gluecron

A GitHub replacement. AI-native code intelligence, git hosting, automated CI, and a self-hostable platform built to keep every push production-ready. Every repo ships with gates, branch protection, CODEOWNERS sync, and an AI reviewer on by default — opt out per feature, never by default. Deploy anywhere Bun runs — fly.toml is in-repo, Dockerfile for any container host. Backed by Neon Postgres.

Features

Code hosting

• Git Smart HTTP (clone / push / fetch) — subprocess-backed
• SSH keys, personal access tokens, OAuth 2.0 provider
• Public / private repos, forks, stars, topics, archive, transfer, template repos
• Pull-style repository mirroring (upstream git URL, periodic fetch + audit log)
• Releases, tags, protected tags
• Repository rulesets — push policy engine covering commit/branch/tag patterns, blocked paths, file-size caps, force-push forbiddance

Code browsing

• File tree, syntax highlighting (40+ languages), commit log, unified diffs, blame, raw
• Branch + tag switcher, contributor list, commit activity graph
• Code search (ILIKE) — per-repo and global
• Semantic code search — Voyage voyage-code-3 when VOYAGE_API_KEY is set, deterministic hashing fallback otherwise
• Symbol / xref navigation across ts/js/py/rs/go/rb/java/kt/swift
• Dependency graph — npm / pip / poetry / go / cargo / rubygems / composer
• Commit signature verification — GPG + SSH "Verified" badges

Collaboration

• Issues, labels, milestones, issue templates, saved replies
• Pull requests: inline review, draft PRs, AI triage on create, merge queues, required-checks matrix
• Discussions (forum threads, q-and-a, pinned/locked)
• Wikis (DB-backed, revision history + revert)
• Projects / kanban boards
• Gists (multi-file, per-revision snapshots, stars, secret)
• Reactions (8 canonical emoji) on issues, PRs, and comments
• Mentions, notifications, personalised activity feed, user follows, profile READMEs
• Closing keywords auto-close issues on PR merge

AI-native

• AI code review blocks merges on fail (requireAiApproval branch protection)
• AI security review (Sonnet 4) + 15-pattern secret scanner on every push
• AI commit messages, PR summaries, changelogs (per-range viewer + on release)
• AI merge-conflict resolver, AI incident responder (auto-issue on deploy fail)
• AI explain-this-codebase (per-commit cached Markdown)
• AI-generated failing test stubs
• AI dependency updater (opens a PR with a bump table)
• Copilot-style completion endpoint (POST /api/copilot/completions, Haiku, LRU-cached)
• AI chat — global and repo-scoped

Automation

• Workflow runner — .gluecron/workflows/*.yml auto-discovered on push, Bun subprocess executor, per-step timeouts, size-capped logs
• Outbound webhooks (HMAC-signed) on push / issue / PR / star
• Inbound GateTest callback (bearer or HMAC)
• Commit status API — external CI POSTs per-commit statuses, combined rollup
• Auto-repair engine (rewrites broken commits when ANTHROPIC_API_KEY is set)
• Autopilot background ticker — mirror sync, merge-queue processing, weekly email digests, advisory rescans (opt out via AUTOPILOT_DISABLED=1)
• Dependabot-equivalent dep bumper + security advisories scanner
• CODEOWNERS auto-sync with team-based resolution (@org/team)

Platform

• Organizations + teams (owner / admin / member roles, team-based CODEOWNERS)
• 2FA / TOTP with recovery codes
• WebAuthn / passkeys
• Enterprise SSO via OIDC (Okta, Azure AD, Auth0, Google Workspace)
• App marketplace + GitHub-Apps-equivalent bot identities (ghi_ install tokens, scoped permissions)
• Package registry (npm protocol — packument / tarball / publish / yank)
• Pages / static hosting (serves from gh-pages branch)
• Environments with protected approvals (reviewer-gated deploys, branch-glob restrictions)
• Sponsors (tier management — payment rails deferred)
• Personal dashboard, explore, global search, insights, releases
• REST + GraphQL APIs (queries only on GraphQL)
• Official CLI (cli/gluecron.ts) — single-file Bun binary
• VS Code extension (vscode-extension/) — explain / open-on-web / semantic search / test generation
• Mobile PWA (manifest + offline-capable service worker). Native iOS/Android apps are not built.
• Command palette (Cmd+K), keyboard shortcuts, dark + light themes

Observability

• Rate limiting, request-ID tracing, /healthz, /readyz, /metrics
• Audit log (personal + per-repo)
• Traffic analytics per repo (views + clones, 7/14/30/90d windows, SHA-truncated IP uniqueness)
• Org-wide insights dashboard (green rate, PR/issue counts, per-repo breakdown)
• Site admin panel — user management, system flags (registration_locked, site_banner_*, read_only_mode), billing overrides
• Billing + quotas (free / pro / team / enterprise seeded plans)
• Email notifications (provider-pluggable: log default, Resend in prod) + opt-in weekly digest

For the full shipped-vs-missing scorecard and internal roadmap, see `BUILD_BIBLE.md`.

Install

One click: Drag `gluecron.dxt` into Claude Desktop → Extensions. Claude prompts for your Gluecron host + a personal access token (generate one at /settings/tokens with admin scope) and the 15 MCP tools (gluecron_create_pr, gluecron_merge_pr, gluecron_repo_health, …) light up.

Browser: Sign up at https://gluecron.com/register or try without signing up at https://gluecron.com/play.

Day-to-day ops: Every routine operator action lives at `/admin/ops` (enable AI auto-merge, trigger a deploy, rollback). Deploy progress streams to `/admin/deploys`. No SSH required.

curl -sSL https://gluecron.com/install | bash

Quick start (local development)

Visit http://localhost:3000 after starting the dev server to register and create your first repository.

bun install
bun dev            # hot-reload dev server
bun run db:migrate # run database migrations
bun test           # run the test suite

Stack

• Runtime: Bun
• Framework: Hono (with JSX for server-rendered views)
• Database: Drizzle ORM + Neon (PostgreSQL)
• Git: Smart HTTP protocol via git CLI subprocesses

Architecture (top-level)

src/
  index.ts          Bun server entry
  app.tsx           Hono composition + error handlers
  db/               Drizzle schema + lazy connection + migrations
  git/              repository.ts (tree/blob/commits/diff/blame/...) + protocol.ts
  hooks/            post-receive (GateTest, outbound deploy webhook, webhooks, CODEOWNERS)
  lib/              auth, config, markdown, highlight, AI helpers, autopilot, ...
  middleware/       softAuth / requireAuth / rate-limit / request-context
  routes/           git, api, web, issues, pulls, editor, settings, webhooks, ...
  views/            layout, components, landing, reactions

Full file inventory lives in `CLAUDE.md`.

Integrations

• GateTest — optional third-party security scanner. When GATETEST_URL is set, every git push POSTs to it; inbound results accepted at POST /api/hooks/gatetest (bearer or HMAC).
• Webhooks — user-registered URLs receive HMAC-signed payloads on push / issue / PR / star events.
• Outbound deploy webhook — optional. Set CRONTECH_DEPLOY_URL (or any URL) to receive a POST on pushes to the default branch. Opt out per repo via autoDeployEnabled.

Deployment

Gluecron runs anywhere Bun runs. The repo ships a fly.toml for Fly.io and a Dockerfile for any container host, with Neon Postgres as the database. See `DEPLOY.md` for step-by-step instructions, environment variables, and the post-deploy verification checklist.

License

See `LICENSE`.