The Problem

Cabinet addresses the friction of managing a knowledge base and AI agents as separate, siloed tools. It positions itself as an "AI-first startup OS" where all data lives as markdown files on disk—no database, no vendor lock-in. The core pain point is the disconnect between where knowledge is stored and where AI agents operate, forcing teams to maintain multiple systems and duplicate context.

What This Does

Cabinet is a collection of five self-contained projects, not a single codebase. The main src/ directory (753 files) is a Next.js/React application with an AI agent framework, task board, markdown editor, and onboarding tour. Supporting projects include cabinetai/ (a CLI for install/update/uninstall), server/ (a daemon with search indexing), and mcps/ (Discord and Telegram integrations).

The system's philosophy is filesystem-first: src/lib/storage/fs-operations.ts handles file read/write, src/lib/agents/ manages agent conversations with persistent state, and src/components/tasks/board/ provides a kanban-style task interface. The README shows setup via npx create-cabinet@latest followed by npm run dev:all.

How It Is Wired

Execution starts from three primary entry points. The CLI's run function in cabinetai/src/lib/process.ts bootstraps the app, reaching 5 functions. The MCP Discord server's main in mcps/mcp-discord/src/index.ts starts a bot. The API route src/app/api/agents/conversations/[id]/events/route.ts handles streaming agent events.

The most-connected modules reveal the architecture's spine. src/lib/agents/provider-cli.ts is a hub with 21 inbound dependencies—changing it ripples widely. src/lib/agents/adapters/types.ts and src/lib/storage/path-utils.ts are stable leaf modules (20 dependents, 0 dependencies). Three modules form an import cycle: conversation-runner.ts, conversation-store.ts, and persona-manager.ts—all in the agent execution path.

The call graph shows cn (a class-name utility) called from 113 places and useLocale from 85. File operations are pervasive: fileExists (26 callers), normalizeCabinetPath (22). Traced paths reach the filesystem directly—execute -> ensureSessionFile writes via fs.writeFileSync, start -> send -> enqueue appends via fs.appendFileSync. Only 2 functions make outbound network calls; 1 calls a model for inference.

How To Use It

Setup: Clone and install dependencies. The README documents:

npx create-cabinet@latest
cd cabinet
npm run dev:all

The CLI downloads the app to ~/.cabinet/app/v{version}/ on first run.

Configuration: .env.example exists at root. The cabinetai/ package has its own config for version management. Runtime configuration lives in src/lib/runtime/runtime-config.ts.

Running: Open http://localhost:4000 after npm run dev:all. The onboarding wizard builds a custom AI team in five questions. Update via npx cabinetai update; the CLI compares against cabinet-release.json from GitHub Releases.

Real-World Use

A startup uses Cabinet as its operating system: markdown files in a my-startup/ directory serve as the knowledge base. The CEO agent (configured via src/lib/agents/) reads project goals from goal-manager.ts, executes tasks through conversation-runner.ts, and the task board (src/components/tasks/board/) tracks progress. Discord integration via mcps/mcp-discord/ lets the team interact with agents from chat. Everything persists as plain files—portable and version-controllable.

Code Health & Issues

Static analysis found 176 issues (29 high, 147 medium) across 6 kinds. High severity: 6 import cycles in the agent conversation modules (conversation-runner.ts, conversation-store.ts, persona-manager.ts) and 4 oversized files—conversation-store.ts at 2119 code lines. Deep nesting affects 39 files; 273 files contain duplicated 6-line blocks. Five hub modules carry high blast radius (provider-cli.ts with 21 dependents).

The SDLC audit found:

  • High - Unpinned GitHub Actions (softprops/action-gh-release@v2) in .github/workflows—tags can be moved, leaking secrets
  • High - Discarded exit codes in electron-release.yml line 64—jobs report green on failure
  • Medium - No Dependabot/Renovate across 5 manifests
  • Medium - No dependency vulnerability scan in CI
  • Medium - persist-credentials: false not set on checkout in electron-release.yml
  • Medium - postinstall lifecycle script in package.json—an install-script attack vector
  • Low - No timeout-minutes on workflow jobs
  • Low - Missing .editorconfig, .gitattributes, formatter config

Tests exist (58 files) and CI is configured, but the import cycles and oversized modules make the agent layer the riskiest to modify.

The Bottom Line

Cabinet is a genuinely ambitious project—a filesystem-first AI OS with a working CLI, agent framework, and integrations. The architecture is sound at the edges but the agent core has real maintainability debt (cycles, 2000+ line files). It's suitable for a team that wants full control over their AI workspace and accepts the complexity of a young codebase. The lack of Docker support and the unpatched dependency gaps mean production deployment requires careful hardening.