Portable AI agent runtime for the JVM. One @Agent class runs on Spring AI, LangChain4j, Anthropic, or 9 more behind one SPI. Token streaming, tool calls, human approvals, and governance over WebSocket, SSE, gRPC, or WebTransport/HTTP3. Speaks MCP, A2A, and AG-UI.
This report summarizes scanner evidence for Atmosphere/atmosphere, a Java project with 3,820 GitHub stars. SynthScan examined 679,350 lines of code across 3980 source files, recording 1650 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 11.0 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 654 finding(s).
Are imports declared and package/API names verified? 506 finding(s).
Are wrappers, guards, and repeated structures necessary? 527 finding(s).
Which changes need focused human review? 1650 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1650 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | CHANGELOG.md | 2377 | `io.reactivex.rxjava3.disposables.Disposable.dispose()` on the Runner | CODE |
| CRITICAL | …springboot/checkpoint/CheckpointGovernanceE2ETest.java | 88 | assertTrue(org.atmosphere.coordinator.commitment.Ed25519CommitmentSigner.verify( | CODE |
| CRITICAL | …mosphere/samples/springboot/ragchat/KnowledgeBase.java | 75 | var vector = new org.atmosphere.ai.rag.spring.SpringAiVectorStoreContextProvider(); | CODE |
| CRITICAL | …s/springboot/ragchat/KnowledgeBaseContextProvider.java | 59 | if (!new org.atmosphere.ai.rag.spring.SpringAiVectorStoreContextProvider().isAvailable()) { | CODE |
| CRITICAL | …springboot/personalassistant/LangChain4jLlmConfig.java | 51 | return dev.langchain4j.model.openai.OpenAiStreamingChatModel.builder() | CODE |
| CRITICAL | scripts/lib/prove_gate.sh | 129 | s_noop_test() { inject_in_class "$TEST_CLASS" ' @org.junit.jupiter.api.Test void zzz() { org.junit.jupiter.api.Asse | CODE |
| CRITICAL | scripts/lib/prove_gate.sh | 137 | s_assume() { inject_in_class "$CONTRACT" ' void zzzA() { org.junit.jupiter.api.Assumptions.assumeTrue(false); }' | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 417 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 419 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 421 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 486 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 488 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 490 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 492 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 494 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 496 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 498 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 537 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 539 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 541 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 551 | var gateway = org.atmosphere.ai.gateway.GatewayProfiles.production( | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 657 | org.atmosphere.ai.cost.CostAccountantHolder.install(accountant); | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 664 | org.atmosphere.ai.cost.TokenPricingHolder.install(pricing); | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 671 | org.atmosphere.ai.cost.CostAccountantHolder.reset(); | CODE |
| CRITICAL⚡ | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 672 | org.atmosphere.ai.cost.TokenPricingHolder.reset(); | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 370 | @org.springframework.boot.autoconfigure.condition.ConditionalOnBean(FactResolver.class) | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 396 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 439 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 456 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 458 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 509 | var config = org.atmosphere.ai.identity.OAuthOboConfig.builder( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 576 | org.atmosphere.ai.gateway.AiGatewayHolder.install(gateway); | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 587 | org.atmosphere.ai.gateway.AiGatewayHolder.reset(); | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 747 | org.atmosphere.ai.resume.RunRegistryHolder.install(registry); | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 787 | org.atmosphere.ai.resume.RunRegistryHolder.reset(); | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 853 | return org.springframework.boot.autoconfigure.condition.ConditionOutcome.match( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 857 | return org.springframework.boot.autoconfigure.condition.ConditionOutcome.noMatch( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 894 | org.atmosphere.ai.resume.DurableRunSpineHolder.install( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 933 | org.atmosphere.ai.resume.DurableRunSpineHolder.reset(); | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1015 | var recorderConfig = new org.atmosphere.ai.tape.TapeRecorder.Config( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1019 | var installed = org.atmosphere.ai.tape.TapeSupport.install(store, recorderConfig); | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1074 | org.atmosphere.ai.tape.TapeSupport.uninstall(recorder); | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1107 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1259 | var builder = org.atmosphere.ai.routing.RoutingLlmClient.builder( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1275 | builder.route(org.atmosphere.ai.routing.RoutingLlmClient.RoutingRule.contentBased( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1289 | builder.route(org.atmosphere.ai.routing.RoutingLlmClient.RoutingRule.modelBased( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1304 | builder.route(org.atmosphere.ai.routing.RoutingLlmClient.RoutingRule.costBased( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1319 | builder.route(org.atmosphere.ai.routing.RoutingLlmClient.RoutingRule.latencyBased( | CODE |
| CRITICAL | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 1349 | var clientBuilder = org.atmosphere.ai.llm.OpenAiCompatibleClient.builder() | CODE |
| CRITICAL | …a/org/atmosphere/spring/boot/AtmosphereProperties.java | 987 | return new org.atmosphere.ai.routing.RoutingLlmClient.RoutingRule.ModelOption( | CODE |
| CRITICAL | …here/spring/boot/AtmosphereAdminAutoConfiguration.java | 230 | @org.springframework.beans.factory.annotation.Autowired(required = false) | CODE |
| CRITICAL | …here/spring/boot/AtmosphereAdminAutoConfiguration.java | 332 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL | …here/spring/boot/AtmosphereAdminAutoConfiguration.java | 335 | org.atmosphere.ai.devinspector.DevInspectorRecorderHolder.install(recorder); | CODE |
| CRITICAL | …rg/atmosphere/spring/boot/AtmosphereAdminEndpoint.java | 58 | @org.springframework.beans.factory.annotation.Value( | CODE |
| CRITICAL | …spring/alibaba/SpringAiAlibabaVisionWireShapeTest.java | 68 | org.atmosphere.ai.approval.ToolApprovalPolicy.annotated()); | CODE |
| CRITICAL | …spring/alibaba/SpringAiAlibabaRuntimeContractTest.java | 51 | throw new com.alibaba.cloud.ai.graph.exception.GraphRunnerException( | CODE |
| CRITICAL⚡ | …ere/ai/spring/alibaba/SpringAiAlibabaAgentRuntime.java | 442 | if (org.atmosphere.ai.plan.PlanningTools.WRITE_TODOS.equals(tool.name())) { | CODE |
| CRITICAL⚡ | …ere/ai/spring/alibaba/SpringAiAlibabaAgentRuntime.java | 448 | var agentId = org.atmosphere.ai.tool.ToolScopes.agentId(injectables, context.agentId()); | CODE |
| CRITICAL⚡ | …ere/ai/spring/alibaba/SpringAiAlibabaAgentRuntime.java | 449 | var conversationId = org.atmosphere.ai.tool.ToolScopes.conversationId(injectables); | CODE |
| CRITICAL | …tmosphere/ai/sk/SemanticKernelRuntimeContractTest.java | 181 | org.atmosphere.ai.approval.ToolApprovalPolicy.annotated()) | CODE |
| 422 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .claude/workflows/doc-drift-audit.js | 13 | // ── Scope ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .claude/workflows/doc-drift-audit.js | 16 | // ── Schemas ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .claude/workflows/doc-drift-audit.js | 73 | // ── Inventory ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .claude/workflows/doc-drift-audit.js | 96 | // ── Audit → Verify (pipelined per group) ──────────────────────────────────── | COMMENT |
| MEDIUM | .claude/workflows/doc-drift-audit.js | 198 | // ── Synthesize ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 16 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 54 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .claude/skills/obsidian-writer/vault-sync.sh | 16 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .claude/skills/obsidian-writer/vault-sync.sh | 69 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .claude/skills/obsidian-writer/test.sh | 16 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .claude/skills/obsidian-writer/test.sh | 33 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/install.sh | 14 | # ── Colors ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/install.sh | 31 | # ── Detect platform ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/install.sh | 40 | # ── Check prerequisites ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/install.sh | 63 | # ── Download ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/install.sh | 75 | # ── Install ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/install.sh | 130 | # ── Uninstall ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/install.sh | 158 | # ── Main ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | cli/e2e-test-cli-runtime.sh | 115 | # ── Cleanup ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | cli/e2e-test-cli-runtime.sh | 123 | # ── Align CLI pinned version with the locally-built SNAPSHOT ───────────────── | COMMENT |
| MEDIUM⚡ | cli/e2e-test-cli-runtime.sh | 135 | # ── Prerequisites ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 31 | # ── Helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 159 | # ── 1. atmosphere run spring-boot-chat boots and responds ─────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 191 | # ── 1b. run --env overrides an ambient environment export ──────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 220 | # ── 2. atmosphere run --port 9999 overrides port ──────────────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 244 | # ── 3. atmosphere run --env FOO=BAR propagates env ────────────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 289 | # ── 4. Second atmosphere run uses cache ───────────────────────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 313 | # ── 5. atmosphere new chat-test then standalone compile ─────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 341 | # ── 6. atmosphere new ai-test --template ai-chat then compile ───────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 358 | # ── 7. atmosphere new agent-test --template agent then compile ──────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 377 | # ── 8. atmosphere import --trust with fixture skill then compile ──────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 418 | # ── 9. Corrupted cache JAR triggers re-download ──────────────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 470 | # ── 10. atmosphere run nonexistent-sample exits non-zero ──────────────────── | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 485 | # ── Summary ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | cli/test-cli.sh | 557 | # ── --runtime scaffold + compile ────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 19 | # ── Helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 74 | # ── Prerequisites ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 92 | # ── 1. samples.json Integrity ────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 156 | # ── 2. CLI: version ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 165 | # ── 3. CLI: help ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 178 | # ── 4. CLI: list ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 189 | # ── 5. CLI: list --tag ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 202 | # ── 6. CLI: list --category ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 211 | # ── 6b. CLI: list --tag + --category (combined filter, bug fix #1) ──────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 251 | # ── 6c. CLI: info for all samples ───────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 266 | # ── 7. CLI: info ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 282 | # ── 8. CLI: info unknown sample ──────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 294 | # ── 9. CLI: run (validation only, no Java) ───────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 306 | # ── 10. CLI: unknown command ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 318 | # ── 11. CLI: install (menu rendering) ────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 341 | # ── 12. CLI: new (validation, no network) ───────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 406 | # ── 12a. CLI: sample sources come from the ref that matches VERSION ─────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 461 | # ── 12b. CLI: new (network — gated by ATMOSPHERE_NETWORK_TESTS=1) ───────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 614 | # ── 12c. CLI: --runtime overlay ──────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 780 | # ── --force: strip pre-pinned adapters before injecting ─────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 841 | # ── 12d. CLI: new --routing ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 1005 | # ── 12e. CLI: compose (gated by ATMOSPHERE_NETWORK_TESTS=1 + jbang) ─────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 1072 | # ── 13. npx: create-atmosphere-app ───────────────────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 1254 | # ── 14. samples.json <-> filesystem consistency ──────────────────────────── | COMMENT |
| MEDIUM | cli/test-cli.sh | 1302 | # ── Import command tests ─────────────────────────────────────────────────── | COMMENT |
| 401 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | feature-phases.yaml | 1 | # ABOUTME: Dark-launch register — every feature shipped disarmed (flag off, shadow mode, log-only) | COMMENT |
| LOW | jreleaser.yml | 61 | # BOM-managed dependency versions (the Quarkus extension pattern). | COMMENT |
| LOW | .agents/skills/carnet/test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .agents/skills/carnet/test.sh | 1501 | # ================================================================== pasted terminal output | COMMENT |
| LOW | .agents/skills/carnet/carnet.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .agents/skills/carnet/carnet.sh | 21 | # with REGISTRE_TRACKER — the same key and variable the limitation gates in .registre read. | COMMENT |
| LOW | .agents/skills/carnet/carnet.sh | 221 | # Whether a claim marker names the caller. A Claude Code session is its id. Every caller outside | COMMENT |
| LOW | .agents/skills/carnet/carnet.sh | 241 | # mkdir is atomic everywhere, and flock does not exist on macOS. It holds its holder's pid. | COMMENT |
| LOW | .agents/skills/carnet/hooks/auto-claim.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .agents/skills/carnet/hooks/auto-claim.sh | 21 | # guard still finds the script when the session's working directory is not the project root): | COMMENT |
| LOW | .agents/skills/carnet/hooks/auto-claim.sh | 41 | # will sometimes forget -- which is the whole failure the claim exists to prevent. So the | COMMENT |
| LOW | .agents/skills/carnet/hooks/auto-claim.sh | 61 | # claim it on the next redirect — an issue held for as long as the session runs, the human | COMMENT |
| LOW | .agents/skills/carnet/hooks/auto-claim.sh | 101 | tool=$(printf '%s' "$payload" | jq -r '.tool_name // empty' 2>/dev/null || true) | COMMENT |
| LOW | .agents/skills/carnet/hooks/auto-claim.sh | 121 | probe=$(printf '%s' "$probe" | sed -E 's/(^|[[:space:]&])[0-9]*>>?[[:space:]]*\/dev\/null//g') | COMMENT |
| LOW | .agents/skills/carnet/hooks/prompt-status.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .agents/skills/carnet/hooks/prompt-status.sh | 21 | # "UserPromptSubmit": [{ "matcher": "", "hooks": [{ "type": "command", "timeout": 20, | COMMENT |
| LOW | .agents/skills/carnet/hooks/prompt-status.sh | 41 | # was thinking about. Nothing in the text marks a wakeup — it starts with whatever the model | COMMENT |
| LOW | .agents/skills/carnet/hooks/prompt-status.sh | 121 | COMMENT | |
| LOW | .agents/skills/carnet/hooks/session-end-release.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .agents/skills/bilan/test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .agents/skills/bilan/test.sh | 41 | unset REGISTRE_TRACKER REGISTRE_SCAN_DIRS REGISTRE_EXTENSIONS CLAUDE_SCRATCHPAD_DIR GH_STUB_LOG | COMMENT |
| LOW | .agents/skills/bilan/test.sh | 361 | # ---- a registered limitation is a register entry, not work owed | COMMENT |
| LOW | .agents/skills/bilan/test.sh | 1101 | # process inside it and nothing edited in two hours. | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 21 | # that believed it was done said 10 while it still held open carnet issues. Every fact behind | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 81 | # This checkout's own git dir: .git/worktrees/<name> in a linked worktree, which is where | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 641 | [ -s "$f" ] || return 0 | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 661 | # procedure correctly was capped at 6 for complying, with no action available to it: nothing to | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 1081 | } | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 1201 | # git. The verdict is printed — it is genuinely useful to see — and the number stays about work | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 1381 | if [ "$JSON" = 1 ]; then | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 1421 | printf '%s unseen\n' "$sid" | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 1461 | # A worktree with an agent actively working in it is not something a dead session left behind. | COMMENT |
| LOW | .agents/skills/bilan/bilan.sh | 1501 | why=$(session_state "$id" "$f" "$registered"); state=$? | COMMENT |
| LOW | .agents/skills/bilan/hooks/session-start-sweep.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .agents/skills/bilan/hooks/session-start-sweep.sh | 21 | # | COMMENT |
| LOW | .agents/skills/bilan/hooks/stop-gate.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .agents/skills/bilan/hooks/stop-gate.sh | 21 | # paragraph; a wrong number that can STOP a session costs every turn it has left, and fixing one | COMMENT |
| LOW | .agents/skills/bilan/hooks/stop-gate.sh | 61 | COMMENT | |
| LOW | .claude/hooks/check-drift-log.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .claude/hooks/check-drift-log.sh | 81 | exit 0 | COMMENT |
| LOW | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 21 | # This is the manual counterpart to scripts/release-gate-samples.sh: that | COMMENT |
| LOW | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 41 | # [--jvm-arg -Dx=y]... [--timeout SECONDS] | COMMENT |
| LOW | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 61 | if ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null)" && [[ -n "$ROOT" ]]; then | COMMENT |
| LOW | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 81 | # Note the ordering guarantee this relies on: `env -u FOO FOO=bar` unsets first | COMMENT |
| LOW | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 141 | # sample-matrix.md calls this boot type `exec` and grpc-chat uses it; before | COMMENT |
| LOW | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 161 | # released versions of this project, and "9" sorts above "6", so a leftover | COMMENT |
| LOW | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 321 | # a differently-named property does not silently boot on the default | COMMENT |
| LOW | .claude/skills/obsidian-writer/vault-sync.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .claude/skills/obsidian-writer/vault-sync.sh | 21 | # `push -m <msg> <path>…` to commit and publish your notes. | COMMENT |
| LOW | .claude/skills/obsidian-writer/vault-sync.sh | 41 | # conflicted files are left as committed, and the message names every tracked | COMMENT |
| LOW | .claude/skills/obsidian-writer/vault-sync.sh | 61 | # already published that an edit made without that version (a concurrent one) was | COMMENT |
| LOW | .claude/skills/obsidian-writer/test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .claude/skills/obsidian-writer/test.sh | 21 | # session reads: for `push`, 0 only when origin/main ends up holding each of its | COMMENT |
| LOW | cli/e2e-test-runtime-overlay.sh | 1 | #!/bin/sh | COMMENT |
| LOW | cli/e2e-test-runtime-overlay.sh | 101 | # Args: | COMMENT |
| LOW | cli/e2e-test-runtime-overlay.sh | 181 | # cap the boot at 300s, but separating download from boot makes the | COMMENT |
| LOW | cli/e2e-test-runtime-overlay.sh | 241 | # SIGTERM and let the cleanup trap mop up if the JVM stalls. | COMMENT |
| LOW | cli/e2e-test-runtime-overlay.sh | 281 | COMMENT | |
| 315 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .agents/skills/bilan/test.sh | 54 | # at whatever checkout the harness was launched from, and the suite committed to it and tried | COMMENT |
| MEDIUM | .agents/skills/bilan/test.sh | 120 | # keeps the harness measurable throughout; the unmeasured case has its own block below, where it | COMMENT |
| MEDIUM | .agents/skills/bilan/test.sh | 1138 | # The harness's own guard. `mktemp -d -t <prefix>` returns empty on GNU, `|| exit 1` inside | COMMENT |
| MEDIUM | .agents/skills/bilan/bilan.sh | 1135 | # message is text the session or the harness wrote, and the transcript says so (`promptSource: | COMMENT |
| MEDIUM | .claude/hooks/check-drift-log.sh | 4 | # session transcript and blocks the stop if .harness/drift-log.md was not | COMMENT |
| MEDIUM⚡ | cli/test-cli.sh | 688 | # via a tiny harness script. | COMMENT |
| MEDIUM⚡ | cli/test-cli.sh | 695 | # Stand-alone harness that calls apply_runtime_overlay with the env the | COMMENT |
| MEDIUM | cli/test-cli.sh | 861 | # Stand-alone harness that calls inject_routing_block with the env the real CLI | COMMENT |
| MEDIUM⚡ | …-personal-assistant/src/main/resources/application.yml | 27 | # Deep-agent harness — three surfaces, no app-wide flag needed here: | COMMENT |
| MEDIUM⚡ | …-personal-assistant/src/main/resources/application.yml | 29 | # (harness() defaults to {Harness.ALL}) — the PrimaryAssistant | COMMENT |
| MEDIUM⚡ | …-personal-assistant/src/main/resources/application.yml | 30 | # coordinator keeps fleet delegation on this way; harness = {} opts | COMMENT |
| MEDIUM⚡ | …-personal-assistant/src/main/resources/application.yml | 33 | # UpstreamMcpAgent declares harness = {Harness.ALL} for its | COMMENT |
| MEDIUM⚡ | …-personal-assistant/src/main/resources/application.yml | 37 | # 3. The app-wide atmosphere.ai.harness.enabled flag is tri-state: | COMMENT |
| MEDIUM⚡ | …-personal-assistant/src/main/resources/application.yml | 39 | # bare @AiEndpoint the full harness, false is the kill switch that | COMMENT |
| MEDIUM⚡ | …-personal-assistant/src/main/resources/application.yml | 40 | # beats every annotation; atmosphere.ai.harness.exclude-paths carves | COMMENT |
| MEDIUM⚡ | …-personal-assistant/src/main/resources/application.yml | 43 | # (/api/console/info, "harness" section). | COMMENT |
| MEDIUM | …ot-reattach-harness/src/main/resources/application.yml | 7 | # The reattach harness is a CI-only surface; leave auth off so the | COMMENT |
| MEDIUM | scripts/validate-doc-thirdparty-versions.sh | 23 | # .harness/thirdparty-version-allowlist.txt holds documented exceptions. | COMMENT |
| MEDIUM | scripts/validate-backend-class-refs.sh | 20 | # (2) appear in `.harness/external-class-allowlist.txt` (third-party | COMMENT |
| MEDIUM⚡ | scripts/validate-no-private-handle.sh | 18 | # - Skips `.harness/sessions/` (transient session transcripts that are | COMMENT |
| MEDIUM⚡ | scripts/validate-no-private-handle.sh | 22 | # `.harness/private-handle-allowlist.txt` (line-based glob list, `#` | COMMENT |
| MEDIUM | scripts/validate-doc-version-alignment.sh | 20 | # - skips .harness/drift-log.md, CHANGELOG.md and the site's whats-new.md | COMMENT |
| MEDIUM | scripts/validate-doc-version-alignment.sh | 22 | # - honours .harness/doc-version-allowlist.txt for documented exceptions. | COMMENT |
| MEDIUM | scripts/validate-blog-claims.sh | 4 | # Validates every claim in .harness/blog-claims.json against a git ref | COMMENT |
| MEDIUM | scripts/validate-blog-claims.sh | 12 | # (EvidenceConsumerGrepPinTest); evidence paths under .harness/ are | COMMENT |
| MEDIUM | scripts/validate-no-beta-on-main.sh | 18 | # - .harness/drift-log.md : append-only historical narrative | COMMENT |
| MEDIUM | scripts/validate-doc-symbols.sh | 15 | # .harness/doc-symbol-allowlist.txt (the curated set of external-framework / | COMMENT |
| MEDIUM | scripts/validate-atmosphere-doc-version.sh | 38 | # versions you upgrade FROM), CHANGELOG.md, .harness/drift-log.md, and the | COMMENT |
| MEDIUM | scripts/validate-atmosphere-doc-version.sh | 39 | # site's whats-new.md. .harness/atmosphere-doc-version-allowlist.txt holds any | COMMENT |
| MEDIUM⚡ | scripts/regen-capability-snapshot.sh | 3 | # Regenerate .harness/capabilities.snapshot.json from canonical sources. | COMMENT |
| MEDIUM⚡ | scripts/regen-capability-snapshot.sh | 11 | # Output: .harness/capabilities.snapshot.json (deterministic, alphabetical). | COMMENT |
| MEDIUM | scripts/validate-capability-claims.sh | 5 | # .harness/capabilities.snapshot.json. | COMMENT |
| MEDIUM | scripts/validate-capability-claims.sh | 27 | # .harness/enumeration-allowlist.txt; dated audits under docs/audits/ | COMMENT |
| MEDIUM | scripts/validate-facts-registry.sh | 4 | # truth in .harness/facts.json: | COMMENT |
| MEDIUM | scripts/validate-facts-registry.sh | 28 | # Append-only / historical surfaces (.harness/drift-log.md, CHANGELOG.md, | COMMENT |
| MEDIUM | scripts/regen-skillcards.sh | 6 | # 1. .harness/capabilities.snapshot.json | COMMENT |
| MEDIUM | scripts/regen-skillcards.sh | 200 | # Drift between this file and .harness/capabilities.snapshot.json breaks | COMMENT |
| MEDIUM | scripts/validate-no-phantom-javadoc-refs.sh | 17 | # .harness/phantom-javadoc-allowlist.txt (external types). | COMMENT |
| MEDIUM | scripts/check-website-urls.sh | 23 | # Honours .harness/url-allowlist.txt (substring match) for URLs that are known | COMMENT |
| MEDIUM | scripts/check-website-urls.sh | 68 | # Markdown/markup punctuation in Python (robust against ")**", "):", "].", | COMMENT |
| MEDIUM | scripts/check-website-urls.sh | 158 | # none, the probe harness failed — do NOT report "OK". | COMMENT |
| MEDIUM | scripts/scan-skillcards.sh | 29 | # - JSON report at .harness/skillcard-scan-report.json (for CI parsing) | COMMENT |
| MEDIUM | scripts/validate-no-orphan-classes.sh | 35 | # * not in .harness/orphan-class-allowlist.txt. | COMMENT |
| MEDIUM | scripts/validate-no-orphan-classes.sh | 84 | # by OTHER modules' tests or by a JMH/integration harness by design (e.g. | COMMENT |
| MEDIUM | scripts/validate-drift-log.sh | 3 | # Structural-hygiene validator for .harness/drift-log.md. | COMMENT |
| MEDIUM | scripts/lib/prove_gate.sh | 57 | # as a no-op. Never let a test harness revert paths it did not write. | COMMENT |
| MEDIUM | .github/workflows/integration-tests.yml | 12 | # <groups> filter empty (see .harness/drift-log.md, 2026-07-01). | COMMENT |
| MEDIUM | .github/workflows/release-4x.yml | 105 | # evidence behind each public claim in .harness/blog-claims.json. | COMMENT |
| MEDIUM | .github/workflows/release-4x.yml | 423 | # Maven GAV cited by .harness/blog-claims.json to answer HTTP 200 at | COMMENT |
| MEDIUM | .github/workflows/e2e.yml | 86 | # .harness/playwright-project-exclusions.txt, and when a spec file is | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 59 | # .harness/playwright-project-exclusions.txt. Nine projects once sat in no | COMMENT |
| MEDIUM⚡ | .github/workflows/foundation-e2e.yml | 151 | # ── Reattach-harness sample ─────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/foundation-e2e.yml | 152 | # Deterministic harness for the mid-stream reattach wire. Runs on | COMMENT |
| MEDIUM | .github/workflows/foundation-e2e.yml | 167 | # The harness exposes the AI endpoint only; /actuator isn't wired. | COMMENT |
| MEDIUM | modules/spring-ai-alibaba/SKILLCARD.yaml | 3 | # Drift between this file and .harness/capabilities.snapshot.json breaks | COMMENT |
| MEDIUM | …ere/ai/spring/alibaba/SpringAiAlibabaAgentRuntime.java | 70 | * {@code ChatModel}), {@link AiCapability#PLANNING} (harness planning | COMMENT |
| MEDIUM | modules/semantic-kernel/SKILLCARD.yaml | 3 | # Drift between this file and .harness/capabilities.snapshot.json breaks | COMMENT |
| MEDIUM | modules/cohere/SKILLCARD.yaml | 3 | # Drift between this file and .harness/capabilities.snapshot.json breaks | COMMENT |
| MEDIUM | modules/crewai/SKILLCARD.yaml | 3 | # Drift between this file and .harness/capabilities.snapshot.json breaks | COMMENT |
| MEDIUM | …org/atmosphere/coordinator/annotation/Coordinator.java | 79 | * {@link Harness#ALL} is the default. Opt down with {@code harness = {}} | COMMENT |
| 12 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | CHANGELOG.md | 1720 | `https://atmosphere.async-io.org/extensions/guardrails/v1`. | CODE |
| MEDIUM | CHANGELOG.md | 1998 | ### Added — Observability, grounded facts, guardrails, flow viewer (`1df67cdd7d`) | COMMENT |
| MEDIUM | README.md | 179 | See the full [capability matrix](modules/ai/README.md#capability-matrix) for text streaming, tool calling, structured ou | CODE |
| MEDIUM | README.md | 196 | | [Compliance evidence](https://atmosphere.github.io/docs/tutorial/32-owasp-agentic-matrix/) | `atmosphere-ai`, `atmosph | CODE |
| MEDIUM | README.md | 321 | | Governance & verification | [Governance](https://atmosphere.github.io/docs/reference/governance/) · [Agent scope](http | CODE |
| MEDIUM | README.md | 334 | | [atmosphere-skills](https://github.com/Atmosphere/atmosphere-skills) | Curated agent skill files: personality, tools, | CODE |
| MEDIUM | …de/skills/release-sample-sweep/references/cli-sweep.md | 97 | ### 3. `atmosphere new` → scaffold, compile, run | COMMENT |
| MEDIUM | docs/runtime-selection.md | 160 | # applied to the scaffold's pom.xml) | COMMENT |
| MEDIUM | cli/e2e-test-runtime-overlay.sh | 251 | # scaffold + boot + assert. The CLI is the only path to several runtimes | COMMENT |
| MEDIUM | cli/e2e-test-runtime-overlay.sh | 290 | # after force-swap. The other candidate samples (multi-agent) have their | COMMENT |
| MEDIUM⚡ | cli/e2e-test-cli-runtime.sh | 128 | # script runs, so point the CLI at that version for the scaffold-then-compile | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 6 | # scaffold-then-compile, and error handling. Requires Java 21+ and Maven. | COMMENT |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 360 | # — it was stale scaffolding hidden behind earlier failures in CI.) | COMMENT |
| MEDIUM⚡ | cli/test-cli.sh | 557 | # ── --runtime scaffold + compile ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | cli/test-cli.sh | 558 | # For each scaffold-and-compile overlay runtime, scaffold ai-chat with | COMMENT |
| MEDIUM⚡ | cli/test-cli.sh | 678 | # parse arguments far enough to call apply_runtime_overlay AFTER scaffolding, | COMMENT |
| MEDIUM | cli/test-cli.sh | 410 | # sample code with released artefacts and the scaffold cannot compile. | COMMENT |
| MEDIUM | cli/test-cli.sh | 444 | # installs into the local repo before scaffolding). | COMMENT |
| MEDIUM | cli/test-cli.sh | 477 | # Portable Maven wrapper: scaffold must be runnable with just a JDK (the | COMMENT |
| MEDIUM | cli/test-cli.sh | 489 | # Reactor-internal GIB files must NOT leak into a standalone scaffold. | COMMENT |
| MEDIUM | cli/test-cli.sh | 543 | # and the scaffold died with "cannot find symbol: hasReachableModel". | COMMENT |
| MEDIUM | cli/test-cli.sh | 600 | # shipped without scaffold coverage and went unscaffoldable for days | COMMENT |
| MEDIUM | cli/test-cli.sh | 844 | # default (the scaffold is byte-identical without it). Like the --runtime | COMMENT |
| MEDIUM | cli/test-cli.sh | 862 | # provides. \$1 = template, \$2 = scaffold dir. | COMMENT |
| MEDIUM | cli/test-cli.sh | 876 | # Build a scaffold-shaped dir holding a COPY of the real ai-chat application.yml | COMMENT |
| MEDIUM | cli/test-cli.sh | 926 | # No-op: a scaffold dir with NO application.yml must warn + return 0 (graceful; | COMMENT |
| MEDIUM | cli/test-cli.sh | 927 | # the routing block is optional, it must not break scaffolding). | COMMENT |
| MEDIUM | cli/test-cli.sh | 982 | # Network-gated end-to-end: scaffold a real ai-chat with --routing and confirm | COMMENT |
| MEDIUM | cli/homebrew/atmosphere.rb | 5 | # scaffolding new projects, and exploring the Atmosphere framework. | COMMENT |
| MEDIUM | generator/test-compose.sh | 2 | # Integration tests for `atmosphere compose` — generates multi-agent projects and verifies they compile. | COMMENT |
| MEDIUM | samples/spring-boot-rag-chat/README.md | 1 | # Atmosphere RAG Agent Sample | COMMENT |
| MEDIUM | samples/spring-boot-rag-chat/README.md | 119 | ## RAG Injection Safety (on by default) | COMMENT |
| MEDIUM | …pring-boot-rag-chat/src/main/resources/application.yml | 1 | # Atmosphere RAG Chat - Configuration | COMMENT |
| MEDIUM | …pring-boot-rag-chat/src/main/resources/application.yml | 70 | # Distinct from LLM_MODEL (a chat model id): the embedding model has to | COMMENT |
| MEDIUM | …g-chat/src/main/resources/docs/atmosphere-ai-module.md | 38 | ## Context Providers (RAG) | COMMENT |
| MEDIUM | …a/org/atmosphere/samples/springboot/aichat/AiChat.java | 83 | // simulated response through the same pipeline, so guardrails, | COMMENT |
| MEDIUM | samples/spring-boot-ms-governance-chat/README.md | 21 | │ ├── FaqRetrievalInterceptor.java # RAG-lite: FAQ snippet into request metadata | CODE |
| MEDIUM | …nance-chat/src/main/resources/atmosphere-policies.yaml | 122 | # ── Tier 6: common agentic-hijack probes (audit-only) ─────────────────── | COMMENT |
| MEDIUM | …atmosphere/samples/springboot/aitools/AiToolsChat.java | 81 | // otherwise the real runtime streams — guardrails, interceptors, | COMMENT |
| MEDIUM | .harness/drift-log.md | 189 | | 29 | An earlier project memory referenced the JS resilience roadmap as "auth → offline queue → history sync → presence | CODE |
| MEDIUM | .harness/drift-log.md | 501 | | 53 | `modules/ai/src/main/java/org/atmosphere/ai/memory/LongTermMemory.java:25` Javadoc read "Backed by a `FactStore` | CODE |
| MEDIUM | .harness/drift-log.md | 549 | ## 2026-05-22 — Hallucinated head SHA in `gh run cancel` filter (`docs/drift-log-sha-hallucination`) | COMMENT |
| MEDIUM | .harness/drift-log.md | 588 | | 56 | `CHANGELOG.md` `[Unreleased]` SKILLCARD entry (the squashed `ac146ca308 feat(ai,harness): NVIDIA-style verified a | CODE |
| MEDIUM | .harness/drift-log.md | 840 | | 68 | The Quarkus medium-4 subagent (the one that hit spec mismatches and stopped before completing) reported verbatim: | CODE |
| MEDIUM | .harness/drift-log.md | 1068 | | 95 | `modules/ai/src/main/java/org/atmosphere/ai/bridge/package-info.java:29` listed ``{@code GrpcProtocolBridge} — {@ | CODE |
| MEDIUM | scripts/validate-no-private-handle.sh | 7 | # Background: a "no more hallucinations" review on 2026-05-23 caught the | COMMENT |
| MEDIUM | scripts/promote-changelog.py | 13 | # match the project's no-hallucination rule. | COMMENT |
| MEDIUM | .github/workflows/cli-e2e.yml | 97 | # ATMOSPHERE_NETWORK_TESTS=1) — for every overlay runtime, scaffold | COMMENT |
| MEDIUM | .github/workflows/cli-e2e.yml | 151 | # Compile the scaffold against the locally-built SNAPSHOT (installed | COMMENT |
| MEDIUM | .github/workflows/native-image-ci.yml | 203 | # through the same pipeline (guardrails, interceptors, metrics) a real | COMMENT |
| MEDIUM | .github/workflows/e2e.yml | 81 | # agent, orchestration-primitives, admin-coverage) are now mapped — | COMMENT |
| MEDIUM | .github/workflows/e2e.yml | 110 | # admin-coverage, and orchestration-primitives specs are now | COMMENT |
| MEDIUM | .github/workflows/cli-install.yml | 86 | # exec the CLI, but the first scaffold step fails with | COMMENT |
| MEDIUM⚡ | .github/workflows/foundation-e2e.yml | 339 | # RAG console on port 8080, keyless. Proves @Command slash commands | COMMENT |
| MEDIUM⚡ | .github/workflows/foundation-e2e.yml | 342 | # RAG retrieval. Keyless → deterministic DemoAgentRuntime. | COMMENT |
| MEDIUM | …osphere/spring/boot/AtmosphereAiEndpointRegistrar.java | 53 | // Quarkus-native classpaths pick up guardrails too — Spring beans win | COMMENT |
| MEDIUM | …or/processor/CoordinatorSkillScopeConfinementTest.java | 42 | * {@code ## Guardrails} lines — so those guardrails must be an <em>enforced</em> | COMMENT |
| MEDIUM | …or/processor/CoordinatorSkillScopeConfinementTest.java | 171 | // the skill's guardrails (POLITE_REDIRECT semantics) must win, matching | STRING |
| MEDIUM | …osphere/spring/boot/AtmosphereAiAutoConfiguration.java | 188 | // registrar applied guardrails to the default endpoint only and | COMMENT |
| MEDIUM | …osphere/spring/boot/AtmosphereAiEndpointRegistrar.java | 52 | // plain-servlet / Quarkus-native classpaths pick up guardrails too — | COMMENT |
| 31 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …e/samples/springboot/guardedemail/DemoPlanRuntime.java | 0 | { "goal": "summarize", "steps": [ { "label": "fetch", "toolname": "fetch_emails", "arguments": { "folder": "inbox" }, "r | STRING |
| HIGH | …va/org/atmosphere/admin/ai/VerifierControllerTest.java | 0 | { "goal": "summarize", "steps": [ { "label": "fetch", "toolname": "fetch_emails", "arguments": { "folder": "inbox" }, "r | STRING |
| HIGH | …st/java/org/atmosphere/verifier/PlanAndVerifyTest.java | 0 | { "goal": "summarize", "steps": [ { "label": "fetch", "toolname": "fetch_emails", "arguments": { "folder": "inbox" }, "r | STRING |
| HIGH | …va/org/atmosphere/verifier/WorkflowJsonParserTest.java | 0 | { "goal": "summarize", "steps": [ { "label": "fetch", "toolname": "fetch_emails", "arguments": { "folder": "inbox" }, "r | STRING |
| HIGH | …c/test/java/org/atmosphere/verifier/VerifyCliTest.java | 0 | { "goal": "summarize", "steps": [ { "label": "fetch", "toolname": "fetch_emails", "arguments": { "folder": "inbox" }, "r | STRING |
| HIGH | …g/atmosphere/checkpoint/SqliteCheckpointStoreTest.java | 0 | create table if not exists checkpoints ( id text primary key, parent_id text, coordination_id text not null, agent_name | STRING |
| HIGH | …va/org/atmosphere/checkpoint/SchemaMigrationsTest.java | 0 | create table if not exists checkpoints ( id text primary key, parent_id text, coordination_id text not null, agent_name | STRING |
| HIGH | …a/org/atmosphere/checkpoint/SqliteCheckpointStore.java | 0 | create table if not exists checkpoints ( id text primary key, parent_id text, coordination_id text not null, agent_name | STRING |
| HIGH | …egrationtests/mcp/McpAuthorizationIntegrationTest.java | 0 | {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{ "name":"echo","arguments":{"text":"hi"}}} | STRING |
| HIGH | …/atmosphere/quarkus/deployment/McpQuarkusAuthTest.java | 0 | {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{ "name":"echo","arguments":{"text":"hi"}}} | STRING |
| HIGH | …sphere/quarkus/deployment/McpQuarkusVertxAuthTest.java | 0 | {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{ "name":"echo","arguments":{"text":"hi"}}} | STRING |
| HIGH | …c/test/java/org/atmosphere/mcp/McpSpecSurfaceTest.java | 0 | "_meta":{ "io.modelcontextprotocol/protocolversion":"2026-07-28", "io.modelcontextprotocol/clientinfo":{"name":"c","vers | STRING |
| HIGH | …/mcp/src/test/java/org/atmosphere/mcp/McpMrtrTest.java | 0 | "_meta":{ "io.modelcontextprotocol/protocolversion":"2026-07-28", "io.modelcontextprotocol/clientinfo":{"name":"c","vers | STRING |
| HIGH | …est/java/org/atmosphere/mcp/McpTasksExtensionTest.java | 0 | "_meta":{ "io.modelcontextprotocol/protocolversion":"2026-07-28", "io.modelcontextprotocol/clientinfo":{"name":"c","vers | STRING |
| HIGH | …/mcp/src/test/java/org/atmosphere/mcp/McpAppsTest.java | 0 | "_meta":{ "io.modelcontextprotocol/protocolversion":"2026-07-28", "io.modelcontextprotocol/clientinfo":{"name":"c","vers | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/obsidian-vault-setup/SKILL.md | 43 | ### Step 1: Verify prerequisites | COMMENT |
| LOW | .claude/skills/obsidian-vault-setup/SKILL.md | 58 | ### Step 2: Clone atmosphere-vault | COMMENT |
| LOW | .claude/skills/obsidian-vault-setup/SKILL.md | 70 | ### Step 3: Install plugins | COMMENT |
| LOW | .claude/skills/obsidian-vault-setup/SKILL.md | 89 | ### Step 4: Create claude_docs symlink | COMMENT |
| LOW | .claude/skills/obsidian-vault-setup/SKILL.md | 107 | ### Step 5: Open vault in Obsidian | COMMENT |
| LOW | .claude/skills/obsidian-vault-setup/SKILL.md | 120 | ### Step 6: Verify sync flow | COMMENT |
| LOW⚡ | samples/spring-boot-multi-agent-startup-team/README.md | 128 | // Step 1: Research (sequential) | COMMENT |
| LOW⚡ | samples/spring-boot-multi-agent-startup-team/README.md | 132 | // Step 2: Strategy + Finance (parallel) | COMMENT |
| LOW⚡ | samples/spring-boot-multi-agent-startup-team/README.md | 139 | // Step 3: Writer synthesis | COMMENT |
| LOW⚡ | samples/spring-boot-multi-agent-startup-team/README.md | 143 | // Step 4: CEO LLM synthesis | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 210 | // Step 1: Create instance and inject fields | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 214 | // Step 2: Parse skill file | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 232 | // Step 3: Scan @Command methods | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 236 | // Step 4: Find @Prompt method | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 241 | // Step 5: Resolve AI infrastructure | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 265 | // Step 6: Parse @Fleet and resolve agents | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 275 | // Step 7: Validate fleet | COMMENT |
| LOW | …sphere/coordinator/processor/CoordinatorProcessor.java | 286 | // Step 8: Create AgentFleet and AiEndpointHandler with injectable | COMMENT |
| LOW | …sphere/coordinator/processor/CoordinatorProcessor.java | 397 | // Step 9: Register handler | COMMENT |
| LOW | …sphere/coordinator/processor/CoordinatorProcessor.java | 408 | // Step 10: Register protocol bridges | COMMENT |
| LOW | …sphere/coordinator/processor/CoordinatorProcessor.java | 449 | // Step 11: Log fleet topology | COMMENT |
| LOW⚡ | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 144 | // Step 3: Scan @Command methods | COMMENT |
| LOW⚡ | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 148 | // Step 4: Find @Prompt or use synthetic default | COMMENT |
| LOW⚡ | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 154 | // Step 5: Resolve AI infrastructure | COMMENT |
| LOW⚡ | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 334 | // Step 12: Log summary | COMMENT |
| LOW | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 109 | // Step 1: Create instance and inject fields | COMMENT |
| LOW | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 124 | // Step 2: Parse skill file → system prompt | COMMENT |
| LOW | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 181 | // Step 6: Create AgentHandler | COMMENT |
| LOW | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 274 | // Step 7: Register handler at /atmosphere/agent/{name} | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | atmosphere.js/tests/unit/webtransport.test.ts | 100 | function createMockTransportInstance( | CODE |
| LOW | atmosphere.js/src/hooks/svelte/messageHistory.ts | 40 | export function createMessageHistoryStore( | CODE |
| LOW | …here.js/src/hooks/react/useExternalConnectionStatus.ts | 97 | export function useExternalConnectionStatus( | CODE |
| LOW | modules/crewai/sidecar/tests/test_sessions_lifecycle.py | 45 | def test_post_session_drains_then_delete_is_idempotent(app_with_crew) -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_sessions_lifecycle.py | 73 | def test_delete_during_stream_cancels_producer() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools_in_sessions.py | 69 | def test_session_with_tools_injects_them_on_each_agent() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools_in_sessions.py | 105 | def test_session_with_tools_calls_callback_when_tool_fires() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools_in_sessions.py | 168 | def test_session_without_tools_works_unchanged() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools_in_sessions.py | 246 | def test_session_with_system_prompt_threads_into_backstory() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_wire_shape.py | 66 | def test_session_emits_session_then_tokens_then_usage_then_done() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_wire_shape.py | 136 | def test_crew_failure_during_stream_emits_error_frame() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_wire_shape.py | 165 | def test_rejects_oversized_message() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_health.py | 20 | def test_health_returns_ok_with_version(client) -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 51 | def test_build_remote_tool_pydantic_schema() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 85 | def test_build_remote_tool_honours_structural_facets() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 129 | def test_build_remote_tool_facetless_array_still_degrades_to_any() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 141 | def test_build_remote_tool_unknown_type_falls_back_to_any(caplog) -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 161 | def test_remote_tool_posts_to_callback() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 202 | def test_remote_tool_propagates_error() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 226 | def test_remote_tool_propagates_http_error() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 247 | def test_build_remote_tool_rejects_empty_callback_url() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 257 | def test_build_remote_tool_rejects_empty_callback_token() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 268 | def test_remote_tool_sends_auth_token_header() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 295 | def test_inject_tools_into_crew_appends_to_each_agent() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 314 | def test_inject_tools_handles_none_tools_field() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 325 | def test_inject_tools_noop_when_no_tools() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 337 | def test_apply_system_prompt_prepends_block_to_backstory() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 354 | def test_apply_system_prompt_idempotent() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 370 | def test_apply_system_prompt_noop_on_empty() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 377 | def test_apply_max_iter_bounds_every_agent() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 388 | def test_apply_max_iter_ignores_a_nonpositive_value() -> None: | CODE |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 399 | def test_apply_max_iter_tolerates_a_crew_with_no_agents() -> None: | CODE |
| LOW | …-starter/frontend/src/composables/useAtmosphereChat.ts | 653 | function markLastPromptUndelivered() { | CODE |
| LOW | …es/integration-tests/e2e/helpers/transport-fallback.ts | 8 | export async function advertiseUnreachableWebTransport(page: Page): Promise<void> { | CODE |
| LOW | …/main/java/org/atmosphere/mcp/ToolResponseHandler.java | 40 | public class ToolResponseHandler implements AtmosphereHandler { | CODE |
| LOW | …/ai/langchain4j/ToolAwareStreamingResponseHandler.java | 48 | class ToolAwareStreamingResponseHandler implements StreamingChatResponseHandler { | CODE |
| LOW | …ai/langchain4j/AtmosphereStreamingResponseHandler.java | 34 | public class AtmosphereStreamingResponseHandler implements StreamingChatResponseHandler { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …de/skills/release-sample-sweep/scripts/sweep-sample.sh | 39 | # Usage: | COMMENT |
| LOW | .claude/skills/obsidian-writer/vault-sync.sh | 65 | # Usage: | COMMENT |
| LOW | scripts/sign-skillcards.sh | 27 | # Usage: | COMMENT |
| LOW | scripts/verify-skillcards.sh | 10 | # Usage: | COMMENT |
| LOW⚡ | scripts/validate-no-private-handle.sh | 28 | # Usage: | COMMENT |
| LOW | scripts/validate-blog-claims.sh | 30 | # Usage: | COMMENT |
| LOW⚡ | scripts/test-channels-manual.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/pre-push-validate.sh | 18 | # Usage: | COMMENT |
| LOW | scripts/architectural-validation.sh | 14 | # Usage: | COMMENT |
| LOW | scripts/release-gate-samples.sh | 32 | # Usage: | COMMENT |
| LOW⚡ | scripts/regen-capability-snapshot.sh | 21 | # Usage: | COMMENT |
| LOW | scripts/regen-skillcards.sh | 34 | # Usage: | COMMENT |
| LOW | scripts/validate-dangling-doc-comments.sh | 21 | # Usage: | COMMENT |
| LOW | scripts/scan-skillcards.sh | 31 | # Usage: | COMMENT |
| LOW | scripts/benchmarks/run-streaming-load.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/benchmarks/run-jmh.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/benchmarks/vt-pinning-check.sh | 9 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 210 | // Step 1: Create instance and inject fields | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 214 | // Step 2: Parse skill file | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 232 | // Step 3: Scan @Command methods | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 236 | // Step 4: Find @Prompt method | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 241 | // Step 5: Resolve AI infrastructure | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 265 | // Step 6: Parse @Fleet and resolve agents | COMMENT |
| LOW⚡ | …sphere/coordinator/processor/CoordinatorProcessor.java | 275 | // Step 7: Validate fleet | COMMENT |
| LOW | …sphere/coordinator/processor/CoordinatorProcessor.java | 286 | // Step 8: Create AgentFleet and AiEndpointHandler with injectable | COMMENT |
| LOW | …sphere/coordinator/processor/CoordinatorProcessor.java | 397 | // Step 9: Register handler | COMMENT |
| LOW | …sphere/coordinator/processor/CoordinatorProcessor.java | 408 | // Step 10: Register protocol bridges | COMMENT |
| LOW | …sphere/coordinator/processor/CoordinatorProcessor.java | 449 | // Step 11: Log fleet topology | COMMENT |
| LOW⚡ | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 144 | // Step 3: Scan @Command methods | COMMENT |
| LOW⚡ | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 148 | // Step 4: Find @Prompt or use synthetic default | COMMENT |
| LOW⚡ | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 154 | // Step 5: Resolve AI infrastructure | COMMENT |
| LOW⚡ | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 334 | // Step 12: Log summary | COMMENT |
| LOW | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 109 | // Step 1: Create instance and inject fields | COMMENT |
| LOW | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 124 | // Step 2: Parse skill file → system prompt | COMMENT |
| LOW | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 181 | // Step 6: Create AgentHandler | COMMENT |
| LOW | …ava/org/atmosphere/agent/processor/AgentProcessor.java | 274 | // Step 7: Register handler at /atmosphere/agent/{name} | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cli/install.sh | 126 | printf " atmosphere new my-app # Create a new project\n" | CODE |
| MEDIUM | cli/e2e-test-cli-runtime.sh | 382 | # Create a minimal fixture skill file | COMMENT |
| MEDIUM | cli/test-cli.sh | 1308 | # Create a test skill file with YAML frontmatter and ## Tools | COMMENT |
| MEDIUM | cli/homebrew/atmosphere.rb | 25 | # Create a wrapper that sets JAVA_HOME and links samples.json | COMMENT |
| MEDIUM | cli/homebrew/atmosphere.rb | 46 | atmosphere new my-app # Create a project | CODE |
| MEDIUM | …-classroom/src/main/resources/atmosphere-policies.yaml | 4 | # This file is loaded by PoliciesConfig at startup and parsed into | COMMENT |
| MEDIUM⚡ | scripts/validation-patterns.toml | 2 | # This file defines patterns that indicate code quality anti-patterns. | COMMENT |
| MEDIUM | .github/workflows/release-4x.yml | 765 | # Create the ZIP with the well-formed layout | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/promote-changelog.py | 19 | CODE | |
| LOW | modules/crewai/sidecar/tests/test_sessions_lifecycle.py | 20 | CODE | |
| LOW | modules/crewai/sidecar/tests/conftest.py | 22 | CODE | |
| LOW | modules/crewai/sidecar/tests/test_tools_in_sessions.py | 21 | CODE | |
| LOW | modules/crewai/sidecar/tests/test_wire_shape.py | 21 | CODE | |
| LOW | modules/crewai/sidecar/tests/test_health.py | 15 | CODE | |
| LOW | modules/crewai/sidecar/tests/test_tools.py | 20 | CODE | |
| LOW | …rewai/sidecar/src/atmosphere_crewai_bridge/sessions.py | 30 | CODE | |
| LOW | …s/crewai/sidecar/src/atmosphere_crewai_bridge/tools.py | 49 | CODE | |
| LOW | …rewai/sidecar/src/atmosphere_crewai_bridge/__init__.py | 27 | CODE | |
| LOW | …/crewai/sidecar/src/atmosphere_crewai_bridge/stream.py | 41 | CODE | |
| LOW | …les/crewai/sidecar/src/atmosphere_crewai_bridge/app.py | 27 | CODE | |
| LOW | …les/crewai/sidecar/src/atmosphere_crewai_bridge/app.py | 40 | CODE | |
| LOW | …rewai/sidecar/src/atmosphere_crewai_bridge/__main__.py | 23 | CODE | |
| LOW | …ai/sidecar/src/atmosphere_crewai_bridge/crew_loader.py | 35 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .harness/drift-log.md | 660 | | 58 | 22 committed files referenced the project maintainer by a private role-play handle defined only in their local `~ | CODE |
| LOW | …a/org/atmosphere/ai/filter/PiiRedactionFilterTest.java | 44 | assertEquals("[REDACTED]", filter.redact("user@example.com")); | CODE |
| LOW | …a/org/atmosphere/ai/filter/PiiRedactionFilterTest.java | 68 | assertFalse(result.contains("user@example.com")); | CODE |
| LOW | …a/org/atmosphere/ai/filter/PiiRedactionFilterTest.java | 105 | assertFalse(parsed.data().contains("user@example.com")); | CODE |
| LOW | …a/org/atmosphere/ai/filter/PiiRedactionFilterTest.java | 143 | assertEquals("***", customFilter.redact("user@example.com")); | CODE |
| LOW | …a/org/atmosphere/ai/filter/PiiRedactionFilterTest.java | 170 | assertEquals("user@example.com", customFilter.redact("user@example.com")); | CODE |
| LOW | …tmosphere/ai/filter/DeferredStreamEndDeliveryTest.java | 144 | assertFalse(terminal.message().data().contains("user@example.com"), terminal.message().data()); | CODE |
| LOW | …i/embabel/AtmosphereEmbabelEnvironmentPostProcessor.kt | 85 | if (apiKey != null) "real" else "placeholder", | CODE |
| LOW | …va/org/atmosphere/channels/slack/SlackChannelTest.java | 60 | channel = new SlackChannel("xoxb-fake-token", SIGNING_SECRET, MAPPER); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …rewai/sidecar/src/atmosphere_crewai_bridge/sessions.py | 38 | logger = logging.getLogger(__name__) | CODE |
| LOW | …s/crewai/sidecar/src/atmosphere_crewai_bridge/tools.py | 59 | logger = logging.getLogger(__name__) | CODE |
| LOW | …rewai/sidecar/src/atmosphere_crewai_bridge/__init__.py | 31 | __all__ = ["__version__"] | CODE |
| LOW | …/crewai/sidecar/src/atmosphere_crewai_bridge/stream.py | 50 | logger = logging.getLogger(__name__) | CODE |
| LOW | …les/crewai/sidecar/src/atmosphere_crewai_bridge/app.py | 49 | logger = logging.getLogger(__name__) | CODE |
| LOW | …rewai/sidecar/src/atmosphere_crewai_bridge/__main__.py | 35 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ai/sidecar/src/atmosphere_crewai_bridge/crew_loader.py | 43 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/crewai/sidecar/src/atmosphere_crewai_bridge/tools.py | 546 | except Exception: # noqa: BLE001 — a frozen agent must not fail the run | CODE |
| LOW | …/crewai/sidecar/src/atmosphere_crewai_bridge/stream.py | 247 | except Exception as exc: # noqa: BLE001 — boundary; log and emit error | CODE |
| LOW | …/crewai/sidecar/src/atmosphere_crewai_bridge/stream.py | 294 | except Exception as exc: # noqa: BLE001 — fall through to non-stream | CODE |
| LOW | …/crewai/sidecar/src/atmosphere_crewai_bridge/stream.py | 346 | except Exception as exc: # noqa: BLE001 — best-effort | CODE |
| LOW | …les/crewai/sidecar/src/atmosphere_crewai_bridge/app.py | 229 | except Exception as exc: # noqa: BLE001 — boundary | CODE |
| LOW | …les/crewai/sidecar/src/atmosphere_crewai_bridge/app.py | 264 | except Exception as exc: # noqa: BLE001 — boundary | CODE |
| LOW | …les/crewai/sidecar/src/atmosphere_crewai_bridge/app.py | 276 | except Exception as exc: # noqa: BLE001 — boundary; do not block on | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …s/crewai/sidecar/src/atmosphere_crewai_bridge/tools.py | 241 | Build a single CrewAI ``BaseTool`` subclass from a descriptor. The returned tool is a pydantic-validated CrewAI too | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/promote-changelog.py | 80 | CODE | |
| LOW | scripts/lib/source_scan.py | 72 | CODE | |
| LOW | modules/crewai/sidecar/tests/test_wire_shape.py | 32 | CODE | |
| LOW | …/crewai/sidecar/src/atmosphere_crewai_bridge/stream.py | 165 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …osphere/ai/StructuredOutputExtractionPropertyTest.java | 68 | "\n\nLet me know if you need anything else.", | CODE |