jahala

Weeder — Development skill for Claude Code

Development community

The judge of the diff: a static binary that reads what an agent produced and refuses dishonest growth, as SARIF, in milliseconds.

How to install Weeder

This entry records only its repository, not the path inside it, so there is no exact command to give. Open jahala/weeder and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Weeder does

The judge of the diff: a static binary that reads what an agent produced and refuses dishonest growth, as SARIF, in milliseconds.

Alternatives in Development

Ansoff Matrix — Ansoff Matrix analysis across 4 growth strategy quadrants 7.8k ★
JWT Scan — JWT attack toolkit (offline) — alg:none forgery, RS256→HS256 algorithm confusion, weak-secret crack, static cl 4.5k ★
Gallery — Build a static, shareable gallery from your fidelity reports — an index of score cards plus a permalink page ( 3.6k ★

README

weeder

weeder is a gate for code an agent wrote. It reads the diff, refuses dishonest growth, and leaves with an exit code that says whether the change goes through. Deleted or weakened tests, skips, stubs, swallowed errors, secrets, guardrail edits and dependency-direction violations are the shapes it refuses. A static Rust binary, milliseconds, no tokens spent, every finding as SARIF 2.1.0.

$ weeder check
error  G1  src/parser.ts:2  a merge conflict marker (<<<<<<<) was added.
error  G1  src/parser.ts:4  a merge conflict marker (=======) was added.
error  G1  src/parser.ts:6  a merge conflict marker (>>>>>>>) was added.
3 errors, 0 warnings, 0 notes

Exit 2. The commit does not happen.

Why

An agent that has just written a change is the worst available judge of it. It will report success, and it has every incentive to reach success by the shortest road: delete the failing test, add a skip, catch the exception and move on, widen the timeout until the flake stops. Those are cheap to do and expensive to notice, and a reviewer reading a thousand-line diff notices them last.

weeder notices them first, deterministically, before a human opens the pull request. It has no model, no prompt and no opinion about style. It reads what changed against what was there and reports shapes: a test that is gone, an assertion that was dropped, a `TODO` where an implementation belongs.

Install

Release binaries are built for linux and macos on x86_64 and aarch64, one `weeder-.tar.gz` per platform on the [releases page](https://github.com/jahala/weeder/releases), with its SHA-256 beside it. The tarball holds the executable, `garden.json` and `SKILL.md`.

target=aarch64-apple-darwin   # or x86_64-apple-darwin, x86_64-unknown-linux-musl, aarch64-unknown-linux-musl
base=https://github.com/jahala/weeder/releases/latest/download
curl -fsSLO "$base/weeder-$target.tar.gz" -O "$base/weeder-$target.tar.gz.sha256"
shasum -a 256 -c "weeder-$target.tar.gz.sha256"