Code Polishy

One policy for all your repos. Deterministic constraints agents can't ignore.

Code Polishy gives every coding agent the same definition of done and enforces it before code merges.

Current built-in support includes Go, JavaScript, TypeScript, Python, and shell scripts.

What it does

Code Polishy keeps today's agent code from becoming tomorrow's cleanup.

• Stops agents from tangling parts of your codebase together.
• Flags giant files and hard-to-follow functions before they become expensive to change.
• Makes "done" include the tests, builds, and project checks your repo requires.
• Protects your software supply chain from surprise dependency changes and known vulnerabilities.

Agents catch problems while the change is still fresh, and one final gate stops unresolved issues before merge.

How it works

Set it up

Setup starts with one prompt to a coding agent:

Set up Code Polishy in this repository. Follow
https://github.com/riteofstring/code-polishy.

Each repo keeps its current Code Polishy version until you choose to upgrade. A new setup uses the latest stable version tag. Ask for a tag such as v1.2.3 when you need a specific version.

Git is required. Allow about 1 GB of disk space. Windows x64 works without WSL or Git Bash.

See the agent setup guide or the manual setup guide for the full process.

How agents use it

A coding agent runs these commands as it works:

# Check the code you changed
code-polishy test --changed

# Review dependency risk before accepting an update
code-polishy dependency-review --base origin/main

# Enforce the policy before merge
code-polishy merge-gate --base origin/main

The merge gate chooses how much validation the change needs. Fix any finding, rerun the narrowest useful check, and run the gate again when the final code is ready.

Languages

Code Polishy keeps its built-in tools fixed until you upgrade, so local and CI checks stay consistent.

• Go, JavaScript, TypeScript, and Python: Formats code and catches likely bugs, type errors, unused code, and overly complex functions. Locked dependencies are checked for known vulnerabilities.
• Shell scripts: Catches syntax errors and common safety problems.

Code Polishy also rejects empty Go tests and obvious test commands that can pass without running tests. Optional mutation testing can provide deeper proof.

Other languages can connect repo-owned checks. Code Polishy runs and enforces them but does not supply their tools.

What stays in your repo

Three checked-in files keep every agent aligned:

• .code-polishy.lock.json keeps the policy and tools stable until you choose to upgrade.
• .code-polishy.json describes your code boundaries, tests, commands, and exceptions once.
• AGENTS.md gives every coding agent the same operating instructions.

Your prompts can stay focused on what you want built.

More

• All docs
• Agent workflows
• Architecture rules
• Test rules
• Dependency rules

Apache-2.0 licensed. See LICENSE.