2.4

Adjusted Signal

2.4

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

32.8K

Stars

Rust

Language

520.1K

Lines of Code

948

Files

1.2K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 9.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1077 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.3/100 · LOW

Are imports declared and package/API names verified? 24 finding(s).

Agent Over-Engineering Ratio 9.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 951 finding(s).

PR Review Velocity Impact 11.9/100 · LOW

Which changes need focused human review? 1168 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 4MEDIUM 61LOW 1102

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1168 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers884 hits · 826 pts

Severity	File	Line	Snippet	Context
LOW	tools/codex-wechat/codex_wechat.py	341	def resolve_app_server_command(codex: CodexConfig) -> str:	CODE
LOW⚡	crates/codex-plus-core/tests/all/cdp_bridge.rs	1238	assert!(script.contains("function assistantBubbleCandidates("));	CODE
LOW⚡	crates/codex-plus-core/tests/all/cdp_bridge.rs	1241	assert!(script.contains("function latestMessageByDocumentOrder("));	CODE
LOW⚡	crates/codex-plus-core/tests/all/cdp_bridge.rs	1242	assert!(script.contains("function clearPromptsForNewAssistant("));	CODE
LOW⚡	crates/codex-plus-core/tests/all/cdp_bridge.rs	3237	async function loadOptionalCodexAppModule() {{return moduleValue;}}	CODE
LOW⚡	crates/codex-plus-core/tests/all/cdp_bridge.rs	3238	function recordCodexPlusBridgeSuccess() {{}}	CODE
LOW⚡	crates/codex-plus-core/tests/all/cdp_bridge.rs	3239	function recordCodexPlusBridgeFailure() {{}}	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	818	.split("function installCodexPlusImageOverlay()")	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	820	.and_then(\|body\| body.split("function scheduleCodexPlusImageOverlay()").next())	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	1269	.find("function clearPromptsForNewAssistant(")	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	1370	"function clearPromptsForNewAssistant(hash) {\n state.stepwiseEpoch += 1;\n state.bridgeActiveKey = \"\";"	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	1549	"function generationModeOptionsHtml()",	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	1628	assert!(script.contains("function updateGenerationModeControl("));	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	1889	"function outlineIsDocumentScroller(container)",	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	1901	"function outlineScheduleScrollSettle(element, container)",	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2061	"function installContentFadeTracking()",	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2094	"function cancelScheduledPromptPreview()",	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2126	assert!(script.contains("function latestConversationTurnByKey(turns)"));	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2160	.find("function compareConversationTurnKeys(")	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2351	assert!(script.contains("function codexPluginMarketplacePatchEnabled()"));	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2377	assert!(script.contains("function codexPluginUnlockStrategy()"));	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2448	assert!(script.contains("function codexPluginFilterCallbackSource(callback)"));	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2930	assert!(script.contains("function codexPlusProxyStatusEnabled()"));	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2970	assert!(script.contains("function syncNativeSessionActionStyle(row)"));	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	2982	.split_once("function installDeleteButtonEventDelegation()")	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	3008	.split_once("async function refreshRecentConversationsForHost()")	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	3035	assert!(script.contains("function normalizedCodexThreadUuid(value)"));	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	3036	assert!(script.contains("function reactConversationIdFromRow(row)"));	CODE
LOW	crates/codex-plus-core/tests/all/cdp_bridge.rs	4445	async function expectNativeRequestCompletes(promise) {{	CODE
LOW	docs/specs/2026-09-30-ui-extension-api-design.md	206	function registerExtensionUiSelector(selector) { extensionUiSelectors.add(selector); }	CODE
LOW	docs/superpowers/plans/2026-05-22-upstream-worktree.md	1003	function setUpstreamWorktreeMessage(dialog, message, status = "idle") {	CODE
LOW	docs/superpowers/plans/2026-05-22-upstream-worktree.md	1010	async function loadUpstreamWorktreeDefaults(dialog) {	CODE
LOW	docs/superpowers/plans/2026-05-22-upstream-worktree.md	1045	function openUpstreamWorktreeDialog() {	CODE
LOW	docs/superpowers/plans/2026-05-22-upstream-worktree.md	1171	function upstreamWorktreeNativePayloadFromElement(element) {	CODE
LOW	docs/superpowers/plans/2026-05-22-upstream-worktree.md	1191	async function handleUpstreamWorktreeNativeCreate(event) {	CODE
LOW	docs/superpowers/plans/2026-05-22-upstream-worktree.md	1211	function installUpstreamWorktreeNativeAdapter() {	CODE
LOW	…perpowers/plans/2026-05-25-codex-context-management.md	177	function normalizeContextSelection(selection?: Partial<RelayContextSelection>): RelayContextSelection {	CODE
LOW	…perpowers/plans/2026-05-25-codex-context-management.md	953	function contextEntriesFromSettings(settings: BackendSettings): CodexContextEntries {	CODE
LOW⚡	docs/superpowers/plans/2026-05-13-provider-sync.md	43	def test_settings_store_defaults_provider_sync_disabled(tmp_path):	CODE
LOW⚡	docs/superpowers/plans/2026-05-13-provider-sync.md	52	def test_settings_store_saves_and_reloads_provider_sync(tmp_path):	CODE
LOW⚡	docs/superpowers/plans/2026-05-13-provider-sync.md	62	def test_settings_store_ignores_malformed_json(tmp_path):	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	193	def test_provider_sync_updates_rollout_and_sqlite_to_current_provider(tmp_path):	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	216	def test_provider_sync_skips_when_lock_exists(tmp_path):	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	227	def test_provider_sync_prunes_backups_to_five(tmp_path):	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	554	def test_launch_and_inject_runs_provider_sync_before_launch_when_enabled(monkeypatch, tmp_path):	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	568	def test_launch_and_inject_skips_provider_sync_when_disabled(monkeypatch, tmp_path):	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	657	def test_handle_bridge_request_gets_backend_settings(monkeypatch, tmp_path):	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	669	def test_handle_bridge_request_sets_backend_settings(monkeypatch, tmp_path):	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	734	def test_renderer_script_has_backend_provider_sync_toggle():	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	783	function refreshCodexPlusBackendToggles() {	CODE
LOW⚡	…perpowers/plans/2026-05-22-upstream-branch-dropdown.md	150	function readUpstreamBranchSelection() {	CODE
LOW⚡	…perpowers/plans/2026-05-22-upstream-branch-dropdown.md	158	function writeUpstreamBranchSelection(selection) {	CODE
LOW⚡	…perpowers/plans/2026-05-22-upstream-branch-dropdown.md	166	function nativeBranchMenuCandidates() {	CODE
LOW⚡	…perpowers/plans/2026-05-22-upstream-branch-dropdown.md	176	function installUpstreamBranchDropdownAdapter() {	CODE
LOW	…perpowers/plans/2026-05-22-upstream-branch-dropdown.md	248	async function loadUpstreamBranchDefaults(repoPath) {	CODE
LOW	…perpowers/plans/2026-05-22-upstream-branch-dropdown.md	257	function renderUpstreamBranchOption(menu, repoPath, ref) {	CODE
LOW	…perpowers/plans/2026-05-22-upstream-branch-dropdown.md	269	async function injectUpstreamBranchOptions() {	CODE
LOW	…perpowers/plans/2026-05-22-upstream-branch-dropdown.md	338	function upstreamWorktreePayloadFromSelection(trigger) {	CODE
LOW	…specs/2026-06-05-version-gated-plugin-unlock-design.md	84	function codexPluginUnlockStrategy() { ... }	CODE
LOW	…specs/2026-06-05-version-gated-plugin-unlock-design.md	90	function codexPluginUnlockStrategy() {	CODE
824 more matches not shown…

Over-Commented Block163 hits · 158 pts

Severity	File	Line	Snippet	Context
LOW	tools/conversation-canvas/src/tree-canvas.css	21	#pending-tray{position:absolute;bottom:65px;left:20px;z-index:2;max-width:min(360px,calc(100% - 40px));max-height:50%;ov	COMMENT
LOW	crates/codex-plus-data/src/provider_sync.rs	21	const BACKUP_KEEP_COUNT: usize = 5;	COMMENT
LOW	crates/codex-plus-data/src/provider_sync.rs	341	}	COMMENT
LOW	crates/codex-plus-data/src/backup.rs	161	)?;	COMMENT
LOW	crates/codex-plus-core/tests/all/relay_config.rs	21	BackendSettings, RelayMode, RelayModelRoute, RelayProfile, RelayProtocol,	COMMENT
LOW	…ex-plus-core/tests/all/aggregate_default_login_sync.rs	1	//! 聚合默认成员的官方登录同步进 Codex（`syncDefaultMemberLogin`）。	COMMENT
LOW	…s/codex-plus-core/tests/all/live_anthropic_upstream.rs	1	//! Anthropic 上游的真机验收（默认忽略，需要真实的 Anthropic 协议网关）。	COMMENT
LOW	crates/codex-plus-core/tests/all/upstream_worktree.rs	1	// 该增强功能已停用。兼容性与路由拒绝测试分别位于	COMMENT
LOW	…tes/codex-plus-core/tests/all/windows_console_spawn.rs	1	//! 静态检查：Windows 上起子进程必须隐藏控制台窗口（issue #2048 / #2559 / #2778）。	COMMENT
LOW	crates/codex-plus-core/tests/all/auto_takeover_live.rs	1	//! 自动接管的真实环境验证。	COMMENT
LOW	crates/codex-plus-core/tests/all/main.rs	1	//! codex-plus-core 集成测试的统一入口。	COMMENT
LOW	crates/codex-plus-core/tests/all/zed_remote.rs	1	// 该增强功能已停用。兼容性与路由拒绝测试分别位于	COMMENT
LOW	crates/codex-plus-core/tests/all/e2e_codex_real_cli.rs	1	//! E2E：真实 apply 流程 + 真实 codex CLI 解析生成的 model_catalog_json。	COMMENT
LOW	crates/codex-plus-core/examples/takeover_probe.rs	1	//! 自动接管探针的命令行验证工具。	COMMENT
LOW	crates/codex-plus-core/src/auto_takeover.rs	1	//! 「自动接管官方 App」的判据与状态机。	COMMENT
LOW	crates/codex-plus-core/src/newapi.rs	1	//! new-api（one-api 的分支）的余额与分组倍率，只用供应商自己的 Key：	COMMENT
LOW	crates/codex-plus-core/src/work_view.rs	1	//! 纯 API Key 供应商下强制退出 Work 视图。	COMMENT
LOW	crates/codex-plus-core/src/computer_use.rs	1	//! 复用 Codex app 的 Computer Use（`cua_repl` MCP server），把它接入 Claude Code /	COMMENT
LOW	crates/codex-plus-core/src/computer_use.rs	201	"https_proxy",	COMMENT
LOW	crates/codex-plus-core/src/computer_use.rs	361	"NODE_REPL_INSTRUCTIONS_USE_CASE_CHROME".into(),	COMMENT
LOW	crates/codex-plus-core/src/window_capture.rs	1	//! 目标窗口取流：ScreenCaptureKit 抓单个窗口，编码成 JPEG 交给界面预览。	COMMENT
LOW	crates/codex-plus-core/src/window_capture.rs	21	//! # 两个前置条件	COMMENT
LOW	crates/codex-plus-core/src/relay_headers.rs	1	//! 供应商自定义上游请求头（issue #1685）。	COMMENT
LOW	crates/codex-plus-core/src/claude_hooks.rs	1	//! Claude Code 的回合结束钩子。	COMMENT
LOW	crates/codex-plus-core/src/official_login.rs	281	/// auth.json 文本。	COMMENT
LOW	crates/codex-plus-core/src/codex_sqlite.rs	401	updated += 1;	COMMENT
LOW	crates/codex-plus-core/src/wsl_network.rs	1	//! Codex 选了「在 WSL 中运行」时，让 WSL 里的 Codex 连得上 Windows 上的网关（#2773）。	COMMENT
LOW	crates/codex-plus-core/src/foreign_reasoning.rs	1	//! 别家签发的加密内容（#2777）。	COMMENT
LOW	crates/codex-plus-core/src/skills.rs	1	//! Codex Skills 管理。	COMMENT
LOW	crates/codex-plus-core/src/agent_pet.rs	1	//! Agent 桌宠：内置图库目录、运行时联网取图与本地缓存。	COMMENT
LOW	crates/codex-plus-core/src/plugin_marketplace.rs	1	use std::io::{Cursor, Read};	COMMENT
LOW	crates/codex-plus-core/src/plugin_marketplace.rs	401	///	COMMENT
LOW	crates/codex-plus-core/src/computer_use_approval.rs	1	//! Computer Use 的应用级审批。	COMMENT
LOW	crates/codex-plus-core/src/relay_config.rs	1061	///	COMMENT
LOW	crates/codex-plus-core/src/relay_config.rs	1201		COMMENT
LOW	crates/codex-plus-core/src/relay_config.rs	2321	.any(\|key\| table.get(key).and_then(Item::as_str).is_some())	COMMENT
LOW	crates/codex-plus-core/src/relay_config.rs	2941		COMMENT
LOW	crates/codex-plus-core/src/relay_config.rs	3541	repair_merged_mcp_servers(&mut target_doc, &HashMap::new());	COMMENT
LOW	crates/codex-plus-core/src/relay_config.rs	3821	if let Some(value) = parse_optional_positive_u64(auto_compact_limit, "压缩上下文大小")? {	COMMENT
LOW	crates/codex-plus-core/src/relay_config.rs	5201	.collect()	COMMENT
LOW	crates/codex-plus-core/src/relay_config.rs	5701	/// （Codex 解析空文件会报 EOF 并退回登录页）；3) live 与快照都不可用时直接报错中止，	COMMENT
LOW	crates/codex-plus-core/src/relay_config.rs	5741	// 两边都没有凭据：生成只含代理 token 的合法 JSON，绝不产出空文件。	COMMENT
LOW	crates/codex-plus-core/src/windows_integration.rs	41	#[cfg(windows)]	COMMENT
LOW	crates/codex-plus-core/src/app_paths.rs	1021	/// 像 MSIX 包不等于该包已注册（用户把 Store 包目录整体搬走后路径形状依旧成立），拿	COMMENT
LOW	crates/codex-plus-core/src/native_browser.rs	1441	#[cfg(test)]	COMMENT
LOW	crates/codex-plus-core/src/protocol_proxy.rs	21		COMMENT
LOW	crates/codex-plus-core/src/protocol_proxy.rs	281	/// 并按住推理阶段等首段可见输出（各最多 120 秒），压缩时整段读完才回响应头。	COMMENT
LOW	crates/codex-plus-core/src/protocol_proxy.rs	561	enum StreamCommitMode {	COMMENT
LOW	crates/codex-plus-core/src/protocol_proxy.rs	4841	.is_some_and(\|host\| {	COMMENT
LOW	crates/codex-plus-core/src/protocol_proxy.rs	7861	})	COMMENT
LOW	crates/codex-plus-core/src/protocol_proxy.rs	8501	}	COMMENT
LOW	crates/codex-plus-core/src/protocol_proxy.rs	8981	const SCHEMA_COMBINATOR_KEYS: [&str; 3] = ["oneOf", "anyOf", "allOf"];	COMMENT
LOW	crates/codex-plus-core/src/protocol_proxy.rs	10561	*text = cleaned;	COMMENT
LOW	crates/codex-plus-core/src/protocol_proxy.rs	12201	}	COMMENT
LOW	crates/codex-plus-core/src/resident_helper.rs	1	//! 进程内常驻的本地协议代理 helper。	COMMENT
LOW	crates/codex-plus-core/src/browser_use.rs	1	//! Chrome 浏览器的 MCP 服务。	COMMENT
LOW	crates/codex-plus-core/src/browser_use.rs	21	//! 对 Claude 暴露离散工具（而不是让模型写 JS）。每个工具翻译成一段 `cua` 的 JS，	COMMENT
LOW	crates/codex-plus-core/src/watcher.rs	681	}	COMMENT
LOW	crates/codex-plus-core/src/mcp_config.rs	1	//! MCP 服务器配置的结构化读写。	COMMENT
LOW	crates/codex-plus-core/src/mcp_config.rs	61	#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]	COMMENT
103 more matches not shown…

Decorative Section Separators47 hits · 132 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/codex-plus-core/tests/all/protocol_proxy.rs	6897	// ── tool 输出中的图片（issue #1996）────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/tests/all/protocol_proxy.rs	6897	// ── tool 输出中的图片（issue #1996）────────────────────────────────────	COMMENT
MEDIUM	…codex-plus-core/tests/all/agent_collaboration_queue.rs	387	// ── 同一 Agent 并发执行（#2800）──────────────────────────────────────────────	COMMENT
MEDIUM	…codex-plus-core/tests/all/agent_collaboration_queue.rs	387	// ── 同一 Agent 并发执行（#2800）──────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/window_capture.rs	360	// ── SCStream 路径 ────────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	33	// ── Global state ──────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	43	// ── Global state ──────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	97	// ── Configuration ─────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	106	// ── Public helpers ────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	198	// ── URL hashing ───────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	205	// ── URL collection ────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	277	// ── Image stripping ───────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	300	// ── Context window ────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	465	// ── VLM API call ──────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	834	// ── Batch analysis ────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	913	// ── Phase 2 后台分析 ────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	940	// ── Description injection ─────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	986	// ── Main entry: strip + analyze + inject with cache ───────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	1430	// ── Tests ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	1436	// ── image_handling_mode ───────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	1480	// ── image_handling_mode：key 归一化与三级回退（issue #2345）─────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	1480	// ── image_handling_mode：key 归一化与三级回退（issue #2345）─────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	1625	// ── build_vlm_request_body（测试 VLM 同源契约）─────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	1647	// ── strip_images_only ─────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	1928	// ── is_retryable ──────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	1957	// ── collect_recent_image_messages ─────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	2010	// ── cache eviction ────────────────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	2031	// ── strip_image_blocks (tokio::test) ──────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	2346	// ── multi-round history test ─────────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	2546	// ── wiremock integration tests ───────────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	2999	// ── redact_secrets（加固 spec §4.2 脱敏）─────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	3051	// ── validate_image_data_url（加固 spec §4.1 第二道门）────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	3085	// ── test_vlm_once（测试 VLM 命令核心）─────────────────────────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	3388	// ── Responses 协议下的 tool 输出（issue #1996 的第二处缺口）──────	COMMENT
MEDIUM	crates/codex-plus-core/src/vision.rs	3388	// ── Responses 协议下的 tool 输出（issue #1996 的第二处缺口）──────	COMMENT
MEDIUM	scripts/installer/linux/build-deb.sh	57	# ── 1. 安装系统依赖（需要 sudo）───────────────────────────────	COMMENT
MEDIUM	scripts/installer/linux/build-deb.sh	79	# ── 2. 安装 Rust toolchain（无需 sudo）───────────────────────	COMMENT
MEDIUM⚡	scripts/installer/linux/build-deb.sh	92	# ── 3. 构建前端 ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	scripts/installer/linux/build-deb.sh	100	# ── 4. 构建 Rust 二进制 ──────────────────────────────────────	COMMENT
MEDIUM⚡	scripts/installer/linux/build-deb.sh	108	# ── 5. 打包 .deb ─────────────────────────────────────────────	COMMENT
MEDIUM	scripts/installer/linux/build-deb.sh	216	# ── 主流程 ─────────────────────────────────────────────────	COMMENT
MEDIUM⚡	assets/inject/renderer-inject/40-backend-settings.js	1244	// ── 设置项清单 ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/codex-plus-manager/src/capacity-auto-retry.test.ts	34	// ── 最小 DOM ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/codex-plus-manager/src/capacity-auto-retry.test.ts	170	// ── 假时钟 ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	apps/codex-plus-manager/src/model-metadata.ts	178	// ── [1M] 后缀的检测与适配 ────────────────────────────────────────────────	COMMENT
MEDIUM	apps/codex-plus-manager/src/model-metadata.test.ts	621	// ── [1M] 后缀检测与适配（issue #2279）────────────────────────────────	COMMENT
MEDIUM	apps/codex-plus-manager/src/model-metadata.test.ts	621	// ── [1M] 后缀检测与适配（issue #2279）────────────────────────────────	COMMENT

Fake / Example Data21 hits · 23 pts

Severity	File	Line	Snippet	Context
LOW	crates/codex-plus-data/src/storage.rs	2151	fs::write(&existing, b"placeholder").unwrap();	CODE
LOW	crates/codex-plus-core/src/dictation.rs	1205	settings.base_url = "https://fake-user:fake-password@api.example/v1".to_string();	CODE
LOW	crates/codex-plus-core/src/dictation.rs	1447	for mime in ["text/html", "audio/webm\r\nAuthorization: fake-key", ""] {	CODE
LOW	crates/codex-plus-core/src/whale.rs	1187	let first = account_fingerprint("fake-key-one", "test");	CODE
LOW	crates/codex-plus-core/src/whale.rs	1188	let second = account_fingerprint("fake-key-two", "test");	CODE
LOW	crates/codex-plus-core/src/whale.rs	1214	assert!(!String::from_utf8_lossy(&bytes).contains("fake-key"));	CODE
LOW⚡	crates/codex-plus-core/src/whale.rs	1368	fetch_balance_json(&format!("{}/redirect", server.uri()), "fake-key")	CODE
LOW⚡	crates/codex-plus-core/src/whale.rs	1373	.respond_with(ResponseTemplate::new(401).set_body_string("fake-key secret error"))	CODE
LOW⚡	crates/codex-plus-core/src/whale.rs	1376	let error = fetch_balance_json(&format!("{}/error", server.uri()), "fake-key")	CODE
LOW⚡	crates/codex-plus-core/src/whale.rs	1380	assert!(!error.contains("fake-key"));	CODE
LOW	crates/codex-plus-core/src/browser_use.rs	798	"by": { "type": "string", "enum": ["role", "text", "label", "placeholder", "testid", "css"] },	CODE
LOW	crates/codex-plus-core/src/browser_use.rs	1273	"placeholder" => {	CODE
LOW	crates/codex-plus-core/src/whale_full.rs	1080	raw.replace("{key}", "placeholder")	CODE
LOW	crates/codex-plus-core/src/whale_full.rs	1101	if name == "key" && value == "placeholder" {	CODE
LOW	crates/codex-plus-core/src/whale_full.rs	1810	.replace("{key}", "placeholder")	CODE
LOW	crates/codex-plus-core/src/whale_full.rs	2638	api_key: "fake-key".into(),	CODE
LOW	crates/codex-plus-core/src/connect/outbound.rs	759	"token" => settings.weixin_connect_token = "new-fake-token".into(),	CODE
LOW	crates/codex-plus-core/src/connect/outbound.rs	827	settings.weixin_connect_token = "new-fake-token".into();	CODE
LOW	crates/codex-plus-core/src/connect/outbound.rs	1000	("weixinConnectToken", json!("other-fake-token")),	CODE
LOW	assets/inject/floating-panel/runtime/answer-context.js	465	node.getAttribute?.("placeholder"),	CODE
LOW	apps/codex-plus-manager/src/legacy-webkit.test.ts	41	assert.equal(maskAccountText("me@example.com 和 you@example.org"), "m*@example.com 和 y*@example.org");	CODE

AI Slop Vocabulary9 hits · 22 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	crates/codex-plus-core/assets/codex-models.json	55	"base_instructions": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, and your	CODE
MEDIUM⚡	crates/codex-plus-core/assets/codex-models.json	57	"instructions_template": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, an	CODE
MEDIUM	crates/codex-plus-core/assets/codex-models.json	407	"base_instructions": "You are GPT-5.2 running in the Codex CLI, a terminal-based coding assistant. Codex CLI is an	CODE
MEDIUM	site/manager-preview/assets/index-IsykGP6H.js	50	`).replace(h1,"")}function Rv(l,t){return t=Nv(t),Nv(l)===t}function fl(l,t,u,a,e,n){switch(u){case"children":typeof a==	CODE
MEDIUM	site/assets/gsap.min.js	10	!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports):"function"==typeof define&&define.amd?def	CODE
MEDIUM	assets/codex-models.json	35	"instructions_template": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, an	CODE
MEDIUM⚡	assets/codex-models.json	474	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	assets/codex-models.json	474	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM	assets/codex-models.json	980	"base_instructions": "You are GPT-5.2 running in the Codex CLI, a terminal-based coding assistant. Codex CLI is an	CODE

Empty Error Handlers4 hits · 20 pts

Severity	File	Line	Snippet	Context
HIGH	tools/codex-wechat/codex_wechat.py	103	except Exception:	CODE
HIGH	tools/codex-wechat/codex_wechat.py	693	except Exception:	CODE
HIGH	tools/codex-wechat/codex_wechat.py	388	except Exception:	CODE
HIGH	assets/claude-localization/build-copy.py	29	except Exception:	CODE

Excessive Try-Catch Wrapping16 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW	tools/codex-wechat/codex_wechat.py	103	except Exception:	CODE
LOW	tools/codex-wechat/codex_wechat.py	385	except Exception:	CODE
LOW	tools/codex-wechat/codex_wechat.py	388	except Exception:	CODE
LOW	tools/codex-wechat/codex_wechat.py	401	except Exception:	CODE
LOW	tools/codex-wechat/codex_wechat.py	557	except Exception as exc:	CODE
LOW	tools/codex-wechat/codex_wechat.py	683	except Exception as exc:	CODE
LOW	tools/codex-wechat/codex_wechat.py	693	except Exception:	CODE
LOW	tools/codex-wechat/codex_wechat.py	743	except Exception as exc:	CODE
LOW	tools/codex-wechat/codex_wechat.py	755	except Exception as exc:	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	329	except Exception:	CODE
LOW	docs/superpowers/plans/2026-05-13-provider-sync.md	496	except Exception:	CODE
MEDIUM	docs/superpowers/plans/2026-05-13-provider-sync.md	109	def load(self) -> BackendSettings:	CODE
LOW	assets/claude-localization/build-copy.py	29	except Exception:	CODE
LOW	assets/claude-localization/build-copy.py	415	except Exception as error:	CODE
LOW	assets/claude-localization/sign-copy.py	62	except Exception:	CODE
MEDIUM	assets/claude-localization/sign-copy.py	43	def is_macho(path):	CODE

Slop Phrases12 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW⚡	crates/codex-plus-core/assets/codex-models.json	55	"base_instructions": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW⚡	crates/codex-plus-core/assets/codex-models.json	57	"instructions_template": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, an	CODE
LOW	crates/codex-plus-core/assets/codex-models.json	407	"base_instructions": "You are GPT-5.2 running in the Codex CLI, a terminal-based coding assistant. Codex CLI is an	CODE
LOW	assets/codex-models.json	35	"instructions_template": "You are Codex, a coding agent based on GPT-5. You and the user share one workspace, an	CODE
LOW	assets/codex-models.json	109	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	assets/codex-models.json	190	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	assets/codex-models.json	271	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	assets/codex-models.json	352	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
MEDIUM⚡	assets/codex-models.json	474	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	assets/codex-models.json	474	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW	assets/codex-models.json	640	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	assets/codex-models.json	980	"base_instructions": "You are GPT-5.2 running in the Codex CLI, a terminal-based coding assistant. Codex CLI is an	CODE

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	site/assets/three.min.js	7	!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports):"function"==typeof define&&define.amd?def	CODE

Deep Nesting7 hits · 7 pts

Severity	File	Line	Context
LOW	tools/codex-wechat/codex_wechat.py	233	CODE
LOW	tools/codex-wechat/codex_wechat.py	697	CODE
LOW	tools/codex-wechat/codex_wechat.py	763	CODE
LOW	tools/codex-wechat/codex_wechat.py	496	CODE
LOW	assets/claude-localization/build-copy.py	102	CODE
LOW	assets/claude-localization/build-copy.py	217	CODE
LOW	assets/claude-localization/sign-copy.py	104	CODE

Modern AI Meta-Vocabulary2 hits · 5 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/reports/2026-10-03-full-open-issue-audit.md	891	\| [#835](https://github.com/BigPizzaV3/CodexPlusPlus/issues/835) \| 老是提示 invalid params, context window exce \| 这条错误由上游供应商	CODE
MEDIUM	site/manager-preview/assets/App-DlCf5kBI.js	431	*/const ds=ue("X",[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]]),Ig=[{id:"openai",nam	COMMENT

Unused Imports2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	tools/codex-wechat/codex_wechat.py	10		CODE
LOW	assets/claude-localization/sign-copy.py	20		CODE

BigPizzaV3/CodexPlusPlus

Open-Source Code Quality, Security and Technical Debt Review