dexter - Moses Yebei

The Problem

Dexter is an autonomous agent designed for deep financial research, automating task planning, tool execution, and self-validation using live market data. For a technical client, the primary pain point is the architectural fragility inherent in a codebase of this size (86 modules, 190 import edges) where circular dependencies and duplicated logic create significant risk and friction during maintenance or extension.

What This Does

Dexter functions as a research orchestration layer. It decomposes complex financial queries into structured steps, executes tools (browser, financial data APIs, web search), and synthesizes answers via an LLM loop. The core execution flow originates at src/cli.tsx:25 and is driven by src/agent/agent.ts:59, which reaches 39 internal functions. Model interaction is handled by src/model/llm.ts, which defines getChatModel and withRetry. The agent relies on a tool registry managed by src/tools/registry.ts. Execution paths touch the filesystem during evaluation runs via src/evals/run.ts:338 (using fs.readFileSync) and make outbound model calls via the run -> callModel -> callLlm traced path.

How It Is Wired

Execution starts at the CLI entry point src/cli.tsx:25. The primary runner is src/agent/agent.ts:59, which coordinates the run loop. Key functions with wide blast radius include callLlm (called from 4 places) and formatToolName (called from 4 places). The internal call graph contains 6 modules in circular dependencies, specifically src/agent/prompts.ts, src/tools/registry.ts, and src/tools/finance/index.ts, which mutually reach each other and hinder refactoring. Hub modules with high dependency counts are src/tools/types.ts (16 modules depend on it) and src/theme.ts. Additionally, 64 repeated 6-line blocks exist across files like src/cli.tsx, src/hooks/useModelSelection.ts, and src/hooks/useAgentRunner.ts, violating the DRY principle and increasing cognitive load.

How To Use It

Setup: The repository requires the Bun runtime (v1.0+). Install dependencies using:

bun install

Configure required API keys by copying env.example to .env. Required keys include OPENAI_API_KEY. Optional keys for financial data (FINANCIAL_DATASETS_API_KEY) and web search (EXASEARCH_API_KEY or TAVILY_API_KEY) are documented in the file.

Configuration: Environment variables are managed in .env. The project uses TypeScript configuration defined in tsconfig.json.

Running it: Execute the agent in interactive mode:

bun start

For development with watch mode:

bun dev

Evaluation: Run the eval suite against the financial question dataset:

bun run src/evals/run.ts

Real-World Use

A practical scenario involves automating a competitive analysis request, such as "Analyze the recent margin expansion trends for NVIDIA versus AMD." A user invokes the CLI, the agent decomposes the query into steps (e.g., retrieving income statements, calculating ratio changes), executes src/tools/finance/prices.ts and src/tools/finance/fundamentals.ts, and iterates via src/agent/agent.ts until a self-validated answer is formed, outputting a structured report.

Code Health & Issues

Static analysis identified 17 distinct issues across 7 high and 10 medium severity:

[HIGH/soundness] Import cycle member x6: Files src/agent/prompts.ts, src/tools/registry.ts, and src/tools/finance/index.ts participate in circular imports, creating brittle dependency paths.
[HIGH/clarity] Duplicated code blocks: 64 repeated 6-line blocks found across 13 files, including src/cli.tsx and multiple hook files, indicating copy-paste logic that requires extraction.
[MEDIUM/cognitive_load] High branching density x8: Files src/tools/finance/api.ts, src/utils/env.ts, and src/utils/text-navigation.ts exhibit 18 branch points over 60 lines, suggesting logic that should be decomposed or dispatched via a table.
[MEDIUM/clarity] Hub modules x2: src/tools/types.ts and src/theme.ts are depended upon by 16 and 14 modules respectively, creating high-blast-radius change points.
[HIGH] Pin third-party GitHub Actions to commit SHA: The workflow uses oven-sh/setup-bun@v2, which is untagged and subject to owner-driven updates that could alter CI behavior with repository secrets.
[HIGH] Add a LICENSE: No license file exists at the repository root, defaulting to "all rights reserved" and preventing legal reuse.
[MEDIUM] Enable Dependabot or Renovate: No update bot is configured for the 26 declared dependencies.

The Bottom Line

Dexter is a functional autonomous agent with a clear focus on financial research orchestration. However, it carries significant technical debt: circular imports create soundness risks, duplicated logic increases merge friction, and the absence of a license and dependency automation poses operational risk. It is suitable for teams requiring a customizable research prototype, but requires refactoring of the import graph and duplicated blocks, as well as IP clearance, before it is viable for production or client-facing engagements.

What the analyser found

Deployment readiness

4/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

98 files

TypeScript68
TSX17
Markdown4
JSON2
YAML1
JavaScript1

React

Module dependencies

The 10 most depended-upon modules of 86, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_src_tools_types["types"] n1_src_theme["theme"] n2_src_tools_finance_api["api"] n3_src_model_llm["llm"] n4_src_agent_types["types"] n5_src_agent_prompts["prompts"] n6_src_utils_logger["logger"] n7_src_components_ModelSelector["ModelSelector"] n8_utils_in_memory_chat_history["in-memory-chat-history"] n9_src_utils_env["env"] n7_src_components_ModelSelector --> n1_src_theme n3_src_model_llm --> n4_src_agent_types n2_src_tools_finance_api --> n6_src_utils_logger n8_utils_in_memory_chat_history --> n3_src_model_llm classDef cyc stroke:#ef4444,stroke-width:2px; class n5_src_agent_prompts cyc;

Dependencies

6 of 26 declared dependencies are a major version behind. Resolved 26 of 26 against the registry.

Package	Declared	Latest	Behind
`typescript`	^5.9.3	7.0.2	2 major
`ink`	^6.5.1	7.1.1	1 major
`@babel/core`	^7.28.5	8.0.1	1 major
`@babel/preset-env`	^7.28.5	8.0.2	1 major
`@types/jest`	^29.5.14	30.0.0	1 major
`jest`	^29.7.0	30.4.2	1 major

Findings

MediumNo LICENSE file - unclear usage/redistribution rights root
LowDependencies declared without a lockfile - non-reproducible builds package.json

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium5

low2

Pin third-party GitHub Actions to a commit SHAhigh

.github/workflows

oven-sh/setup-bun@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Add a LICENSE; redistribution rights are undefinedhigh

no licence file at the repository root

Fix: Add MIT or Apache-2.0 at the repository root.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/ci.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Review the install lifecycle script and disable scripts in CImedium

package.json

postinstall

Install scripts are the execution vector for every npm compromise from event-stream onward, and a postinstall that fetches a binary makes the build depend on a URL nobody reviews.

Fix: Move the work into an explicit build step, or set ignore-scripts in CI and run it by name.

Expand the test suite; it cannot cover this codebasemedium

1 test files against 86 source files (ratio 0.012)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow

.github/workflows/ci.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.