CodeEraser

CodeEraser

· English | 中文

CodeEraser keeps an agent-written repo small and clean: a write that duplicates code or bloats a file is refused before it lands.

What it does

LLM-assisted codebases drift the same way: the same function written twice, the same paragraph pasted into three files, files that only grow. CodeEraser refuses the write that would do that, before it reaches disk, with no model in the loop.

• A write that copies code already in the tree is refused, and the refusal names the region it duplicates.
• A write that leaves a file over 750 lines is refused the same way.
• Everything else is a report or a gate: the Stop audit refuses the turn, ce precommit the commit, CI the merge.

Judges Python, TypeScript/TSX, Rust, Go, Haskell, C, C++, Java, Lua, R, Markdown and HTML (thirteen language codes, twelve tree-sitter grammars); JS, CSS, Vue, Svelte, shell and YAML files for size only; .txt for documentation duplication only.

Runs as CLI · GUI (eleven screens) · Claude Code plugin (four hooks, one skill, one command, twenty-one read-only MCP tools) · pre-commit · CI.

The effect: the same task, run twice

One seven-step task, two identical copies of the seed; the only variable is whether CodeEraser is in the loop — the write-time guard, the Stop audit, and, once the audit refuses, the eraser acting on its own plan. Both runs still end red — not on the same things.

A scripted agent replays one seven-step task (discounts, a compact report, CSV and JSON output, money formatting) on demo/seed, a small invoicing service, once without CodeEraser and once with it. Every number above and every refusal below is ce's verbatim output.

A copied helper, refused before the file exists. Move 1 of the run above, on its own. The reason names the region the content duplicates and the ordering that would pass, so the refusal is actionable rather than a veto.

$ Write invoicer/discount.py
✗ ce: content for <work>/invoicer/discount.py duplicates 1 indexed region(s): invoicer/money.py:1-18 (89 tokens). Reuse the existing implementation instead of re-writing it. Moving it? Trim the source region first: the probe verifies against the current tree, and the same write then passes.

One line, two mouths. ce.toml puts invoicer/** on file_lines_fail = 40. The write-time guard refuses the write that would cross it, and ce scan grades the same tree against the same number — one declaration, read by the hook and by CI.

$ Write invoicer/invoice.py
✗ ce: this write leaves <work>/invoicer/invoice.py at 93 lines, past the hard budget of 40 (plan §4.1). Split the file instead of growing it.
$ ce scan .
FAIL invoicer/invoice.py:1 file-lines = 51 (limit 40) [invoicer/invoice.py]
warn invoicer/report.py:1 file-lines = 35 (limit 30) [invoicer/report.py]
scanned 9 files / 19 functions — 1 warn, 1 fail -> FAIL (failed: hard_line)

The full table, both transcripts and the JSON behind them are in demo/README.md, replayed byte for byte in CI; the first real interception is recorded in T1-INTERCEPT. The precision and recall points are frozen with their evaluation ledgers (EVAL-SET, EVAL-SET-LANGS).

How it works

Zoom and pan this diagram at codeeraser.dev/how/#verdict.

• Write-time clone guard: normalized tokens winnowed at k = 25, w = 26, so any shared run of 50+ tokens is caught; only novel duplication is charged (FPR-REPLAY).
• Near-miss (T3) clones: candidates from MinHash/LSH, judged in the core by tree edit distance at TSED ≥ 0.85.
• Documentation duplication that survives rewording: 5-word shingles, Jaccard ≥ 0.80 or a 50-word verbatim run.
• Liveness: per-language resolution ladders feed a reference graph; a four-way verdict comes back with a confidence code.
• Gate score: 0–1000 over seven axes, held by the ADR-006 shrink-only ratchet (growth needs max(+2 %, +10 lines) or a named re-establish).
• Deterministic: no model anywhere; text crosses only the local ce → ce-core pipe, and the core opens no file.

The rest — same-role advice, Datalog queries and rules, intra-function dead code, merge suggestions, architecture, structure axes, tombstone residue, erase — is on codeeraser.dev/how and in the methodology booklets.

Install, run, update

• Installer. Each release ships five GUI installers (NSIS / AppImage / dmg) bundling the GUI, ce and the ce-core judgment core; the Windows installer runs ce setup (AppImage / dmg users run it once), which wires Claude Code. The fifteen artifacts are unsigned by decision; verify with sha256sum -c --ignore-missing SHA256SUMS.
• Homebrew / winget. brew install skymanbp/codeeraser/codeeraser; winget install skymanbp.CodeEraser once winget-pkgs merges.
• Claude Code plugin. /plugin marketplace add skymanbp/CodeEraser@release, then /plugin install codeeraser@codeeraser.
• CLI only, or from source. Put ce and ce-core side by side on PATH, or cargo install codeeraser, or build with GHC 9.14.1 + cabal; ce finds the core as CE_CORE_BIN → a ce-core sibling → PATH, and --core <path> wins.
• Updating. ce update checks the latest release against its two-phase pins and --yes replaces the binaries (RELEASE).

Commands

Output is English by default and Chinese under --lang zh, CE_LANG=zh or [ui] lang = "zh". [[rules.class]] in ce.toml gives one glob set its own lines and ratchet tolerance (ce.toml reference).

Three faces, one product

Every capability reaches the CLI, the GUI and the plugin with its MCP server, or is a named omission; the face_parity gate derives the sets from the code.

Capability × face table

Tech stack and philosophy

Zoom and pan this diagram at codeeraser.dev/#architecture.

• Rust 1.94.1 (edition 2024): tree-sitter 0.27 with twelve grammars, rusqlite 0.40 (index schema 17 / GRAPH_REV 23 / MENTION_REV 4), a per-project daemon.
• Haskell (GHC 9.14.1): ce-core, every judgment family. Tauri 2: the GUI over the same crate.
• One wire: NDJSON over stdio (proto 9.0.0, sixteen families); the daemon speaks its own protocol (2.3.0).
• Design rules: ADR-001 … ADR-009 (Rust frontend, parse layer in Rust, lazy daemon, cheap PreToolUse, two clone layers, shrink-only ratchet, pinned distribution, policy as Haskell data, derived documentation facts) in DEVELOPMENT_PLAN.
• Philosophy. Measure in Rust, decide and write in Haskell, print everywhere else. Nothing asks a model anything; hooks fail open and say so; documentation is generated or gated, including the nineteen-booklet methodology, and every push runs the seven product gates on this tree.

Known limits

PreToolUse shapes behaviour; it is not a security wall (shell writes bypass it; the Stop audit and CI are the backstops). Hooks fail open on internal errors and record the degradation.

• Languages. AST judgment uses the twelve grammars above; Markdown, HTML and .txt are judged by the documentation and graph rules; T4 clones are not promised.
• Advice, never a verdict. Symbol-level liveness, ce similar, ce merge and ce arch never fail a gate; a guard class stays observe until it has its own false-positive record.
• Lines not drawn. cognitive_fail defaults to 0 (complexity only warns), and ce structure has no score floor.
• Distribution. A release builds five targets; ce setup wires nothing from an elevated account that is not the logged-in user (exit 13); judging this repository needs the cli/tests submodule seated.
• One wire line. A request line to the core is at most 134,217,728 bytes; larger requests split into batches, and an oversized item is refused by name, never truncated.

Scores are not comparable across a [[rules.class]] switch, across a named re-establish that moves softLine, or across these releases: v0.7.3 → v1.0.0, v1.2.0 → v1.3.0, v1.3.x → v1.4.0, v1.6.0 → v1.7.0, v1.7.4 → v1.8.0, v1.8.0 → v1.9.0 (1.9.1 and 1.9.2 are comparable with 1.9.0); the reasons are in CHANGELOG.

Documentation

• CLI reference · ce.toml reference (generated from the binary and the config schema; drift reddens CI) · Methodology (nineteen booklets, cited to implementation lines) · structure axes · size advisory · erase contract · GUI reference · plugin · demo
• DEVELOPMENT_PLAN · EVAL-SET · EVAL-SET-SIMILAR · EVAL-SET-LANGS · EVAL-SET-FLOW · language-expansion · FIELD-TEST · PERF-BUDGET · FPR-REPLAY · FPR-TOMBSTONE · FPR-L2 · T1-INTERCEPT · contracts/VERSIONING.md · docs/RELEASE.md (wire SemVer and the two-phase release runbook)
• Website: codeeraser.dev · how it works · math · stack

License

Apache-2.0; see LICENSE. Third-party inventory in NOTICE (regenerated and gated in CI). The test suite lives in skymanbp/CodeEraser-tests; clone with --recurse-submodules. "CodeEraser"™ is a trademark of skymanbp; per Apache-2.0 §6 the license covers the code, not the name.