open mind - Moses Yebei

The Problem

Read-later apps become graveyards. Saves pile into a list, the list becomes a backlog, and the backlog becomes guilt. Openmind addresses this by re-framing the problem: instead of managing a queue, it acts as a self-hosted commonplace book where the value comes from re-encountering saved items sideways—by color, fragment, or vibe—long after saving them.

What This Does

Openmind is a self-hosted, AI-optional read-later and knowledge management system. The core is a Go API (apps/api/) backed by Postgres and pgvector for hybrid full-text and semantic search. It handles capture, enrichment, feeds, and a "Drift" feature that resurfaced forgotten items for a daily ritual rather than a backlog.

The repo is a portfolio of four self-contained projects. Besides the Go API, there is a web frontend (apps/web/), a Tauri desktop app (apps/dock/), a browser extension (apps/extension/), and a mobile app (apps/mobile/). The README pitches the product as "Postgres + one Go binary" with docker compose up as the entire deployment, and AI calls going through a pluggable adapter (apps/api/internal/ai/) where the noop provider keeps the app fully functional.

How It Is Wired

Execution starts at main in apps/api/cmd/openmind/main.go, which reaches 150 functions. The Run function in apps/api/internal/enrich/pipeline.go is the workhorse, called from 55 places and reaching 136 functions. The shortest paths from entry to external effects are concrete: main -> run reads files via os.ReadFile; Run -> UpdateItemExtraction executes database queries; SearchItems -> ParseQuery calls a model via genai.Text. The API server logic is concentrated in apps/api/internal/api/server.go and gen.go, with NewServer called from 158 places—the widest blast radius in the codebase.

The most connected modules are apps/web/lib/api (39 modules depend on it, instability 0.03) and apps/web/lib/types (24 dependents, zero imports). The API is the hub: 150 functions read or write the database, 36 make outbound network calls, and 8 call models for inference. The wiring is not fully mapped for the web frontend's internal routing, but the Go API's control flow is well-defined.

How To Use It

Setup: Clone with git clone https://github.com/moses-y/open-mind, then use the Dockerfile (apps/api/Dockerfile) or docker compose up per the README.
Configuration: Copy .env.example to .env and set Postgres connection details and optional AI provider keys. The noop provider works with no configuration.
Running it: The Go binary starts via apps/api/cmd/openmind/main.go. The README documents docker compose up as the full deployment.

Real-World Use

A user saves a link via the browser extension. The API returns instantly (no AI in the save path). Background enrichment extracts the color palette and summary. Later, the user searches for "blue" and finds the item via pgvector semantic similarity. They pin it to the Desk, and the Drift feature surfaces it again days later for re-encountering.

Code Health & Issues

Static analysis found 32 findings (4 high, 28 medium). The high-severity items are:

High - Hub modules: apps/web/lib/api.ts and apps/web/lib/types.ts have 39 and 24 dependents respectively; churn here is high-blast-radius.
High - Duplicated code: 436 repeated 6-line blocks across 124 files, notably in apps/api/internal/ai/openai_test.go and apps/api/internal/enrich/pdf_test.go.
High - Oversized files: apps/api/internal/api/gen.go at 1502 lines and apps/dock/src/panel/Panel.tsx are hard to hold in one head.

SDLC observations: CI exists (GitHub Actions) but uses unpinned action tags (pnpm/action-setup@v4), no least-privilege token permissions declared, no Dependabot configured, and the Docker base image (golang:1.25-alpine) is a mutable tag. Tests and license are present.

The Bottom Line

Openmind is a well-architected self-hosted alternative to read-later apps, with a clean Go API separated from a pluggable AI layer. The codebase is a portfolio of four projects, not a monolith, and the Go API shows disciplined structure. The main risks are the hub modules and oversized files in the web app, plus CI hygiene gaps that are easily fixed. Suitable for developers who want a self-hosted, AI-optional knowledge base with a strong search and re-discovery model.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

687 files

Go180
TypeScript107
Markdown104
TSX83
SQL33
JSON21

ReactNext.jsExpressDocker

Module dependencies

The 10 most depended-upon modules of 199, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_apps_web_lib_api["api"] n1_apps_web_lib_types["types"] n2_apps_web_lib_cards["cards"] n3_apps_web_components_Shell["Shell"] n4_apps_dock_src_lib_api["api"] n5_apps_mobile_lib_api["api"] n6_apps_dock_src_lib_settings["settings"] n7_apps_web_lib_auth_mode["auth-mode"] n8_apps_web_lib_colors["colors"] n9_apps_web_lib_text["text"] n4_apps_dock_src_lib_api --> n6_apps_dock_src_lib_settings n3_apps_web_components_Shell --> n7_apps_web_lib_auth_mode n0_apps_web_lib_api --> n7_apps_web_lib_auth_mode

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium5

low2

Pin third-party GitHub Actions to a commit SHAhigh4 occurrences

.github/workflows

pnpm/action-setup@v4, crabnebula-dev/cloud-release@v0, dtolnay/rust-toolchain@stable, swatinem/rust-cache@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/ci.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

10 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium4 occurrences

apps/api/Dockerfile

golang:1.25-alpine, gcr.io/distroless/static:nonroot, alpine:3.20 (mutable tag)

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/ci.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/ci.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.