PhantomCommit AI: Bringing Forgotten Code Back to Life with Open-Source AI

What I Built Code never truly dies. It just waits to be understood. 👻 Every developer has encountered a mysterious bug. Something worked a few weeks ago, but now it doesn't. You check the current code, read the documentation, and start debugging. Yet the answer might not be in the current code at all. It could be hiding in a commit from months ago. That thought inspired me to create PhantomCommit AI, an open-source Git history investigation platform powered by Google's Gemma models. I wanted to build something that could explore forgotten code, investigate suspicious changes, and help developers understand the history behind their software. The Problem I Wanted to Solve Git is excellent at recording changes, but understanding a complicated repository's history can be difficult. A function disappears. An old validation check is removed. A feature is rewritten. Weeks later, a regression appears, and nobody immediately knows which change deserves investigation. Traditional Git tools give us the commits and differences. I wanted to take that information further by connecting real historical evidence with AI-powered explanations and interactive visualizations. PhantomCommit AI is my attempt to make that process easier. How PhantomCommit AI Works The application connects to public GitHub repositories, retrieves real commit history, examines file changes, and helps developers investigate what happened. Instead of sending an entire repository to a language model and asking it to guess, PhantomCommit AI first collects and organizes relevant Git evidence. Its AI layer then explains the available changes and suggests what to investigate next. I built several interconnected features. 1. Code Graveyard - Explore Forgotten Code The Code Graveyard helps developers inspect removed files and code lines preserved in Git history. For each historical artifact, developers can examine the related commit and file changes. A deletion is treated as evidence of a change, not proof that a function has permanently disappeared. This distinction matters because code can also be moved, renamed, or replaced. 2. Ghost Replay - Travel Through Git History Ghost Replay provides a more visual way to explore previous code revisions. I integrated React Flow to visualize commit relationships and Monaco Editor to compare historical code snapshots. Instead of reading individual commit messages without context, developers can inspect how selected files changed between revisions. 3. Smart Code Recovery - Investigate Restoration One of the features I found most interesting to build was Smart Code Recovery. It allows developers to inspect a deleted implementation, compare it with a selected current revision, and generate a restoration patch when sufficient evidence is available. The patch is validated against the selected text before being offered for export. The application never automatically commits or applies recovered code. A developer still needs to review compatibility and test the proposed changes. 4. Code Impact Graph - Understand What Could Be Affected A code change rarely exists in isolation. PhantomCommit AI includes a static dependency graph for supported JavaScript and TypeScript code. It helps reveal relationships such as imports, function references, and component dependencies within the inspected scope. I wanted developers to have a clearer starting point when asking, "If this code changes, what else should I investigate?" 5. Security Regression Review - Look for Suspicious Changes The platform includes focused checks for changes involving authentication, authorization, validation, and other security-related logic. For example, removing a permission check may deserve investigation. However, I deliberately avoided treating every suspicious diff as a confirmed security vulnerability. The application produces review leads, which developers must validate. 6. Feature Evolution Timeline - Follow the Story This feature organizes inspected changes into a timeline showing additions, modifications, removals, and recorded file renames. It helps developers understand the historical development of a selected area of code. 7. AI Studio and AI Detective - The Intelligence Behind the Investigation This is where the open-weight AI comes in. I created an AI Studio containing 18 focused investigation tools, alongside a conversational AI Detective experience. Developers can ask questions such as: Why did this code change? Which inspected commits might explain a regression? What functionality was removed? Could this change introduce a security risk? What should I test before restoring the old implementation? Does the available Git evidence support an earlier AI conclusion? The AI analyzes selected Git evidence, produces explanations, and returns structured findings with references. Those references are checked against the retrieved commit data, making unsupported claims easier to identify. What I Learned My biggest lesson was that an AI explanation is not the same thing as evidence. During development, I had to think carefully about how to distinguish what Git actually proves from what an AI model merely suggests. For example, deleting a validation function does not automatically prove that an application is vulnerable. The validation may have moved elsewhere. I learned the importance of deterministic analysis, structured outputs, source verification, bounded context, and clear uncertainty. These lessons influenced the project's architecture much more than I originally expected. Demo Live application: PhantomCommit AI Source code: GitHub - PhantomCommit AI Application Preview The application includes a responsive interface with dark and light themes, repository investigation tools, visual history exploration, and dedicated AI features. AI Studio The intended investigation workflow is straightforward. Sign in to PhantomCommit AI. Connect GitHub and import a public repository. Select a branch and inspect its commit history. Use Code Graveyard or Ghost Replay to explore historical changes. Open AI Studio and choose an investigation tool. Select an available AI provider and approve source processing. Ask a question about the inspected code. Review the explanation and its supporting references. Save the investigation or export a Markdown report. The application uses real repository evidence rather than inserting fictional commit history into the runtime. Verification status: The current source has passed its GitHub Actions automated verification workflow, and the application has a deployed Render service. A complete live, authenticated GitHub-to-Gemma investigation still needs independent end-to-end confirmation. View automated verification Partner Technologies PhantomCommit AI brings together several technologies. Below is how I implemented them and what I learned from using them. Google Gemma - AI-Powered Code Investigation Gemma is the primary open-weight model family integrated into PhantomCommit AI. The application uses Google's official @google/genai SDK and supports the configured Gemma 4 26B and 31B models through hosted inference. The AI pipeline follows several steps. Step 1 - Retrieve evidence: The server retrieves selected commits, file changes, and patches from GitHub. Step 2 - Select relevant context: A deterministic ranking system identifies inspected commits relevant to the developer's question. The context is bounded to avoid unnecessarily large prompts. Step 3 - Request analysis: The application sends the selected evidence and investigation instructions to the configured AI provider. Step 4 - Validate the response: Zod checks the structured response, and source references are compared with retrieved commit SHAs, file paths, and available changed-line evidence. Step 5 - Display findings: The developer receives an explanation with source references and recommended next steps. I learned that structured output validation can help control how an AI system communicates its findings, but it cannot guarantee that every interpretation is correct. The project also includes Google model fallbacks for availability failures. The application records the actual model used rather than labeling every fallback response as Gemma. Paper Instruments Ultramarine - An Alternative AI Provider I integrated Ultramarine through the Paper Instruments Chat Completions API. Its implementation supports the same investigation-task structure as the Gemma route, including structured findings and evidence checking. A user can explicitly choose between the configured providers. This was useful from an architectural perspective because I wanted to avoid tightly coupling the application to one model service. The main lesson was that provider flexibility requires more than changing an API endpoint. Different model services need careful error handling, response validation, and consistent evidence standards. Render - Hosting the Web Application I used Render to deploy the full-stack Next.js application. The service hosts both the user interface and the server-side API. It is connected to the public GitHub repository's main branch for automated deployment. The deployment uses a Node.js runtime, while external services handle authentication, database storage, and AI inference. Working with Render helped me understand the operational side of deploying a full-stack AI application, particularly environment configuration, build verification, and service integration. Supabase - Authentication and Persistent Investigation Data Supabase provides PostgreSQL and user authentication. I used it to design storage for repository information, inspected commits, analysis runs, findings, investigation conversations, and reports. PostgreSQL row-level security policies enforce user ownership boundaries. I also added database tests to check that one authenticated user cannot read or modify another user's protected investigation records. This was especially important because saved code investigations should not be accessible to unrelated accounts. GitHub - The Source of Historical Evidence GitHub is the foundation of the investigation workflow. Using its REST API, PhantomCommit AI retrieves public repository metadata, branches, commits, file changes, and selected snapshots. The application preserves references back to source commits so developers can inspect the original evidence. I also implemented caching and rate-limit handling to reduce unnecessary requests and handle API restrictions more predictably. The Overall Architecture My main architectural goal was to keep the deterministic analysis separate from the AI interpretation. The pipeline follows this structure: GitHub REST API → Git Evidence Analysis → Context Selection → Gemma or Ultramarine → Structured Response Validation → Supabase → User Interface This separation makes the code easier to test and helps preserve useful functionality even when the AI provider is unavailable. What This Project Means to Me What I find most meaningful about PhantomCommit AI is the idea that software history contains useful knowledge that can easily be overlooked. Behind every removed function or forgotten implementation is a technical decision. Sometimes that decision was correct. Sometimes it deserves another look. By combining historical evidence with open-weight AI, I wanted to make those decisions easier to understand. This project also brought together several areas I enjoy exploring: cloud deployment, full-stack development, AI integration, database security, and developer tooling. There are still improvements I want to explore, including stronger semantic code tracking, broader history coverage, and more rigorous AI evaluation. But the core philosophy will remain unchanged. Don't trust an explanation just because it sounds convincing. Follow the evidence. That is the idea behind PhantomCommit AI. Code never truly dies. It just waits to be understood. 👻 Explore the project: Live App: https://phantomcommitai.onrender.com GitHub: https://github.com/Y-Udayanga/PhantomCommitAI Developer: Yasindu Udayanga I'd love to hear from other developers: Have you ever discovered that a difficult bug was caused by code removed several commits ago? How did you track it down?