tersa - Moses Yebei

The Problem

Developers building AI‑augmented products need a low‑code way to prototype multi‑model pipelines, but wiring HTTP calls, handling streaming responses, and persisting canvas state are repetitive and error‑prone.

What This Does

tersa ships a browser‑based visual workflow editor built on Next.js 15 and React 19. The UI lives in components/ai-elements/ (canvas, nodes, toolbar) and in the Kibo UI wrapper (components/kibo-ui/editor/index.tsx). Core node types are under components/nodes/ – image, text, video – each exposing an index.tsx entry that renders the node UI and hooks into the AI SDK gateway. Server‑side helpers for media handling live in app/api/ (chat/route.ts, upload/route.ts) and action files in app/actions/image/ for creating, editing, and describing images. The project is managed with pnpm and CI runs on GitHub Actions.

How It Is Wired

Execution starts when Next.js renders app/page.tsx, which composes the top‑level layout (app/layout.tsx) and injects the canvas component components/ai-elements/canvas.tsx. The canvas uses ReactFlow to instantiate node components from components/nodes/. Each node imports its own UI (index.tsx) and shared utilities (primitive.tsx, transform.tsx).

When a user triggers a model call (e.g., via the toolbar), the UI dispatches an async action defined in app/actions/image/*.ts. These actions call the Vercel AI SDK (@ai-sdk/gateway) and store results in the browser’s local storage (handled by components/ai-elements/connection.tsx).

API routes in app/api/ expose two external endpoints:

chat/route.ts – forwards chat messages to the gateway.
upload/route.ts – stores binary blobs using Vercel Blob (@vercel/blob).

The import graph contains 78 internal modules with 44 edges; nine modules form circular dependencies, notably components/nodes/image/index.tsx, components/nodes/text/index.tsx, and components/nodes/video/index.tsx. These cycles inflate the blast radius of any change to shared types or utilities. The most connected module, components/nodes/model-selector, is imported by three modules and imports three others, giving it an instability score of 0.5. components/canvas has no inbound imports but imports five others, indicating a potential hidden dependency hub.

The largest file, components/kibo-ui/editor/index.tsx (1,727 lines), aggregates editor state, drag‑and‑drop handling, and model selection, making it a single point of failure for UI changes.

How To Use It

# Clone the exact repo
git clone https://github.com/moses-y/tersa.git
cd tersa

# Install with pnpm (as declared in package.json)
pnpm install

# Create a .env.local with your Vercel AI SDK Gateway token and any provider keys
# (the README points to this file, but variable names are not hard‑coded)

# Start the dev server
pnpm dev

Open http://localhost:3000. The canvas appears; drag nodes from the toolbar, select models, and hit Run. API calls are routed through app/api/chat/route.ts and media uploads via app/api/upload/route.ts.

Real‑World Use

A product team can prototype a “caption‑then‑generate‑video” pipeline:

Add an Image node (uploads a picture).
Connect it to a Text node (generates a caption using a LLM).
Feed the caption into a Video node (creates a short clip via a diffusion model).

The flow runs entirely in the browser, with intermediate results streamed back from the AI SDK gateway and persisted locally for quick iteration.

Code Health & Issues

Measured findings (static analysis)

High – Cognitive load: Deep nesting (max indent = 8) in components/nodes/model-selector.tsx and components/nodes/text/transform.tsx.
High – Soundness: Import cycles involving nine files (e.g., components/nodes/image/index.tsx).
High – Clarity: Repeated 6‑line blocks across 21 files (e.g., app/actions/image/*.ts).
High – Cognitive load: Oversized editor (components/kibo-ui/editor/index.tsx, 1,727 lines).

Code‑health audit

High – Pin third‑party actions to commit SHAs (.github/workflows/release.yml).
High – Dependency next@16.1.6 has a published CVE (upgrade required).
High – No test suite (78 source files, zero test files).
Medium – No dependency‑vulnerability scan in CI.
Medium – Checkout step keeps credentials; set persist-credentials: false.
Low – Workflow jobs lack timeout-minutes.
Low – Missing convention files (.editorconfig, .gitattributes, formatter config).

Other hygiene facts: CI is present, a license file exists, lockfile is committed, and no secrets were found.

The Bottom Line

tersa delivers a functional, visual AI workflow builder that integrates tightly with Vercel’s AI SDK and Blob storage. It’s usable out‑of‑the‑box for rapid prototyping, but the codebase suffers from deep nesting, import cycles, and a lack of automated testing, which raise maintenance risk. Teams comfortable with refactoring and adding a test harness can extract value quickly; others should weigh the effort required to resolve the identified health issues.

What the analyser found

Deployment readiness

5/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

103 files

TSX54
TypeScript22
Markdown10
JSON5
YAML3
CSS1

ReactNext.js

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["components 45 modules"] g1["lib 12 modules"] g2["app 8 modules"] g3["providers 6 modules"] g4["hooks 3 modules"] g5["(root) 2 modules"] g2 -->|1| g3

Module dependencies

The 10 most depended-upon modules of 78, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_ponents_nodes_model_selector["model-selector"] n1_components_nodes_image_index["index"] n2_components_nodes_text_index["index"] n3_components_nodes_video_index["index"] n4_components_ui_button["button"] n5_components_ui_tooltip["tooltip"] n6_components_nodes_layout["layout"] n7_components_nodes_index["index"] n8_onents_nodes_image_transform["transform"] n9_ponents_nodes_text_primitive["primitive"] n1_components_nodes_image_index --> n8_onents_nodes_image_transform n8_onents_nodes_image_transform --> n0_ponents_nodes_model_selector n8_onents_nodes_image_transform --> n1_components_nodes_image_index n7_components_nodes_index --> n1_components_nodes_image_index n7_components_nodes_index --> n2_components_nodes_text_index n7_components_nodes_index --> n3_components_nodes_video_index n0_ponents_nodes_model_selector --> n4_components_ui_button n0_ponents_nodes_model_selector --> n5_components_ui_tooltip n2_components_nodes_text_index --> n9_ponents_nodes_text_primitive n9_ponents_nodes_text_primitive --> n6_components_nodes_layout n9_ponents_nodes_text_primitive --> n2_components_nodes_text_index classDef cyc stroke:#ef4444,stroke-width:2px; class n1_components_nodes_image_index,n2_components_nodes_text_index,n3_components_nodes_video_index,n8_onents_nodes_image_transform,n9_ponents_nodes_text_primitive cyc;

Dependencies

11 of 60 declared dependencies are a major version behind. Resolved 60 of 60 against the registry.

Package	Declared	Latest	Behind
`react-dropzone`	^15.0.0	20.1.0	5 major
`@vercel/blob`	^0.27.0	2.8.0	2 major
`typescript`	^5	7.0.2	2 major
`@ai-sdk/gateway`	^3.0.53	4.0.52	1 major
`@ai-sdk/react`	^3.0.97	4.0.69	1 major
`@vercel/analytics`	^1.6.1	2.0.1	1 major
`ai`	^6.0.95	7.0.66	1 major
`lucide-react`	^0.563.0	1.31.0	1 major

Findings

MediumNo test files detected - untested code paths repository-wide

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high3

medium2

low2

Pin third-party GitHub Actions to a commit SHAhigh

.github/workflows

pnpm/action-setup@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Upgrade the pinned dependency carrying a published advisoryhigh28 occurrences

next@16.1.6 CVE-2026-44575 (high) +27 more

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Add a test suite; this repository has nonehigh78 occurrences

78 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/release.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow

.github/workflows/release.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.