conar - Moses Yebei

The Problem

Developers need a single UI that can query PostgreSQL, MySQL, MSSQL or ClickHouse and get AI‑generated assistance, while keeping connection credentials encrypted. Maintaining separate tooling for each database and for prompt‑based query help creates friction and security risk.

What This Does

conar ships a desktop + web app built with React/TypeScript that talks to a backend (apps/api) exposing oRPC endpoints such as apps/api/orpc/routers/ai/* and apps/api/orpc/routers/connections/*. The UI layer lives under apps/app/src and renders components like components/connection-details.tsx and components/table/cell/*. Database schema handling is generated by the Drizzle ORM files in apps/app/src/drizzle/ and the connection‑specific query logic lives in apps/app/src/entities/connection/ (e.g., query.ts, generators/*). AI assistance is wired through the apps/api/orpc/routers/ai/* handlers, which call the OpenAI/Anthropic SDKs defined in apps/api/lib/*.

How It Is Wired

Execution starts in the API server entry point apps/api/index.ts, which loads environment variables from apps/api/.env.example (or the committed apps/api/.env.test) and registers the oRPC router tree (apps/api/orpc/index.ts). The router exposes createQuery (apps/app/src/entities/connection/query.ts) – this is the most fan‑in function, called from six places and reaching run → database client (client.query).

Key call chain: execute (in apps/app/src/entities/connection/dialects/clickhouse/index.ts:63) → connectionResourceToQueryParams → client.query({ query, format: 'JSONEachRow' }). This is the only path that writes/reads the DB detected by the analysis.

AI path: apps/api/orpc/routers/ai/generate-title.ts → createAnswer (used 14 times) → external LLM SDK (apps/api/lib/openai.ts not listed but implied).

State hubs: useSubscription (apps/app/src/entities/user/hooks/use-subscription.ts) is imported by 45 modules, making it a high‑blast‑radius module. The connection/query.ts module is a hub with 22 inbound imports and participates in an import cycle.

Import cycles: 38 files, e.g., apps/app/src/entities/connection/query.ts ↔ apps/app/src/routes/_protected/connection/$resourceId/table/index.tsx. These cycles increase cognitive load and risk accidental side‑effects when refactoring.

Deep nesting: Functions in cell-menu.tsx, cell-table.tsx, and connections-list.tsx reach eight levels of indentation, making them hard to follow.

No additional external call graph beyond the listed functions was resolved; many UI callbacks (framework‑provided) are not represented.

How To Use It

# clone the repo
git clone https://github.com/moses-y/conar
cd conar

# install dependencies (pnpm is the lockfile manager)
pnpm install

# start supporting services
pnpm run docker:start   # brings up PostgreSQL and Redis per README

# run database migrations
pnpm run drizzle:migrate

# launch all dev servers (Turbo monorepo)
pnpm run dev

Configuration files: copy the examples to real env files and fill in your keys.

cp apps/api/.env.example apps/api/.env
# edit apps/api/.env with your Stripe, Resend, OpenAI, etc. keys

The API server runs on the port defined in apps/api/.env.example; the desktop client (apps/desktop) and web client (apps/app) connect to it automatically.

Real‑World Use

A SaaS platform can embed the desktop client in an internal admin dashboard. An engineer runs pnpm run dev, opens the UI, adds a PostgreSQL connection (encrypted via the API), and asks the AI “Give me a query that returns the top 10 customers by revenue”. The request travels through apps/api/orpc/routers/ai/fix-sql.ts, hits the OpenAI SDK, receives a generated SQL string, and createQuery executes it against the live DB, returning results to the UI.

Code Health & Issues

Critical – Rotate credentials in apps/api/.env.test (contains live keys).
High – Pin GitHub Action versions to commit SHAs; remove committed .env.test; add a test step to CI; both are missing from the four workflows.
Medium – Declare least‑privilege GITHUB_TOKEN permissions; enable Dependabot; add a dependency‑vulnerability scan; add a pre‑commit secret gate; set persist-credentials: false on the checkout step; expand test coverage (currently 18 test files for ~590 source files).

All findings are from deterministic static analysis; no additional subjective issues are reported.

The Bottom Line

conar provides a functional, AI‑augmented UI for multi‑database querying, with a clear separation between API, UI, and dialect modules. However, the codebase suffers from import cycles, deep nesting, and several security/CI hygiene problems that should be addressed before production use. It is suitable for teams comfortable working in a monorepo of TypeScript/React and willing to remediate the identified health issues.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

817 files

TypeScript364
TSX247
JSON70
SQL30
YAML12
CSS8

ReactTransformers

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["apps<br/>432 modules"] g1["packages<br/>175 modules"] g2["scripts<br/>3 modules"] g0 -->|2| g1

Module dependencies

The 10 most depended-upon modules of 611, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_rc_entities_connection_query["query"] n1_ion__resourceId_table__store["-store"] n2_tion__resourceId_table_index["index"] n3_tion__resourceId_query_index["index"] n4_n__resourceId_table__columns["-columns"] n5_connection_utils_seeds_index["index"] n6__components_table_cell_utils["utils"] n7__connection_generators_utils["utils"] n8_nsformers_create_transformer["create-transformer"] n9__connection_generators_index["index"] n9__connection_generators_index --> n7__connection_generators_utils n8_nsformers_create_transformer --> n6__components_table_cell_utils n2_tion__resourceId_table_index --> n4_n__resourceId_table__columns n2_tion__resourceId_table_index --> n1_ion__resourceId_table__store classDef cyc stroke:#ef4444,stroke-width:2px; class n0_rc_entities_connection_query,n2_tion__resourceId_table_index,n3_tion__resourceId_query_index,n5_connection_utils_seeds_index,n8_nsformers_create_transformer,n9__connection_generators_index cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high3

medium6

low1

Rotate the credentials in the committed environment filecritical5 occurrences

apps/api/.env.test

STRIPE_SECRET_KEY, RESEND_API_KEY, OPENAI_API_KEY, EXA_API_KEY, CONTEXT7_API_KEY hold generated values

These values are loaded by the application at boot, so a generated value here is a working credential for something that runs.

Fix: Rotate each named credential, remove the file from the index, and replace it with a keys-only example.

Pin third-party GitHub Actions to a commit SHAhigh4 occurrences

.github/workflows

SethCohen/github-releases-to-discord@v1, pnpm/action-setup@v4, oven-sh/setup-bun@v1, pnpm/action-setup@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Remove the committed .env and rotate what it holdshigh3 occurrences

apps/api/.env.test

apps/api/.env.test, apps/app/.env.test, apps/proxy/.env.test

A tracked .env is the most common route for a working key to reach a public clone, and it is the file the app actually loads, so the value is usually live.

Fix: git rm --cached the file, add it to .gitignore, rotate every credential it names, commit a .env.example with empty values.

Make CI invoke the test suite it hashigh17 occurrences

.github/workflows

17 test files, no test command in the 4 workflows read

A green check that never executed an assertion is worse than no check, because reviewers trust it.

Fix: Add a test step to the existing workflow rather than a new workflow.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/github-releases-to-discord.yml

2 workflow(s) declare no permissions, 2 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

16 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Add a pre-commit secret gatemedium

a secret-shaped file is tracked and no repo-level gate is visible

Without a gate the same class of leak recurs on the next commit, so a leak finding is the symptom and this is the cause.

Fix: Add a pre-commit hook scanning staged content, and enable push protection.

Set persist-credentials: false on checkoutmedium

.github/workflows/publish-cli.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Expand the test suite; it cannot cover this codebasemedium18 occurrences

18 test files against 590 source files (ratio 0.031)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/github-releases-to-discord.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.