Version 0.1.0 · MIT · Windows · macOS · Linux

See what depends on what.

TraceDeck is a dependency explorer and change-impact analyzer for JavaScript, TypeScript, and mixed-language repositories. Know what might break before you change it.

Download View on GitHub

Analysis stays on this device. No account required to use the app.

The TraceDeck dependency graph in its structure layout: every file drawn as a labelled node nested inside its real folder tree — src/main/analysis, renderer/components, tests/fixtures — with layout, colour and folder filters along the top.

Dependency graph. The structure layout nests every file inside its real folder tree. Switch layouts to spread the graph out, or colour by community to see how the code is actually coupled rather than how it is filed.

01 — Private

No network calls

No telemetry, no sync, no uploads. The Electron session cancels every outbound request that is not a local file.

02 — Offline-first

Works with no connection

No CDNs, no model APIs, no grammar downloads. Everything the analysis needs ships in the application.

03 — Deterministic

Same repo, same result

The same repository produces the same graph, the same findings, and the same scores. Every number is arithmetic you can trace.

The app

Every view, in one place.

Seven workspaces, each with its evidence attached. Pick one — no scrolling required.

Graph & impact

Select any file or symbol and the inspector shows its dependents, its dependencies, and a change impact score built from six weighted factors — each one shown, so you can see how the number was reached.

Blast radius walks reverse edges breadth-first and explains the shortest path to each affected file.
Filters for focus neighbourhood, folder prefix, node type and edge type, including hiding type-only edges.
Call-graph slice restricts the canvas to call edges and symbol nodes.
Saved views, collapse barrels, minimap, PNG and SVG export.
Soft and hard node limits (1,500 / 5,000) keep interaction responsive.

A repository file open in the code panel beside the graph, with the inspector showing a change impact score of 41 out of 100 broken into six weighted factors, a blast radius of 16 files that could be affected against 8 it depends on, structure metrics, and the list of direct dependents.

Inspector. A focused file with its impact score broken into all six factors, blast radius at a chosen depth, structure metrics, and its direct dependents — each one a link you can open.

Change Review

Compare the working tree against HEAD without modifying Git state. TraceDeck extracts normalized snapshots from both sides, compares structural evidence, and computes possible impact along the graph.

Paginated evidence: files, edges, findings, violations, cycles, reachable exports, affected files, candidate tests.
Freshness model — current, stale, incompatible.
Drill down from any row into the graph overlay, source diff, finding, or rule.
Export as Markdown from the app, or text, JSON, Markdown and HTML from the CLI.

Change Review · working tree vs HEAD current

5 files differ from HEADsnapshot compared

12 edges added · 3 removedstructural evidence

6 files could be affectedpossible impact

4 candidate testsreverse reachability

0 new cycles · 0 new violationsfindings delta

2 files with no known testcaveat

Computed dynamic imports have no statically knowable targetlimitation

Evidence, not verdicts. Every row is a count you can open. The wording stays cautious on purpose — “possible impact”, never “safe to change”.

Findings

Ten finding types, each saying where it came from and what it does not know. Dismissals are keyed by a content fingerprint rather than a line number, so editing above a finding does not resurrect a dismissal.

Cycles from Tarjan's SCC, iterative — no stack overflow on deep chains.
Unused exports are candidates, never confirmed dead code.
Type errors come from the TypeScript compiler itself, opt-in.
Architecture violations are the tenth type, declared as glob rules.

The circular dependencies view showing one medium-severity import cycle between two files, with the import chain listed.

Groups of files that import each other, directly or through a chain. Tarjan's SCC over resolved imports.

A list of unused export candidates, each labelled low severity with the symbol name, its kind, and the file and line it is declared in.

Exported symbols with no resolved import. Entry points, barrels and git rename history are excluded.

The unresolved imports view listing specifiers that could not be resolved, each with the importing file and an explanation.

Imports the scan could not follow to a file — each one a gap in the graph, so results involving them may be incomplete.

Five high-severity TypeScript compiler diagnostics, each showing the file, line, column, and the compiler's own message.

Real compile errors from getPreEmitDiagnostics. Opt-in, needs a tsconfig, and the only check that proves code is broken.

Two high-severity syntax errors in a Python fixture file, each giving the line and column where the parser failed.

Line-addressable parser failures, from TSC and tree-sitter ERROR nodes, across every inventoried text file.

The merge conflicts view in its empty state, stating that no file contains unresolved conflict markers.

Unresolved conflict markers, mirrored as live marks in the editor gutter. Empty states say plainly that nothing was found.

A single TODO comment finding showing the containing test file and the line the comment appears on.

TODO, FIXME and HACK comments across inventoried text files, each addressable by line.

Duplicate code findings, each showing a six-line block and the list of file-and-line locations where that block repeats.

Normalised six-line blocks appearing more than once. A text match, not a semantic clone detector — the view says so.

Complexity hotspot findings listing functions with their cyclomatic complexity, nesting depth, file, and starting line.

Functions with cyclomatic complexity of 10 or higher, with nesting depth and start line. A count, not a grade.

The architecture rules view offering built-in rule packs such as layered and client must not import server, with an empty violations list.

Glob rules with exception patterns and severity, built-in packs, a forbidden-import matrix, and a layer diagram.

Dashboard & Explorer

One screen for the whole repository, and one for every file in it.

Dashboard: counts for files, symbols and edges, every finding type at a glance, working-tree impact against HEAD, dependency licences, and files ranked by change impact score.
Explorer: the full filesystem inventory, not just graph sources — kind filters, exported-only, recents, and project text search.

The TraceDeck dashboard showing counts for project files, symbols, graph edges and each finding type, a working-tree impact card, and dependency licences.

Dashboard. The whole repository at a glance.

The explorer view showing the full project tree with filter chips for files, folders and symbols, and further chips for function, class, interface and React component.

Explorer. Every file, with kind filters.

Metrics & architecture

Structural measurements, and the boundaries you decide to enforce.

Metrics: fan-in/fan-out per folder, Martin instability and abstractness, cyclomatic complexity, nesting depth, simplified LCOM, and a 90-day git churn heatmap.
Architecture: glob rules with exception patterns and severity, built-in packs (layered, client-server, no-tests-from-src), a forbidden-import matrix, and a layer diagram.
Bars are counts, not grades.

The metrics view with fan-in and fan-out bars per folder, a table of folder instability and abstractness, and a list of coupling outliers.

Metrics. Coupling, complexity, churn.

The architecture rules view offering built-in rule packs such as layered and client must not import server, with a violations list.

Rules. Boundaries you declare.

Editor & Git

Enough editor to fix what you found. Not an IDE, and not a Git client.

Editor

Monaco, with the TypeScript semantic checker off on purpose.
Explicit unlock, no auto-save. Ctrl/Cmd+S saves only while unlocked.
Atomic save: temp file, then rename. UTF-8 only, hash-checked.
Gutter markers for conflicts, syntax, type and unresolved findings, todos and complexity. F8 cycles findings in the file.
Indent from EditorConfig; format with the project's Prettier if present.

Git — local, read-only

Shells out locally for read-only helpers. Never writes to your Git state.
Working-tree changes against HEAD.
Unified diff, blame, co-change, recent renames, 90-day churn.
Opens your system mergetool.
Dashboard git-impact card: changed paths plus dependents and candidate tests.

Reports & themes

Export what you found to a location you pick, and read it in whichever theme suits you.

Markdown, JSON, or one standalone HTML file with no scripts, no external assets, no fonts and no images.
Scope a report to the project, a file or symbol, or a single finding type.
Four themes: TraceDeck Dark, Cursor Dark, VS Code Dark, VS Code Light.
Hovering a graph node does nothing, on purpose — highlighting is bound to click, to avoid a photosensitivity hazard from full-canvas flashing.

The report export view with a title field, format choices of Markdown, JSON and standalone HTML, scope options, and a checklist of sections.

Reports. Markdown, JSON or standalone HTML.

The settings view showing four theme previews, scan settings checkboxes, exclusion text areas, and a privacy panel.

Settings. Themes, scan scope, privacy.

CLI and CI

The same analysis, headless.

Run a scan in CI or from a script. Results go to <root>/.tracedeck/cli.sqlite, and --fail-on returns a non-zero exit code when a listed finding type matches.

SARIF output for CI integration.
Baseline support — ignore known fingerprints, or write a new baseline.
Change Review from the CLI, in text, JSON, Markdown or HTML.

Scan

npm run scan -- [path] [--full] \
  [--fail-on type,type] \
  [--format text|json|sarif] \
  [--baseline file] [--write-baseline]

Change Review

npm run scan -- [path] --review \
  [--review-format text|json|markdown|html] \
  [--review-output file] \
  [--review-traversal-depth 1-25]

Privacy and security

The analysis has nowhere to send your code.

This is not a policy promise. It is how the application is built.

Control	How it is enforced
Outbound network	The Electron session cancels every outbound request that is not a local file or the Vite dev server.
Content-Security-Policy	Restricts `connect-src`, `script-src` and `frame-src`.
Renderer capabilities	No Node.js, no filesystem, no database access. It can only call an explicit allowlist of IPC channels.
Electron hardening	`contextIsolation: true`, `nodeIntegration: false`, `sandbox: true`, `webviewTag: false`.
Telemetry	None. No analytics, crash reporting, update check, or sync.
Database location	The OS application-data directory — not inside your repository.
Source writes	Only on explicit save of a file you have unlocked.
Report writes	Only to a location you pick in a native save dialog.

This page follows the same stance: no tracking scripts, no analytics, no cookies, and no externally hosted fonts or assets.

Language support

Two parsers, one graph.

Parser	Extensions
TypeScript Compiler API	`.ts` `.tsx` `.mts` `.cts` `.js` `.jsx` `.mjs` `.cjs`, plus `<script>` in `.vue` `.svelte` `.astro`
tree-sitter	`.html` `.htm` `.css` `.scss` `.sass` `.less` `.py` `.go` `.rs`, plus Vue, Svelte and Astro template and style regions

Package-root rewrites for Go (go.mod), Python (pyproject.toml / setup.cfg) and Rust (Cargo.toml).

Honest limitations

What TraceDeck cannot tell you.

Static analysis only. It cannot find runtime errors, and it never runs your code.

No style analysis, beyond optionally formatting the open buffer with your project's Prettier. No language server, no IntelliSense, and no go-to-definition across a project.

Change-impact scores are a weighted sum over the dependency graph. They are not calibrated against incident data, and not a judgement about code quality.

Computed dynamic imports such as import(`./mods/${name}`) have no statically knowable target. Namespace imports consume a module's whole surface, so individual symbol usage is unknown.

Python, Go, Rust, HTML, CSS and Sass contribute import-like edges to the graph, but have no unused-export surface.

Call edges come from conservative extraction. This is not a points-to analysis or class hierarchy analysis.

Because the app makes no network requests, it cannot fetch a vulnerability database or rank findings against any external source.