DEV Community: Andy Khang

RepoRetro: Ghost in the Repo — Unearthing Dead Code & Honoring Departed Contributors with Gemma & Entire

Andy Khang — Fri, 30 Oct 2026 17:18:07 +0000

This article is a submission for the Hacktoberfest Open-Source AI Challenge: Week 4 ("Ghost in the Machine").

"Do not remove a fence until you know why it was put up in the first place."

— G.K. Chesterton (Chesterton's Fence)

Every seasoned codebase is haunted.

In every mature repository, there are functions with zero active callers, orphaned billing modules preserved across three refactors, commented-out blocks that everyone is terrified to delete, and TODO (Elena 2023) comments left by engineers who haven't committed in three years.

When modern developers encounter these artifacts, we face a dilemma. Traditional linters blindly shout: "Unused export! Delete it!" But seasoned engineers know the danger of heedless deletion: what if that function was an edge-case guard against a banking outage? What if that unreferenced class was an incomplete prototype an agent generated during a frantic sprint?

For Hacktoberfest 2026 Week 4 ("Ghost in the Machine"), I built RepoRetro: an open-source repository archaeologist that doesn't just treat dead code like garbage to be purged. In the Mexican tradition of Día de los Muertos, RepoRetro builds a digital Ofrenda for your repository. It unearths abandoned code, calculates a multi-factor Haunt Score (0–100), queries past AI agent sessions via Entire, and uses Google's open-weight Gemma to reconstruct the historical rationale before delivering a Chesterton's Fence verdict: is this a Load-Bearing Relic, Unfinished Work, or Safe to Exorcise?

What I Built

RepoRetro is a dual-interface repository intelligence tool:

Interactive Candlelit Web Dashboard: A rich Día de los Muertos themed interface with cempasúchil marigold glowing accents, live scan progress, graveyard statistics, and a dedicated Ofrenda Tab honoring departed contributors.
Terminal CLI: A fast command-line scanner (npx reporetro scan . or npx tsx src/cli.ts scan) that prints formatted archaeological reports directly to your stdout.

🕯️ REPORETRO: GHOST IN THE REPO ARCHAEOLOGY REPORT
═══════════════════════════════════════════════════════════════════════
Repository: haunted-repo
Scanned At: 2026-10-27T14:37:09.967Z
Files: 3 | Commits: 4 | Relics: 7 | Departed Contributors: 2
Average Haunt Score: 94 / 100 👻
═══════════════════════════════════════════════════════════════════════

🪦 THE GRAVEYARD (7 Relics Discovered):
  [UNREFERENCED EXPORT] legacyRsaDecrypt (src/auth/crypto.ts:7-12)
    Haunt Score: 95/100 | Author: Elena Rostova (Departed 42.3 mos ago)
    Commit: 3fd5802 (2023-04-12)
    Why: Introduced by Elena Rostova for v1.2 spec. Callers refactored away.
    Verdict: ⚰️ SAFE TO EXORCISE
    Rationale: Confirmed orphaned with zero internal importers.

  [UNREFERENCED EXPORT] CarrierPigeon (src/telemetry/carrier-pigeon.ts:2-7)
    Haunt Score: 95/100 | Author: Marcus Vance (Departed 29.3 mos ago)
    Commit: 06c86da (2024-05-10)
    Why: Generated during AI session cp-telemetry-99a8e1.
    Entire Session Match: Prompt "Prototype an offline event buffering class CarrierPigeon..."
    Agent Reasoning: Marcus planned to wire this into telemetry sink, but transitioned off.
    Verdict: 🚧 UNFINISHED WORK
    Rationale: File contains functional logic that was abandoned mid-architecture.

🏵️ THE OFRENDA (Honoring Departed Contributors):
  🕯️ Elena Rostova (elena@heritage-labs.org)
     Active: 2023-04-12 to 2023-04-12 | Departed: 42.3 months ago
     "Though inactive for 42 months, their architectural footprint endures across 
     the foundation of this repository."
  🕯️ Marcus Vance (marcus@cloudbridge.dev)
     Active: 2024-02-15 to 2024-05-10 | Departed: 29.3 months ago
     "Though inactive for 29 months, their architectural footprint endures across 
     the foundation of this repository."

Demo & Visual Tour

1. The Code Graveyard & Chesterton's Fences

RepoRetro serves an altar-inspired UI with real-time analytics:

Haunt Score Meter (0–100): Combines unreferenced export counts, git decay time, author departure delta, and commented line density into a unified index.
The Graveyard View: Lists every dead code relic with expandable commit history, author attribution, and correlated agent prompt history.
Chesterton's Fence Badges:
- 🕯️ Load-Bearing Relic: Keep and document (e.g., legacy banking fallback).
- 🪦 Safe to Lay to Rest: Confirmed dead code ready for clean removal.
- 🌼 Unfinished Ghost Work: Incomplete feature branch ready to resurrect.

2. Private Repository Scanning & Zero-Persistence Security

Real enterprise repositories and legacy codebases almost never live in public git URLs. To make RepoRetro viable for real teams, it supports user-added credentials across both the Web UI and CLI:

Personal Access Tokens (PAT): Works with GitHub (classic and fine-grained PATs), GitLab (read_repository), and Bitbucket App Passwords.
SSH Private Keys: Paste OpenSSH / PEM keys directly or load key files from your filesystem.
Intelligent URL Adaptation: Automatically converts HTTPS URLs to SSH when an SSH key is given, and SSH (git@...) URLs to HTTPS when a token is provided.
Zero-Storage Ephemeral Security: Credentials are kept strictly in-memory during cloning. They are never written to disk or the SQLite database. Git origins are automatically sanitized, and any credential strings in errors or logs are replaced with ***.
Environment Variable Fallbacks: Server deployments automatically detect GITHUB_TOKEN, GIT_TOKEN, GIT_USERNAME, GIT_PASSWORD, or GIT_SSH_KEY from .env.

3. The Día de los Muertos Ofrenda Tab

The Ofrenda Tab honors long-gone contributors who haven't committed in over 6 months:

Computes their first and last commit eras, total commits given, and surviving lines of code still in HEAD.
Generates poetic tributes celebrating their foundational craft.
Transmutes the cold finger-pointing of git blame into a community celebration of human craftsmanship.

4. Archaeological Sessions & Entire Checkpoints

When AI coding agents write code, their thinking is usually lost once merged. RepoRetro inspects git commit trailers (Entire-Checkpoint: ...) and the git-native entire/checkpoints/v1 tree to recover:

The original human prompt that initiated the code.
The agent's chain-of-thought reasoning snippet.
Why the feature was paused or abandoned mid-architecture.

System Architecture

                    ┌────────────────────────────────────────────────────────┐
                    │                   RepoRetro Web UI                     │
                    │         (Día de los Muertos Altar / Express API)       │
                    └───────────────────────────┬────────────────────────────┘
                                                │
                 ┌──────────────────────────────┴──────────────────────────────┐
                 ▼                                                             ▼
     ┌───────────────────────┐                                     ┌───────────────────────┐
     │    DeadCodeDetector   │                                     │      GitAnalyzer      │
     │  - Unreferenced Exp.  │                                     │  - Git Blame & Log    │
     │  - Commented Blocks   │                                     │  - Commit Trailers    │
     │  - Ancient Markers    │                                     │  - Author Inactivity  │
     └───────────┬───────────┘                                     └───────────┬───────────┘
                 │                                                             │
                 └──────────────────────────────┬──────────────────────────────┘
                                                │
                                                ▼
                               ┌─────────────────────────────────┐
                               │    AgentSessionCorrelator       │
                               │   - Entire Checkpoints Ref      │
                               │   - .entire/sessions.jsonl      │
                               └────────────────┬────────────────┘
                                                │
                                                ▼
                               ┌─────────────────────────────────┐
                               │       Mastra Orchestrator       │
                               │     @mastra/core Agent + Tools  │
                               └────────────────┬────────────────┘
                                                │
                                                ▼
                               ┌─────────────────────────────────┐
                               │       Gemma 2 (2B / 9B)         │
                               │   - Local Ollama / llama.cpp    │
                               │   - Archaeological Synthesis    │
                               │   - Chesterton's Fence Verdict  │
                               └────────────────┬────────────────┘
                                                │
                                                ▼
                               ┌─────────────────────────────────┐
                               │     SQLite Storage & Cache      │
                               └─────────────────────────────────┘

How I Built It

RepoRetro is crafted entirely in TypeScript using modern, modular tooling:

1. Open-Weight Gemma Integration (Featured Category: Best Use of Gemma)

To determine why a piece of code exists, RepoRetro sends the commit history, diff snippet, author tenure, and session transcripts to Gemma 2 (gemma-2-2b-it or gemma-2-9b-it).

OpenAI-Compatible Client: Seamlessly connects to local inference engines (Ollama, llama.cpp, vLLM) or hosted endpoints.
Archaeological Prompt Engineering: Rather than asking Gemma to refactor or rewrite the code, Gemma acts as a historical detective, answering two critical questions:
1. What engineering problem was the author solving when this code was introduced?
2. Applying Chesterton's Fence, is this code a Load-Bearing Relic, Unfinished Work, or Safe to Exorcise?
Offline Fallback Engine: If no inference endpoint is reachable, RepoRetro gracefully uses a deterministic rule-based archaeological synthesizer so users can run scans completely offline.

2. Entire Git-Native Checkpoints (Partner Category: Best Use of Entire)

In traditional development, when a human writes code, their thoughts are lost. In agentic development, agents produce rich tool calls, reasoning steps, and prompts—which are usually discarded once merged.

RepoRetro integrates with Entire, an open agent checkpointing protocol:

It scans commits for Entire-Checkpoint: <id> trailers.
It parses the .entire/sessions.jsonl log and queries the git-native entire/checkpoints/v1 ref.
When RepoRetro finds dead code in src/telemetry/carrier-pigeon.ts, it matches it to the exact Entire session where developer Marcus Vance asked: > "Prototype an offline event buffering class CarrierPigeon for mobile and IoT devices."
RepoRetro pulls the agent's internal reasoning snippet, explaining to the modern maintainer that the code was left unreferenced because Marcus was reassigned before completing the sink integration.

3. Mastra Agent Framework (Partner Category: Best Use of Mastra)

RepoRetro orchestrates the analysis using @mastra/core:

Implements custom Mastra tools: inspectGitCommit (extracting commit metadata and trailers) and searchSession (correlating agent transcripts).
Encapsulates the entire archaeological reasoning workflow inside a Mastra Agent, allowing other automated pipelines or CI/CD agents to invoke RepoRetro programmatically.

4. Cloud Deployment (Featured Categories: Best Use of Render & DigitalOcean)

RepoRetro is ready for cloud deployment with zero manual configuration:

Render (render.yaml): Includes a complete Render Blueprint defining the Node.js web service, environment variables, health check path (/api/health), and automated build steps.
DigitalOcean (.do/app.yaml & Dockerfile): Multi-stage production container ready to deploy to DigitalOcean App Platform or run locally with docker-compose up.

Why Does Open Innovation Matter?

The Hacktoberfest Week 4 prompt asks a poignant question: Why does open innovation matter for what you built?

When building a tool that inspects the history and ghosts of a repository, openness is not just a license preference—it is a non-negotiable architectural requirement:

Codebase Privacy & Security:
A repository's git history holds a company's crown jewels: legacy security fixes, proprietary algorithms, internal author emails, and unreleased prototypes. If an archaeology tool required piping every commit diff, author timestamp, and line of code to a closed third-party SaaS API, most engineering organizations would never be allowed to run it. By running open-weight Gemma models on local hardware (via Ollama or llama.cpp), RepoRetro runs with the internet completely disconnected. Your codebase never leaves your workstation.
The Threat of Vendor Lock-In on Developer History:
When developers rely on closed-source agent platforms, their prompts and session context are trapped in proprietary databases. If that vendor pivots, raises prices, or shuts down, the context of why your software was built disappears into the ether. By integrating with Entire, agent sessions live directly inside the repository as git-native objects (entire/checkpoints/v1). An open tool like RepoRetro ensures that your team's historical memory remains your property forever.
Software Longevity:
Proprietary development tools decay as APIs change. Open innovation allows communities to maintain tools across decades. Just as open-source codebases preserve historical commits from 15 years ago, open archaeology tools guarantee that we can continue to inspect and understand our legacy systems for generations to come.

The Spirit of It: Día de los Muertos & The Human Element

Too often in software engineering, we treat past code with cynicism. We look at legacy code, roll our eyes, and murmur: "Who on earth wrote this mess?"

RepoRetro flips this perspective. Codebases are human endeavors. The engineer who wrote that convoluted 200-line regex in 2022 might have been staying up until 3:00 AM preventing a production crash on Black Friday. The author who wrote an incomplete billing client might have been called away to another team or laid off during a company restructuring.

In the spirit of Día de los Muertos, RepoRetro honors those who came before us. By lighting a digital candle on the Ofrenda, displaying their surviving impact, and understanding their original intent before touching a single line, we build software with empathy, reverence, and respect.

Try It Out

Run the CLI

git clone https://github.com/AndyKhang404/reporetro.git
cd reporetro
npm install
npm run build

# Generate the included multi-era haunted repository fixture
npm run seed-fixture

# Scan any local repository
npm run cli scan fixtures/haunted-repo

# Scan a private repo using a Personal Access Token (PAT)
npm run cli scan https://github.com/owner/private-repo --token ghp_yourTokenHere

# Scan a private repo using an SSH key file
npm run cli scan git@github.com:owner/private-repo.git --ssh-key ~/.ssh/id_ed25519

Launch the Altar Dashboard

# Start the web server
npm start
# Open http://localhost:3000 in your browser

Prize Categories Entered

Best Use of Gemma ($200 Featured): Open-weight Gemma 2 powers local historical reasoning, commit intent synthesis, and Chesterton's Fence verdicts without code telemetry leaving the machine.
Best Use of Entire ($100 Partner): Queries git-native entire/checkpoints/v1 and .entire/sessions.jsonl to correlate unreferenced code with the original developer prompts and agent reasoning.
Best Use of Mastra ($100 Partner): Orchestrates archaeological tools and inspection workflows with @mastra/core/agent.
Best Use of Render ($200 Featured): Native Infrastructure-as-Code via render.yaml Blueprint.
Best Use of DigitalOcean ($200 Featured): Production Docker container and .do/app.yaml App Platform spec.
Overall Winner ($250): A creative, deeply thematic fusion of Halloween ("Ghost in the Machine") and Día de los Muertos honoring the past of open-source software.

Community Wisdom & Citations

The architectural philosophy of RepoRetro was deeply inspired by ongoing discussions in the developer community:

Chesterton's half-implemented fence that he built just in case by Tommy Hawkins — on why half-implemented features exist and why deleting them blindly is dangerous.
Your Git History Keeps the Code. Who Keeps the Lesson? by Evgeny Shevtsov — on the missing link between commit diffs and original intent.
Repository Intelligence in 2026: Why AI That Reads Your Git History Beats AI That Reads Your Files by Ailoitte — on why historical context matters more than static file analysis.

Code and documentation licensed under the MIT License.

Sloth Digest 🦥: Private Overnight Gmail Briefing & Reply-Debt Tracker with Gemma, Temporal & Mastra

Andy Khang — Mon, 26 Oct 2026 02:36:12 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

In honor of International Sloth Day and the "Slow and Steady" theme, I built Sloth Digest 🦥 — a 100% private, local-first overnight Gmail executive briefing and Reply-Debt Tracker that does the dreaded morning inbox catch-up while you sleep.

Waking up to 40 unread emails, sifting through newsletters, and anxiously wondering "Wait, did I ever reply to Sarah's question from Tuesday?" is the opposite of sloth energy. Instead of handing your most sensitive personal data to a cloud LLM API, Sloth Digest runs entirely on your home server or laptop:

Sleep through the night: At 6:00 AM, a durable Temporal schedule wakes up on your machine.
Read-only IMAP ingestion: It inspects new messages in your Gmail INBOX and [Gmail]/Sent Mail using strict RFC 3501 EXAMINE mode with UID cursors — so it never marks unread emails as read or mutates your mailbox.
Local Gemma inference via llama.cpp: An open-weight Gemma model served locally over llama.cpp classifies mail (personal, transactional, bulk), summarizes multi-message personal threads into strictly two lines, and extracts unanswered questions directed at you.
Auto-Reconciled Reply Debt: Every direct ask is recorded in a local SQLite reply_debt ledger (NEW, PENDING 3d, etc.). Whenever you reply from any email client during the day, the next run inspects your Sent folder's In-Reply-To and thread headers and automatically resolves the debt.
Wake-up delivery: At 7:00 AM, a self-hosted ntfy push notification lands on your phone with your reading time saved and pending asks, linked to a zero-dependency LAN web dashboard (http://localhost:3000).

Demo, Prerequisites & Quickstart

Before Starting the App (Live Gmail + Full Stack Prerequisites)

Before launching Sloth Digest against your real Gmail inbox, prepare the following prerequisites:

Runtime Environment:
- Node.js 22+ and npm (for local CLI execution)
- Docker & Docker Compose (recommended for running the full 4-container stack: sloth-llama, sloth-temporal, sloth-ntfy, and sloth-app)
Google App Password for Gmail (imap.gmail.com:993):
- Gmail disallows standard account passwords over IMAP. First, ensure 2-Step Verification (2FA) is enabled on your Google Account (https://myaccount.google.com/security).
- Generate a 16-character Google App Password at https://myaccount.google.com/apppasswords and copy the 16-character code.
- Verify that IMAP access is enabled in your Gmail forwarding/POP/IMAP settings.
Quantized Gemma GGUF Weights (./models/):
- Create the local ./models directory (mkdir -p models) and download your quantized Gemma GGUF model file into it (for example, gemma-2-2b-it-Q4_K_M.gguf or a Gemma 4B GGUF model matching LLAMA_MODEL_FILE in .env).
Environment Variables (.env):
- Copy cp .env.example .env and configure your credentials and schedule before starting the app:

# Gmail IMAP Credentials (requires 2FA + 16-char Google App Password)
GMAIL_USER=your-email@gmail.com
GMAIL_APP_PASSWORD=your-16-char-app-password
# Or mount via Docker secret file:
# GMAIL_APP_PASSWORD_FILE=/run/secrets/gmail_password

# llama.cpp Server (OpenAI-compatible /v1 endpoint running Gemma)
LLAMA_SERVER_URL=http://localhost:8080
LLAMA_MODEL_NAME=gemma-2-2b-it
LLAMA_MODEL_FILE=gemma-2-2b-it-Q4_K_M.gguf

# Temporal Schedule & Timezone
TEMPORAL_ADDRESS=localhost:7233
DIGEST_SCHEDULE_HOUR=6
DIGEST_SCHEDULE_MINUTE=0
DIGEST_SCHEDULE_TIMEZONE=Asia/Ho_Chi_Minh

# Self-Hosted ntfy Push Delivery & LAN Dashboard
NTFY_URL=http://localhost:8088/sloth-digest
NTFY_SCHEDULE_TIME=07:00
WEB_PORT=3000
# Optional: Protect the LAN dashboard with HTTP Basic / Bearer auth
# WEB_AUTH_TOKEN=your-secret-dashboard-token

Option A: Start the Full Self-Hosted Stack (Docker Compose)

Once .env and ./models/ are ready, bring up llama-server, Temporal (with Web UI on 127.0.0.1:8233), ntfy (127.0.0.1:8088), and the unified sloth-app worker + dashboard (http://localhost:3000):

# Build and start all 4 containers
docker compose up -d --build

# Register the 06:00 AM daily Temporal schedule
docker exec -it sloth-app npx tsx src/cli.ts schedule

# Or trigger an immediate digest run right now
docker exec -it sloth-app npx tsx src/cli.ts run-now

Option B: Instant Offline Demo (Zero Credentials Needed for Judges)

Want to test the entire pipeline immediately without setting up a Google App Password or downloading GGUF weights first? Use the built-in synthetic inbox seeder and deterministic fallback:

# 1. Clone and install
git clone https://github.com/AndyKhang404/sloth-digest.git
cd sloth-digest
npm install
cp .env.example .env

# 2. Run the automated verification suite (12/12 assertions)
npm run test-pipeline

# 3. Seed realistic multi-thread emails + a Sent reply into local SQLite
npm run seed -- --local

# 4. Run the standalone local digest pipeline
npm run sloth -- run-local

# 5. Inspect active reply debt in the CLI or launch the LAN web dashboard
npm run sloth -- debt
npm run sloth -- serve

Sample CLI & Digest Output

When the pipeline finishes, it writes a clean Markdown briefing to ./data/digests/ and serves it at http://localhost:3000:

# 🦥 Sloth Digest — Executive Morning Briefing
** Lazy Payoff:** Saved **14.2 min** of reading (3,650 words condensed to 270 words @ 238 WPM)

## 🌅 Two-Line Executive Overview
- Processed 3 active personal threads overnight while skipping 4 bulk/transactional messages.
- You have 2 open reply-debt items awaiting your response today (1 thread auto-resolved via Sent mail).

## 🔴 Active Reply Debt (Needs Your Reply)
1. **[NEW] Production Migration Window Confirmation** — from `sarah.chen@example.com`
   - **Ask:** Can you confirm if Sunday 02:00 UTC works for the database cutover?
   - **Cited Message-ID:** `<msg-prod-cutover-02@example.com>`
2. **[PENDING 2d] Q4 Architecture Sign-off** — from `alex.rivera@example.com`
   - **Ask:** Please review the updated latency numbers in section 3 before Friday.
   - **Cited Message-ID:** `<msg-q4-arch-01@example.com>`

Code

AndyKhang404 / sloth-digest

Private overnight Gmail digest and reply-debt tracker powered locally by Gemma, llama.cpp, Mastra, and Temporal.

🦥 Sloth Digest

Private Overnight Gmail Executive Briefing & Reply-Debt Tracker
Built for Hacktoberfest 2026 Week 3: "Slow and Steady"
Lead Category: Best Use of Gemma ($200) • Secondary: Best Use of Temporal, Best Use of Mastra

📖 What is Sloth Digest?

In honor of International Sloth Day and the Hacktoberfest 2026 "Slow and Steady" theme, Sloth Digest channels your inner sloth by doing the dreaded morning email catch-up while you sleep.

Instead of waking up to 40 unread emails, scrolling through noise, and dreading forgotten replies:

Sleep through the night: At 6:00 AM, a durable Temporal workflow wakes up on your home server.
Read-only triage: It examines new emails in your Gmail inbox without modifying read flags or leaving your local network.
Local AI synthesis: An open-weight Gemma 4B model running on llama.cpp categorizes bulk mail, summarizes personal threads into strictly two lines, and extracts direct asks.
Durable…

View on GitHub

How I Built It

Architecture

flowchart TD
    Gmail["Gmail IMAP (Read-Only EXAMINE)"] -->|UID Cursor Fetch| Temporal["Temporal Workflow (nightlyEmailDigestWorkflow)"]
    Temporal --> Ingest["1. fetchNewEmailsActivity (INBOX + Sent)"]
    Temporal --> Classify["2. classifyEmailsActivity (Gemma + Mastra)"]
    Temporal --> Summarize["3. summarizeThreadActivity (2-Line Thread Summary)"]
    Temporal --> Reduce["4. reduceAndGenerateDigestActivity (Reply-Debt Engine + SQLite)"]
    Temporal --> Notify["5. deliverNotificationActivity"]
    Classify <--> Llama["llama.cpp Server (Gemma GGUF on 127.0.0.1:8080)"]
    Summarize <--> Llama
    Reduce --> Dashboard["LAN Web Dashboard (:3000)"]
    Notify --> Ntfy["Self-Hosted ntfy Push (:8088)\nScheduled 07:00 Delivery"]

Joining the Community Conversation on Local AI & Email Agents

While designing Sloth Digest, three discussions from the DEV community directly shaped the architecture:

Zero-rewrite local inference with llama.cpp: In How to serve an OpenAI-compatible local API with llama.cpp by @dedupedai, the author demonstrates exposing a local GGUF model over /v1/chat/completions with JSON schema constraints. We used this exact pattern so our Mastra agents talk to llama-server on 127.0.0.1:8080 with response_format: { type: 'json_object' }.
Deterministic verifiers around small local models: In Beyond Vibes: Architecting Closed-Loop AI Agents with Local SLMs, Deterministic Evals, and Human Learning Loops by @akshatsoni26, the core takeaway is "Numbers owned by code, words owned by models" — never trust a small local model to invent IDs or calculate metrics unverified. Inspired by that guardrail pattern, Sloth Digest cross-checks every cited_message_ids entry returned by Gemma against a deterministic Set of real RFC 822 Message-IDs in that thread, and computes reading-time savings in pure TypeScript.
Why email is tough for agents: In Giving Autonomous Agents Access to Email by @francofuji, the author highlights how traditional email polling and state management trip up autonomous agents. For personal inboxes, the biggest hazard is side effects (accidentally marking unread messages as \Seen or choking on huge attachments), which drove our strict read-only EXAMINE + 100 KB source cap design.

Key Implementation Details

1. Strictly Read-Only IMAP with UID Cursors (`src/ingest/imap.ts`)

If an overnight script marks your emails as "Read" before you wake up, you will miss critical messages when you open your phone. We open both INBOX and [Gmail]/Sent Mail with { readOnly: true } (IMAP EXAMINE) and track (uidvalidity, last_uid) cursors in SQLite:

const inboxLock = await imap.getMailboxLock('INBOX', { readOnly: true });
try {
  const mailbox = imap.mailbox;
  if (mailbox && mailbox.exists > 0) {
    const uidvalidity = String(mailbox.uidValidity);
    const cursor = dbService.getCursor(accountId, 'INBOX');
    const lastUid = cursor?.uidvalidity === uidvalidity ? cursor.last_uid : 0;
    // Fetch only UIDs > lastUid with a 100 KB source cap to skip heavy attachments
  }
} finally {
  inboxLock.release();
}

2. Prompt-Injection Isolation & Citation Verification (`src/agent/mastra.ts`)

Incoming emails are untrusted external input. Before passing any email into our Mastra agents (EmailTriageAgent, ThreadSummarizerAgent, DigestOverviewAgent), we strip scripts, styles, hidden zero-width/bidirectional Unicode characters, and wrap the text inside <untrusted_email_data> tags with boundary neutralization. Then we validate the output with zod and filter any hallucinated Message-ID citations:

export const ThreadSummarySchema = z.object({
  thread_summary: z.tuple([z.string(), z.string()]),
  needs_reply: z.boolean(),
  reply_reason: z.string().optional(),
  cited_message_ids: z.array(z.string()),
});

// Deterministic validation: filter out any cited message IDs not actually in this thread
const validMessageIds = new Set(messages.map((m) => m.message_id));
const validatedCitations = result.cited_message_ids.filter((id) => validMessageIds.has(id));

3. Auto-Resolving Reply Debt via Sent Mail (`src/engine/debt.ts`)

Instead of forcing you to manually check off to-do items every day, reconcileSentReplies checks if you replied to the thread or In-Reply-To message ID from your phone or desktop client, and clears the debt automatically:

const normalizeMsgId = (id: string) => id.trim().replace(/^<+|>+$/g, '');

for (const reply of sentReplies) {
  const normalizedReplyTarget = reply.inReplyTo ? normalizeMsgId(reply.inReplyTo) : '';
  for (const debt of openDebts) {
    if (debt.status !== 'open') continue;
    const matchesInReplyTo =
      Boolean(normalizedReplyTarget) &&
      normalizedReplyTarget === normalizeMsgId(debt.message_id);
    const matchesThread = reply.threadId === debt.thread_id;

    if (matchesInReplyTo || matchesThread) {
      dbService.resolveReplyDebtByThread(debt.thread_id, reply.messageId);
      debt.status = 'resolved';
    }
  }
}

4. Durable Orchestration with Temporal (`src/temporal/workflows.ts`)

Home servers reboot, Wi-Fi blips, and CPU inference can spike. Wrapping the 5 pipeline stages in a Temporal workflow (nightlyEmailDigestWorkflow) with activity retries, exponential backoff, and heartbeats ensures the 6:00 AM digest finishes reliably before the 7:00 AM push notification fires.

What I Would Do Differently Next

Right now, thread summarization runs sequentially per active thread to keep CPU and RAM usage gentle on low-power home servers. Next, I would add configurable concurrency limits in the Temporal worker alongside a lightweight local embedding index so follow-up threads from weeks ago can link prior context automatically.

Why Does Open Innovation Matter?

Your personal email inbox holds bank alerts, medical updates, private family conversations, and work contracts. Sending every unread email to a proprietary cloud LLM API every night means trading away your privacy and paying recurring token fees forever.

Open innovation makes Sloth Digest possible on three fronts:

Privacy by Architecture (Open-Weight Gemma + llama.cpp): Because Gemma runs locally as a quantized GGUF model bound strictly to 127.0.0.1:8080, zero bytes of email content ever leave your LAN.
Sloth Economics ($0/month Forever): Nightly batch triage across dozens of emails costs $0.00 in API fees. Once your container stack is up, it runs quietly on existing hardware.
Verifiable, Self-Hosted Stack: Every component — from Mastra agent schemas and Temporal workflow orchestration to ntfy push notifications and SQLite — runs in rootless local Docker containers that you can inspect, audit, and customize.

The Lazy Payoff

Sloth Digest calculates your exact time saved on every run using the standard human reading speed benchmark of 238 words per minute:

Metric	Cold Inbox Morning	With Sloth Digest 🦥
Morning Triage Time	30–60 minutes scanning threads & promos	~2 minutes reading a 2-line-per-thread briefing
Forgotten Replies	Searching "did I reply to that?" days later	Auto-tracked Reply Debt cleared when you hit Send
Cloud AI Exposure	100% of inbox sent to third-party servers	0 bytes leave your machine

Over a year, saving just 25 minutes each morning reclaims ~150 hours of focus — all while you sleep in.

Prize Categories

This project targets the following Hacktoberfest Week 3 partner categories:

Best Use of Gemma: Google's open-weight Gemma model (served locally via llama.cpp) powers all three stages of intelligence: inbox triage (classifyEmailWithGemma), strict two-line thread summarization + ask extraction (summarizeThreadWithGemma), and the morning executive briefing (generateOverallOverviewWithGemma).
Best Use of Temporal: nightlyEmailDigestWorkflow orchestrates the 5-step ingestion, classification, thread map-reduce summarization, SQLite ledger reconciliation, and notification delivery pipeline with activity timeouts, heartbeats, exponential backoff retries, and a 6:00 AM cron schedule.
Best Use of Mastra: @mastra/core defines our structured local agents (EmailTriageAgent, ThreadSummarizerAgent, DigestOverviewAgent) paired with strict zod schema validation (EmailCategorySchema, ThreadSummarySchema, InboxOverviewSchema) and prompt-injection boundary sanitization.

DEV Community: Andy Khang

RepoRetro: Ghost in the Repo — Unearthing Dead Code & Honoring Departed Contributors with Gemma & Entire

What I Built

Demo & Visual Tour

1. The Code Graveyard & Chesterton's Fences

2. Private Repository Scanning & Zero-Persistence Security

3. The Día de los Muertos Ofrenda Tab

4. Archaeological Sessions & Entire Checkpoints

System Architecture

How I Built It

1. Open-Weight Gemma Integration (Featured Category: Best Use of Gemma)

2. Entire Git-Native Checkpoints (Partner Category: Best Use of Entire)

3. Mastra Agent Framework (Partner Category: Best Use of Mastra)

4. Cloud Deployment (Featured Categories: Best Use of Render & DigitalOcean)

Why Does Open Innovation Matter?

The Spirit of It: Día de los Muertos & The Human Element

Try It Out

Run the CLI

Launch the Altar Dashboard

Prize Categories Entered

Community Wisdom & Citations

Sloth Digest 🦥: Private Overnight Gmail Briefing & Reply-Debt Tracker with Gemma, Temporal & Mastra

What I Built

Demo, Prerequisites & Quickstart

Before Starting the App (Live Gmail + Full Stack Prerequisites)

Option A: Start the Full Self-Hosted Stack (Docker Compose)

Option B: Instant Offline Demo (Zero Credentials Needed for Judges)

Sample CLI & Digest Output

Code

AndyKhang404 / sloth-digest

Private overnight Gmail digest and reply-debt tracker powered locally by Gemma, llama.cpp, Mastra, and Temporal.

🦥 Sloth Digest

📖 What is Sloth Digest?

How I Built It

Architecture

Joining the Community Conversation on Local AI & Email Agents

Key Implementation Details

1. Strictly Read-Only IMAP with UID Cursors (src/ingest/imap.ts)

2. Prompt-Injection Isolation & Citation Verification (src/agent/mastra.ts)

3. Auto-Resolving Reply Debt via Sent Mail (src/engine/debt.ts)

4. Durable Orchestration with Temporal (src/temporal/workflows.ts)

What I Would Do Differently Next

Why Does Open Innovation Matter?

The Lazy Payoff

Prize Categories

1. Strictly Read-Only IMAP with UID Cursors (`src/ingest/imap.ts`)

2. Prompt-Injection Isolation & Citation Verification (`src/agent/mastra.ts`)

3. Auto-Resolving Reply Debt via Sent Mail (`src/engine/debt.ts`)

4. Durable Orchestration with Temporal (`src/temporal/workflows.ts`)