RepoSloth：讓本地 AI 探索程式碼庫

Mayur P

Posted on Oct 24 AI-assisted

Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady Submission 🦥

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

When landing on a new open-source repository or legacy codebase, developers typically engage in what I call the "Codebase Shuffle": opening dozens of folders, hunting for where main or the router lives, guessing how database pools and authentication are configured, and reading thousands of lines of code just to build a baseline mental model.

I built RepoSloth to let developers be intentionally lazy and take it slow.

RepoSloth is a private, local-first developer tool that ingests any local Git repository or uploaded ZIP archive and analyzes the codebase using open-weight AI models running on your own machine.

What RepoSloth does for you:

• Zero-Execution Codebase Synthesis: Instantly categorizes frameworks, candidate entry points, and manifest dependencies, clearly separating observed facts from AI inferences.
• File & Function Explainer: Breaks down complex modules into plain-English summaries, inputs/outputs, implementation flows, and potential edge cases.
• Grounded "Ask Your Codebase" Q&A: Uses localized windowed chunking and lexical retrieval to answer questions like "Where is authentication handled?" or "Where should I add a new endpoint?", complete with verifiable file paths and line citations.
• Automated Mermaid Architecture Diagrams: Generates visual module diagrams and dependency maps strictly from verified import evidence.
• Secret & Traversal Defense Shield: Prevents Zip-Slip exploits on uploaded archives and redacts API keys, AWS credentials, Bearer tokens, and .env files before code reaches the AI prompt.

Developers, open-source contributors, code reviewers, and engineering managers get to be lazier: RepoSloth does the tedious exploration while you sit back with a cup of coffee.

Demo

• GitHub Repository: https://github.com/song-code-won/RepoSloth
• Live Local Dashboard: Run streamlit run reposloth/app.py after pulling your local model via ollama run qwen2.5-coder:7b.

Quick Walkthrough:

1. Connect Local Engine: RepoSloth automatically discovers your local Ollama daemon on localhost:11434.
2. Scan Repository: Select a local repository or drop in an archive (a sample FastAPI microservice is included in /sample_repo).
3. Explore:
   • The Overview tab reveals the detected framework (FastAPI), entry point (app.py), and dependencies.
   • The Ask Your Codebase tab retrieves auth.py lines 1–17 to explain token verification with exact line citations.
   • The Architecture tab visualizes module relationships in an exportable Mermaid diagram.

Code

song-code-won / RepoSloth

RepoSloth: Local AI Codebase Explainer using open-weight models (Qwen 2.5 Coder / Ollama). Built for Hacktoberfest 2026 DEV Challenge.

🦥 RepoSloth — Local AI Codebase Explainer

"Let AI explore the code while you take it slow."

Built for the Hacktoberfest 2026 DEV Open-Source AI Challenge, Week 3: “Slow and Steady.”

RepoSloth is a private, local-first developer tool that helps you instantly understand unfamiliar repositories without opening every single file. Powered by open-weight models running locally through Ollama, RepoSloth synthesizes architecture, maps entry points, explains complex functions, and answers codebase questions with verifiable line citations.

✨ Key Features

• 🛡️ Zero-Execution Sandbox: Never runs untrusted code, build scripts, or repository hooks.
• 🔒 100% Local & Air-Gapped: Runs entirely on your machine via Ollama. No closed API keys, subscription fees, or data leaks.
• 🔐 Built-in Secret & Traversal Shield: Redacts API keys, credentials, and .env files automatically. Thwarts Zip-Slip path traversal attacks.
• 📋 Automated Repository Overview: Distinguishes verified facts (manifests, files, imports) from AI-generated hypotheses.
• 🔍 File…

All code is open-source under the permissive MIT License.

How I Built It

RepoSloth is built using a local-first stack that prioritizes security, reproducibility, and zero external costs:

• Local Inference Engine: Ollama running open-weight code models.
• Primary AI Model: Qwen 2.5 Coder (7B) (Apache 2.0 license) — provides deep architectural comprehension and reasoning. For low-spec or CPU-only setups, Qwen 2.5 Coder (1.5B) is supported out-of-the-box.
• Frontend / Dashboard: Streamlit with custom developer styling, collapsible inspectors, and reactive tabs.
• File Discovery & Parsing: Python standard library (pathlib, ast, os) with intelligent directory exclusion (node_modules, venv, .git, build outputs, and binaries).
• Security & Secret Redactor: A multi-pattern regex sanitizer that strips high-entropy credentials, private keys, and environment tokens.
• Grounded Context Chunker: A windowed source chunker that calculates lexical and keyword overlap to retrieve supporting snippets without requiring a heavyweight vector database.
• Testing: Automated pytest suite with 14 passing tests verifying archive safety, secret redaction, and offline daemon error handling.

Why Does Open Innovation Matter?

For a codebase exploration tool, open innovation and local models are non-negotiable:

1. Intellectual Property & Privacy: Proprietary enterprise code, pre-release startup repos, and sensitive business logic cannot simply be piped to closed third-party cloud APIs. Open-weight models running on Ollama ensure that zero bytes of code ever leave the local machine.
2. Air-Gapped & Offline Reliability: Once the open-weight model weights are downloaded, RepoSloth works completely offline—on flights, trains, or air-gapped corporate intranets.
3. No Metered API Costs: Analyzing a 50,000-line repository with closed APIs can consume dozens of dollars in token fees per run. With open-weight models, exploration is truly free and limitless.
4. Reproducibility & Longevity: Closed APIs deprecate models and alter outputs without warning. Open-weight models with permissive licenses (like Apache 2.0) ensure that software built today remains functional tomorrow.

The Lazy Payoff

Onboarding onto an unfamiliar 10,000+ line repository typically consumes 2 to 4 hours of manual file reading, tracing imports, and locating entry points before making a pull request.

With RepoSloth:

• Scan & Structure: Completed in under 2 seconds.
• Architecture & Entrypoint Detection: Instant.
• Targeted Code Questioning: Answers with direct line numbers in under 15 seconds.

That cuts preliminary repository reconnaissance down from half a day to less than 2 minutes—saving hours of cognitive fatigue and letting you stay slow and steady!

Prize Categories

• Hacktoberfest Week 3: Slow and Steady (Primary Challenge Category)