Coppice

Keep prompting. Coppice keeps the repo honest.

For vibe-coded projects (Cursor, VS Code, Copilot): one architecture, one library per job, no leftover files, no known-vulnerable package versions.

What it does

After Coppice: Scan Workspace (or on folder open / lockfile change) it:

1. Locks architecture — one UI kit, one time library, one HTTP client, one folder convention. No MUI + Chakra. No datetime + Pendulum + Arrow.
2. Stops duplicate features — if auth exists, do not add login/.
3. Prunes orphans — unused files and unused packages.
4. Checks CVEs at version level — axios@0.21.1 is flagged; a patched axios@1.7.2 is not. Bump the winner. Do not add a second library to “fix” it.
5. Talks to the next agent — writes COPPICE.md and .cursor/rules/coppice.mdc so the next prompt sees the contract.

Commands

• Coppice: Scan Workspace — scan the open folder and refresh the contract.

Output

Requirements

• VS Code 1.85+ or Cursor
• Node is used for the bundled MCP helper

Privacy

Scans run locally on your workspace. CVE checks query the public OSV API with package name + exact version only. Source code is not uploaded to Coppice servers (there are none).