npx quack "my async fn returns undefined"

   __        quack.
 <(o )___    What exactly is undefined — the variable, the property,
  ( ._> /    or the thing you expected it to hold?
   `---'

The duck never answers your bug. It only asks the questions that make you find it.

That's the whole product. Rubber-duck debugging works because explaining a problem forces you to confront your assumptions — quack automates the duck, not the thinking. It is deliberately not an AI that solves your bug: no network, no API key, no account, no telemetry. Offline, instant, seedable.

Demo GIF (asciinema) goes here before launch.

Useful flags: --mode savage (see below), --json (machine-readable), --seed 42 (reproducible), --quiet (no duck, you monster), --help (in-character). The duck always exits 0 — it will never break your pipeline, only your confidence.

The quack-vscode extension puts a 🦆 in your status bar. It reads your selection and the actual errors under your cursor, and asks about those. Same engine, same questions, still no answers. (Marketplace + OpenVSX.)

The dataset is the product. Adding a question is a one-file PR to packages/data/packs/ — see CONTRIBUTING.md. CI enforces the one sacred rule: every entry must be a question. Advice is rejected by a linter, automatically, forever.

The engine is small on purpose: a documented contract (specs/001-rubber-duck-debugger/contracts/core-api.md), a seeded PRNG (mulberry32), and JSON packs. Reimplement it in anything.

One question before every commit:

cp scripts/hooks/prepare-commit-msg .git/hooks/ && chmod +x .git/hooks/prepare-commit-msg

Two actions, everything else is automated by .github/workflows/release.yml:

# 1. bump the version in packages/cli/package.json (and any libs that changed)
# 2. tag and push
git tag v0.1.0 && git push origin v0.1.0

The release workflow re-runs the full quality bar (build, types, lint, tests, and the dataset never-answers guardrail), verifies the tag matches the CLI version, publishes every public package whose version is new (pnpm -r publish skips already-published versions and the private extension), creates a GitHub Release with generated notes, and writes a per-package outcome summary. A safe rehearsal is one click: Actions → Release → Run workflow → dry-run: true.

Trust model: no npm token is stored anywhere in this repository. Publishing uses npm trusted publishing (OIDC) — register each package once on npmjs.com (package → Settings → Trusted Publisher → GitHub Actions → this repo + release.yml). Every published version carries a provenance attestation; verify with npm audit signatures. If your org cannot use OIDC, the fallback is an NPM_TOKEN repository secret plus NODE_AUTH_TOKEN on the publish step — still never a token in code.

⚠️ Before the first publish: the name quack is taken on npm. Available fallbacks checked 2026-06-12: quackd, rubberduck-cli (and @quack/* scope ownership must be confirmed). Update name in packages/cli/package.json and the repository.url/homepage placeholders (OWNER) in all three public manifests — provenance requires the repository URL to match the publishing repo.

pnpm install && pnpm build && pnpm test   # Node ≥ 18.17

Monorepo: packages/core (pure engine) · packages/data (question packs) · packages/cli · packages/vscode. One runtime dependency in the whole product (picocolors). MIT.

The name quack is a placeholder pending an npm availability check (fallbacks: quackd, ducksay, rubberduck-cli).