DEV Community: Amrit Dash

Lockfile Ofrenda: candles for the packages that stopped speaking

Amrit Dash — Thu, 29 Oct 2026 12:14:57 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Lockfile Ofrenda is a Día de los Muertos altar for the packages that are still in your package-lock.json after the registry has gone quiet.

npm outdated tells you that you froze a version. It does not tell you that the latest tag on the registry has not moved since 2015, that the maintainer wrote a deprecation note you never read, or that the name 404s now. Those packages are not ghouls in a haunted terminal. They are offerings that never left the table: jade, gulp-util, request, colors. Nested node_modules count. Direct dependencies count. The lockfile is the ofrenda because that is what you actually ship.

The app parses npm lockfile v2/v3 (and the older nested dependencies tree), asks registry.npmjs.org for last publish, deprecation text, and maintainers, then lights a marigold candle for anything unpublished, deprecated, silent for 730 days, or listed with no maintainers. Click a candle and a local Gemma model (via Ollama) may write a remembrance. Code then checks the text against the record. Invented years, invented CVEs, invented replacements are dropped. If Gemma is offline or fails that check, you get a clerk's copy of the registry fields instead, labeled as such.

I built this instead of a possessed shell because the ghosts in my machine were already there, sitting in lockfiles I had not opened in years. The theme asked for something that honors the past. An ofrenda is not a jump scare. It is a list of names and a light.

This is a new project for this window. MIT. No login.

Demo

There is no login and nothing to host a session cookie in. Run it locally, drop a lockfile or use the demo, click a candle.

git clone https://github.com/amrit-contour/lockfile-ofrenda
cd lockfile-ofrenda
cp .env.example .env
npm install
# optional, for spoken remembrances instead of the clerk copy:
ollama serve && ollama pull gemma3:4b
npm start

Open http://localhost:8788. Use the demo lockfile is the fastest path for judges. The sample is seven packages: six quiet, debug still alive. Filter Quiet / All / Direct. Click jade. Snuff a candle if you do not want it spoken of again this session.

If Ollama is not running, the slip still fills. That is not a failed demo. The clerk copy is the product working without a hosted model.

Empty altar:

Quiet packages from the demo lockfile:

jade's slip, copied from the registry when Gemma was silent:

A public Render URL is not part of this entry. render.yaml is in the repo if you want a host. This post does not claim Best Use of Render.

Code

amrit-contour / lockfile-ofrenda

Día de los Muertos altar for quiet packages in your npm lockfile

Lockfile Ofrenda

A Día de los Muertos altar for the quiet packages in your npm lockfile.

Source: github.com/amrit-contour/lockfile-ofrenda

npm outdated tells you that you froze a version. It does not tell you that the registry has not heard from that package in years, or that the maintainer marked it deprecated and you still pull it in transitively. This app reads package-lock.json, asks the public npm registry for last publish / deprecated / maintainers, and lights a candle for anything unpublished, deprecated, silent for two years, or listed with no maintainers.

A local Gemma model (via Ollama) may write a remembrance. Code then checks the text against the record. Invented years and wanderings are dropped. If Gemma is offline or fails the check, you get a clerk’s copy of the registry fields instead.

Why open weights

The lockfile is a map of what you ship. Sending it to a hosted…

View on GitHub

Repo: github.com/amrit-contour/lockfile-ofrenda (public, MIT). My DEV GitHub handle is the-AoG-guy; this repo lives on the amrit-contour account I ship from.

flowchart LR
  lock[package-lock.json] --> parse[parseLockfile]
  parse --> registry[registry.npmjs.org]
  registry --> score[score: unpublished / deprecated / silent 730d / no maintainers]
  score --> altar[altar UI]
  altar --> gemma[Gemma via Ollama]
  gemma --> ground[groundEulogy]
  ground -->|facts only| slip[remembrance slip]
  ground -->|wandered or offline| clerk[clerk copy of the record]

Quiet is scored from the latest tag's publish time, not time.modified. ms in the demo is quiet because the latest publish is 2020-12-08 even though the record has been touched later. That is the point: a bump of metadata is not a release.

How I Built It

Open-weight Gemma is the remembrance, not the scanner. The scanner is TypeScript: a lockfile walk, a registry fetch, a 730-day threshold, a grounding pass. Gemma is allowed to write 90–140 words from a JSON fact bag. Temperature is 0.2. The system prompt is a clerk of a death register, not a poet with a search engine.

"You may only use the JSON facts. Do not invent successors, CVEs, people, or dates."

Then groundEulogy tokenizes the reply against the record. Years that are not in the facts are dropped. If too much of the text is invention, the whole remembrance is refused and the clerk copy is shown. Source is labeled gemma or record so the altar never pretends a model spoke when it did not.

That is the same instinct as PenMunshi: Gemma writes, code checks every fact. A lockfile is a map of what you ship. Sending it to a hosted chat API is a worse deal than reading registry.npmjs.org yourself.

I did not scan package.json alone. Week 4 already has Exorcist hunting declared deps. The ghosts I care about are nested: jade arrives because something else still asks for it. The lockfile is the honest list.

Stack: Node 20, Hono, tsx, vanilla HTML/CSS/JS. Tests cover lockfile parsing. npm test and npm run typecheck are in the README.

Why Does Open Innovation Matter?

A hosted model would have been easier. It would also mean uploading the names and versions of everything I ship, plus asking a vendor to invent a eulogy about software they do not maintain. The ofrenda only needs two networks: the public npm registry, which already published those facts, and optionally localhost Ollama.

If Gemma is down, the altar still works. That is the open-weight contract I wanted: the model is a clerk who may be out of the office. The record is not. A closed API disappearing is the same story this app is telling about packages. I did not want the remembrance layer to be another ghost.

Running Gemma locally also means the tone can be strict. I do not have to hope a remote safety layer will refuse to invent a CVE. I refuse it in ground.ts.

The Spirit of It

The first name that came up on the demo lockfile was jade 1.11.0. Last publish 2015-06-12. The deprecation field still says: Jade has been renamed to pug. Maintainers: forbeslindesay. License: MIT. Description: a clean, whitespace-sensitive template language for writing HTML.

That package taught a lot of people to indent HTML. It is still in lockfiles. The slip does not ask you to feel guilty. It lights a candle and copies the record. Snuff it if you already know.

Prize Categories

Best Use of Gemma — local gemma3:4b through Ollama writes the remembrance; grounding code decides whether that text may leave the altar. No other partner category is claimed.

My WhatsApp Was My Open-Mic Booking System, So I Gave It to Gemma

Amrit Dash — Mon, 26 Oct 2026 03:57:47 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

I'm a stand-up comic in Bangalore, and I curate the Monday and Tuesday open-mic lineups at a club.

WhatsApp is my daily driver. I use it to ask other rooms for spots, gossip about shows and audience with comics, reply to my family group, talk to my girlfriend and somewhere in all of that, comics message me asking for a spot on the lineups I curate. Every new message pushes the older ones down. Some requests just slip out of view, and that isn't fair to the comic who asked on Saturday morning.

So every week, to keep it fair, I scroll back through every chat, work out who actually asked, check who performed last week (they go to the back of the queue), decide if last week's cancelled mic gets repeated, message everyone, and add and remove people from each show's WhatsApp group by hand.

It takes me about 3 hours every week. I'd rather spend those 3 hours writing jokes. Or sleeping. Mostly sleeping.

So I built Spot Solutions. A Gemma model running on my old laptop reads my DMs, picks out the real spot requests, and drops them on a lineup board. I drag names into shows, press send, and the confirmations, polite regrets and group updates take care of themselves.

Nothing goes out without my OK. I wanted to be lazy, not crazy.

Demo

Live app: spot-solutions.web.app. Hit Try the live demo and you get your own sandbox of a curator's week. No sign-up. Drag comics around, edit the messages, reset a lineup, break things. It's yours.

(Watch it as a video, 25 seconds.)

Here's the weekly loop:

Comics DM me like they always have. Nothing changes for them.
The server on my laptop waits until a chat goes quiet, then hands the whole burst to Gemma. So "hey" ... "monday?" ... "got a new 5" counts as one request, not three.
Gemma decides what each conversation is: a spot request (with preferred days), a cancellation, "am I up this week?", a question about the venue, or noise.
Requests land in Waiting on the board. Last week's performers sink to the bottom with a tag.
I drag comics into Monday and Tuesday, hit Confirm & send, and review who gets added to and removed from each show's group before anything changes.

It's built for the phone, because that's where I actually curate:

The Lazy Payoff

What Spot Solutions takes off my plate every week:

finding the actual requests in a weekend of DMs
checking who performed last week, who asked for which day, and whether a cancelled mic repeats
messaging every comic, the ones who got a spot and the ones who didn't
adding and removing people from each show's group

Before: about 3 hours a week. Now: about 15 minutes, most of it spent dragging names around.

That's about 12 hours a month back. It also runs for next to nothing, on a laptop that was gathering dust.

This isn't my first attempt either. Version 1 ran for 7 months across 2024 and 2025 on Google Apps Script, Google Sheets and Twilio: 2,200+ spot requests from 150+ comics. It worked, but it needed rigid keywords, cost money per message, and every rule lived in spreadsheet formulas. Version 2 keeps all the rules V1 learned (request windows, skip-last-week, ban and ignore lists, "did the mic happen?" checks, last-minute spot offers) and lets Gemma handle the messy human part.

How I Built It

WhatsApp: whatsapp-web.js in a Node worker. One headless WhatsApp Web session per curator.
AI: Gemma 3 (4B) through Ollama, on the same laptop. Gemini is an optional fallback, off unless you add a key.
App: React + Vite with Material 3, hosted on Firebase. Works on a phone, and installs as a PWA.
The glue: Firestore. The web app writes commands, the worker listens and writes results back. The laptop only makes outbound connections. No open ports, no tunnel, no static IP. It works on home Wi-Fi while I'm on mobile data across town.

The part where the small model broke

Comics ask for spots in every way imaginable:

"bhai monday ka spot milega? naya 5 hai"
"put me down pls"
"any day works, got new bits"
"guru tuesday sigutta?"

And my WhatsApp isn't only comics. It's bank alerts, UPI receipts, OTPs, delivery updates, forwarded memes and audience members asking about tickets. A 4B model asked "is this a spot request?" will say yes with confidence to things that clearly aren't, and a confidence score alone didn't protect against that.

What worked was making the model quote the ask. Every classification has to include an evidence field copied from the messages, and the worker checks that quote is really there:

/** The model must quote the ask. If its "evidence" isn't actually in the messages, it made it up. */
export function evidenceIsReal(evidence: string, messages: string[]) {
  const ev = norm(evidence);
  if (!ev) return false;
  const text = norm(messages.join(" "));
  if (text.includes(ev)) return true;
  const words = ev.split(" ").filter((w) => w.length > 1);
  const hits = words.filter((w) => text.includes(w)).length;
  return words.length > 0 && hits / words.length >= 0.75;
}

If the quote isn't in the chat, the classification gets thrown out as noise. The model can't invent a request out of a bank alert when it has to point at the words. The 75% word match is loose on purpose: Hinglish has no fixed spelling, so a quote can drift a little from the original and still be honest.

Auto-acknowledging ("got your request, will confirm soon") is off by default. When it's on, it needs a quoted ask at 85%+ confidence, in a message under 10 minutes old, from a real person and never a business account.

Making an old laptop a real server

Most of the second half of the week went into making the server boring to run:

One installer each for Ubuntu (even from a USB stick), Windows and macOS. The Mac gets a small menu-bar app.
It survives restarts, power cuts and closed lids. The WhatsApp login gets backed up, and when the server comes back it catches up on DMs that arrived while it was down, without auto-replying to any of them.
Restarting the worker, restarting Ollama, reading logs and approving new curators all happen from the app's Server page, so after setup I never need to touch the laptop.
It's invite-only. Other curators sign in, I approve them, and they link their own WhatsApp. An 8 GB laptop should comfortably host about 6 curators.

Why Open Matters Here

My comics' DMs are private. People send me their phone numbers, their sets, their bad days. Sending every one of those messages to a cloud API so a model can decide whether "bro monday?" is a spot request felt wrong.

With Gemma running locally:

No cloud model reads the chats. Gemma reads them on my own laptop, and messages that aren't spot requests aren't even stored.
The AI costs nothing. No per-message bill, which matters when a busy weekend means hundreds of messages.
I can swap the model. Gemma 3 1B on a weak machine, 12B on a better one, or Gemini as a fallback when I choose. Each curator gets a setting for this: "Local only" or "Local first".
Old hardware gets a second life. The laptop running this was headed for a drawer.

And it's all MIT licensed. Another open-mic scene can run its own server for its own comics, and nothing about it depends on me.

Several Laptops, One Lineup

One laptop is a single point of failure, and old laptops fail. So Spot Solutions runs on as many servers as you want, all pointed at the same project: a Mac, a Windows laptop, an Ubuntu box in a cupboard.

Each WhatsApp account runs on exactly one of them at a time. That server holds a lease and renews it every 30 seconds. If it goes quiet (power cut, closed lid, a cat on the keyboard), it stops its own WhatsApp first, and only after that can another server take the account over.

The new server doesn't ask for a QR scan. It pulls an encrypted copy of the WhatsApp login from Cloud Storage, unlocks it, and carries on. Every copy gets a version number, and the newest copy always wins, so a laptop that comes back after a week can't overwrite a fresher login with its old one.

Accounts go to the least busy server, curators can pin themselves to one, and a curator who picks "Local only" only ever lands on a server running Gemma. Each machine gets its own key, so if a laptop gets stolen I revoke that one key and the rest keep running.

Code

amrit-contour / spot-solutions

Open-mic lineups from your WhatsApp DMs, sorted by Gemma running on your own laptop. Drag, review, send.

Your open-mic lineup, sorted while you sleep.
Comics ask for spots in your WhatsApp DMs, however they like. A Gemma model running on your own laptop picks out the real requests.
You drag names into shows and press send. Confirmations, polite regrets and show groups take care of themselves

Try the live demo · The write-up on DEV · Run a server · Docs

Why this exists

I'm a stand-up comic in Bangalore and I curate the Monday and Tuesday open-mic lineups at a club. Spot requests arrive in WhatsApp between family groups, comic gossip, bank alerts and memes. Every new message buries the older ones, so being fair to whoever asked first meant scrolling back through every chat, checking who performed last week, messaging everyone and fixing each show's group by hand.

That was about 3 hours a week. Now it's about 15 minutes.

Version 1 ran for 7…

View on GitHub

Prize Categories

Best Use of Gemma: Gemma 3 runs every AI decision in the app, locally through Ollama: reading bursts of Hinglish, English and Kannada DMs, sorting them into spot requests, cancellations, questions and noise, pulling out preferred days, and quoting the ask so nothing gets invented. Curators who pick "Local only" never touch a cloud model at all.

Built with Gemma 3, Ollama, whatsapp-web.js, React and Firebase, mostly by a sloth with a laptop and a AI subscription.

TestMadeEasy: Gemma 4 turns a photo of a textbook page into a branded test paper

Amrit Dash — Mon, 19 Oct 2026 05:51:44 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge: Week 2 (Side Hustle).

What I Built

My friend Akash Agrawal (@baniyaman) teaches at a coaching centre. Every time he needs a test paper for a class, a subject or a unit, he does the same thing: picks questions from books and old papers, screenshots them, marks them up, and sends the pile to a DTP operator.

The DTP operator's whole job is turning those screenshots into a paper. They retype every question in proper maths notation, redraw the figures, drop it all into the coaching centre's branded template with its logo, and send back a PDF to review and print. Akash's centre pays ₹5 for a plain question and ₹10 and up for anything with a diagram. And it takes about a week: 2 days of the teacher picking questions, then 5 days waiting on the operator.

TestMadeEasy removes that middle layer. The teacher photographs a page (or marks a section of one), and the app gives back every question as clean, consistent text:

the question in LaTeX, so maths and chemistry notation looks like a real exam paper
options, kept separate from the question
a generated answer and solution
subject, chapter, topic, difficulty and marks
the diagram, cropped straight out of the photo

Then the teacher picks questions, applies their institute's branding (logo, colours, header, watermark) and prints the paper and its answer key. Same day, no operator.

There's one more piece that makes it smarter over time: a shared master question bank. Every extracted question is checked against it, so a question someone has already scanned gets matched and synced instead of extracted again. The bigger the bank gets, the less anyone needs to scan. You start changing values in existing questions instead of typing new ones.

Who pays for it

Small coaching institutes, the kind with a few teachers running weekly JEE, NEET and board-exam tests. They already pay for this work today, per question, to a DTP operator, or as a salary (some operators get ₹15,000 to 20,000 per exam cycle).

Our plan is a subscription in tiers:

Free: 5 question papers, kept on the account for good.
Paid: teacher accounts and up to 100 papers a month, priced per paper generated. With 10 to 15 questions per paper, we're aiming for ₹1 to 2 per question, against the ₹5 to ₹10+ they pay now.
Premium: access to the shared master bank, so you can build papers from questions other teachers have already extracted.
Bring your own key: bigger centres can plug in their own API key and a stronger model if they want.

That ₹1 to 2 number is only possible because of the model this week's rebuild runs on. More on that below.

Demo

Live: testmadeeasy.tech

Judge login (a teacher account with sample data already loaded):

Email: testinguseramrit@gmail.com
Password: hacktoberfest

It has 18 questions extracted from 4 practice sheets, a "Shree Science Academy" brand, and 3 test papers with answer keys. To try it yourself, go to Add Questions and upload any page (or one of the sample sheets in the repo). A page usually takes under a minute.

Code

amrit-dash / testmadeeasy

Turn a photo of a textbook page into a branded, print-ready test paper. Gemma 4 extracts questions as LaTeX.

TestMadeEasy

Photo of a textbook page in. Print-ready, branded test paper out.

testmadeeasy.tech · Features · User guide

TestMadeEasy is a question-paper builder for coaching teachers. You photograph a page from a reference book, and the open-weight Gemma 4 model pulls every question off it as clean LaTeX: options, subject, chapter, topic, difficulty, marks, and where any diagram sits. The questions land in your own question bank. You pick the ones you want, add your institute's logo, colour and watermark, and print a test paper plus its answer key.

It's built for the small coaching institutes in India that run weekly JEE, NEET and board-exam tests and currently pay a DTP operator to retype every question by hand.

Demo video: youtu.be/lA2mvoYwOtQ

Want to try it without your own pages? The 4 practice sheets in docs/images (physics, chemistry, maths, biology, all original questions) are what the demo uses.

What it does

…

View on GitHub

Where this week fits

I want to be upfront about the timeline. TestMadeEasy started as a private project earlier in 2026, built on Gemini. Akash built the first UI in Replit, and I built the backend, the AI pipeline and the infrastructure around it.

We pitched it to an IIT-prep coaching centre at ₹5,000. They didn't say no. They paid ₹1,000 for a trial, we set them up with accounts, fed in their previous papers, and scraped previous-year IIT papers to pre-fill the master bank. The extraction was good enough that the papers came out right.

They still didn't really use it. They kept sending us question papers on WhatsApp, so we'd run them through the platform ourselves and send the paper back. What they actually asked for was a WhatsApp bot: send photos, get a paper back. It was habit, plus a platform they never quite got comfortable with, and we didn't move past the trial. Akash, though, uses it every day for his own classes, and he's passed it on to other teachers who use it too.

The lesson I took from that pitch was price. ₹5,000 for a centre that's used to paying an operator per question is a hard sell. This week was the turning point: we rebuilt the AI core on open-weight Gemma 4 to get the cost low enough to pitch ₹1 to 2 per question next time, and we opened the code.

How I Built It

React and Vite on the front, Express on the back, Postgres, auth and image storage on Supabase. It all runs as one container on Google Cloud Run behind Firebase Hosting, on a .tech domain.

Swapping in Gemma 4

Every AI call used to go to Gemini. Gemma 4 is served through the same Gemini API, with the same key, and it accepts the same system prompts and JSON response schemas. So the first step was mostly configuration:

gemma-4-31b-it does extraction, answers and diagram redraws.
gemma-4-26b-a4b-it (the mixture-of-experts one, 4B active) scores teacher edits to shared questions.
An admin can switch any task back to a Gemini model from a dropdown, and nothing else in the code knows which one is running.

Then we tested it on real pages, and that's where the work was.

Diagrams without image generation

Gemma doesn't generate images, and we don't want it to. Redrawing a diagram loses detail and costs tokens. Instead, the model tells us where each diagram is, and we crop it out of the original photo. Nothing is lost, and it's cheap.

The old prompt asked for boxes as {x, y, width, height} in percent. Gemma kept returning half a box ({x: 61, y: 158}, no width or height) or raw pixels, so the app had nothing to crop with and showed the whole page. We switched to [ymin, xmin, ymax, xmax] on a 0 to 1000 grid. That's the format Google's vision models are trained on for detection; Google AI's post on Detecting and Editing Visual Objects with Gemini and Native Bounding Boxes Changes Everything for Visions Devs by amirhosseinghanipour both explain it well. The server converts the box back to percent:

// [ymin, xmin, ymax, xmax] on a 0-1000 grid -> {x, y, width, height} in percent
function boxToBounds(box: unknown, padPct: number) {
  if (!Array.isArray(box) || box.length !== 4) return null;
  const [ymin, xmin, ymax, xmax] = box.map((v) => Math.min(1000, Math.max(0, v)) / 10);
  const x = Math.max(0, xmin - padPct);
  const y = Math.max(0, ymin - padPct);
  return { x, y, width: Math.min(100, xmax + padPct) - x, height: Math.min(100, ymax + padPct) - y };
}

The boxes went from garbage to tight on the first try.

The model also tends to stop a question's box one line early, so the last row of options got cut off. Rather than add another paragraph of "PLEASE INCLUDE THE OPTIONS" to the prompt, the server grows each box with plain geometry: it takes in the question's own diagram and reaches down to just above the next question in the same column.

Making Gemma reliable

A few more things broke, and each fix was small once we found it:

Pages that "failed" for no reason. Gemma sometimes wraps its JSON in a markdown fence even in JSON mode. Our "was this cut off?" check looked for a closing }, found a fence, retried twice and gave up. Stripping the fence fixed 2 of our 4 test pages.
Pages that came back with 1 question out of 4. Now the schema makes the model list every question number on the page first, then extract. If it lists 4 and returns 1, the server retries once and tells it what it missed.
Calls that hung for 15 minutes. Every AI call now has a 150-second timeout, so a stalled request gets retried instead of blocking the job.
Jobs that froze halfway. Extraction runs in the background after the upload request returns. Cloud Run, by default, only gives a container CPU while a request is in flight, so jobs crawled whenever nobody was polling. One flag, --no-cpu-throttling, fixed it.
Free-tier limits. Gemma on the Gemini API has a low tokens-per-minute cap and a page costs 3 to 5k tokens, so Gemma calls now run 2 at a time.

After all that: 4 practice sheets in, 18 of 18 questions out, each with a working crop.

Why open innovation matters here

Cost is the whole business. Our pitch failed partly on price. On Gemini 3 Flash a page cost about $0.003 in tokens, small until a teacher scans a 200-page question book. Gemma 4 on the Gemini API costs nothing right now, which is what makes ₹1 to 2 per question (and a real free tier) work. The app still records token counts on every question, so if that ever changes, we'll see it.

No lock-in on what matters. The question bank is the product. If the free tier goes away, the weights are open: we can run the same Gemma 4 on our own GPU and keep every prompt and schema as they are, because it's the same model, not a "similar" one.

Privacy is the next step, and I'll be straight about it. Right now the hosted free tier is what keeps cost at zero, and Google says free-tier prompts can be used to improve its products. For schools that don't want exam papers leaving the building, self-hosting the same open model is the honest answer, and it's on our list.

What we'd build next: the WhatsApp flow our trial centre asked for (send photos, get a paper back), and upscaling for cropped diagrams from low-quality phone photos.

Prize Categories

Best Use of Gemma: Gemma 4 31B and Gemma 4 26B A4B run every AI task by default: reading photos into structured questions, finding question and diagram boxes for cropping, generating answers, redrawing simple diagrams as TikZ, and scoring edits to the shared bank.
Best Use of a .tech Domain: the app lives at testmadeeasy.tech.

Team

Built by @amrit-dash and @baniyaman (Akash Agrawal).

I made `git push` refuse to work until I touch grass

Amrit Dash — Sat, 10 Oct 2026 13:13:54 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge: Week 1, Touch Grass.

What I Built

For the past couple of weeks I've been losing track of time. I'd look up, see 1 o'clock, and honestly not know if it was the afternoon or the middle of the night.

I was so deep in a project that I'd stopped taking breaks. That's what made me build touch-grass.

It's a git pre-push hook. After 3 hours indoors (you can change that), this happens. Here's a real one from testing, with the limit set to 1 minute:

$ git push

🌱 touch-grass: 9m since you last saw the sky. Push blocked.
   Run `touchgrass prove`, scan the code with your phone and take a photo outside.
   (Yes, `git push --no-verify` works. You'll know.)

To get your push back, you run touchgrass prove. It prints a QR code. You scan it, your phone opens the camera, and you go outside and take a photo.

Then Gemma 4, running on your own laptop, looks at it and decides if it counts.

Demo

I didn't record a video, so here's a real prove run from testing instead. I ran it over the tunnel, scanned the code and walked outside:

$ touchgrass prove --tunnel
📱 On your phone (anywhere), open:
   https://….trycloudflare.com/?t=…
   Model: gemma4:e4b via http://localhost:11434
   Waiting for a photo of the outside world… (Ctrl+C to give up)

✅ Grass confirmed. A hilly landscape with scattered houses under a cloudy sky.
   "It looks like you've found a much better environment to debug than your IDE."
   Push unlocked.

Code: https://github.com/amrit-dash/MLH-touch-grass

How It Gets People Outside

Every "go outside" app I've tried sends a notification. I swipe it away in under a second.

This one sits on the command I run 20 times a day. I can't swipe it away. The only way past it (well, the honest way) is the front door.

And it's tiny. You don't need a hike. You need sky or a plant in frame, taken in the last 15 minutes. That's a 2 minute walk, which is exactly the break I wasn't taking.

I built it, set it up, and promptly forgot about it. Then a push got blocked, and when I looked up from the screen the sun was setting outside.

How I Built It

It's about 700 lines of Python plus one HTML page, with zero required dependencies.

The hook. touchgrass install writes a pre-push hook. It compares now against the last time a photo passed.
The phone page. touchgrass prove starts a small server on your Wi-Fi with a one-time token in the URL. The page opens the rear camera directly (capture="environment"), shrinks the photo to 1024px and sends it with its capture time. Not on the same Wi-Fi? touchgrass prove --tunnel gives the page a temporary HTTPS address through a Cloudflare quick tunnel, so it works on mobile data too.
The check. The photo goes to Gemma through Ollama, on localhost. The prompt asks for JSON only: outdoors, sky_or_plants, photo_of_screen, a one line description and a roast.
The verdict. Plain Python decides, not the model. Outdoors, plus sky or plants, plus not a screen.
The double check. Anything that passes gets one more question about screens (more on that below). Then the clock resets and you get a "grass receipt" (touchgrass log).

I kept the decision in code on purpose. The model describes the photo, and 3 lines of if decide what that means. Easier to test, and the model can't be talked into saying "pass".

Can you cheat it?

Obviously that was the first thing I tried.

Cheat	What stops it
Old photo from the gallery	Capture time has to be within 15 minutes
Photo out the window	Prompt says "not through a window" (I haven't tested this one yet)
Grass wallpaper on your monitor	`photo_of_screen`, plus the bezel double check
A monitor so close it fills the whole frame	Nothing, yet. Keep reading.
`git push --no-verify`	Nothing. You'll know.

I also benchmarked it so I wasn't just trusting vibes. 18 labelled photos: 8 real outdoor scenes, 8 indoor rooms and desks, and 2 fakes where I pasted a field of cows onto a monitor in a desk photo.

The first run got 16 out of 18. Every real photo was right. Both fakes sailed through as "Grass confirmed", with the roast "Hope the grass is as green as your commit history!" (rude, and also wrong).

So I changed 2 things. The prompt now makes the model look for a screen before it looks at the scene. And any photo that passes gets asked one more, much narrower question: what's at the edges of this photo, is it a bezel? Small models are bad at noticing a monitor frame when they're busy describing cows. They're good at it when that's the only question.

Second run: 18 out of 18, about 26 seconds a photo on a 4 core CPU with no GPU. Full results are in docs/benchmark.md.

(18 photos is tiny, and I fixed the prompt after seeing the fakes fail, so read that as "known holes closed", not "perfect". Also it calls the cows horses every single time.)

Then I tried it for real, with my own phone.

The first real photo:

✅ Grass confirmed. A multi-story residential building with laundry hanging out to dry is visible under a blue sky.
"It looks like your deployment is stuck waiting for the laundry cycle to finish."

Fair.

Then I put a photo of a grass field on my monitor and held my phone close enough that the grass filled the whole frame. No bezel, no desk.

✅ Grass confirmed. A vibrant green field of tall grass stretches towards a line of trees under a cloudy sky.
"Hope your code is as lush and green as this field, or you'll be debugging in the weeds."

It got me. Both checks missed it.

When I tried again and a sliver of the browser bar crept into the corner, it caught me straight away:

❌ That's a picture of a screen. Nice try.

I retook the full-frame shot, saved it and tried 4 different screen prompts on it, with and without Gemma's thinking turned on. Every one said it was a real field. Once the screen fills the frame there isn't much left to see, just slightly too-green grass.

So that's the known hole. If you're willing to press your phone against your monitor to dodge a 2 minute walk, you win. You'll know, though.

And the hillside in the demo above went through the new HTTPS tunnel.

Why Open Matters Here

This thing looks at photos of where you are. Your street, your backyard, maybe your face.

I don't want that going to someone else's API every time I push code. With an open-weight model the only thing that ever looks at it is my laptop. (With --tunnel the photo passes through Cloudflare on the way, encrypted, but nobody else's model sees it and nothing stores it.) It also costs nothing per check, works offline, and if you think my rules are too strict you can change the prompt or swap the model in one env var.

What's Missing

--no-verify skips it. It's a nudge with jokes, not a prison.
The capture time comes from the phone's browser, so a determined cheater can fake it.
A screen held close enough to fill the whole frame gets through. I couldn't prompt my way out of that one.
Same Wi-Fi by default. --tunnel fixes that, but then the photo goes through Cloudflare.

Prize Categories

Best Use of Gemma