open lovable - Moses Yebei

The Problem

Rebuilding an existing website as a React app is slow, manual work: scrape the content, reimplement the layout, wire up interactivity. This project automates that loop — point it at a URL, describe changes in chat, and it generates and applies React code live in a sandbox. It's the open-source demo of Firecrawl's AI site-cloning workflow, forked here without the original's 28k-star history.

What This Does

Open Lovable is a chat-driven React app builder. The pipeline lives in app/api/ (36 route files): scrape-website/route.ts pulls a target site, analyze-edit-intent/route.ts turns a chat message into an edit plan, generate-ai-code-stream/route.ts streams generated code, and the install-packages, run-command, and sandbox-* routes manage a live execution environment. The UI is app/page.tsx and app/generation/page.tsx.

This is a collection of 9 self-contained projects, not one codebase. The substantial ones: the site-cloning engine, the AI generation/sandbox orchestrator, and a marketing site (components/app/(home)/) showcasing Firecrawl's API endpoints with Pixi-based animated hero components.

How It Is Wired

Execution starts in app/page.tsx — the chat UI — and flows into the API routes that own the side effects: sandbox creation, package installation, code application, Vite log monitoring. The import graph (274 modules, 102 edges) shows three hubs: components/shared/header/Nav/Nav (13 imports, instability 1.0), the Hero section (7 imports), and AnimatedRect (imported by 8 modules). Five modules sit in circular dependencies — cell.ts, crawl.ts, mapping.ts in the Pixi tickers feature — which makes those files risky to change in isolation.

The widest blast radius is generate-ai-code-stream/route.ts at 1,472 lines: it handles generation, streaming, and error handling in one file. Deep nesting (depth 9) and 23 branch points over 62 lines in Title.tsx compound the maintenance cost.

How To Use It

git clone https://github.com/moses-y/open-lovable
cd open-lovable
pnpm install

Add .env.local with FIRECRAWL_API_KEY (required) and one AI provider key (GEMINI_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, or GROQ_API_KEY). Choose a sandbox provider: Vercel (default, via OIDC token or personal access token) or E2B (E2B_API_KEY). Run pnpm dev and open http://localhost:3000.

Real-World Use

A product team wants to modernize a legacy landing page. Paste the URL into Open Lovable, chat "rebuild this with a dark theme and a pricing section," and the tool scrapes the source, generates the React code, applies it in the sandbox, and shows a live preview — iterating on the result conversationally instead of hand-porting HTML.

Code Health & Issues

Static analysis found 38 findings (12 high, 26 medium) across 5 kinds: 5 circular import members, 629 duplicated 6-line blocks across 92 files (worst in the app/api/ routes), 11 deeply nested control flows, 7 oversized files, and 14 high-branching modules. The health audit adds: High — no test suite across 274 source files; High — no CI workflow; Medium — no Dependabot/Renovate for the 2 manifests; Low — missing .editorconfig, .gitattributes, and formatter config. No secrets were found committed.

The Bottom Line

The core idea is sound and the API surface is well-organized, but the heavy route files and duplicated logic will hurt anyone extending it. Add tests and CI before relying on it, and expect to refactor generate-ai-code-stream/route.ts if you touch generation. Best for teams prototyping AI-driven site cloning, not for production use as-is.

What the analyser found

Deployment readiness

4/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

336 files

TSX193
TypeScript76
CSS24
JSON16
Markdown7
JavaScript3

ReactNext.jsTailwind

Module dependencies

The 10 most depended-upon modules of 274, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_ures_components_AnimatedRect["AnimatedRect"] n1_o_Pixi_tickers_features_cell["cell"] n2_components_BlinkingContainer["BlinkingContainer"] n3_kers_features_components_Dot["Dot"] n4_lib_sandbox_types["types"] n5_red_effects_flame_core_flame["core-flame"] n6_ffects_flame_ascii_explosion["ascii-explosion"] n7_ate_open_lovable_lib_prompts["prompts"] n8__Pixi_tickers_features_crawl["crawl"] n9_ixi_tickers_features_mapping["mapping"] n1_o_Pixi_tickers_features_cell --> n0_ures_components_AnimatedRect n1_o_Pixi_tickers_features_cell --> n2_components_BlinkingContainer n1_o_Pixi_tickers_features_cell --> n8__Pixi_tickers_features_crawl n1_o_Pixi_tickers_features_cell --> n9_ixi_tickers_features_mapping n2_components_BlinkingContainer --> n0_ures_components_AnimatedRect n3_kers_features_components_Dot --> n0_ures_components_AnimatedRect n8__Pixi_tickers_features_crawl --> n1_o_Pixi_tickers_features_cell n8__Pixi_tickers_features_crawl --> n0_ures_components_AnimatedRect n8__Pixi_tickers_features_crawl --> n2_components_BlinkingContainer n8__Pixi_tickers_features_crawl --> n3_kers_features_components_Dot n9_ixi_tickers_features_mapping --> n1_o_Pixi_tickers_features_cell n9_ixi_tickers_features_mapping --> n0_ures_components_AnimatedRect n9_ixi_tickers_features_mapping --> n2_components_BlinkingContainer n9_ixi_tickers_features_mapping --> n3_kers_features_components_Dot classDef cyc stroke:#ef4444,stroke-width:2px; class n1_o_Pixi_tickers_features_cell,n8__Pixi_tickers_features_crawl,n9_ixi_tickers_features_mapping cyc;

Dependencies

26 of 84 declared dependencies are a major version behind. Resolved 84 of 84 against the registry.

Package	Declared	Latest	Behind
`@types/node`	^20	26.2.0	6 major
`inquirer`	^9.2.12	14.0.2	5 major
`commander`	^11.1.0	15.0.0	4 major
`@vercel/sandbox`	^0.0.17	3.1.0	3 major
`@ai-sdk/anthropic`	^2.0.1	4.0.39	2 major
`@ai-sdk/google`	^2.0.4	4.0.44	2 major
`@ai-sdk/groq`	^2.0.0	4.0.28	2 major
`@ai-sdk/openai`	^2.0.4	4.0.42	2 major

Findings

MediumNo test files detected - untested code paths repository-wide
MediumNo CI/CD pipeline detected - no automated build/test gate .github/ or CI config

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high2

medium1

low1

Upgrade the pinned dependency carrying a critical advisorycritical31 occurrences

next@15.4.3 GHSA-9qr9-h5gf-34mp (critical) +30 more

The manifest pins the exact version the advisory covers, so this is not a warning about drift: the vulnerable code is what installs, and a critical rating means it is reachable over the network without credentials or user interaction.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Add a test suite; this repository has nonehigh274 occurrences

274 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Add a workflow that builds and tests this repositoryhigh

274 source files, no CI configuration

Every change merges with nobody having run the build once, which across this estate is 499 repositories.

Fix: Add a workflow running the project build and test command on push and pull_request.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.