RepoGeist：以開源 AI 揭開 Git 歷史中的隱藏故事

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine.

There is code in your repository that nobody can see anymore.

It had a filename. Someone spent an afternoon writing it. Another developer changed it three weeks later. Then one commit removed it, the branch moved on, and the reason slowly disappeared from the team's memory.

Git remembers the code. It does not explain the story.

What I Built

RepoGeist is a privacy-first Git archaeology application that reconstructs a repository's past and lets you investigate it with a local open-weight AI model.

The deterministic half reads real Git objects. It counts commits and contributors, traces file activity, identifies quiet branches, finds files deleted from the analyzed HEAD, and retrieves their last historical versions without modifying the working tree.

The generative half turns selected evidence into explanations. Ghost Chat answers questions about the repository. Commit Autopsy interprets a bounded diff. The Repository Speaks transforms factual milestones into a haunted chronicle, technical documentary, or developer retrospective. Answers include references to the commits and files supplied as evidence.

My interpretation of “Ghost in the Machine” is both literal and practical: the ghosts are deleted modules, abandoned experiments, and decisions whose authors are no longer in the room.

Demo

Demo video: Watch on YouTube

The most revealing route through RepoGeist's synthetic demo repository is:

1. RepoGeist analyzes ten deterministic commits and a stale experiment branch.
2. The Graveyard reveals auth/legacy.py, which no longer exists at HEAD.
3. Code Resurrection displays its final historical version directly from Git.
4. Ghost Chat receives the deletion commit, related authentication changes, and bounded metadata.
5. The answer explains what the evidence proves. If Git never documents why it happened, RepoGeist says the motivation is unknown.

That last constraint matters. A confident ghost that invents history is just a hallucination wearing a costume.

Code

👻 RepoGeist

Every repository has a past. Some commits still haunt it.

RepoGeist is a privacy-first Git archaeology platform. It reconstructs real repository history, finds code absent from HEAD, surfaces quiet branches, retrieves historical source, and lets a local open-weight model explain the evidence without sending source code to a third party.

Built for the Hacktoberfest 2026 Open-Source AI Challenge — Week 4, Ghost in the Machine.

What works

• Secure import beneath one configured repository root
• Deterministic commit, contributor, file, language, activity, and branch analysis
• Deleted-file detection and read-only historical content retrieval
• Searchable timeline, repository graveyard, and responsive Spectral Terminal UI
• Evidence retrieval and locally hosted Ollama chat with commit/file citations
• Bounded-diff commit autopsies and three evidence-grounded story styles
• Markdown and JSON investigation reports
• Analysis jobs with real stage-based progress
• Reproducible ten-commit synthetic demo plus stale experiment branch
• Docker Compose, API tests, typechecking, production build, and CI

The…

Repository: github.com/AryanSharma9917/repogeist

The repository includes Docker Compose, a reproducible demo-repository generator, FastAPI OpenAPI documentation, architecture and security guides, automated tests, and CI that does not require downloading model weights.

How I Built It

The frontend is built with Next.js and TypeScript. The backend uses FastAPI, SQLAlchemy, and SQLite. RepoGeist invokes native Git using argument arrays with hooks disabled; it never executes code from an analyzed repository. A configured repository-root boundary prevents the API from browsing arbitrary paths on the host.

The core architectural decision was to keep Git facts separate from AI prose:

Git repository
  -> deterministic extraction
  -> SQLite evidence records
  -> bounded keyword/entity retrieval
  -> local Ollama prompt
  -> evidence-linked response

RepoGeist uses the open-weight Qwen2.5 3B model through Ollama by default. Both the runtime URL and model name are configurable. The model never receives the entire repository; it sees a bounded evidence packet containing relevant commit metadata, changed paths, deletion records, and, for a commit autopsy, a limited diff.

Repository content is treated as untrusted data. A commit message could contain prompt-injection text, so the system prompt explicitly says that repository-derived text is evidence, not instructions. The model receives no tools for shell execution, arbitrary file access, secret access, repository mutation, or outbound requests.

The application remains useful without Ollama. If local AI is unavailable, only the AI endpoints return setup guidance. The factual dashboard, timeline, Graveyard, Code Resurrection, and deterministic reports still work.

What I verified

• Six backend tests pass against real temporary Git repositories.
• Ruff linting and TypeScript checking pass.
• The Next.js production build succeeds and generates eleven application routes.
• Docker Compose configuration and the frontend/backend Docker builds succeed.
• The backend container completed a real demo import, ten-commit analysis, Graveyard lookup, and historical-source retrieval.
• The installed frontend dependency tree reports zero known vulnerabilities.
• A real Ollama run with qwen2.5:3b produced a Ghost Chat answer citing the authentication deletion commit and auth/legacy.py while correctly acknowledging that the exact motivation was undocumented.
• A real Haunted Chronicle returned chronological inline citations and a complete evidence panel.

Why Does Open Innovation Matter?

Repository history can contain unreleased features, internal names, security fixes, and architectural clues. Sending all of it to a closed hosted API by default would be the wrong privacy model.

Local inference changes the product, not just its cost. Source code, Git history, prompts, and model responses can remain on the developer's machine. RepoGeist works without an AI subscription, and a team can swap models, inspect the grounding prompt, adjust retrieval, or work completely offline. The deterministic analyzer is open to inspection, so users can distinguish facts extracted from Git from interpretations generated by the model.

Open-weight is not automatically the same as unrestricted open source, and every model's license still deserves review. However, the ability to possess and run the weights locally is what makes RepoGeist's privacy promise technically credible.

The Spirit of It

The moment I want the demo to land is not the animated title. It is a small sentence beneath a polished AI answer:

The file was removed in this commit, but the repository does not document the developer's exact motivation.

That admission is the heart of RepoGeist. Git archaeology is not necromancy. We can recover evidence, preserve context, and tell a compelling story, but we should not put words in the mouths of developers who are not there to correct us.

Sometimes respecting the dead means letting the record end where it ends.