DEV Community: Himanshu Pathak

Veladora — light a candle for the code you inherited

Himanshu Pathak — Sat, 31 Oct 2026 04:27:06 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Veladora is a local altar for a repository you inherited.

You drop a folder. It stays in the tab. A rule engine lights a candle for each thing the next person will trip over: a key written into a source file, an eval, an empty catch, a FIXME that is the only minutes of a meeting you were not in, the same six lines copied into a second file during a rush. The score is a vigil out of 100. It is a first pass, not a clearance to ship.

If you want those findings said back as a remembrance, you light Gemma 3 270M in the browser. The model never receives the files. It receives a redacted brief of at most eight candles. If it loops, the reply is thrown away and the archivist draft stays. The draft is the product. The model is a voice for it.

The week asked for something spooky, or something that honors the past the way Día de los Muertos does. I took the second reading, and I tried not to turn a living tradition into a costume. An ofrenda is a place you set for someone who is not in the room. Inherited code is that room. The comment is the only thing they left on the table. Veladora's job is to tell you which candles to keep and which ones to put out. Keep the sentence about the 2019 contract. Delete the key.

There is a second desk, for languages that outlived their authors. COBOL, Fortran, ALGOL 60, Pascal, BASIC, Prolog, Smalltalk-80, Ada, SNOBOL, MUMPS, RPG, Forth. The short biographies are written down from the public record, because a 270 million parameter model should not be asked to invent the year a language was born. You can paste a snippet and ask the model what it does. The sample includes a tiny COBOL payroll program, because that is the shape of the work a lot of people actually inherit.

The bundled sample, Night Shift Payroll, scores 50 out of 100. Four of the candles are high: a documentation-example AWS key, a second secret assigned in source, eval, and pickle.load. The page says the AWS strings are the public documentation examples, so the demo can light a candle without shipping a live credential.

Demo

The site is static. No build, no account, no key.

https://himanshu-5680.github.io/veladora/

The sample is already loaded. Night Shift Payroll scores 50 out of 100 before you click anything.

Filter to Secrets. The evidence reads AKIA…MPLE, not the full key. Show secrets here reveals it in the tab. Markdown, JSON, CSV, and the GitHub issue body stay redacted.

The same checks in the light theme.

Light Gemma only if you want to wait for about 300 MB and you have WebGPU. The vigil does not need it. If you would rather run it yourself: npx serve . from the repo. Do not open the file directly. Modules will not load on file://.

Code

https://github.com/Himanshu-5680/veladora

MIT for the repository. Gemma's weights stay under the Gemma Terms of Use and are not in the repo. SmolLM2, the understudy, is Apache-2.0.

flowchart LR
  drop[Folder drop or sample] --> engine[Rule engine in the page]
  engine --> report[Vigil and findings]
  report --> draft[Archivist draft]
  report --> brief[Redacted brief]
  brief --> worker[Module worker]
  worker --> gemma[Gemma 3 270M on WebGPU]
  worker --> small[SmolLM2 135M if there is no adapter]
  gemma --> speech[Remembrance, or the draft if the model loops]
  small --> speech
  report --> export[Markdown, JSON, CSV, GitHub issue]

How I Built It

The open piece that the project cannot survive without is a model you can run yourself, on a page you can host yourself. I used Google's Gemma 3 270M Instruct, the ONNX build at onnx-community/gemma-3-270m-it-ONNX, through Transformers.js 4.2.0 in a module worker. WebGPU, dtype q4f16. The worker is a plain file. It is imported from a pinned jsDelivr URL so a bundler never gets a chance to emit a worker the browser cannot run.

I did not let Gemma be the scanner. A model that size will invent a filename if you hand it a repository, and a scanner that invents filenames is worse than no scanner. The rules are ordinary JavaScript, with tests: shaped credentials, assigned secrets that are not the word changeme, dynamic execution, HTML sinks, pickle and unsafe yaml.load, empty handlers, repeated six-line blocks, long or densely branched functions, debug leftovers, a faded copyright year, and a missing LICENSE once there are at least three files. node_modules is skipped. Secret matches are stored redacted on the finding. The raw value sits on localValue for the on-screen reveal and is stripped before JSON, Markdown, or the model prompt.

The brief is capped at 1600 characters and eight findings. Temperature is 0.6, with a repetition penalty and no_repeat_ngram_size: 3. A reply that fails a small garbage check — too few letters, a loop, a repeated word — is replaced by the archivist draft. Silence would also have been fine. Showing a loop would not.

Three write-ups changed the shape of that worker, and I want them in the room:

We put a free, unlimited LLM inside a static web page — Transformers.js + Gemma 3, zero servers by @astrodevkit. A static page, Gemma 3 270M, and an honest line that a model this small will cheerfully make things up. I kept the static page and the honesty, and I refused to let the model be the source of the findings.
Run an LLM in the browser: WebGPU did 63 tokens/s, WASM did 1.6 by @mattbusel. One worker, one generation, progress that names the file, temperature under 0.8, and the note that cross-origin isolation would speed the CPU path and break embeds. I skipped isolation on purpose. Gemma's CPU file is about a gigabyte, so there is no silent CPU fallback for Gemma.
Building Browser-Based Transcription: Workers, Cancellation, and Honest Progress by @flowpick. "Local" still downloads a model, and the interface should say so. Putting the candle out terminates the worker. It does not pretend the download never happened. The weights stay in the browser cache.

If the browser has no WebGPU adapter, the page offers SmolLM2 135M instead and names it as the understudy. It is not Gemma. The Gemma prize, if this is read for that category, is the séance path: Gemma 3 270M is the model that speaks the vigil when the machine can hold it.

Tests are npm test. They cover redaction, the quiet placeholder password, the sample vigil, the garbage filter, and a pasted git log. They do not download a model.

Why Does Open Innovation Matter?

A closed API would have required me to upload the tree in order to explain the tree. The tree is the thing that may contain the secret. That is not a trade I can make, and it is not a trade I can ask a stranger to make when they drop a folder marked "confidential" that their last job left them.

Running the model locally does four things a hosted model does not.

It works after the download, with the network off. The rules work even before the download. I tried the sample with the candle unlit. The score, the twelve findings, and the draft were already there.

It costs nothing the second time. There is no meter between a maintainer and a second look.

It can be swapped. The worker names two models. Gemma is the one I want when WebGPU is there. SmolLM2 is the one that still runs when it is not. Neither is a vendor relationship.

It can disappear from a company's pricing page without taking the vigil with it. The weights, once cached, are files. The rules are in the repository under MIT. A service that sunsets its "code explainer" takes the feature with it. This page does not have a feature to take.

The limit is the point, not a footnote. Gemma 3 270M is not a staff engineer. Pointed at a whole repository it will confabulate. The open path let me put it in a box: evidence in, remembrance out, and a deterministic draft underneath that does not need it. A closed API would have hidden that limit behind a larger model and a data-processing addendum. I would rather show the small model, and show the rail it is not allowed to cross.

My Agent Session

The project was built in Cursor. I have not embedded a DevRelay session here, because the uploader's tool list does not include Cursor and I did not want to file the transcript under a different tool's name. The repository is the record: the rule engine, the tests, and docs/ARCHITECTURE.md. If I save a session later, this is the paragraph it replaces.

The Spirit of It

The sample's loudest human candle is a comment:

FIXME: holiday rates have been wrong since the 2019 contract

The archivist draft tells you to keep that sentence and to get the key out of src/config.js. That is the moment the theme stopped being decoration. The dead code is not the joke. The dead code is the only colleague who remembered the contract. You do not exorcise that. You set a place for it, and you put out the candles that can burn the house down.

Prize Categories

Best Use of Gemma. The séance is Gemma 3 270M Instruct, ONNX, in the browser, on WebGPU. The model is asked to rephrase a redacted brief and nothing else. When the machine cannot run it, the page says so and offers a different open model, by name.
Best Use of GitHub. Tests and GitHub Pages run as Actions. Issues have forms, pull requests have a template, and the vigil can copy a redacted issue body. This entry is the Actions and repository side of that category. I did not use Copilot's coding agent.

.

Himanshu Pathak — Mon, 26 Oct 2026 11:18:34 +0000

A humbling reminder that passing tests can lie

Dhruv Jani

Oct 24

I'm Not on the DEV Team. I Still Debugged Their Missing Badges From Public Code. (And My First Test Was Wrong.)

#opensource #ruby #rails #testing

139

6 min read

HisaabMate

Himanshu Pathak — Mon, 19 Oct 2026 07:03:48 +0000

Project Repository: HisaabMate on GitHub

How I Built It

Architecture

Primary Workflow:

Paste Hinglish notes / Presets / .txt or text PDF.
Ingest & sanitize in Streamlit.
Extraction Engine: Local Ollama API + gemma3:1b JSON Schema.
Python validates dates, clients, durations & categories.
Human edits & adds/removes rows in Neobrutalist Data Editor.
North-Star Audit Tracker + Client & Category Charts.
Formula-Safe CSV Export + Client Invoice Memo.

Offline Fallback:

Deterministic Hinglish Regex Parser (ensures the app never breaks).

Tech Stack & Design Decisions

Google Gemma 3 (gemma3:1b) via Ollama: Runs locally at http://localhost:11434/api/chat. Despite its compact 1B parameter footprint (runs smoothly on consumer laptops), pairing it with Ollama's JSON Schema format constraint and explicit Hinglish few-shot conversion rules (1 ghanta = 60, aadha ghanta = 30) makes structured extraction fast and reliable.
Deterministic Offline Hinglish Fallback (extract_work_entries_offline): If Ollama is offline or zero-latency parsing is needed, the built-in regex parser extracts ISO dates, Hinglish durations, "ke liye" / "ke saath" client names, categories, and "billable nahi" flags in-process.
In-Memory Document Guardrails (src/document_parser.py): Uses pypdf and BytesIO to read uploaded .txt and text-based PDF work logs entirely in RAM, enforcing a 5 MB size cap and 30-page PDF limit without touching the filesystem.
Pastel Neobrutalist Streamlit UI (app.py): Styled with Space Grotesk, Plus Jakarta Sans, and JetBrains Mono typography, tactile 2px solid #1E293B ink borders, 4px offset shadows, and @st.cache_data helpers for instant reruns.
21 Offline Unit & Headless UI Tests (tests/): Automated tests verify schema validation, DataFrame NaN/float round-trips, formula-injection escaping, PDF guardrails, and full UI workflows offline.

Community Wisdom That Shaped the Build

While designing the local structured extraction pipeline, these DEV community posts helped shape the architecture:

Ollama Structured Outputs in Practice — Getting Type-Safe JSON from Local LLMs with Pydantic by @jangwook_kim_e31e7291ad98
LLM Structured Outputs and JSON Schema: Tool Calling That Never Drifts by @jeff_pdc
Clean JSON Extraction with Ollama and Python by @nearshi

Why Does Open Innovation Matter?

100% Client Privacy & NDA Compliance: Freelancers log work involving unreleased features and real client names. Because gemma3:1b runs locally and files are parsed strictly in RAM, zero bytes of client data ever leave the freelancer's laptop.
Zero Per-Request API Cost (Viable Side-Hustle Economics): Running an open-weight 1B model on the user's own CPU/GPU brings marginal inference cost to $0.00, allowing HisaabMate to exist as a free open-source tool or a one-time-purchase app.
No Vendor Lock-In & Bilingual Control: Closed APIs deprecate models and behave unpredictably on code-mixed languages like Hinglish. Open Python validation rules let users inspect every prompt, swap local models, or work completely offline.

My Agent Session

During development, I worked with my coding agent to:

Design the strict separation between natural-language extraction (src/ollama_client.py) and deterministic Python financial validation (src/worklog.py).
Fix a subtle Pandas/Streamlit st.data_editor round-trip bug where newly added rows introduced NaN and float durations, solved via _sanitize_editor_records().
Build the offline Hinglish fallback parser and the 21-test unittest + AppTest suite.

My First User

I tested HisaabMate on my own weekly Hinglish developer logs and shared it with a fellow student freelancer who tracks tasks in WhatsApp messages.

What happened: Pasting raw Hinglish notes immediately separated billable client tasks (BharatPay, ZeptoClone) from non-billable sprint syncs and admin work, flagging incomplete rows where details were forgotten.
What they liked most: The Audit Readiness bar and the one-click Markdown Invoice Memo, which can be pasted straight into a client WhatsApp/Slack message alongside the CSV.
Would they pay?: They wouldn't want another monthly SaaS subscription, but would gladly pay a small one-time fee for a local desktop tool that keeps client names private and recovers 2+ forgotten billable hours per sprint.

Prize Categories

Best Use of Gemma: HisaabMate uses Google's open-weight gemma3:1b model running locally via Ollama (src/ollama_client.py) as its primary extraction engine. Using JSON Schema constrained decoding (ENTRY_SCHEMA at temperature: 0), gemma3:1b parses code-mixed Hinglish and English work notes—converting phrases like "2 ghante", "aadha ghanta", and "billable nahi" into structured, schema-validated timesheet drafts without sending a single token to the cloud.

devchallenge #hf26challenge #ai #opensource

WildWalk: an open-source AI tool that gets you off your screen

Himanshu Pathak — Sun, 11 Oct 2026 18:18:12 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass

What I Built

WildWalk is a free, open-source web app that helps people step outside. You type your city, and it:

Pulls live temperature, humidity and air quality from Open-Meteo.
Scores how good a walk would be right now, using a TabPFN model.
Finds nearby parks and gardens with SerpApi.
Writes a short walk guide with Gemma, and reads it aloud as an MP3.

Then you switch on Pocket Mode: a full-screen timer, the phone goes into your pocket, and the guide plays. When the walk ends, you rate it. That rating goes back into the training data for the score model.

Who it is for: people who spend most of their day on screens and need a quick, clear reason to go out. Students, office workers and parents are the first audience I have in mind.

Honest current state: the TabPFN model is trained on synthetic seed data for now. Real ratings will improve it. The guide model is small (1B parameters), so the guides are simple. I would rather say that clearly than oversell it.

Demo

Video (1–2 min): https://github.com/Himanshu-5680/WildWalk/blob/main/docs/demo.mp4
Screenshots:

Not deployed yet. It runs locally with setup.bat and start_all.bat.

Code

Himanshu-5680 / WildWalk

🌿 WildWalk

Touch grass, not screens.

WildWalk is a small, open-source tool that helps you decide whether to go outside today, and gives you a short audio guide for a screen-free walk. You enter your city. It checks the weather and air quality, gives the walk a score, suggests nearby places, and reads you a guide. Then you put your phone in your pocket and go.

Built for the Hacktoberfest 2026 Open-Source AI Challenge (Week 1: "Touch Grass").

📸 Screenshots

Walk plan

Guide and audio

Pocket mode

Walk journal

Learn

🎯 The problem

Many people spend most of their day on screens and rarely go outside. Deciding whether a walk is worth it is often guesswork: is it too hot, is the air bad, where should I go? WildWalk gives one clear answer in one place, and helps you stay off your phone once you leave.

💡 Goal

Make going…

View on GitHub

How I Built It

Everything in the main path is open-source or open-weight:

Gemma 3 (1B) via Ollama. An open-weight model running on my own machine. It writes the walk guide from a prompt that includes the score, nearby spots, nature facts and past walks.
TabPFN. A tabular foundation model that predicts a walk score from temperature, humidity, AQI, month and hour. Each rated walk is appended to a CSV, and the model retrains on it.
Temporal. Every walk plan is a durable workflow: find spots, score, recall, write, voice, save. Each step has retries, so one failing step does not break the whole request.
Tiger Data (Postgres + pgvector). Stores nature facts. The guide uses hybrid keyword and vector search to pick the facts that match the city and season.
MongoDB Atlas. Vector memory of past walks, so the model can recall similar walks.
SerpApi. Live web search for nearby parks.
Edge TTS. A free neural voice for narration.
Stack: FastAPI backend, plain HTML, CSS and JavaScript frontend, no build step.

Browser → FastAPI → Temporal workflow
                     ├─ SerpApi        → nearby spots
                     ├─ TabPFN         → walk score
                     ├─ Tiger Data     → nature facts (pgvector search)
                     ├─ MongoDB Atlas  → past walks (vector memory)
                     ├─ Gemma (Ollama) → walk guide
                     └─ Edge TTS       → audio

Fallback: if the backend is offline, the website computes a simple local score and guide, and shows a note saying so. The app never just breaks.

Why Does Open Innovation Matter?

No per-request bill. Gemma and TabPFN run on my own machine. A closed API would charge for every guide and send every request to a company server.
I can change it. I can swap the Gemma size, retrain TabPFN on real walk data, or rewrite the prompt. With a closed API I would be limited to what the provider allows.
Open data. Open-Meteo and OpenStreetMap are free, so anyone in any city can run this without a paid data contract.
Honest limits. Some parts are still cloud services (Atlas, Tiger Data, SerpApi, Edge TTS). The core decision and the guide run locally, but not everything stays on the device.

Prize Categories

Best Use of TabPFN: walk scoring from tabular data, retrained on each rated walk.
Best Use of Gemma: the guide writer, running locally.
Best Use of Temporal: durable walk workflow with retries and resume.
Best Use of Tiger Data: pgvector hybrid search over nature facts.
Best Use of MongoDB Atlas: vector memory of past walks.
Best Use of SerpApi: live search for nearby parks.

devchallenge #hf26challenge #ai #opensource

hello dev.

Himanshu Pathak — Fri, 02 Oct 2026 16:51:39 +0000