chili3d - Moses Yebei

The Problem

Designers need a browser‑based CAD tool that runs without installing heavy native binaries. Existing web CAD solutions either require server‑side rendering or expose a limited set of primitives, forcing users to switch to desktop applications for anything beyond basic sketches.

What This Does

chili3d delivers a full‑featured 3D CAD UI that runs entirely in the browser. Core geometry is powered by OpenCascade compiled to WebAssembly (packages/wasm/lib/chili-wasm.d.ts), while rendering and interaction use Three.js (packages/three/src/threeView.ts).

The TypeScript monorepo is split into logical packages:

packages/app – command definitions, UI bodies, and the top‑level command dispatcher.
packages/core – foundational services (observer, pub/sub, math, i18n) and the document model.
packages/builder – utilities for assembling the final bundle.

Key UI commands (e.g., packages/app/src/commands/create/box.ts, .../boolean.ts) map directly to the underlying shape primitives in packages/core/src/shape.

How It Is Wired

Execution begins in the CLI‑style command execute defined in packages/app/src/commands/application/newDocument.ts (line 14). That function instantiates a fresh document (packages/core/src/document.ts) and walks 290 internal functions, establishing the initial model graph.

The most frequently traversed backbone is the foundation hub:

packages/core/src/foundation/observer.ts – defines getPrivateValue, setPrivateValue, initializeDefaultValue. Called from 58 files, it propagates state changes to the UI.
packages/core/src/foundation/pubsub.ts – implements pub, sub, dispose. Reached by 50 files and used by the undo/redo stack.

A dense import cycle surrounds the core index modules (packages/core/src/foundation/index.ts, packages/core/src/math/index.ts, packages/core/src/document.ts). The cycle inflates the blast radius: any change to a shared type forces recompilation of >50 dependents and risks hidden runtime order bugs.

The call graph shows a few high‑impact functions:

getPrivateValue – called from 99 locations, central to every model mutation.
setProperty – 83 callers, used by UI bindings and command handlers.
gc – 54 callers, part of the custom memory manager for WebAssembly objects.

File‑level responsibilities that dominate runtime:

Observer (observer.ts) – state change detection, used by UI components and command services.
Pub/Sub (pubsub.ts) – event distribution for undo/redo, selection, and viewport updates.
Matrix4 (matrix4.ts) – geometric transforms, accessed by 41 files for every move/rotate operation.

No external I/O beyond two filesystem writes: execute → commit → delete (via this.open) and a read in get (also via this.open). No network calls are present in the static analysis.

How To Use It

# Clone the exact repo
git clone https://github.com/moses-y/chili3d
cd chili3d

# Install Node dependencies (lockfile present)
npm ci

# Build the WebAssembly module
npm run setup:wasm   # installs emscripten toolchain if needed
npm run build:wasm

# Start development server
npm run dev          # serves at http://localhost:8080

The Dockerfile (Dockerfile) can be used for production builds:

docker build -t chili3d .
docker run -p 8080:80 chili3d

No additional environment variables are required; configuration lives in packages/core/src/config.ts.

Real‑World Use

A manufacturing portal can embed the app by loading index.html from cpp/test/. The portal creates a new document via the exposed execute entry, runs a series of create commands (create/box.ts, create/boolean.ts) to generate a part, then calls saveDocument to export a STEP file. All steps run client‑side, eliminating server‑side CAD licensing.

Code Health & Issues

MEDIUM – GITHUB_TOKEN permissions not limited (.github/workflows/main.yml).
MEDIUM – No Dependabot/Renovate configured (14 manifest files).
MEDIUM – CI runs npm install instead of npm ci.
MEDIUM – Docker base images are unpinned (node:alpine, nginx:alpine).
MEDIUM – No dependency‑vulnerability scan in CI.
MEDIUM – Large binary (packages/wasm/lib/chili-wasm.wasm, 15 MB) stored in Git.
MEDIUM – Checkout step keeps credentials (persist-credentials default).
LOW – No job timeout set in workflow.
LOW – Missing convention files (.editorconfig, formatter config).

Static analysis also reported 45 import‑cycle members and 12 hub modules (e.g., packages/core/src/foundation/index.ts). These increase maintenance cost: any change to a hub may trigger widespread recompilation and risk subtle circular‑dependency bugs.

The Bottom Line

chili3d provides a functional, browser‑only CAD stack with a solid TypeScript foundation and WebAssembly‑accelerated geometry. It is suitable for teams that need an extensible web CAD surface and are comfortable managing import cycles and the current lack of automated security tooling. Expect to allocate effort to refactor core hubs and introduce CI hardening before using it in a production pipeline.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

567 files

TypeScript446
CSS40
JSON32
C++9
JavaScript7
Markdown5

ReactDocker

Module dependencies

The 10 most depended-upon modules of 459, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_es_core_src_foundation_index["index"] n1_packages_core_src_index["index"] n2_packages_core_src_math_index["index"] n3_packages_core_src_document["document"] n4_ackages_core_src_shape_index["index"] n5_packages_core_src_i18n_index["index"] n6_ges_core_src_serialize_index["index"] n7_rc_commands_multistepCommand["multistepCommand"] n8_ckages_core_src_visual_index["index"] n9_p_src_commands_createCommand["createCommand"] n9_p_src_commands_createCommand --> n7_rc_commands_multistepCommand n3_packages_core_src_document --> n0_es_core_src_foundation_index n3_packages_core_src_document --> n6_ges_core_src_serialize_index n3_packages_core_src_document --> n8_ckages_core_src_visual_index n1_packages_core_src_index --> n3_packages_core_src_document n1_packages_core_src_index --> n0_es_core_src_foundation_index n1_packages_core_src_index --> n5_packages_core_src_i18n_index n1_packages_core_src_index --> n2_packages_core_src_math_index n1_packages_core_src_index --> n6_ges_core_src_serialize_index n1_packages_core_src_index --> n4_ackages_core_src_shape_index n1_packages_core_src_index --> n8_ckages_core_src_visual_index classDef cyc stroke:#ef4444,stroke-width:2px; class n0_es_core_src_foundation_index,n2_packages_core_src_math_index,n3_packages_core_src_document,n4_ackages_core_src_shape_index,n6_ges_core_src_serialize_index,n8_ckages_core_src_visual_index cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

medium7

low2

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/main.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

14 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Install from the lockfile in CImedium

.github/workflows

npm install with a committed package-lock.json

A fresh resolution in CI means the tested dependency set is not the locked one, so the failure only appears after merge.

Fix: Use npm ci, yarn install --immutable, or pnpm install --frozen-lockfile.

Pin the container base image by digestmedium2 occurrences

Dockerfile

node:alpine, nginx:alpine

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium2 occurrences

packages/wasm/lib/chili-wasm.wasm

2 blobs over 5MB: chili-wasm.wasm 15.1MB, fzhei.json 9.3MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/main.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow

.github/workflows/main.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.