Zedbee
Install Swarm
Pre-commit quality for JavaScript and TypeScript teams

Protect the shared codebase. Not the old backlog.

Zedbee Swarm scans the exact change your team is committing, runs a managed suite of code-quality and security checks, and blocks only new or worsened issues. One dependable gate for local development, CI, and coding agents.

Install SwarmSee what it checks
npm install --save-dev zedbee
npx zedbee init
Real output · staged diff · one command
zsh — zedbee
~/Projects/TrillionDollarIdea/npx zedbee scan
Zedbee Swarm
Checks (2.5s)
  • Formattingfail
  • Lint1.8s
  • TypeScriptqueued
  • Cyclomatic complexityincomplete
  • Readability complexityincomplete
  • Structural security1.7s
  • Secretsqueued
Activity
Cyclomatic complexity: checking…
Readability complexity: checking…
Structural security: checking…
Formatting: 732 blocking findings
Cyclomatic complexity: incomplete
Readability complexity: incomplete
Summary
Illustrative staged-diff scan. Formatting fails, two complexity checks are incomplete, and other checks are passed or queued. This is a product demonstration, not a scan of your computer.

The commit is the contract.

Swarm checks what is staged, not whatever happens to be open in the editor. Broad checks. Narrow blame.

01 / Exact index
HEADa41f9c2
STAGED→ Swarm
TREEignored

It checks the commit you are actually making

Swarm reads the exact Git index. Partially staged files, later working-tree edits, and untracked configuration cannot change what gets judged.

02 / Attribution
Before
Staged

New problems get stopped. Old debt stays out of the way.

Project-wide checks can inspect all the context they need. Swarm then attributes findings back to the selected change, so developers are responsible for what they introduced or made worse.

03
fmtlinttypescomplexitysecuritysecretsdupesdepsdead codereacta11yvulns

One gate. A managed engineering suite.

Twelve categories of checks, managed together and invoked with one command.

04
.zedbeerc.jsoncvs
.eslintrc.cjs.prettierrctsconfig.lint.json

Consistent policy without configuration archaeology

Pinned analyzers and inert managed configuration. A bounded, inspectable policy instead of executable config hidden through the repo.

05
terminaljsonsarif 2.1.0

Built for humans, CI, and coding agents

Branded terminal locally, deterministic text or JSON for automation, SARIF for enterprise ingestion. Every format represents the same decision.

06
Pass0
Blocked1
Incompl.2

Unknown never masquerades as clean

When required analysis cannot complete, Swarm returns a distinct incomplete result. Your pipeline can tell “nothing found” from “never finished.”

New problems should block the commit. Old problems should not block the team.

Before the commit

Review the change before code review does

Swarm runs where the work happens: before the commit. Developers get an attributable result while the context is still fresh, reviewers get a cleaner proposed change, and the team spends less time rediscovering preventable issues in CI.

Catch the regression while the developer who introduced it is still looking at the code.

  1. 01Editor
  2. 02git add
  3. zedbee scanblocks only new or worse
  4. 04Commit
  5. 05Code review
Managed analyzers

A full toolchain without the toolchain drift

Swarm coordinates a deliberately bounded set of managed analyzers under one policy and one reporting contract. Inspect what is enabled, where it applies, which engine runs it, and what its limitations are.

npx zedbee checks
Formattingprettier · pinned
Linteslint · managed rules
Typestsc · project-wide
Complexitycyclomatic · readability
Zedbee Swarmone policy · one contract
Securitystructural · secrets
Duplicationtoken-level
Dependenciesarchitecture · vulns
React · a11ycorrectness · dead code
Containment

Inspection should not require surrendering the repository.

Repository content and analyzer output are treated as untrusted inputs. Swarm uses isolated snapshots, inert managed rules, bounded shell-free execution where supported, checksum-verified managed binaries, redacted secret handling, and explicit network disclosure.

Trust boundary
isolated snapshot
read-only
managed rules
inert
execution
shell-free
binaries
checksum-verified
secrets
redacted
network
disclosed
← untrusted reporesult →

Fixes stay reviewable

zedbee fix previews supported fixes, requests approval, and writes only to working files. It never stages or commits on the developer’s behalf.

  1. 01 Preview
    - const x = foo( a,b )
+ const x = foo(a, b);
  2. 02 Approve
    Apply 1 fix to src/util.ts?
[y]es / [n]o / [d]iff
  3. 03 Apply
    wrote src/util.ts
index unchanged
  4. 04 Review & stage
    $ git diff
$ git add src/util.ts

One standard, wherever the work runs.

Developers use Swarm interactively. CI consumes deterministic JSON or SARIF. Coding agents read stable finding IDs, locations, remediation, and attribution evidence. The interface changes for its audience. The engineering decision does not.

Developer terminal

✗ Formatting fail✓ Lint 1.8s! Complexity incomplete

The decision

BLOCKED 1

ZB-FMT-0012 · src/billing/usage.ts:42
introduced in staged change

CI · JSON / SARIF

{ "status": "blocked",
  "exit": 1,
  "findings": [1] }

Coding agent

id: ZB-FMT-0012
loc: usage.ts:42
fix: available
attribution: staged

AI can write the code. Your team still owns the standard.

Put a dependable gate in front of the next commit.

Adopt Zedbee with a guided setup that previews the recommended policy, network behavior, and exact repository changes before anything is written.

npm install --save-dev zedbee
npx zedbee init
Start with ZedbeeExplore the check suite
staged
commit