesn't gitignore node_modules, the scan read the installed packages as the repo's code, and a mention inside them kept a dead file alive. node_modules is never the repo now. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
The Pages workflow now publishes site/ with The State of AI Code at /study/, and the CLI, the README, the landing page and the dashboard link there instead of the research folder. Version 0.1.0, with the repository field npm provenance needs. Pushing a v* tag tests and publishes to npm with trusted publishing, or an NPM_TOKEN secret for the first release. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
zomb: 13 findings in this change (since
|
| Area | Finding | Where | |
|---|---|---|---|
| ⚪ low | shortcuts | Casts to any | cloud/grants.ts:18 |
| ⚪ low | shortcuts | Casts to any | cloud/jobs.ts:135 |
| ⚪ low | shortcuts | Casts to any | cloud/jobs.ts:137 |
| ⚪ low | shortcuts | Casts to any | cloud/server.ts:92 |
| ⚪ low | shortcuts | Casts to any | cloud/server.ts:173 |
| ⚪ low | shortcuts | Casts to any | cloud/server.ts:242 |
| ⚪ low | shortcuts | Casts to any | cloud/server.ts:261 |
| ⚪ low | shortcuts | Casts to any | test/cloud.test.ts:271 |
| ⚪ low | sprawl | 10 copy-pasted lines | test/cloud.test.ts:69-78 and test/cloud.test.ts:158-167 |
| ⚪ low | sprawl | 8 copy-pasted lines | test/e2e.test.ts:40-47 and test/e2e.test.ts:91-98 |
| ⚪ low | sprawl | 8 copy-pasted lines | test/e2e.test.ts:41-48 and test/e2e.test.ts:115-122 |
| ⚪ low | sprawl | 7 copy-pasted lines | test/blueprint.test.ts:109-115 and test/e2e.test.ts:43-49 |
| ⚪ low | architecture | Split cloud/server.ts (677 lines) | cloud/server.ts |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Everything left before launch, except billing: production traffic for dead routes, Copilot hand-off without the click, a container sandbox for zomb Cloud scans, three CLI bugs the published package would have shipped with, and the launch setup (study on Pages, 0.1.0, a release workflow).
CLI
zomb show <n>(0ebed5e). The scan reads as one numbered to-do list grouped by area, with a shape per severity, a loader while it scans, and a calendar plus the study comparison at the end.zomb show <n>prints one finding in full. Only the terminal text changed:--json,--markdown, the report, the baseline, fix and guard are byte-for-byte the same.--traffic <log>: routes no request reached (af4b153). Reads nginx/Apache access logs, JSON lines or arrays (Vercel drains, most shippers) and/path countexports,.gzor not, and credits each request to the route Next.js would serve it from (static before[param]before catch-alls; locale prefixes ignored). With traffic, an unlinked route with no requests becomesdelete-route("no links and no traffic"), and a linked one with none is asked about. The JSON only gainssummary.trafficwhen traffic is given.dist/had nobaseline.json, so the built CLI crashed on start. It is a JSON import now, whichtscemits.process.exitright after printing cut piped output at 64 KB on macOS (zomb --json | jq, or an agent reading stdout). The CLI flushes stdout first.node_modules, the scan read installed packages as the repo's code, and a mention in them kept dead files alive.zomb Cloud
x-vercel-signature, anything else sends a bearer token, gzipped or not. Only a path and a daily count are kept, for 90 days. Static files are skipped, and a repo keeps at most 10,000 paths a day. After 14 days, push and weekly scans pass the last 30 days to--traffic.ZOMB_SECRET_KEYor a generated key), refreshes it one at a time, and assigns the weekly issue as them. A refused or revoked token is deleted, the issue gets its manual line back, and the dashboard says "Copilot stopped".ZOMB_SANDBOX=dockerruns each install and scan in a throwaway container: uid 1000, no capabilities, no new privileges, 2 GB, 2 CPUs, 512 processes, 10 minutes. The server still fetches, so the GitHub token never enters the container. The checkout goes in as a tar on stdin, nothing is mounted, and it works from a server container on the host's socket.ZOMB_SANDBOX_IMAGEandZOMB_SANDBOX_NETWORKare optional. The image now has the Docker CLI and startscloud/server.ts, and there's a.dockerignore.Launch
site/with The State of AI Code at/study/. The CLI, README, landing page and dashboard link there (f8e275f).repositoryfield npm provenance needs.release.yml: av*tag checks the tag matchespackage.json, runs the tests, and publishes with provenance. It uses trusted publishing, or anNPM_TOKENsecret for the first release..jsnames (Knip entries, research usage lines) point at the.tsfiles (ea92d00).Checked
npm test: 43/43 on Node 24, also in a clean clone with no global git identity (as on a CI runner).tsc --noEmitis clean.zomb-cloudimage and matches the host scan, traffic included. It skips when the image isn't there, as in CI.npm packcontents,dist/bin.js --help, a scan andguardon Node 24 and on Node 22.18 (the engine minimum). Installed from the tarball into a fresh project./setup. WithZOMB_SANDBOX=dockerit reports the sandbox, and it warns when Docker or the image is missing.cloud/server.tsat 677 lines.After merging
gh api -X POST repos/Open-Dev-Society/zomb/pages -f build_type=workflow). The site then deploys on merge, or from the site workflow's Run button.v0.1.0tag, with anNPM_TOKENsecret for this first release. Then addrelease.ymlas the package's trusted publisher on npmjs.com, allownpm publish, and delete the token.Billing is not in this PR.