Siftly - Moses Yebei

The Problem

Twitter/X bookmarks accumulate faster than they can be organized. The built-in bookmarking feature offers no search, no categorization, and no way to surface older saves. Siftly solves this by turning bookmarks into a searchable, locally-hosted knowledge base with AI-powered organization.

What This Does

Siftly is a self-hosted Next.js application that imports Twitter/X bookmarks (via bookmarklet, console script, or OAuth), then runs a 4-stage AI pipeline: entity extraction, vision analysis on images, semantic tagging, and categorization. The result is a searchable interface with AI-powered search (app/ai-search/page.tsx), an interactive mindmap (components/mindmap/), and export tools (lib/obsidian-exporter.ts, lib/exporter.ts).

The core logic lives in lib/ (AI client abstraction, parsers, vision analyzer) and app/api/ (REST routes for bookmarks, categories, import, search). The CLI tool cli/siftly.ts provides a command-line interface. The stack is TypeScript/React/Next.js with Prisma/SQLite for storage and Docker for containerized deployment.

How It Is Wired

The entry point is main in cli/siftly.ts:273, which reaches 12 functions. The shortest traced path from entry to external effect is main -> cmdSearch which hits the database via prisma.bookmark.findMany. The API routes follow a similar pattern: POST handlers in routes like app/api/categorize/route.ts call getProvider and setState before writing to the database.

The highest fan-in functions are getProvider (called from 10 places), getActiveModel (8 places), and getCliAvailability (7 places) — all in lib/settings.ts and lib/ai-client.ts. Changes to these ripple across the entire app. The app/api/analyze/images/route.ts is the most connected route: it defines 3 functions, calls into 27 others, and performs database reads, cryptographic operations, and model inference.

The module graph shows no circular dependencies, but components/mindmap/mindmap-canvas has high instability (imports 5 modules, nothing imports it), making it a leaf that's easy to change but hard to test in isolation.

How To Use It

Setup:

git clone https://github.com/moses-y/Siftly
cd Siftly
npm install
npx prisma generate
npx prisma migrate dev --name init
npx next dev

Configuration: Copy .env.example to .env.local and set ANTHROPIC_API_KEY if not using Claude Code CLI. The app auto-detects auth: Claude Code CLI session (zero config), API key in Settings, or ANTHROPIC_BASE_URL for a proxy.

Running: npm run dev starts the dev server at http://localhost:3000. Docker users can use docker/docker-compose.yml. The CLI entry point is cli/siftly.ts.

Real-World Use

A researcher with 5,000+ bookmarks on AI tools imports them via the bookmarklet, runs the pipeline, then searches "meme about crypto crash" to find a specific post. The mindmap shows related bookmarks by category, and the Obsidian exporter (lib/obsidian-exporter.ts) pushes notes into their vault. All data stays local except AI API calls.

Code Health & Issues

Static analysis (measured, not opinion) found 27 findings: 4 high, 23 medium.

High - Duplicated code blocks — 209 repeated 6-line blocks across 24 files (e.g., app/api/bookmarks/route.ts, cli/siftly.ts). Extract shared helpers.
High - Deep nesting — 5 files with max indentation depth 8 (e.g., app/categories/page.tsx). Flatten with early returns.
High - Oversized files — app/import/page.tsx at 1,258 lines, plus app/settings/page.tsx and components/bookmark-card.tsx. Split by responsibility.
Medium - Empty catch blocks — app/import/page.tsx, app/layout.tsx silently discard errors.
Medium - High branching density — 43 branch points over 135 lines in lib/claude-cli-auth.ts.

SDLC observations from the structure: CI exists but never runs the 4 test files (ratio 0.049 tests-to-source), GitHub Actions aren't pinned to commit SHAs, no dependency vulnerability scan, and the Docker base image (node:22-alpine) isn't pinned by digest.

The Bottom Line

Siftly is a functional, feature-rich bookmark manager with a solid AI pipeline and clean architecture at the module level. The main weaknesses are code duplication, oversized files, and CI that doesn't actually test the code. It's a good fit for technical users who want local control over their bookmarks and are comfortable with AI API costs or already have Claude Code CLI.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

116 files

TypeScript58
TSX22
Markdown9
Shell3
JSON3
YAML2

ReactNext.jsDocker

Module dependencies

The 10 most depended-upon modules of 82, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_ents_mindmap_mindmap_context["mindmap-context"] n1_omponents_mindmap_tweet_node["tweet-node"] n2_lib_claude_cli_auth["claude-cli-auth"] n3_onents_mindmap_category_node["category-node"] n4_omponents_mindmap_chain_edge["chain-edge"] n5_components_mindmap_root_node["root-node"] n6_components_theme_toggle["theme-toggle"] n7_lib_claude_cli["claude-cli"] n8_lib_minimax_auth["minimax-auth"] n9_lib_openai_auth["openai-auth"] n1_omponents_mindmap_tweet_node --> n0_ents_mindmap_mindmap_context n2_lib_claude_cli_auth --> n7_lib_claude_cli

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium4

low2

Pin third-party GitHub Actions to a commit SHAhigh5 occurrences

.github/workflows

docker/setup-qemu-action@v3, docker/setup-buildx-action@v3, docker/login-action@v3, docker/metadata-action@v5

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Make CI invoke the test suite it hashigh4 occurrences

.github/workflows

4 test files, no test command in any workflow

A green check that never executed an assertion is worse than no check, because reviewers trust it.

Fix: Add a test step to the existing workflow rather than a new workflow.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

docker/Dockerfile

node:22-alpine, node:22-alpine

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Expand the test suite; it cannot cover this codebasemedium4 occurrences

4 test files against 82 source files (ratio 0.049)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow

.github/workflows/docker-ghcr.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.