A framework for building agent-native applications.
This report presents the forensic synthetic code analysis of BuilderIO/agent-native, a TypeScript project with 3,649 GitHub stars. SynthScan v2.0 examined 2,213,453 lines of code across 9540 source files, recording 7597 pattern matches distributed across 12 syntactic categories. The overall adjusted score of 4.3 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 7597 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/guard-public-packages.ts | 73 | function readWorkspacePackageNames(): Set<string> { | CODE |
| LOW | scripts/guard-public-packages.ts | 102 | function dependencyProtocolFailures( | CODE |
| LOW | scripts/guard-public-packages.ts | 122 | function localWorkspaceDependencyFailures( | CODE |
| LOW | scripts/ensure-builder-orgs.ts | 485 | async function ensureBetterAuthOrgTables(db: Db): Promise<void> { | CODE |
| LOW | scripts/ensure-builder-orgs.ts | 544 | async function ensureClipsOrgSettingsTable(db: Db): Promise<void> { | CODE |
| LOW | scripts/ensure-builder-orgs.ts | 715 | async function findBetterAuthBuilderOrgId(db: Db): Promise<string | null> { | CODE |
| LOW | scripts/guard-agent-chat-context.ts | 76 | export function analyzeAgentChatContextPolicy( | CODE |
| LOW | scripts/guard-agent-chat-context.ts | 145 | export function checkAgentChatContextPolicies(repoRoot: string): { | CODE |
| LOW | scripts/dev-lazy.ts | 231 | function includeDesktopLazyDefaults(selected: TemplateApp[]): TemplateApp[] { | CODE |
| LOW | scripts/dev-lazy.ts | 584 | export function isBrowserAssetDestination( | CODE |
| LOW | scripts/dev-lazy.ts | 596 | export function selectProxyResponseTimeout( | CODE |
| LOW | scripts/dev-lazy.ts | 1588 | export function canonicalLoopbackRedirect( | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke.ts | 154 | function assertStandalonePackageJson(): void { | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke.ts | 466 | function isTransientDevServerError(err: unknown): boolean { | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke.ts | 609 | async function readAuthenticatedSessionEmail( | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke.ts | 712 | async function waitForAuthenticatedShell( | CODE |
| LOW | scripts/guard-request-storms.ts | 139 | export function analyzeRequestStormSource({ | CODE |
| LOW | scripts/guard-request-storms.ts | 201 | export function shouldScanRequestStormFile(relativeFile: string): boolean { | CODE |
| LOW | scripts/sync-template-netlify-env.ts | 331 | export function isAllowedHostedTemplateEnvKey(key: string): boolean { | CODE |
| LOW | scripts/sync-template-netlify-env.ts | 340 | export function isForbiddenHostedTemplateEnvKey(key: string): boolean { | CODE |
| LOW | scripts/sync-template-netlify-env.ts | 407 | export function normalizeProductionUrlEntry( | CODE |
| LOW | scripts/qa-dispatch-workspace-resources-smoke.ts | 53 | function cleanDispatchGeneratedFiles() { | CODE |
| LOW | scripts/changeset-publish-sequential.ts | 151 | function protocolDependencyFailures(pkg: PackageJson): string[] { | CODE |
| LOW | scripts/changeset-publish-sequential.ts | 172 | async function assertPackedManifestIsPublishable( | CODE |
| LOW | scripts/changeset-publish-sequential.ts | 332 | function isMissingPackageOnPublish(output: string): boolean { | CODE |
| LOW | scripts/changeset-publish-sequential.ts | 351 | async function waitForPackageAvailability(pkg: PublishPackage): Promise<void> { | CODE |
| LOW | scripts/changeset-publish-sequential.ts | 407 | export function localRuntimeDependencyNames(pkg: PublishPackage): string[] { | CODE |
| LOW | scripts/qa-cli-smoke.ts | 60 | function resolveExpectedCoreDependencyVersion(): string { | CODE |
| LOW | scripts/qa-cli-smoke.ts | 70 | function assertNoUnresolvedPlaceholders(dir: string): void { | CODE |
| LOW | scripts/qa-cli-smoke.ts | 105 | function assertNoWorkspaceProtocolDeps(pkg: any): void { | CODE |
| LOW | scripts/qa-cli-smoke.ts | 194 | function assertDispatchPackageDependency(pkg: any, context: string): void { | CODE |
| LOW | scripts/sync-workspace-core-skills.ts | 372 | function checkActionFirstInstructionPhrases() { | CODE |
| LOW | scripts/sync-workspace-core-skills.ts | 404 | function forEachExistingTemplateSharedSkill(fn) { | CODE |
| LOW | scripts/sync-workspace-core-skills.ts | 453 | function checkTemplateSharedSkillsInSync() { | CODE |
| LOW | scripts/qa-dispatch-automations-smoke.ts | 52 | function cleanDispatchGeneratedFiles() { | CODE |
| LOW | scripts/sync-plan-marketplace.ts | 137 | function rewriteSkillFrontmatterName(source: string, name: string): string { | CODE |
| LOW⚡ | scripts/guard-i18n-catalogs.ts | 894 | function readCatalogEnglishValueBaseline() { | CODE |
| LOW⚡ | scripts/guard-i18n-catalogs.ts | 898 | function readLocalizedDocsBaseline() { | CODE |
| LOW⚡ | scripts/guard-i18n-catalogs.ts | 902 | function readLocalizedDocsCoverageBaseline() { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 250 | async function checkCatalogEnglishValueDebt(catalogDirs: string[]) { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 380 | async function checkCatalogScriptContamination( | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 409 | function disallowedScriptsForLocale(locale: LocaleCode, value: string) { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 475 | function checkDuplicateTopLevelCatalogKeys(file: string) { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 753 | function unionPlaceholdersForPluralBase(flat: FlatCatalog, base: string) { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 920 | export function checkStaleBaselineEntries( | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 992 | function checkRawVisibleLiteralFile( | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1114 | export function normalizeLocalizedDocSlug(relativePath: string): string { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1121 | export function checkLocalizedDocsCoverage({ | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1166 | function checkLocalizedDocsCoverageFromDisk(): { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1193 | function checkLocalizedDocsEmbeddedStrings(): { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1237 | function checkLocalizedDocsProtectedIdentifiers(): string[] { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1299 | function docSourcePathWithoutExtension(file: string): string { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1303 | function sourceDocFileForLocalized( | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1314 | function extractEmbeddedDocsStrings(text: string): string[] { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1350 | function collectEmbeddedDocsBlockStrings(out: Set<string>, source: string) { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1374 | function addLikelyTranslatableDocsString(out: Set<string>, value: string) { | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 1380 | function extractVisibleHtmlStrings(html: string): string[] { | CODE |
| LOW | …s/fusion-analytics-migration/manual-data-extensions.ts | 18 | export function onboardingProgressExtension(): string { | CODE |
| LOW | …s/fusion-analytics-migration/manual-data-extensions.ts | 481 | export function competitiveLandscapeExtension(): string { | CODE |
| LOW | …s/fusion-analytics-migration/manual-data-extensions.ts | 628 | export function strategicAccountsExtension(): string { | CODE |
| 5586 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/dev-electron.ts | 56 | // ── App port assignments ─────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/dev-electron.ts | 75 | // ── Parse --apps flag ────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/dev-electron.ts | 84 | // ── Ports that may need cleanup before starting ──────────────── | COMMENT |
| MEDIUM | scripts/dev-electron.ts | 133 | // ── Build concurrently command list ─────────────────────────── | COMMENT |
| MEDIUM | scripts/dev-all.ts | 17 | // ── Args ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/triggers/dispatcher.ts | 152 | // ─── Dispatcher deps (same pattern as SchedulerDeps) ──────────────────────── | COMMENT |
| MEDIUM | packages/core/src/terminal/terminal-plugin.ts | 22 | // ─── module-load self-heal: chmod node-pty's spawn-helper ───────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 2107 | // ─── Agent Teams: per-run send reference ───────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 2983 | // ─── Agent Teams: durable sub-agent run processor ───────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 3927 | // ─── Generate thread title ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 4024 | // ─── Run management endpoints (for hot-reload resilience) ───────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 4328 | // ─── Checkpoint endpoints ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 4439 | // ─── Public read-only shared thread endpoint ───────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 4451 | // ─── Thread management endpoints ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 4925 | // ─── Durable background agent-chat run processor ────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 5168 | // ─── Recurring Jobs Scheduler ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 5244 | // ─── Agent Teams orphan sweep ───────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 5294 | // ─── Unclaimed background-run sweep ──────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 5490 | // ─── Trigger Dispatcher (event-based automations) ───────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-teams.spec.ts | 468 | // ── Completion loop injection ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 62 | // ─── Postgres introspection ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 135 | // ─── SQLite / libSQL / D1 introspection ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 174 | // ─── Cached entry point ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 221 | // ─── Formatting ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 262 | // ─── Public API ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 3 | // ── In-memory queue table (real queue module runs against this) ─────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 128 | // ── app_state (task records + thread reverse-lookup) ────────────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 160 | // ── chat thread store (thread_data round-trips through here) ────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 177 | // ── run-manager: drive runFn then onComplete with a synthetic run ───────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 237 | // ── production-agent: scripted agent loop ───────────────────────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 293 | // ── progress registry: no-op writes ────────────────────────────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 327 | // ── capture self-fire dispatches ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 3192 | // ─── Voice transcription (Whisper) ─────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 3199 | // ─── Google realtime transcription session bridge ─────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 3208 | // ─── Voice provider status ─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 3216 | // ─── Ad-hoc secrets (user-created keys) ──────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 3221 | // ─── Secrets registry ──────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 3331 | // ─── Agent run progress ─────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 3337 | // ─── Automations API ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 3343 | // ─── Application State CRUD ────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 3346 | // ─── User-scoped settings store ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 1228 | // ─── Durable sandbox execution processor ───────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 1297 | // ─── Durable sandbox execution sweep ────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 3024 | // ─── Usage & cost summary ──────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 3060 | // ─── File upload primitive ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 3258 | // ─── Notifications inbox ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 3269 | // ─── Extensions (sandboxed mini-app runtime + proxy) ──────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 3295 | // ─── Data programs (stored server-side JS scripts + run cache) ───── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 3305 | // ─── Page-level legacy redirect: /tools → /extensions ────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 3401 | // ─── Avatar routes ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-teams.ts | 770 | // ── Legacy fallback: no durable queue row ──────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-teams.ts | 1283 | // ── Delegation-depth guardrail ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-teams.ts | 1563 | // ── Completion loop: notify the parent thread ───────────────────────────── | COMMENT |
| MEDIUM | …s/core/src/server/agent-teams-delegation-depth.spec.ts | 3 | // ── app_state (task records + thread reverse-lookup) ────────────────────── | COMMENT |
| MEDIUM | …s/core/src/server/agent-teams-delegation-depth.spec.ts | 85 | // (i) within-limit spawn still works ─────────────────────────────────────── | COMMENT |
| MEDIUM | …s/core/src/server/agent-teams-delegation-depth.spec.ts | 113 | // (ii) spawn at/over MAX is refused with the error result ─────────────────── | COMMENT |
| MEDIUM | …s/core/src/server/agent-teams-delegation-depth.spec.ts | 168 | // (iii) the env override changes the limit ───────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/google-oauth.ts | 39 | // ─── Platform Detection ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/google-oauth.ts | 351 | // ─── redirect_uri Allowlist ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/google-oauth.ts | 444 | // ─── OAuth State ───────────────────────────────────────────────────────────── | COMMENT |
| 957 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/dev-all.ts | 161 | COMMENT | |
| LOW | packages/pinpoint/src/ui/components/PinMarker.tsx | 1 | // @agent-native/pinpoint — Pin markers: outline + numbered badge per element | COMMENT |
| LOW | packages/pinpoint/src/freeze/react-freeze.spec.ts | 1 | // @agent-native/pinpoint — freezeReact tests | COMMENT |
| LOW | packages/pinpoint/src/storage/storage-interface.ts | 1 | // @agent-native/pinpoint — Storage interface re-export | COMMENT |
| LOW | …ckages/pinpoint/src/detection/selector-builder.spec.ts | 1 | // @agent-native/pinpoint — selector-builder tests | COMMENT |
| LOW | packages/core/src/index.ts | 161 | // IMPORTANT: this top-level entry (the package `default`/Node condition) must | COMMENT |
| LOW | packages/core/src/demo/fetch-interceptor.ts | 41 | // run state here would make recovery think it's not progressing and | COMMENT |
| LOW | packages/core/src/settings/store.ts | 61 | // blocking SHARE lock for CREATE INDEX). `ensureTableExists` / | COMMENT |
| LOW | packages/core/src/org/migrations.ts | 61 | version: 1008, | COMMENT |
| LOW | packages/core/src/a2a/handlers.ts | 561 | // on every subsequent tasks/get and tasks/cancel call. Caller-supplied | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 121 | // don't include one). | COMMENT |
| LOW | packages/core/src/deploy/build.ts | 1781 | COMMENT | |
| LOW | packages/core/src/secrets/storage.ts | 161 | } | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 701 | // app's own action surface immediately callable; framework, provider, | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 721 | // correct owner. | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 881 | const { createCoreAttachmentActionEntries } = | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 981 | // whenever they're registered, regardless of whether they made the | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1121 | handler: async function* (message, context) { | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1141 | COMMENT | |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1921 | // hooks are useful, but they should never leave agent_runs stuck | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 2461 | : undefined; | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 3061 | const modelCandidate = | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 4301 | // deferral still inside `UNCLAIMED_BACKGROUND_RUN_REDISPATCH_BOUND_MS` | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 5301 | // leaves exactly such a row behind — status='running', dispatch_mode= | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 5321 | // 'background-processing') is the sole gate on actual execution; a row | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 5341 | startedAt: number; | COMMENT |
| LOW | packages/core/src/server/sentry.ts | 141 | f?.function === "Socket.socketOnEnd" || | COMMENT |
| LOW | packages/core/src/server/poll.ts | 741 | try { | COMMENT |
| LOW | packages/core/src/server/core-routes-plugin.ts | 1681 | ); | COMMENT |
| LOW | packages/core/src/server/core-routes-plugin.ts | 1721 | COMMENT | |
| LOW | packages/core/src/server/core-routes-plugin.ts | 2141 | // /builder/status (primary flow), or | COMMENT |
| LOW | packages/core/src/server/core-routes-plugin.ts | 2321 | const isFreeAccount = parseBuilderCallbackBoolean( | COMMENT |
| LOW | packages/core/src/server/core-routes-plugin.ts | 3301 | } catch { | COMMENT |
| LOW | packages/core/src/server/core-routes-plugin.ts | 3501 | `${mcpRoutePrefix}/connect`, | COMMENT |
| LOW | packages/core/src/server/collab-plugin.ts | 121 | // visibility, and share rows. In addition to the owner/org tags we also | COMMENT |
| LOW | packages/core/src/server/google-oauth.ts | 841 | ), | COMMENT |
| LOW | packages/core/src/server/csrf.ts | 61 | */ | COMMENT |
| LOW | packages/core/src/server/auth.ts | 1721 | // primary integration processor, so it must bypass cookie/session auth. | COMMENT |
| LOW | packages/core/src/server/auth.ts | 1741 | // the run is never claimed, its heartbeat never starts, and it times out with | COMMENT |
| LOW | packages/core/src/server/auth.ts | 1781 | p === `${MCP_LEGACY_ROUTE_PREFIX}/` | COMMENT |
| LOW | packages/core/src/server/auth.ts | 1841 | // Internal processor endpoint for the A2A async-mode fanout. Mirrors the | COMMENT |
| LOW | packages/core/src/server/auth.ts | 1861 | // OAuth access token that `getSession` only honors on the action surface. | COMMENT |
| LOW | packages/core/src/server/auth.ts | 1921 | // React Router's lazy route discovery fetches `/__manifest?p=...` to | COMMENT |
| LOW | packages/core/src/server/auth.ts | 3601 | // custom plugin in the same server boot), don't re-mount routes — but DO | COMMENT |
| LOW | packages/core/src/server/ssr-handler.ts | 401 | } | COMMENT |
| LOW | packages/core/src/server/transcribe-voice.ts | 61 | // bounding worst-case request size; truncation (when it does happen) keeps | COMMENT |
| LOW | packages/core/src/server/framework-request-handler.ts | 181 | // readiness gate above only guarantees every tracked plugin has FINISHED | COMMENT |
| LOW | packages/core/src/usage/store.ts | 261 | if (isPostgres()) { | COMMENT |
| LOW | packages/core/src/agent/durable-background.ts | 301 | `forceEnv=${typeof process.env.AGENT_CHAT_FORCE_BACKGROUND_RUNTIME === "string" && process.env.AGENT_CHAT_FORCE_BACK | COMMENT |
| LOW | packages/core/src/agent/run-manager.ts | 981 | finalStatus, | COMMENT |
| LOW | packages/core/src/agent/run-manager.ts | 1521 | // Check memory first — return both running AND recently-completed runs | COMMENT |
| LOW | packages/core/src/agent/run-manager.ts | 1581 | // For an in-memory run we don't have a separate "last event emit" | COMMENT |
| LOW | packages/core/src/agent/run-manager.ts | 1601 | hasInFlightWork: sqlSnapshot?.inFlightSince != null, | COMMENT |
| LOW | packages/core/src/agent/run-manager.ts | 1621 | // no live worker; a claimed/heartbeating run is left alone by the | COMMENT |
| LOW | packages/core/src/agent/run-manager.ts | 1681 | }; | COMMENT |
| LOW | packages/core/src/agent/production-agent.spec.ts | 1621 | id: "tool-edit", | COMMENT |
| LOW | packages/core/src/agent/run-loop-with-resume.ts | 321 | "run_timeout", | COMMENT |
| LOW | packages/core/src/agent/run-loop-with-resume.ts | 361 | upstreamSignal.removeEventListener("abort", abortFromUpstream); | COMMENT |
| LOW | packages/core/src/agent/production-agent.ts | 3201 | firstStartedAt: number; | COMMENT |
| LOW | packages/core/src/agent/production-agent.ts | 4061 | opts.toolLimits?.maxResultChars ?? | COMMENT |
| 459 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/agent-native-visual-plans/skills/visual-plan/SKILL.md | 394 | `targetNodePath` (e.g. `card > list > listItem "Acme Inc"`) identifying the | CODE |
| LOW | .agents/skills/secrets/SKILL.md | 231 | "user@example.com", | CODE |
| LOW | .agents/skills/tracking/SKILL.md | 37 | { userId: "user@example.com" }, | CODE |
| LOW | .agents/skills/tracking/SKILL.md | 48 | identify("user@example.com", { plan: "pro", company: "ExampleCo" }); | CODE |
| LOW | .agents/skills/automations/SKILL.md | 114 | }, { owner: "user@example.com" }); | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 835 | "placeholder", | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 855 | "placeholder", | CODE |
| LOW | packages/core/src/demo/redact.spec.ts | 301 | session_id: "Acme Corp", | CODE |
| LOW | packages/core/src/demo/redact.spec.ts | 315 | expect(out.session_id).toBe("Acme Corp"); | CODE |
| LOW | packages/core/src/demo/redact.spec.ts | 351 | ids: ["John Smith", "Jane Doe"], | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 73 | owner_email: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 262 | message: { id: "placeholder", role: "assistant", content: [] }, | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 266 | headId: "placeholder", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 358 | ownerEmail: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 371 | ownerEmail: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 389 | await searchThreads("user@example.com", "100%_done"); | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 437 | const result = await listThreads("user@example.com", { limit: 10 }); | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 460 | owner_email: "user@example.com", | CODE |
| LOW⚡ | packages/core/src/chat-threads/store.spec.ts | 510 | const defaultList = await listThreads("user@example.com", { limit: 10 }); | CODE |
| LOW⚡ | packages/core/src/chat-threads/store.spec.ts | 514 | const listWithArchived = await listThreads("user@example.com", { | CODE |
| LOW⚡ | packages/core/src/chat-threads/store.spec.ts | 524 | const defaultSearch = await searchThreads("user@example.com", "Thread"); | CODE |
| LOW⚡ | packages/core/src/chat-threads/store.spec.ts | 529 | "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 543 | const afterUnarchive = await listThreads("user@example.com", { | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 595 | await freshStore.listThreads("user@example.com"); | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 712 | const forked = await forkThread("thread-unflushed", "user@example.com", { | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 746 | owner_email: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 797 | const forked = await forkThread("thread-stale", "user@example.com", { | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 827 | owner_email: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 881 | const forked = await forkThread("thread-fresh", "user@example.com", { | CODE |
| LOW | packages/core/src/org/context.spec.ts | 425 | name: "Jane Doe", | CODE |
| LOW | packages/core/src/org/context.spec.ts | 447 | expect(ctx.orgName).toBe("Jane Doe's workspace"); | CODE |
| LOW | packages/core/src/org/context.spec.ts | 642 | expect(result.name).toBe("Acme Inc"); | CODE |
| LOW | packages/core/src/org/context.spec.ts | 652 | expect(calls[0].args[1]).toBe("Acme Inc"); | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 103 | vi.mocked(getSession).mockResolvedValue({ email: "test@test.com" } as any); | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 105 | email: "test@test.com", | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 115 | { id: "1", path: "a.md", owner: "test@test.com" }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 123 | expect(mockEnsurePersonalDefaults).toHaveBeenCalledWith("test@test.com"); | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 125 | "test@test.com", | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 127 | { userEmail: "test@test.com", orgId: null }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 216 | expect(mockEnsurePersonalDefaults).toHaveBeenCalledWith("test@test.com"); | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 218 | "test@test.com", | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 220 | { userEmail: "test@test.com", orgId: null }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 852 | { id: "1", path: "README.md", owner: "test@test.com" }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 853 | { id: "2", path: "skills/learn.md", owner: "test@test.com" }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 854 | { id: "3", path: "skills/review.md", owner: "test@test.com" }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 855 | { id: "4", path: "docs/api/auth.md", owner: "test@test.com" }, | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 48 | getSession: vi.fn().mockResolvedValue({ email: "test@test.com" }), | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 52 | email: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 138 | expect(mockResourceList).toHaveBeenCalledWith("test@test.com", undefined); | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 160 | userEmail: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 173 | "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 175 | { userEmail: "test@test.com", orgId: null }, | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 188 | "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 192 | userEmail: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 239 | owner: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 318 | owner: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 342 | owner: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 373 | owner: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 459 | email: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 477 | email: "test@test.com", | CODE |
| 219 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 3 | ## The framework for agentic apps | COMMENT |
| MEDIUM | .agents/skills/external-agents/SKILL.md | 144 | ### 1a. Generic cross-app verbs + scaffolding | COMMENT |
| MEDIUM | .agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | packages/core/src/index.ts | 17 | // In-loop processors (observers/guardrails for runAgentLoop) | COMMENT |
| MEDIUM | packages/core/src/triggers/dispatcher.ts | 175 | // In-flight agentic dispatches keyed by `${owner}:${path}`. Guards against the | COMMENT |
| MEDIUM | …es/core/src/server/agent-chat-plugin.resources.spec.ts | 77 | content: "# Organization Guardrails\n\nNarrow workspace guardrails.", | CODE |
| MEDIUM | packages/core/src/server/framework-request-handler.ts | 741 | // at a TS source file (the scaffold default), but Node can't | COMMENT |
| MEDIUM | packages/core/src/cli/plan-local.ts | 1776 | // `plan local init` scaffold fails its own `plan local check`/`serve` lint. | COMMENT |
| MEDIUM | packages/core/src/cli/plan-local.ts | 3158 | // subcommand (e.g. `plan local init --help` must not scaffold a folder). | COMMENT |
| MEDIUM | packages/core/src/cli/create-e2e.spec.ts | 412 | // The scaffold must be linked to the local core build (file: URL), not | COMMENT |
| MEDIUM | packages/core/src/cli/index.ts | 26 | // first fails deep inside a scaffold dynamic import with a cryptic | COMMENT |
| MEDIUM | packages/core/src/cli/index.ts | 764 | // refresh scaffold skills, and verify — without framework patches. | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 138 | // standalone scaffold (script-friendly, matches historic behavior). | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 164 | // Headless scaffold a single standalone app (the lightest starts; headless | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 169 | // it must skip the start-shape prompt and scaffold a workspace directly. | COMMENT |
| MEDIUM | packages/core/src/cli/plan-install.spec.ts | 168 | // _gitignore must be renamed to .gitignore so the scaffold is git-clean. | COMMENT |
| MEDIUM | packages/core/src/cli/plan-local.spec.ts | 338 | // Mirrors the `plan local init` scaffold prose, which documents block usage | COMMENT |
| MEDIUM | packages/core/src/cli/plan-local.spec.ts | 729 | // The scaffold's `<WireframeBlock><Screen>...` is a documentation example in | COMMENT |
| MEDIUM | packages/core/src/cli/create-workspace.ts | 25 | // Preserve the alias's contract: always scaffold a workspace, never the | COMMENT |
| MEDIUM | packages/core/src/templates/chat-shell-sync.spec.ts | 11 | * # scaffold → chat | COMMENT |
| MEDIUM | packages/core/src/templates/chat-shell-sync.spec.ts | 17 | * # chat → scaffold | COMMENT |
| MEDIUM | …templates/default/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | …workspace-core/.agents/skills/external-agents/SKILL.md | 144 | ### 1a. Generic cross-app verbs + scaffolding | COMMENT |
| MEDIUM | …es/workspace-core/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | packages/core/src/client/builder-frame.ts | 153 | // Detect "build/create/make/scaffold a new app/agent" style prompts. | COMMENT |
| MEDIUM | packages/core/src/client/composer/TiptapComposer.tsx | 2339 | // the local agent (dispatch, mail, etc.) cannot scaffold workspace | COMMENT |
| MEDIUM | …patch/src/server/lib/workspace-resources-store.spec.ts | 822 | content: "# Workspace guardrails", | CODE |
| MEDIUM | …patch/src/server/lib/workspace-resources-store.spec.ts | 968 | content: "# Updated guardrails", | CODE |
| MEDIUM | …patch/src/server/lib/workspace-resources-store.spec.ts | 988 | content: "# Updated guardrails", | CODE |
| MEDIUM | packages/dispatch/src/routes/pages/workspace.tsx | 454 | : "# Instructions\n\nAlways-on guardrails for agents across apps..." | CODE |
| MEDIUM | .github/workflows/ci.yml | 301 | # `--headless` scaffold must `pnpm typecheck` (no inherited vite/client | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 312 | # packages/scheduling scaffold path. Together they guard the two | COMMENT |
| MEDIUM | templates/design/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/calendar/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/forms/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/clips/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/chat/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/mail/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/plan/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/plan/server/plan-content.spec.ts | 72 | // `tabs`) AND strip the document scaffold so the block validates and renders | COMMENT |
| MEDIUM | templates/plan/server/plan-content.spec.ts | 699 | // one as a full standalone page, drop the scaffold (doctype/html/head/body) | COMMENT |
| MEDIUM | templates/plan/server/plan-content.ts | 480 | // scaffold stripped and the whole columns block degrades to an "Unsupported | COMMENT |
| MEDIUM | templates/dispatch/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/content/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/slides/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/brain/evals/slack-pilot-corpus.ts | 113 | captureTitle: "#brain-pilot Slack history guardrails", | CODE |
| MEDIUM | templates/brain/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | templates/assets/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | …mplates/analytics/.agents/skills/create-skill/SKILL.md | 115 | ### Generator (scaffolding) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …tes/design/app/components/design/MultiScreenCanvas.tsx | 1902 | // into id-less AI-generated screens can never flow-insert. | COMMENT |
| HIGH | …n/app/components/design/bridge/editor-chrome.bridge.ts | 1361 | // Id-on-demand (empty-node-id fix, bridge side): AI-generated screens | COMMENT |
| HIGH | …n/app/components/design/bridge/editor-chrome.bridge.ts | 4092 | // common for hover states, toggles, carousels in AI-generated prototypes) | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 5607 | // ── Real-usage regressions from the user's AI-generated design (Batch 5) ──── | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 5621 | // Mirrors the user's AI-generated screen shape: a block container with | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 6155 | // AI-generated-design shape: NO data-agent-native-node-id anywhere. | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 6822 | // anywhere (the common case for default AI-generated content) used to | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 6845 | // No data-agent-native-node-id anywhere — default AI-generated shape. | COMMENT |
| HIGH | …nents/design/edit-panel/element-classification.test.ts | 38 | // AI-generated todo design: div tag, draft-text-* source id, no | COMMENT |
| HIGH | templates/design/app/pages/Index.tsx | 133 | // Designs the user has manually renamed since creation — an AI-generated | COMMENT |
| HIGH | templates/design/app/pages/Index.tsx | 289 | // immediately, then a short AI-generated name replaces it in the | COMMENT |
| HIGH | …pp/pages/DesignEditor.styleCommitAndDropAnchor.spec.ts | 78 | // Mirrors a fresh AI-generated screen: no data-agent-native-node-id | COMMENT |
| HIGH | templates/design/actions/generate-screens.ts | 24 | // fixed desktop-shaped region regardless of content (B5-10: AI-generated | COMMENT |
| HIGH | templates/design/actions/generate-screens.spec.ts | 221 | // B5-10: AI-generated desktop designs were being placed in mobile-width | COMMENT |
| HIGH | …analytics/.agents/skills/dashboard-management/SKILL.md | 282 | // Use "dashboard" for AI-generated first-party panels by default. | COMMENT |
| HIGH | …plates/analytics/server/lib/data-dictionary-context.ts | 240 | "## AI-generated suggestions", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/qa/SKILL.md | 43 | ### Step 1: Parse Args | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 50 | ### Step 2: Check Credential Readiness | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 69 | ### Step 3: Start Dev Servers | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 90 | ### Step 4: Generate Test Plans | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 111 | ### Step 5: Create Team and Spawn Testers | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 132 | ### Step 6: Monitor and Alert | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 140 | ### Step 7: Compile Report and Shutdown | COMMENT |
| LOW⚡ | packages/pinpoint/README.md | 11 | ### Step 1: Install | COMMENT |
| LOW⚡ | packages/pinpoint/README.md | 17 | ### Step 2: Initialize agent actions and skill | COMMENT |
| LOW⚡ | packages/pinpoint/README.md | 25 | ### Step 3: Mount the client overlay | COMMENT |
| LOW | packages/pinpoint/README.md | 43 | ### Step 4: Add server middleware | COMMENT |
| LOW | packages/pinpoint/README.md | 56 | ### Step 5: Verify | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 87 | // Step 1: Peek at JWT claims WITHOUT verification to get org_domain. | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 101 | // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 117 | // Step 3: Verify JWT with the candidate secrets. | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 265 | // Step 1: Let the adapter cache the raw body and identify any challenge. | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 271 | // Step 2: Verify webhook signature | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 280 | // Step 3: Parse the incoming message | COMMENT |
| LOW | …rc/templates/workspace-core/.agents/skills/qa/SKILL.md | 43 | ### Step 1: Parse Args | COMMENT |
| LOW | …rc/templates/workspace-core/.agents/skills/qa/SKILL.md | 50 | ### Step 2: Check Credential Readiness | COMMENT |
| LOW | …rc/templates/workspace-core/.agents/skills/qa/SKILL.md | 69 | ### Step 3: Start Dev Servers | COMMENT |
| LOW | …rc/templates/workspace-core/.agents/skills/qa/SKILL.md | 90 | ### Step 4: Generate Test Plans | COMMENT |
| LOW | …rc/templates/workspace-core/.agents/skills/qa/SKILL.md | 111 | ### Step 5: Create Team and Spawn Testers | COMMENT |
| LOW | …rc/templates/workspace-core/.agents/skills/qa/SKILL.md | 132 | ### Step 6: Monitor and Alert | COMMENT |
| LOW | …rc/templates/workspace-core/.agents/skills/qa/SKILL.md | 140 | ### Step 7: Compile Report and Shutdown | COMMENT |
| LOW | …s/plan/actions/update-visual-plan-comment-flow.spec.ts | 901 | // Step 1: reviewer comment-only call (no authoring changes). | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 38 | ### Step 1: Understand the Question (catalog-first, clarify-first) | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 49 | ### Step 2: Gather Data from Multiple Sources | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 90 | ### Step 3: Analyze and Synthesize | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 104 | ### Step 4: Generate Charts (when useful) | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 126 | ### Step 5: Format Results as Markdown | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 162 | ### Step 6: Save the Analysis (only when requested) | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 196 | ### Step 7: Navigate to the Result | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 432 | // Step 1: Look up user by email | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 447 | // Step 2: Open/get DM channel | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 466 | // Step 3: Send message | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 74 | // Step 1: HubSpot deal-property cohort IN-search. | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 125 | // Step 2: batched deal -> company associations. Big intermediate | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 148 | // Step 3: batched company -> domain lookup. | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 176 | // Step 4: Pylon account sentiment, keyed by domain. Second provider, | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 206 | // Step 5: join + emit. csm_name is computed HERE, in the program — never | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/core/src/a2a/server.ts | 87 | // Step 1: Peek at JWT claims WITHOUT verification to get org_domain. | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 101 | // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 117 | // Step 3: Verify JWT with the candidate secrets. | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 265 | // Step 1: Let the adapter cache the raw body and identify any challenge. | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 271 | // Step 2: Verify webhook signature | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 280 | // Step 3: Parse the incoming message | COMMENT |
| LOW | …s/public/mediapipe/wasm/vision_wasm_nosimd_internal.js | 23 | // We need to check if Module already exists (e.g. case 3 above). | COMMENT |
| LOW | …es/clips/public/mediapipe/wasm/vision_wasm_internal.js | 23 | // We need to check if Module already exists (e.g. case 3 above). | COMMENT |
| LOW | …s/plan/actions/update-visual-plan-comment-flow.spec.ts | 901 | // Step 1: reviewer comment-only call (no authoring changes). | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 432 | // Step 1: Look up user by email | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 447 | // Step 2: Open/get DM channel | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 466 | // Step 3: Send message | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 74 | // Step 1: HubSpot deal-property cohort IN-search. | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 125 | // Step 2: batched deal -> company associations. Big intermediate | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 148 | // Step 3: batched company -> domain lookup. | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 176 | // Step 4: Pylon account sentiment, keyed by domain. Second provider, | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 206 | // Step 5: join + emit. csm_name is computed HERE, in the program — never | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/core/src/server/agent-teams-run-queue.spec.ts | 5 | // robust to formatting. | COMMENT |
| MEDIUM | packages/core/src/client/org/TeamPage.tsx | 681 | // "email" per line. A robust full CSV parser would be overkill here. | COMMENT |
| LOW | .github/workflows/auto-publish.yml | 89 | # (actions/runner-images#13883), so we just use a Node version that | COMMENT |
| MEDIUM | templates/design/actions/get-motion-timeline.ts | 107 | // Timeline span (max delay + duration) is robust when tracks carry | COMMENT |
| MEDIUM | templates/design/e2e/effects-heavy-geometry.spec.ts | 249 | // robust to any outer iframe offset while still catching a layout | COMMENT |
| MEDIUM | templates/clips/desktop/src/lib/recorder.ts | 2854 | // also means the preview → recording transition is seamless (no black | COMMENT |
| MEDIUM | …plates/content/app/components/editor/BubbleToolbar.tsx | 250 | // Capture a robust anchor (quote + surrounding context + offset) | COMMENT |
| MEDIUM | templates/content/server/plugins/db.ts | 277 | // v28-v31: robust text-anchor + @mention metadata for document comments. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | templates/design/actions/generate-design.spec.ts | 483 | const fileTypeCall = mocks.fileUpdateChain.set.mock.calls.find( | CODE |
| CRITICAL | templates/plan/actions/view-screen.ts | 108 | screens: bundle.plan.content.prototype.screens.map( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ckages/core/src/cli/skills-content/document-quality.ts | 16 | drop the old idea", "as discussed above", "this revision", "unlike the prior | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/docs/app/entry.server.tsx | 9 | export default async function handleRequest( | CODE |
| LOW | packages/migrate/src/adapters/agent-native-target.ts | 352 | export default async function handleRequest( | CODE |