A live map of your codebase

Push a privacy-scrubbed snapshot of your repository with one command. Ceven indexes it into a live graph — routes, modules, files, symbols, imports and call edges — that you can explore visually in a Library repository and chat with in plain English. Read-only, encrypted, and deletable at any time.

What Code Map is

Code Map turns a repository into a graph Ceven can reason over. The ceven-code CLI scans your repo locally, scrubs it (see what gets uploaded), and pushes the surviving text files. Ceven then indexes them: HTTP routes, modules, files and symbols become nodes; imports, mounts and calls become edges.

You get two surfaces. The map — an interactive canvas of your architecture at /app/libraries — and the chat: ask “where is auth handled?” or “what does POST /api/v1/users do?” and get answers grounded in your actual code, with file-and-line citations.

Code Map is available on paid plans. Re-pushing is incremental — only changed files are re-uploaded and re-indexed, and each push runs under a cost cap you control.

Quickstart

1. Create a Code project at work.ceven.io/libraries. The app shows the project’s push key (cck_…) exactly once — copy it.
2. In your repo, link the project (you’ll paste the key — it’s stored in ~/.ceven/code.json, never inside the repo):
bunx ceven-code init
3. Optional but recommended — see exactly what would be uploaded, without sending anything:
bunx ceven-code push --dry-run
4. Push. The CLI scans, scrubs, uploads, and prints your map URL; the map fills in live as indexing runs:
bunx ceven-code push

What gets uploaded — and what never does

Uploaded: the text source files that survive the filters below, compressed and content-addressed. Nothing else — no env files, no git history, no binaries. Every filter runs on your machine, before any network call.

Never uploaded

Everything matched by your .gitignore chain (same semantics as git) and by .cevenignore files — add one at the repo root to trim pushes without touching .gitignore.
Default excludes: .git, node_modules, dist, build, .next, target, vendor; binaries; files over 400 KB; lockfiles; minified files; media and fonts.
Env- and secret-like files by name: .env*, *.pem, *.key, *.p12, *.pfx, id_rsa*, *credentials*, *secrets*, .npmrc, .netrc.
Any file with a high-confidence secret hit (AWS keys, private-key blocks, GitHub/Slack/OpenAI/Google tokens, JWTs, api_key/secret/token/password assignments). These files are held back entirely — high-confidence secrets never leave your machine.

On top of that, entropy masking: any quoted string that merely looks like a credential (long, no spaces, high entropy) is replaced with «redacted» in the uploaded copy only, and counted in the push summary. Your files on disk are never modified.

Run bunx ceven-code push --dry-run anytime to print the full send / exclude / mask list with nothing sent.

Privacy & trust

Source code is the most sensitive thing you could hand us, so the guarantees are stated plainly:

Stored per project, encrypted at rest

Your source is encrypted server-side with a per-project key before it touches the database. It is only ever used to build your project's map and answer your questions about it.

Never shared across accounts

Blobs are stored per project — there is no global content store, no cross-tenant dedup, and no way for another account (or another of your projects) to read or even probe for your files.

Delete anytime — and it's really gone

Deleting a project purges the stored source promptly, and every remaining trace (the derived graph, file records, push history) is hard-deleted within 7 days. Nothing lingers.

The push key can only push

The cck_ project key is push-only by design: even if it leaks from a CI box, it cannot read source, graphs, or chat — it can only push code at us. Rotate it in the app at any time; the old key dies instantly.

Chat is read-only

The codebase chat can search the map, inspect nodes, and read stored file slices for the one project you opened. It cannot write, run, or modify anything — yours or anyone else's.

Takedown or abuse concern — e.g. someone pushed code they don’t have rights to? Email team@ceven.io and we’ll remove it.

CI usage

Keep the map fresh by pushing from CI. Put the push key in a CI secret (CEVEN_CODE_KEY) — remember it is push-only, so a leaked CI secret can never read your code back:

# e.g. GitHub Actions
- run: bunx ceven-code push --yes
  env:
    CEVEN_CODE_KEY: ${{ secrets.CEVEN_CODE_KEY }}

Without a TTY the confirm prompt defaults to yes; failures exit non-zero. Re-running a failed push is safe — uploads are content-addressed and resumable, so only the still-missing files are re-sent.

FAQ

Do I need a paid plan?

Yes — creating Code projects and pushing requires a paid Ceven plan. If your plan lapses, existing keys stop accepting pushes until you upgrade again.

Can the chat (or anyone) modify my code?

No. The chat is read-only by construction — its only capabilities are searching the map, inspecting nodes, and reading stored file slices for the one project you opened. Your repo on disk is never touched by anything but the CLI's local scan.

What if a secret slips past the filters?

High-confidence secrets hold their whole file back, and entropic strings are masked in the uploaded copy. If something still got through: rotate that credential, delete the project (stored source is purged promptly), and push again — the scrubbed re-push replaces the old snapshot.

How big can a push be?

2,000 files / 15 MB compressed per push. Over the cap, the CLI stops, lists the biggest offenders, and suggests .cevenignore patterns instead of silently truncating.

How do I stop pushing a directory without touching .gitignore?

Add a .cevenignore file (same syntax as .gitignore, applied on top of it) — useful for things you want in git but not in your code map, like generated docs or fixtures.

How is my source protected at rest?

Each project's files are encrypted with a per-project key derived from a server master secret, and stored per project — no shared or cross-account content store exists. Deleting the project purges the source promptly and everything derived from it within 7 days.

Map your codebase in two commands

Create a project, run the CLI, and watch the map draw itself — routes first, then modules, files and call paths.

Open Code