Deep-init AI review: real engineering, bigger claims than the code can carry

DEEP PROJECT REVIEW · SOURCE + TWO LIVE SITES

Most agent demos are mockups with a nice gradient. Deep-init AI is not. The live app, the promo site and a 28584-line TypeScript/TSX repository wire a tenant-aware Telegram gateway to provider fallback, server-executed tools, memory, reminders, voice, MCP servers, SSH pair tunnels and a mission-control console. The source holds 36 API routes, 59 maintenance and test scripts, encrypted registry secrets and a real replay suite. Then the marketing says the agent “can do anything a human can do on a computer” and “never sleeps.” The code backs many specific actions. It does not back those universal claims.

How it is put together

A Next.js 16 app serves the portal and 36 API routes. The session layer uses scrypt credentials, HMAC-signed HttpOnly cookies and tenant-bound pairing tokens. The agent registry stores bot tokens, owner tokens, provider keys and memory in AES-256-GCM envelopes with tenant-bound associated data; Vercel Blob shares state across lambdas while a local gateway directory supports development. Telegram webhooks or a browser poll bridge feed a provider chain, cognition packs, a typed tool executor, session log, memory and reminder ledger. SSH tunnels expose queued commands to paired machines using their own machine credentials.

Security findings: strong defaults, two edges to fix

The reviewed tenant routes usually call `requireUser`, ignore client-supplied tenant identifiers and attach server-vaulted keys only to the authenticated user. Tunnel endpoints separate owner commands from machine check-ins. Admin feedback uses an owner-role gate. These are meaningful controls. Two edges deserve immediate fixes. First, `/api/cron` performs stateful reminder delivery. When `CRON_SECRET` is absent it accepts every caller; when set, it also accepts any request carrying an `x-vercel-cron` header, which an ordinary HTTP client can supply unless the hosting edge strips or authenticates it. Require a secret in every environment and compare it timing-safely. Second, the app registers own-bot webhooks as `?t=`. Query strings can reach platform logs and analytics. Use a separate random webhook secret and look up the bot token server-side.

Encrypting a bot token at rest buys nothing if the same token ends up in a webhook URL.

What the tests and checks show

After a clean install, ESLint completes with zero errors and one warning. The Next.js production build succeeds across 38 routes, with one dynamic-filesystem tracing warning. The production dependency audit reports zero known advisories. The tool catalog freshness check passes. The snapshot replay suite passes 31 checks across calculation tool calls, unknown-tool refusal, memory fallback and a skill-catalog injection case. That is stronger evidence than most projects in this series, though the many standalone scripts are not wired into one CI workflow and no workflow is checked in.

The marketing versus what is verified

The live app is polished and reachable in English, Russian and Hebrew RTL. Pairing, provider fallback, voice, memory, reminders, server tools, MCP configuration and SSH tunnels are present in code. Yet the landing page says it can browse, click, fill forms, run 24/7 and create its own skills as universal abilities. Browser automation appears as a catalog capability and MCP option, not proof that every deployment has a persistent computer-use runtime. The reminder cron is scheduled, but 24/7 behavior still depends on Vercel, Blob, cron configuration, bot setup and provider health. Replace universals with a tested capability matrix and published uptime limits.

Licensing and keeping it running

The README repeatedly says “open source,” but the reviewed commit has no `LICENSE` file. Public source is not the same as a license to use, modify and redistribute. Add an explicit license before presenting it as open source. The registry’s merge-before-write helps serverless concurrency, but its own comments describe last-write-wins at this scale; high-volume tenants need conflict tests and stronger transactional guarantees. Provider and bot credentials are encrypted, while the webhook URL handling undermines that care.

How it looks and reads

The live portal is the best-looking work in the series: cream paper, orange terminal accents, small monospace labels and a boot-sequence panel that explain a complicated product without turning into a stock dashboard. The promo site goes dark and operational and adds a believable 30-second product story. The screenshots, the video and the Hebrew RTL are real assets. The weak spot is copy. “Can do anything,” “never sleeps,” “self-learning” and “full-time operator” promise things the architecture cannot guarantee on every deployment.

Verdict

Deep-init AI is an impressive experimental agent console: real Telegram wiring, a good tenant boundary, encrypted shared state, provider failover, a useful tool loop and replay evidence stronger than usual. It is the most technically ambitious project of the five. Before anyone trusts it as an always-on operator, it needs a locked-down cron, bot tokens out of URLs, a license, the wider test set automated and the universal claims cut back to what was measured.

Live app · Promotional site · Source

Reviewed source at commit be8604b · live app and promo checked · build, lint, audit, catalog and snapshot replay reproduced 2026-09-21