llamacoder - Moses Yebei

The Problem

Generating a small, working app from a single natural-language prompt is the core value of Claude Artifacts, but that product is closed and proprietary. This repo is an open-source reimplementation: point an LLM at a prompt, get back a runnable React app rendered in a sandbox, with chat history, sharing, and code execution. The pain point it solves is giving teams an artifact-style workflow without being locked into a vendor.

What This Does

app/(main)/page.tsx is the prompt entry point. The flow is: user submits a prompt → app/api/create-chat/route.ts creates a chat record via Prisma → the LLM streams a response through app/api/get-next-completion-stream-promise/route.ts → generated code is rendered in a Sandpack sandbox via components/code-runner.tsx and friends. Chat UI lives under app/(main)/chats/[id]/ with chat-box.tsx, chat-log.tsx, and code-viewer.tsx. Sharing is handled by app/share/[id]/page.tsx and app/share/v2/[messageId]/page.tsx. The lib/shadcn.ts file (2,751 lines) is the UI component library, and prisma/ holds the schema for chat persistence, backed by Neon/PostgreSQL.

How It Is Wired

Execution starts at app/(main)/page.tsx, which routes into app/(main)/chats/[id]/page.tsx and its client counterpart page.client.tsx. The traced path reaches external services in few hops: prompt → create-chat/route.ts → Prisma write to Postgres; prompt → streaming route → Together AI inference API; generated code → Sandpack (CodeSandbox) for execution. The lib/shadcn-docs/index.ts module is the most unstable hub (instability 0.9, 9 imports out, 1 in) — a change there ripples widely.

A circular import cycle spans page.tsx, chat-box.tsx, chat-log.tsx, and code-viewer.tsx. Anyone modifying the chat UI must trace mutually reachable modules before touching a file. The dependency graph is shallow (24 edges across 77 modules), so most files are leaves; the blast radius concentrates in lib/shadcn.ts and the chat page cluster.

How To Use It

git clone https://github.com/moses-y/llamacoder
cd llamacoder
pnpm install
cp .example.env .env
pnpm dev

Required environment variables (per README and .example.env): TOGETHER_API_KEY for LLM inference, CSB_API_KEY for the CodeSandbox sandbox, and DATABASE_URL — a Neon Postgres connection string consumed by Prisma. Run pnpm prisma migrate dev before first start to create tables. The README documents npm install/npm run dev; the repo ships a pnpm-lock.yaml, so pnpm is the consistent choice.

Real-World Use

A support team wants internal tools — a CSV validator, a JSON formatter — generated on demand without a developer. A user types "build a tool that validates CSV columns against a schema" into the prompt box. Llama 3.1 405B streams back a React component, Sandpack executes it live, and the user can iterate in chat until it works. The result is shareable via the share routes, so a colleague gets a working URL instead of a screenshot.

Code Health & Issues

Static analysis (measured, not opinion) found 11 findings: 8 high, 3 medium. Key items:

High — Import cycle: app/(main)/chats/[id]/page.tsx, chat-box.tsx, chat-log.tsx participate in a circular import; extract shared types or defer an import.
High — Duplicated code: 230 repeated 6-line blocks across 24 files; extract shared helpers.
High — Deep nesting: max indentation depth 8 in app/(main)/page.tsx, code-viewer.tsx, page.client.tsx.
High — Oversized file: lib/shadcn.ts at 2,751 lines.
High — Vulnerable dependency: next@16.1.6 carries CVE-2026-44575 (high) plus 27 more advisories; upgrade and commit the lockfile.
High — No tests: 77 source files, zero test files.
High — No CI: no build/test workflow exists.
Medium — No Dependabot/Renovate: advisories sit unpatched.
Medium — Thin README: 1,420 bytes doesn't cover setup adequately.
Medium — postinstall script in package.json: an install-time execution vector; disable scripts in CI.

The Bottom Line

Functionally solid demo of the artifact pattern with a real LLM backend, but it's a fork of a popular project that inherits both its strengths and its debt. Before production use: upgrade Next.js, add tests and CI, and break the chat-page import cycle. Right for teams wanting to self-host an artifact-style generator; not yet a hardened deployable.

What the analyser found

Deployment readiness

4/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

118 files

TSX58
TypeScript18
JSON9
Markdown3
SQL3
CSS1

ReactNext.jsTailwindPyTorch

Module dependencies

The 10 most depended-upon modules of 77, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_app__main__chats__id__page["page"] n1_app__main__providers["providers"] n2_lib_shadcn_docs_index["index"] n3_main__chats__id__page_client["page.client"] n4_p__main__chats__id__chat_box["chat-box"] n5_main__chats__id__code_viewer["code-viewer"] n6_p__main__chats__id__chat_log["chat-log"] n7_app__main__actions["actions"] n8_hats__id__code_viewer_layout["code-viewer-layout"] n9_app__main__chats__id__share["share"] n4_p__main__chats__id__chat_box --> n7_app__main__actions n4_p__main__chats__id__chat_box --> n0_app__main__chats__id__page n6_p__main__chats__id__chat_log --> n0_app__main__chats__id__page n5_main__chats__id__code_viewer --> n0_app__main__chats__id__page n5_main__chats__id__code_viewer --> n9_app__main__chats__id__share n3_main__chats__id__page_client --> n4_p__main__chats__id__chat_box n3_main__chats__id__page_client --> n6_p__main__chats__id__chat_log n3_main__chats__id__page_client --> n5_main__chats__id__code_viewer n3_main__chats__id__page_client --> n8_hats__id__code_viewer_layout n3_main__chats__id__page_client --> n0_app__main__chats__id__page n3_main__chats__id__page_client --> n1_app__main__providers n0_app__main__chats__id__page --> n3_main__chats__id__page_client classDef cyc stroke:#ef4444,stroke-width:2px; class n0_app__main__chats__id__page,n3_main__chats__id__page_client,n4_p__main__chats__id__chat_box,n5_main__chats__id__code_viewer,n6_p__main__chats__id__chat_log cyc;

Dependencies

15 of 48 declared dependencies are a major version behind. Resolved 48 of 48 against the registry.

Package	Declared	Latest	Behind
`@types/node`	^20	26.2.0	6 major
`framer-motion`	^11.18.0	13.1.0	2 major
`typescript`	^5	7.0.2	2 major
`@next/bundle-analyzer`	^15.1.5	16.3.1	1 major
`@prisma/adapter-neon`	6.5.0	7.9.1	1 major
`@prisma/client`	6.5.0	7.9.1	1 major
`@vercel/og`	^0.8.6	1.0.1	1 major
`lucide-react`	^0.563.0	1.31.0	1 major

Findings

MediumNo test files detected - untested code paths repository-wide
MediumNo CI/CD pipeline detected - no automated build/test gate .github/ or CI config

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high3

medium3

Upgrade the pinned dependency carrying a published advisoryhigh28 occurrences

next@16.1.6 CVE-2026-44575 (high) +27 more

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Add a test suite; this repository has nonehigh77 occurrences

77 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Add a workflow that builds and tests this repositoryhigh

77 source files, no CI configuration

Every change merges with nobody having run the build once, which across this estate is 499 repositories.

Fix: Add a workflow running the project build and test command on push and pull_request.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Expand the README; it does not say how to run thismedium

README.md

1420 bytes of README for 77 code files

A 236-byte README for 1,302 files leaves no way to find the entry point, which is the state of the largest repository in this estate.

Fix: Add install, run, and one worked example.

Review the install lifecycle script and disable scripts in CImedium

package.json

postinstall

Install scripts are the execution vector for every npm compromise from event-stream onward, and a postinstall that fetches a binary makes the build depend on a URL nobody reviews.

Fix: Move the work into an explicit build step, or set ignore-scripts in CI and run it by name.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.