BubbleLab - Moses Yebei

The Problem A developer entering this repo faces a deeply interconnected core package (packages/bubble-core) with 646 internal modules and 1176 import edges, 22 of which participate in circular dependencies. Changes to oversized files like ai-agent.ts (1830 lines) or the execution store ripple widely due to high instability scores (up to 0.91) and hub-module churn (67 dependents on a single types file). The platform’s value—exportable TypeScript workflows—is undercut by the cognitive load required to navigate and modify the codebase.

What This Does BubbleLab is a Typescript-native workflow automation platform comprising four self-contained projects: packages/ (396 code files, 14 data files), apps/ (349 code files, 44 data files), tools/ (6 code files), and scripts/ (3 code files). It compiles natural-language prompts into production-ready TypeScript workflows using a composable bubble system, provides full execution tracing with token/cost tracking, and supports import from n8n-style platforms and instant TypeScript/API export. The UI runs on React + Tailwind via Vite; the API server is a Node/Bun service with Docker deployment.

How It Is Wired Execution starts at apps/bubble-studio/index.html and apps/bubble-studio/src/routes/index.tsx. The API entry is apps/bubblelab-api/src/index.ts, which mounts a DB schema at apps/bubblelab-api/src/db/index (Ca 31, Ce 3, instability 0.09). Core control flows through packages/bubble-core/src/index (Ca 8, Ce 79, instability 0.91), a hub receiving imports from 67 modules including packages/bubble-core/src/types/bubble (Ca 67, Ce 1, instability 0.01). Circular imports affect 22 modules across bubble-factory.ts, ai-agent.ts, and schemas/index.ts, requiring care when extending the bubble system. The import graph was fully resolved across 650 code files; no architecture beyond these measured edges has been mapped.

How To Use It Setup is defined by the repo’s dependency files. Install with:

pnpm install

Start the development environment with:

pnpm run dev

Open http://localhost:3000. To generate workflows with the AI assistant (Pearl), set GOOGLE_API_KEY and OPENROUTER_API_KEY in apps/bubble-studio/.env.example; the default models are gemini-3.0-pro for generation and morph-v3 for editing. Scaffold a new project with:

npx create-bubblelab-app

No evidence was found for automated CI setup beyond the provided GitHub Actions workflows; a dependabot.yml or equivalent is absent and would need addition for dependency updates.

Real-World Use A developer can clone the repo, install dependencies, and invoke the studio at localhost:3000 to build a flow visually. Using the reddit-scraper template as reference, the resulting workflow file (reddit-news-flow.ts) comprises roughly 50 lines of clean TypeScript that defines nodes, edges, and transformation logic. The exported code runs independently of the studio, can be checked into version control, and integrated into existing CI/CD pipelines. Token usage and execution traces are available in the built-in observability panel.

Code Health & Issues

HIGH – Pin third-party GitHub Actions to commit SHAs: .github/workflows uses oven-sh/setup-bun@v2, pnpm/action-setup@v4; tags can move, risking unpredictable execution with secrets.
HIGH – Replace wildcard CORS origin: apps/bubblelab-api/src/index.ts uses cors() with *; paired with credentials this allows any site to make authenticated requests.
MEDIUM – Enable Dependabot or Renovate: 15 manifests have no update bot configured; unpatched advisories risk accumulation.
MEDIUM – Pin container base image by digest: Dockerfile.api uses node:20-slim, oven/bun:1.1.38-debian without digest; mutable tags change the CVE surface unseen.
MEDIUM – Gate pull requests on dependency vulnerability scan: no dependency-review-action or osv-scanner detected in CI.
MEDIUM – Move large binaries to Git LFS: editing-flow.gif (13.8MB), running-flow.gif (13.1MB) are stored in the repo, inflating clone size and CI checkout cost.
MEDIUM – Set persist-credentials: false on checkout: .github/workflows/ci.yml keeps the token for all later steps.
MEDIUM – Add non-root USER to Docker image: Dockerfile.api has no USER directive; processes run as root.
LOW – Set timeout-minutes on workflow jobs: one CI job declares no timeout, risking overlap on the two-hourly schedule.

All findings above derive from static analysis of the repository’s structure, import graph, and CI configuration. No additional issues are invented here.

The Bottom Line BubbleLab offers a rare combination of full observability and code exportability for TypeScript workflow automation, with a clean visual editor and exportable logic that avoids proprietary lock-in. The main trade-off is a steep navigation cost: the core package’s circular imports, outsized files, and absent dependency automation mean new contributors need time to map dependencies before making safe changes. It’s well-suited for teams that value type safety and exportable code over out-of-the-box CI polish, and who can invest in mapping the measured import graph before heavy modification.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,017 files

TypeScript616
TSX86
JSON70
SQL36
Markdown28
JavaScript14

ReactTailwindDocker

Module dependencies

The 10 most depended-upon modules of 646, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_bubble_core_src_types_bubble["bubble"] n1_s_bubblelab_api_src_db_index["index"] n2_c_types_service_bubble_class["service-bubble-class"] n3__src_types_tool_bubble_class["tool-bubble-class"] n4__bubblelab_api_src_db_schema["schema"] n5_bble_core_src_bubble_factory["bubble-factory"] n6_bubblelab_api_src_config_env["env"] n7_bles_service_bubble_ai_agent["ai-agent"] n8_apps_bubble_studio_src_env["env"] n9_blelab_api_src_schemas_index["index"] n1_s_bubblelab_api_src_db_index --> n4__bubblelab_api_src_db_schema n5_bble_core_src_bubble_factory --> n0_bubble_core_src_types_bubble n5_bble_core_src_bubble_factory --> n3__src_types_tool_bubble_class n7_bles_service_bubble_ai_agent --> n2_c_types_service_bubble_class n7_bles_service_bubble_ai_agent --> n0_bubble_core_src_types_bubble n7_bles_service_bubble_ai_agent --> n5_bble_core_src_bubble_factory classDef cyc stroke:#ef4444,stroke-width:2px; class n5_bble_core_src_bubble_factory,n7_bles_service_bubble_ai_agent,n9_blelab_api_src_schemas_index cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium6

low1

Pin third-party GitHub Actions to a commit SHAhigh2 occurrences

.github/workflows

oven-sh/setup-bun@v2, pnpm/action-setup@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Replace the wildcard CORS origin with an explicit allow listhigh

apps/bubblelab-api/src/index.ts

cors()

Any page on the internet can call the API with the browser's cookies attached, so a logged-in visitor to an unrelated site performs authenticated requests without knowing, and the wildcard combined with credentials is the exact configuration browsers refuse for that reason.

Fix: List the origins the API actually serves, and never pair a wildcard with credentials.

Enable Dependabot or Renovatemedium

15 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

Dockerfile.api

node:20-slim, oven/bun:1.1.38-debian

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium2 occurrences

showcase/editing-flow.gif

2 blobs over 5MB: editing-flow.gif 13.8MB, running-flow.gif 13.1MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/ci.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

Dockerfile.api

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow

.github/workflows/ci.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.