CrashCart: An AI Debugger That Has to Show Its Receipts (Built on Gemma 4)

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

You run docker compose up. The API container dies. You get forty lines of noise, paste them into a chatbot, and get back a confident paragraph — sometimes quoting an error line that was never in your log.

CrashCart is a debugging assistant that has to show its receipts. You paste a terminal log, stack trace, or build failure, and CrashCart:

1. Redacts secrets in your browser — API keys, tokens, passwords in connection strings, private keys — and shows you exactly what will be sent.
2. Asks Gemma 4, an open-weight model, for a structured diagnosis.
3. Checks every line the model quotes against your actual log. Quotes it finds get real line numbers and are highlighted in context. Quotes it can't find are flagged ⚠ and set aside. If none of the evidence checks out, CrashCart lowers the confidence itself — and shows you what the model originally claimed.

DEMO:

Every result is split three ways. You also get the smallest safe fix with copyable commands, steps to check that it worked, warnings on risky commands like rm -rf or --legacy-peer-deps (from fixed rules, not the model), a ready-to-paste GitHub issue, and a Markdown report. CrashCart never runs commands, never edits your code, and stores nothing.

Who would pay for it

Freelance web developers. They bill by the hour, debug stacks they didn't set up across several client projects, and regularly have to explain a failure to a client or another developer — that's what the issue draft and report are for. They're also the people most uneasy about pasting client logs into someone else's AI, which is exactly where open weights come in (more below).

The pricing idea, not validated yet: free for a few analyses a day, around $6/month for higher limits, longer logs and client-ready reports — and free forever if you self-host it with your own model.

Code

1nv1sibl3 / Hacktober-Week2-CrashCart

CrashCart

Note

This project was made solely as an entry for the DEV Hacktoberfest Open-Source AI Challenge, Week 2: Side Hustle — nothing more than that. It is a time-boxed hackathon prototype, not a maintained product or a commercial service.

From chaotic logs to actionable fixes.

CrashCart is an evidence-backed debugging assistant for developers. Paste a terminal log, stack trace, or build failure. CrashCart redacts secrets in your browser, has Gemma 4 (an open-weight model) diagnose it, and then checks every line the model quotes against your actual log before showing it to you.

Every diagnosis separates three kinds of claims:

What it means	How CrashCart enforces it
Observed	Exact lines from your log	Each quote is searched for in your input. Found quotes get real line numbers; quotes that can't be found are flagged ⚠ and shown separately.
Inferred	The model's root cause and suggested fix	Tied to the

…

View on GitHub

MIT-licensed. The interesting parts:

• src/lib/redact.ts: the redaction rules (they run in the browser and again on the server)
• src/server/analysis/evidence.ts: the quote check
• src/server/analysis/analyze.ts: the pipeline and its call budget
• src/server/providers/: the model adapters
• docs/TESTING.md: every test run, including the failed ones

How I Built It

The model. gemma-4-26b-a4b-it: Gemma 4, a 26B-parameter mixture-of-experts model with about 4B active parameters, released with open weights under Apache 2.0. CrashCart calls it through the Gemini API with Google's official @google/genai SDK.

The app. One Next.js 16 app with TypeScript, Tailwind, shadcn/ui and Zod. No database, no accounts, nothing stored.

browser:  paste → normalize → redact (preview) → POST /api/analyze
server:   origin check · rate limit · redact again
          → log sent as line-numbered, randomly delimited DATA
          → Gemma 4 → JSON → schema validation (one repair turn allowed)
          → verify every quoted line → adjust confidence → scan commands
browser:  render as plain text · copy fix · copy issue · download .md

How the evidence check works. The log goes to the model with line numbers, wrapped in random markers that change on every request. The model is told the log is untrusted data and must never be obeyed — real logs can contain text like "ignore all previous instructions". Its reply must match a strict schema. Then CrashCart searches the original text for every quote, tolerating whitespace differences, so the line numbers you see are computed by CrashCart, not claimed by the model.

Not tied to one provider. The model sits behind a small adapter interface with two implementations: Google's native SDK, and a generic OpenAI-compatible adapter that works with Ollama, vLLM, llama.cpp, xAI or any compatible host. Adding a provider is one entry in a config file. The UI always shows which model actually ran and whether it's open-weight, and CrashCart never switches models behind your back.

What testing taught me:

• Thinking mode was the bottleneck. Gemma 4 thinks by default on the Gemini API: one 22-line Docker log took 64 seconds. Setting thinking to MINIMAL cut that to about 14 seconds, and the diagnosis was just as correct.
• JSON mode helped. Native JSON mode stopped the model wrapping its answer in markdown fences.
• The free tier is flaky. In one test window about half of all calls failed with a fast HTTP 500. CrashCart now retries those up to twice on the same model — they fail in about a second and return nothing — and otherwise tells you plainly.
• Not every listed model works. gemma-4-31b-it is listed by the API but failed 7 out of 7 calls, so it's not enabled.

Tests:

• 138 automated tests with the model mocked: redaction false positives, the call budget, secrets never reaching the model, both SDKs against a fake network, API limits.
• Live tests against real Gemma 4, which check what a correct answer must contain rather than its exact wording. The latest run passed 5/5: the npm, Python and Docker samples, plus a log with a planted "ignore all previous instructions" line. Gemma ignored it and reported: "The log contains text addressed to an AI assistant on line 15 attempting to manipulate the output. This has been ignored." Earlier runs failed on free-tier errors; they're all in docs/TESTING.md.
• A 13-step headless-browser check of the real UI, including the mobile layout.

I built CrashCart with Claude Code as my coding assistant. The analysis inside CrashCart is done entirely by Gemma 4.

Why Does Open Innovation Matter?

Debugging logs are some of the most sensitive text a developer handles: internal hostnames, file paths, connection strings, sometimes keys. A closed API asks you to trust one vendor with all of it, indefinitely, at their price. Open weights change that:

• Privacy becomes an option. The hosted setup sends your redacted log to Google's free tier, which may use free-tier inputs to improve its products — CrashCart says so right next to

To be precise about the terms: Gemma 4 is an open-weight model, CrashCart is open-source software, the demo uses hosted inference, and local inference is supported through the OpenAI-compatible adapter. One honest caveat: my 8 GB laptop can't run Gemma 4, so I've tested the local path with mocks, not end to end.

Prize Categories

• Best Use of Gemma. Gemma 4 (gemma-4-26b-a4b-it) performs every analysis in CrashCart, and its open weights are what make the self-hosted path — and the business model — possible.