Features

Everything here is in the build this site is serving. Where something is planned rather than present, it says so — and there is a list at the end of what the app deliberately cannot do.

Rubra Candela reads a folder on your machine, draws how it fits together, and answers questions about it using a language model running locally. No code is uploaded, and nothing works differently offline.

---

Seeing the shape of a project

The dependency graph

Every file and every import, drawn as a force-directed graph you can zoom, pan and search. Node size is lines of code. Node colour is complexity.

Selecting a file lights up everything it touches in both directions — what it imports, and what imports it. That second direction is the one that is hard to get any other way, and it is usually the one that matters before you change something.

Heatmaps

The same graph, recoloured to answer a different question: complexity, number of connections, file size, how recently a file changed, or language. Recency in particular tends to show where the work actually is, which is rarely where the documentation says it is.

What the analysis finds on its own

Without being asked anything:

• Circular dependencies, with the full chain named.
• Files nothing imports — dead code, or an entry point. It distinguishes the two by convention rather than guessing at intent.
• Complexity and size hotspots, scored and ranked.
• Impact: select a file and see the full blast radius of changing it.

Full-text search

Across every indexed file, with results linked back to the graph, so finding a string and seeing where it sits are the same action.

Git intelligence

Current branch, recent commits, uncommitted changes, which files change most often, and who touched them last. Churn is a better predictor of where bugs live than almost anything else, and it is sitting in your repository already.

Live activity

The folder is watched while it is open. Editing a file in your own editor updates the graph without a rescan.

---

Understanding it

Plain-language file explanations

What a file is for, what it is responsible for, how it connects, and what is risky about it. Written for someone who has not seen the codebase before.

Reasoned investigation

Ask an open question — where is authentication handled, what is unfinished, what would break if I changed this — and the engine answers by reading the actual code, listing the files it consulted as evidence.

Choosing what to read is most of the work. Query words are matched against whole words and their variants rather than character runs, so "investigations" finds investigate.ts and "read" does not match inside "thread". Answers also read the files around the ones that matched: a function is rarely wrong on its own, it is wrong about what its callers hand it.

Paths you can click

A file path in an answer opens that file in VS Code, at the line if one was given.

Paths that are marked instead

Small models occasionally cite a file that does not exist — confident, plausible and simply not there. Every path in an answer is checked against your project, and anything absent is marked in amber, not quietly deleted. The sentence around it is usually still a real point.

A path marked as invented is never clickable. An answer that cannot be trusted about whether a file exists should not also offer to open it.

Chat, and asking in plain language

Follow-up questions about a selected file. And a search box that takes "where is authentication?" and frames the matching files on the canvas.

Project brief

A written summary on open: purpose, architecture, health and risks, citing real paths.

---

Finding problems

Credentials committed into source

Keys pasted into a file get committed, pushed, and stay in history after the line is deleted. Rubra Candela finds them: provider tokens matched on their documented shapes — AWS, GitHub, Slack, Stripe, Google, SendGrid, Twilio, npm, private-key blocks, JSON web tokens — plus values that are both named like a secret and random enough to have been generated.

A finding never contains the credential. You get the first four characters, a length, and a file and line. Reporting the value in full would copy it into the answer cache, the activity feed, and anywhere the output was pasted.

Lockfiles, generated bundles, values shaped like module paths and placeholders such as your-api-key-here are ignored. One wrong flag teaches you to dismiss the feature.

This is not a vulnerability scanner. It finds credentials committed into source, and that is all it claims.

---

Changing it

Edit and save

Files can be edited in the Code tab. Editing is explicit: you start it, the tab marks itself unsaved, and nothing reaches disk until you save.

Two guarantees worth naming:

• Concurrent-edit protection. A save carries the hash the file had when you opened it. If it changed underneath — another editor, a branch switch, a colleague — the save is refused and you choose between reloading and overwriting. It is never decided for you.
• Atomic writes. The file is replaced in one step, so an interrupted save cannot leave you with half a file.

Changes the engine proposes

Describe a change and the engine returns a revised file. You read the difference before anything happens.

Nothing on this path writes. Accepting a proposal puts the text in the editor, still unsaved, and the file is written by the save you press yourself — through the same checks as anything you typed by hand. Every proposal is also checked for what it removed, and exports that disappeared are called out, because a local model will confidently delete something it was not asked to touch.

The review step is the feature, not a formality.

Commit from the app

Stage files and commit without leaving.

---

The engine

It runs on your machine through Ollama. Questions and answers are cached locally and never transmitted.

Five tiers

The app measures your machine and picks one. Any of the others can be downloaded and switched to in Settings — including one measured as too large for your hardware, which is labelled slow here rather than blocked. That measurement is a heuristic about available memory, and someone willing to wait longer for a better answer is entitled to that trade.

All five come from one model family, deliberately. Mixing families would mean the same question answered with different habits depending on which tier happened to be installed.

It tells you what a question cost

Elapsed time while it thinks; tokens read and written, and the speed it managed, when the answer lands. A local model is slow enough that the difference between working and stuck matters.

---

Languages

Every file appears on the graph and can be read and explained. Imports are traced for these, which is what produces connections, cycles, dead-code detection and impact analysis:

Each traced language resolves imports its own way, because they do not agree. A Go import names a package — a directory — so it connects to every file in it. A C# using follows the namespace a file declares rather than the folder it sits in, because those are only conventionally related. Where a language is genuinely ambiguous about what an import points at, nothing is drawn: a missing connection is a gap, an invented one is a lie you would act on.

---

What it will not touch

Files whose purpose is holding credentials — .env, private keys, .npmrc, .netrc, keystores, credentials.json and similar — are excluded from the scan entirely. They never become nodes, never enter the index, and cannot be opened through the app's own interface.

Tested rather than assumed: a folder containing id_rsa, .env, credentials.json, a private key, .npmrc and .netrc was opened as a project, and exactly one file was read — the ordinary source file sitting beside them.

---

Privacy

Analysis needs no account. Signing up sends your name, email address and country once, and nothing after that. Passwords are hashed on your machine and never leave it.

The privacy policy enumerates every network connection the application makes. There are four, and three of them are optional.

---

What it cannot do

An honest list, because finding out after installing is worse.

• Windows only. It is built to run on macOS and Linux; signed and notarised builds are not ready.
• Unsigned. Windows SmartScreen will report an unknown publisher. The installer is safe to run and you can verify it against the SHA-256 published on the download page, but the warning is real and stays until there is a code-signing certificate.
• Ollama is a separate install. Bundling it would triple the download and conflict with any copy you already have. The app offers a one-click download when it is missing.
• C, C++, PHP, Ruby and Swift appear on the graph but their imports are not traced yet.
• Local folders only. No remote repositories, no team features, no plugin API.
• It is early. Version 0.2.5.