Hidden Assumptions in automatisch
12 assumptions this code never checks · 4 critical · spanning Environment, Ordering, Resource, Contract, Shape, Domain, Temporal, Scale
Every codebase relies on things it never checks. Most of them are routine. CodeSea looked at automatisch/automatisch and picked out the few most likely to cause trouble. The full list is just below.
Most of what this code assumes is routine. These 3 are the ones most likely to cause trouble here. The rest are minor; they're under "Show everything".
If requestBodySizeLimit is undefined, misconfigured, or exceeds available memory, the server could crash with OOM errors when processing large webhook payloads or silently use Express defaults that are too small
Webhook validation that requires raw request bodies (like signature verification) will fail silently or throw undefined errors if the body parsing middleware doesn't run or fails
A malformed prompt or model issue could cause runAgent() to hang indefinitely or consume excessive memory, blocking the Bull queue worker and preventing other workflows from executing
Show everything (9 more)
The Agent model exists and the database connection is available when this action runs, but doesn't handle the case where the .ee. enterprise module isn't loaded
If this fails: In non-enterprise deployments, importing Agent from agent.ee.js will throw module not found errors, causing the entire agents app to fail loading and breaking workflow execution
packages/backend/src/apps/agents/actions/run-agent/index.js:Agent.query
The $.agents.getAll() method returns an array of objects with 'id' and 'name' properties, but never validates the structure of returned agents
If this fails: If the agents service returns malformed data or the properties are named differently, the map() operation will produce dropdown options with undefined values, breaking the UI agent selection
packages/backend/src/apps/agents/dynamic-data/list-agents/index.js:$.agents.getAll()
Users will enter instanceUrl in the format 'https://subdomain.airbrake.io' as described, but no validation ensures the URL follows this pattern or is a valid URL
If this fails: Invalid URLs will be stored as connection auth data and cause API calls to fail with confusing network errors instead of clear validation messages during connection setup
packages/backend/src/apps/airbrake/auth/index.js:instanceUrl field
The Airbrake auth token remains valid indefinitely once entered, with no expiration handling or refresh mechanism
If this fails: When tokens expire or are revoked, workflows will start failing with authentication errors but the system won't proactively detect or handle token refresh, requiring manual user intervention
packages/backend/src/apps/airbrake/auth/index.js:authToken field
The agentId parameter from $.step.parameters.agentId is always a valid UUID that exists in the database, trusting the dropdown selection mechanism
If this fails: If the agent is deleted between workflow creation and execution, or if the parameter is corrupted, Agent.query().findOne() returns null and runAgent(null) will throw undefined errors
packages/backend/src/apps/agents/actions/run-agent/index.js:$.step.parameters
The passport configuration will successfully set up all OAuth strategies and session handling without checking if required environment variables (CLIENT_ID, CLIENT_SECRET) are present
If this fails: Missing OAuth credentials cause passport strategies to fail silently during initialization, leading to authentication routes returning 500 errors instead of configuration errors
packages/backend/src/app.js:configurePassport call
The number of agents returned by getAll() will be reasonable for dropdown display, with no pagination or limits applied
If this fails: With hundreds of agents, the dropdown becomes unusable and the HTTP response size grows large, potentially causing browser performance issues or request timeouts
packages/backend/src/apps/agents/dynamic-data/list-agents/index.js:$.agents.getAll()
The agentResult returned by runAgent() is always a serializable object that can be stored in the database as JSON
If this fails: If runAgent() returns circular references, functions, or other non-JSON types, $.setActionItem() will fail with serialization errors and the workflow step will crash
packages/backend/src/apps/agents/actions/run-agent/index.js:$.setActionItem
Agents never require external authentication or connection management, assuming they always use internal system credentials
If this fails: If agents need to access external APIs with user-specific credentials, the current architecture provides no way to associate connections with agent executions, limiting agent capabilities
packages/backend/src/apps/agents/index.js:supportsConnections: false
See the full structural analysis of automatisch: the pipeline, data models, and system behavior that put these assumptions in context.
Full analysis of automatisch/automatisch →Frequently Asked Questions
What does automatisch assume that could break in production?
The one most likely to cause trouble: The appConfig.requestBodySizeLimit value is set to a reasonable limit before server startup, but never validates this is actually configured or within system memory limits If this fails, If requestBodySizeLimit is undefined, misconfigured, or exceeds available memory, the server could crash with OOM errors when processing large webhook payloads or silently use Express defaults that are too small
How many hidden assumptions does automatisch have?
CodeSea found 12 assumptions automatisch relies on but never validates, 4 of them critical, spanning Environment, Ordering, Resource, Contract, Shape, Domain, Temporal, Scale. Most are routine — the analysis flags the two or three most likely to actually bite.
What is a hidden assumption?
Something the code depends on but never checks: a data shape, an ordering, an environment condition, a scale limit, or a contract with another service. It holds until the world it runs in changes, then fails silently.