mission control - Moses Yebei

The Problem

Solo founders increasingly rely on autonomous AI agents to execute ideas, but there is no lightweight, agent‑first task hub. Existing tools assume human‑only workflow, leaving founders to chase logs, manage credentials, and manually intervene when agents misbehave.

What This Does

mission-control supplies a Next.js front‑end plus a daemon that mediates every agent interaction. The UI lives under mission‑control/src/app/… (e.g., src/app/dashboard/page.tsx, src/app/inbox/page.tsx) and renders the Eisenhower matrix, inbox, and field‑ops panels. The background daemon starts at mission‑control/scripts/daemon/index.ts, reads daemon-config.json, and dispatches work through the pipeline in scripts/daemon/runner.ts, scheduler.ts, and dispatcher.ts. Shared adapters such as src/lib/adapters/registry.ts expose a token‑optimized API that agents use to read/write tasks, decisions, and approvals.

How It Is Wired

Execution begins with the daemon entry point scripts/daemon/index.ts. It loads configuration (scripts/daemon/config.ts), creates a logger (scripts/daemon/logger.ts), and instantiates the core loop:

index.ts → config.load() reads mission‑control/data/daemon-config.json.
index.ts creates a Runner (scripts/daemon/runner.ts). The runner imports the most connected modules: logger (Ca 11, Ce 2) – centralised log output. types (Ca 11, Ce 0) – shared type definitions. * dispatcher (Ca 2, Ce 5) – decides which task handler to invoke (e.g., run-task.ts, run-inbox-respond.ts).
The runner schedules work via scheduler.ts, which polls the task queue in data/tasks.json and triggers the appropriate handler.
Handlers (run-task.ts, run-brain-dump-triage.ts, etc.) call the adapter layer (src/lib/adapters/registry.ts, src/lib/adapters/types.ts) to read/write JSON data and to invoke external APIs defined in the Next.js API routes (src/app/api/*).
Responses flow back through the dispatcher to the logger and finally update the UI via the same JSON files that the front‑end reads (data/inbox.json, data/decisions.json).

The hub of this graph is scripts/daemon/logger.ts (11 inbound imports, 2 outbound) and scripts/daemon/types.ts (pure type hub, 7 inbound). No circular dependencies were detected, so changes to a hub module have a predictable blast radius limited to the modules that import it.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/mission-control
cd mission-control

# Install dependencies (pnpm is declared in the repo)
pnpm install

# Copy example env and adjust if needed
cp mission-control/.env.example mission-control/.env   # edit .env as required

# Start the daemon (background worker)
pnpm run daemon   # script defined in mission-control/package.json

# Launch the Next.js UI
pnpm dev          # runs Next.js dev server (script defined in package.json)

The UI is reachable at http://localhost:3000. The daemon reads mission-control/data/daemon-config.json; any custom settings must be added there.

Real‑World Use

A founder adds a new idea via the “Brain Dump” page (src/app/brain-dump/page.tsx). The UI writes to data/brain-dump.json. The daemon picks up the entry, triggers run-brain-dump-triage.ts, which spawns a research agent through the adapter layer. The agent’s report lands in data/decisions.json; the founder reviews it in the “Decisions” view and approves the next step, which the daemon then translates into a task in data/tasks.json for the build agent.

Code Health & Issues

High – Duplicated code blocks – 1,557 repeated 6‑line fragments across 130 files (e.g., __tests__/daemon.test.ts, security.test.ts, scripts/daemon/config.ts).
High – Deep nesting – Max indentation depth 8 in src/app/autopilot/page.tsx and several field‑ops pages; makes control flow hard to follow.
High – Oversized files – src/lib/data.ts (733 lines) and scripts/seed-infant-feeding.ts (733 lines) exceed typical maintainability thresholds.
Medium – High branching density – scripts/daemon/config.ts, security.ts, dispatcher.ts contain 61 branch points over 144 lines each; consider strategy tables.
Medium – Out‑of‑date dependencies – 9 packages lag behind the latest major releases (e.g., next ^15.3.3 vs current 16.3.1, typescript ^5.8.0 vs 7.0.2).

CI is present (.github/workflows/ci.yml), tests exist (__tests__/*.test.ts), a license file is included, and no secrets are committed. No Dockerfile is provided, so container builds must be added if required.

The Bottom Line

mission-control delivers a functional, agent‑first task console with a clear separation between UI and daemon orchestration. The codebase is usable but suffers from duplicated logic, deep nesting, and several large files, which will increase maintenance cost. It is suitable for teams comfortable refactoring TypeScript and who need a customizable, open‑source hub for AI‑agent workflows, provided they allocate effort to clean up the identified hotspots.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

325 files

TypeScript125
TSX107
Markdown34
JSON26
JavaScript7
Shell5

ReactNext.jsTailwind

Module dependencies

The 10 most depended-upon modules of 243, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_ontrol_scripts_daemon_logger["logger"] n1_control_scripts_daemon_types["types"] n2_ntrol_src_lib_adapters_types["types"] n3_ontrol_scripts_daemon_config["config"] n4_ol_src_lib_adapters_registry["registry"] n5_trol_scripts_daemon_security["security"] n6_ontrol_scripts_daemon_runner["runner"] n7_ission_control_src_lib_types["types"] n8_ontrol_scripts_daemon_health["health"] n9_cripts_daemon_prompt_builder["prompt-builder"] n3_ontrol_scripts_daemon_config --> n0_ontrol_scripts_daemon_logger n3_ontrol_scripts_daemon_config --> n1_control_scripts_daemon_types n8_ontrol_scripts_daemon_health --> n0_ontrol_scripts_daemon_logger n8_ontrol_scripts_daemon_health --> n5_trol_scripts_daemon_security n8_ontrol_scripts_daemon_health --> n1_control_scripts_daemon_types n0_ontrol_scripts_daemon_logger --> n5_trol_scripts_daemon_security n0_ontrol_scripts_daemon_logger --> n1_control_scripts_daemon_types n9_cripts_daemon_prompt_builder --> n0_ontrol_scripts_daemon_logger n9_cripts_daemon_prompt_builder --> n5_trol_scripts_daemon_security n9_cripts_daemon_prompt_builder --> n1_control_scripts_daemon_types n6_ontrol_scripts_daemon_runner --> n0_ontrol_scripts_daemon_logger n6_ontrol_scripts_daemon_runner --> n3_ontrol_scripts_daemon_config n6_ontrol_scripts_daemon_runner --> n5_trol_scripts_daemon_security n6_ontrol_scripts_daemon_runner --> n1_control_scripts_daemon_types n4_ol_src_lib_adapters_registry --> n2_ntrol_src_lib_adapters_types

Dependencies

9 of 45 declared dependencies are a major version behind. Resolved 45 of 45 against the registry.

Package	Declared	Latest	Behind
`@types/node`	^22.15.0	26.2.0	4 major
`typescript`	^5.8.0	7.0.2	2 major
`lucide-react`	^0.525.0	1.31.0	1 major
`nanoid`	^5.1.6	6.0.1	1 major
`next`	^15.3.3	16.3.1	1 major
`@vitejs/plugin-react`	^5.1.4	6.0.5	1 major
`eslint`	^9.0.0	10.8.1	1 major
`eslint-config-next`	^15.3.3	16.3.1	1 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium5

low2

Pin third-party GitHub Actions to a commit SHAhigh

.github/workflows

pnpm/action-setup@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/ci.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium

mission-control/docs/demo.gif

1 blobs over 5MB: demo.gif 9.1MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/ci.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow

.github/workflows/ci.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.