rowboat - Moses Yebei

The Problem

Developers and knowledge workers spend disproportionate time re‑entering context—emails, meeting notes, decisions—into AI tools. The lack of a persistent, searchable knowledge graph forces repeated prompting and limits the usefulness of LLM assistants.

What This Does

rowboat is a local‑first AI coworker that builds an Obsidian‑compatible Markdown vault, enriches it with backlinks, and uses that graph to provide context‑aware assistance. Core functionality lives in the CLI (apps/cli/src) and the web UI (apps/rowboat/app).

The CLI entry point apps/cli/bin/app.js loads apps/cli/src/app.ts, which wires the DI container (apps/cli/src/di/container.ts) and starts the HTTP server (apps/cli/src/server.ts).
The web UI is a Next.js app under apps/rowboat/app; its API routes (e.g., apps/rowboat/app/api/v1/[projectId]/chat/route.ts) call use‑case classes such as apps/rowboat/src/application/use-cases/api-keys/create-api-key.use-case.ts.
Persistent storage is a vector store (Qdrant) built from the Markdown vault; the Dockerfile Dockerfile.qdrant provisions it.

How It Is Wired

Bootstrap – apps/cli/src/app.ts creates the DI container (apps/cli/src/di/container.ts). The container registers core services (apps/x/packages/core/src/di/container.ts) and the config module (apps/x/packages/core/src/config/config.ts), the latter imported by 52 other modules (the biggest hub).
Server start – apps/cli/src/server.ts calls express() and attaches routes from apps/cli/src/application/assistant/skills/*. Each route eventually invokes the execute function found in multiple use‑case files (e.g., apps/rowboat/src/application/use-cases/api-keys/create-api-key.use-case.ts).
Execution flow – execute → authorize (57 callers) → assertAndConsumeProjectAction (52 callers) → fetch (28 callers). The call graph shows cn (defined in apps/rowboat/lib/utils.ts) is referenced from 38 files, making it a secondary blast‑radius node.
External effects – Filesystem: execute → create writes via fs.writeFile. Config reads: init → identify → getInstallationId reads fs.readFileSync. Network: execute (in API‑key use case) performs an outbound request to the licensing server and generates a cryptographic secret. Database: the simulation runner (apps/experimental/simulation_runner) reads/writes a SQLite DB, but is isolated from the main CLI/Web flow.

Cycles – 32 modules form circular imports; the most problematic are the DI containers (apps/x/packages/core/src/di/container.ts and its CLI counterpart) and shared defaults (apps/x/packages/core/src/models/defaults.ts). Breaking these cycles would reduce build‑time coupling and improve testability.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/rowboat
cd rowboat

# Install Node dependencies (pnpm is declared)
pnpm install

# Build Docker image for Qdrant (vector store)
docker build -f Dockerfile.qdrant -t rowboat-qdrant:sha256-<digest> .

# Start the vector store
docker run -d -p 6333:6333 rowboat-qdrant:sha256-<digest>

# Launch the CLI server (development)
pnpm --filter ./apps/cli dev   # runs apps/cli/src/server.ts

# Or start the Next.js UI
pnpm --filter ./apps/rowboat dev   # runs Next dev server

Configuration lives in .env.example (copy to .env) and per‑user JSON files under ~/.rowboat/config/ (e.g., deepgram.json, elevenlabs.json). The CLI reads apps/cli/src/config/config.ts; the web UI reads the same module via the container.

Real‑World Use

A product manager runs rowboat locally, connects Gmail/Calendar via the Google setup guide, and invokes the CLI command rowboat generate deck --topic "Q3 roadmap". The CLI routes the request to apps/rowboat/src/application/use-cases/api-keys/create-api-key.use-case.ts, which fetches relevant Markdown notes from the vault, enriches them with embeddings stored in Qdrant, and streams a PDF back to the user’s terminal. No external API keys are transmitted beyond the local machine.

Code Health & Issues

High – Pin GitHub Actions – .github/workflows/* uses pnpm/action-setup@v4; replace with a commit SHA.
High – Missing Python lockfile – apps/python-sdk/pyproject.toml has no lockfile; generate and commit one.
High – Wildcard CORS – apps/cli/src/server.ts calls cors() with no origin list; restrict to known front‑ends.
High – Debug mode enabled – apps/experimental/tools_webhook/app.py runs app.run(debug=True); gate behind an env var.
Medium – GITHUB_TOKEN permissions – .github/workflows/rowboat-build.yml lacks explicit permissions; add least‑privilege scopes.
Medium – Dependabot not configured – No .github/dependabot.yml; add to auto‑update 14 manifests.
Medium – Docker base image mutable – Dockerfile.qdrant uses qdrant/qdrant:latest; pin by digest.
Medium – No dependency scan – CI lacks a vulnerability review step; integrate dependency-review-action or osv-scanner.
Medium – Large binaries in repo – apps/docs/docs/videos/intro.mp4 (31 MB) etc.; move to Git LFS or external storage.
Medium – Checkout persisting token – .github/workflows/electron-build.yml should set persist-credentials: false.

No critical findings; overall test and CI presence is satisfactory.

The Bottom Line

rowboat delivers a concrete local‑first AI coworker with a well‑structured monorepo, clear entry points, and a functional vector‑store pipeline. The biggest risks are tight module coupling (import cycles) and several production‑hardening gaps (CORS, debug mode, action pinning). Teams comfortable managing Docker and Node/PNPM environments can adopt it quickly, but should address the highlighted health issues before a production rollout.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,118 files

TypeScript544
TSX336
JSON44
Markdown18
Python15
CSS13

ReactNext.jsFlaskExpressTailwindDockerVector store

Module dependencies

The 10 most depended-upon modules of 908, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_kages_core_src_config_config["config"] n1_usage_quota_policy_interface["usage-quota.policy.inter"] n2__action_authorization_policy["project-action-authoriza"] n3_rojects_repository_interface["projects.repository.inte"] n4_app_lib_types_workflow_types["workflow_types"] n5_ckages_core_src_di_container["container"] n6_oat_app_actions_auth_actions["auth.actions"] n7_owboat_app_lib_feature_flags["feature_flags"] n8__actions_data_source_actions["data-source.actions"] n9_ges_core_src_models_defaults["defaults"] n6_oat_app_actions_auth_actions --> n7_owboat_app_lib_feature_flags n8__actions_data_source_actions --> n6_oat_app_actions_auth_actions n9_ges_core_src_models_defaults --> n5_ckages_core_src_di_container classDef cyc stroke:#ef4444,stroke-width:2px; class n5_ckages_core_src_di_container,n9_ges_core_src_models_defaults cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high4

medium7

low1

Pin third-party GitHub Actions to a commit SHAhigh

.github/workflows

pnpm/action-setup@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Commit a lockfile beside the manifesthigh

apps/python-sdk/pyproject.toml

manifest with no lockfile in scope

An unlocked range means the artifact you tested and the artifact you ship can contain different transitive code, so a malicious patch release reaches production with no diff.

Fix: Run the package manager once and commit the generated lockfile.

Replace the wildcard CORS origin with an explicit allow listhigh

apps/cli/src/server.ts

cors()

Any page on the internet can call the API with the browser's cookies attached, so a logged-in visitor to an unrelated site performs authenticated requests without knowing, and the wildcard combined with credentials is the exact configuration browsers refuse for that reason.

Fix: List the origins the API actually serves, and never pair a wildcard with credentials.

Turn off debug mode and drive it from the environmenthigh

apps/experimental/tools_webhook/app.py

app.run(debug=True)

Django and Flask debug pages render local variables, settings and the full traceback to whoever triggered the error, so one unhandled exception publishes the database password to a stranger, and Werkzeug's debugger additionally offers a remote shell.

Fix: Read it from the environment with a safe default: DEBUG = os.environ.get("DEBUG") == "1".

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/rowboat-build.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

14 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium

Dockerfile.qdrant

qdrant/qdrant:latest (mutable tag)

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium3 occurrences

apps/docs/docs/videos/intro.mp4

3 blobs over 5MB: intro.mp4 31.8MB, Intro-Video.gif 11.8MB, Intro-Video.gif 11.8MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/electron-build.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Expand the test suite; it cannot cover this codebasemedium3 occurrences

3 test files against 908 source files (ratio 0.003)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow3 occurrences

.github/workflows/electron-build.yml

3 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.