A framework for building agent-native applications.
This report presents the forensic synthetic code analysis of BuilderIO/agent-native, a TypeScript project with 4,601 GitHub stars. SynthScan v2.0 examined 3,547,188 lines of code across 15738 source files, recording 11391 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 3.7 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 11391 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | examples/chat-antd/app/lib/agent-page.tsx | 27 | export function resolveAgentPageComponent( | CODE |
| LOW | examples/chat-mui/app/lib/agent-page.tsx | 27 | export function resolveAgentPageComponent( | CODE |
| LOW | scripts/compact-changelogs.ts | 85 | function releaseSectionIsUnreleased(section: string): boolean { | CODE |
| LOW | scripts/validate-content-product-impact.ts | 225 | export function parseContentImpactDeclaration(body: string): DeclarationResult { | CODE |
| LOW | scripts/validate-content-product-impact.ts | 349 | export function analyzeContentProductImpact( | CODE |
| LOW | scripts/validate-content-product-impact.ts | 548 | function materializeContentProductSnapshot( | CODE |
| LOW | scripts/validate-content-product-impact.ts | 646 | export function runContentProductImpactCheck(): void { | CODE |
| LOW | scripts/guard-public-packages.ts | 76 | function readWorkspacePackageNames(): Set<string> { | CODE |
| LOW | scripts/guard-public-packages.ts | 105 | function dependencyProtocolFailures( | CODE |
| LOW | scripts/guard-public-packages.ts | 127 | function localWorkspaceDependencyFailures( | CODE |
| LOW | scripts/guard-agent-chat-context.ts | 89 | export function analyzeAgentChatContextPolicy( | CODE |
| LOW | scripts/guard-agent-chat-context.ts | 158 | export function discoverAgentInstructionFiles(repoRoot: string): string[] { | CODE |
| LOW | scripts/guard-agent-chat-context.ts | 185 | export function checkAgentInstructionSizes(repoRoot: string): { | CODE |
| LOW | scripts/guard-agent-chat-context.ts | 225 | export function checkAgentChatContextPolicies(repoRoot: string): { | CODE |
| LOW | scripts/trusted-acceptance.ts | 151 | export function validateTrustedAcceptanceConfig( | CODE |
| LOW | scripts/trusted-acceptance.ts | 510 | export function createTrustedAcceptancePlan( | CODE |
| LOW | scripts/trusted-acceptance.ts | 591 | export function validatePullRequestProvenance( | CODE |
| LOW | scripts/trusted-acceptance.ts | 708 | function containsSensitiveReceiptData( | CODE |
| LOW | scripts/trusted-acceptance.ts | 734 | export function validateTrustedAcceptanceReceipt( | CODE |
| LOW | scripts/validate-content-product-docs.ts | 78 | export function validateContentProductDocs( | CODE |
| LOW | scripts/validate-content-product-docs.ts | 109 | export function writeContentProductProjections(root = defaultProductRoot) { | CODE |
| LOW | scripts/validate-content-product-docs.ts | 666 | function validateCapabilityMiniSpec( | CODE |
| LOW | scripts/validate-content-product-docs.ts | 887 | function validateForbiddenFrontmatter(record: ProductRecord, errors: string[]) { | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke-readiness.ts | 4 | export function isTransientStartupPollResponse( | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke-readiness.ts | 12 | export function isRetryableSessionReadErrorMessage(message: string): boolean { | CODE |
| LOW | scripts/guard-netlify-prebuilt-workflow.ts | 34 | export function validateReusableWorkflowConcurrency( | CODE |
| LOW | scripts/guard-netlify-prebuilt-workflow.ts | 54 | export function validateProductionPurgeCondition(ifValue: unknown): string[] { | CODE |
| LOW | scripts/guard-netlify-prebuilt-workflow.ts | 65 | export function validateProductionSiteConcurrency(workflows: { | CODE |
| LOW | scripts/guard-eject-manifests.ts | 129 | function validateManifestFreshness(loaded: LoadedManifest): void { | CODE |
| LOW | scripts/guard-eject-manifests.ts | 234 | function validateDeclaredDependencies( | CODE |
| LOW | scripts/guard-eject-manifests.ts | 364 | function validateToolkitExportCoverage(loaded: LoadedManifest[]): void { | CODE |
| LOW | scripts/guard-eject-manifests.ts | 424 | function validateDomainPackageCoverage(loaded: LoadedManifest[]): void { | CODE |
| LOW | scripts/guard-eject-manifests.ts | 529 | function sourceTargetForEntrypoint( | CODE |
| LOW | scripts/validate-content-product-impact-workflow.ts | 121 | function containsCredentialContext(value: unknown): boolean { | CODE |
| LOW | scripts/validate-content-product-impact-workflow.ts | 141 | export function validateContentProductImpactWorkflow( | CODE |
| LOW | scripts/qa-chat-first-workbench-smoke.ts | 646 | async function installElectronAppCreationSmokeMock( | CODE |
| LOW | scripts/qa-chat-first-workbench-smoke.ts | 735 | async function installElectronActiveChatSmokeMock( | CODE |
| LOW | scripts/guard-i18n-changed-copy.ts | 198 | function resolveCatalogSourceImplementation( | CODE |
| LOW | scripts/guard-i18n-changed-copy.ts | 219 | function collectImportedLocaleFiles( | CODE |
| LOW | scripts/guard-i18n-changed-copy.ts | 236 | function collectInlineLocaleChanges( | CODE |
| LOW | scripts/guard-i18n-changed-copy.ts | 270 | function hasInlineEnglishCopyAddition( | CODE |
| LOW | scripts/guard-controller-boundaries.ts | 33 | export function findControllerBoundaryViolations( | CODE |
| LOW⚡ | scripts/guard-env-documentation.ts | 276 | function isDynamicEnvironmentManifest(relativePath: string): boolean { | CODE |
| LOW⚡ | scripts/guard-env-documentation.ts | 280 | function isDeployCredentialRegistry(relativePath: string): boolean { | CODE |
| LOW⚡ | scripts/guard-env-documentation.ts | 284 | function collectDeclaredEnvironmentKeys(source: string, keys: Set<string>) { | CODE |
| LOW | scripts/netlify-prebuilt-target.ts | 81 | export function resolveNetlifyPrebuiltTarget( | CODE |
| LOW | scripts/dev-lazy.ts | 232 | function includeDesktopLazyDefaults(selected: TemplateApp[]): TemplateApp[] { | CODE |
| LOW | scripts/dev-lazy.ts | 592 | export function isBrowserAssetDestination( | CODE |
| LOW | scripts/dev-lazy.ts | 604 | export function selectProxyResponseTimeout( | CODE |
| LOW | scripts/dev-lazy.ts | 1648 | export function canonicalLoopbackRedirect( | CODE |
| LOW | scripts/dev-lazy.ts | 1821 | function runNativeBindingPreflight(): void { | CODE |
| LOW | scripts/guard-ssr-cache-artifact.ts | 86 | function blockAfterGeneratedMarker( | CODE |
| LOW | scripts/guard-ssr-cache-artifact.ts | 102 | export function validateNetlifyHeadersArtifact( | CODE |
| LOW | scripts/guard-ssr-cache-artifact.ts | 177 | export function validateStaticCacheContract( | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke.ts | 170 | function assertStandalonePackageJson(): void { | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke.ts | 372 | async function waitForUnauthenticatedPollReady( | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke.ts | 599 | function isTransientDevServerError(err: unknown): boolean { | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke.ts | 777 | async function readAuthenticatedSessionEmail( | CODE |
| LOW | scripts/qa-standalone-chat-dev-smoke.ts | 952 | async function waitForAuthenticatedShell( | CODE |
| LOW | scripts/guard-request-storms.ts | 139 | export function analyzeRequestStormSource({ | CODE |
| 8890 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/dev-electron.ts | 56 | // ── App port assignments ─────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/dev-electron.ts | 75 | // ── Parse --apps flag ────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/dev-electron.ts | 84 | // ── Ports that may need cleanup before starting ──────────────── | COMMENT |
| MEDIUM | scripts/dev-electron.ts | 187 | // ── Build concurrently command list ─────────────────────────── | COMMENT |
| MEDIUM | scripts/dev-all.ts | 17 | // ── Args ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/triggers/dispatcher.ts | 59 | // ─── Dispatcher deps (same pattern as SchedulerDeps) ──────────────────────── | COMMENT |
| MEDIUM | packages/core/src/terminal/terminal-plugin.ts | 22 | // ─── module-load self-heal: chmod node-pty's spawn-helper ───────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 3144 | // ─── Agent Teams: per-run send reference ───────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 4196 | // ─── Agent Teams: durable sub-agent run processor ───────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 5144 | // ─── Generate thread title ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 5247 | // ─── Run management endpoints (for hot-reload resilience) ───────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 5587 | // ─── Checkpoint endpoints ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 5704 | // ─── Public read-only shared thread endpoint ───────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 5716 | // ─── Thread management endpoints ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 6308 | // ─── Durable background agent-chat run processor ────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 6645 | // ─── Recurring Jobs Scheduler ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 6859 | // ─── Agent Teams orphan sweep ───────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 6910 | // ─── Unclaimed background-run sweep ──────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 7145 | // ─── Legacy chat-thread message_count repair ────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-chat-plugin.ts | 7157 | // ─── Trigger Dispatcher (event-based automations) ───────────────── | COMMENT |
| MEDIUM | packages/core/src/server/short-lived-token.ts | 184 | // ── Realtime subscribe tokens ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/short-lived-token.ts | 360 | // ── Realtime voice tool capabilities ───────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/short-lived-token.ts | 485 | // ── Gateway access-check tokens ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-teams.spec.ts | 506 | // ── Completion loop injection ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 62 | // ─── Postgres introspection ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 135 | // ─── SQLite / libSQL / D1 introspection ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 174 | // ─── Cached entry point ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 221 | // ─── Formatting ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/schema-prompt.ts | 262 | // ─── Public API ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 3 | // ── In-memory queue table (real queue module runs against this) ─────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 128 | // ── app_state (task records + thread reverse-lookup) ────────────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 165 | // ── chat thread store (thread_data round-trips through here) ────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 182 | // ── run-manager: drive runFn then onComplete with a synthetic run ───────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 244 | // ── production-agent: scripted agent loop ───────────────────────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 331 | // ── progress registry: no-op writes ────────────────────────────────────── | COMMENT |
| MEDIUM | …ckages/core/src/server/agent-teams-process-run.spec.ts | 366 | // ── capture self-fire dispatches ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 4221 | // ─── Voice transcription (Whisper) ─────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 4228 | // ─── Google realtime transcription session bridge ─────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 4237 | // ─── Voice provider status ─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 4245 | // ─── Ad-hoc secrets (user-created keys) ──────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 4250 | // ─── Secrets registry ──────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 4362 | // ─── Agent run progress ─────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 4368 | // ─── Automations API ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 4374 | // ─── Application State CRUD ────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/core/src/server/core-routes-plugin.ts | 4377 | // ─── User-scoped settings store ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 2118 | // ─── Durable sandbox execution processor ───────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 2187 | // ─── Durable sandbox execution sweep ────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 4043 | // ─── Usage & cost summary ──────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 4079 | // ─── File upload primitive ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 4287 | // ─── Notifications inbox ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 4298 | // ─── Extensions (sandboxed mini-app runtime + proxy) ──────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 4326 | // ─── Data programs (stored server-side JS scripts + run cache) ───── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 4336 | // ─── Page-level legacy redirect: /tools → /extensions ────────────── | COMMENT |
| MEDIUM | packages/core/src/server/core-routes-plugin.ts | 4432 | // ─── Avatar routes ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/poll-handler.spec.ts | 1321 | // ─── Idle cost ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-teams.ts | 785 | // ── Legacy fallback: no durable queue row ──────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-teams.ts | 1309 | // ── Delegation-depth guardrail ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/server/agent-teams.ts | 1600 | // ── Completion loop: notify the parent thread ───────────────────────────── | COMMENT |
| MEDIUM | …s/core/src/server/agent-teams-delegation-depth.spec.ts | 3 | // ── app_state (task records + thread reverse-lookup) ────────────────────── | COMMENT |
| MEDIUM | …s/core/src/server/agent-teams-delegation-depth.spec.ts | 108 | // (i) within-limit spawn still works ─────────────────────────────────────── | COMMENT |
| 1039 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/dev-lazy.ts | 501 | // Nitro's dev runner waits ~3.1s for the SSR entry import; if Vite is still | COMMENT |
| LOW | scripts/persistent-compositing-baseline.txt | 1 | # guard:persistent-compositing baseline | COMMENT |
| LOW | scripts/dev-all.ts | 161 | COMMENT | |
| LOW | packages/pinpoint/src/ui/components/PinMarker.tsx | 1 | // @agent-native/pinpoint — Pin markers: outline + numbered badge per element | COMMENT |
| LOW | packages/pinpoint/src/freeze/react-freeze.spec.ts | 1 | // @agent-native/pinpoint — freezeReact tests | COMMENT |
| LOW | packages/pinpoint/src/storage/storage-interface.ts | 1 | // @agent-native/pinpoint — Storage interface re-export | COMMENT |
| LOW | …ckages/pinpoint/src/detection/selector-builder.spec.ts | 1 | // @agent-native/pinpoint — selector-builder tests | COMMENT |
| LOW | packages/core/src/action.ts | 1061 | // ecosystem can migrate over time. The bridge treats `undefined` as | COMMENT |
| LOW | packages/core/src/demo/fetch-interceptor.ts | 41 | // run state here would make recovery think it's not progressing and | COMMENT |
| LOW | packages/core/src/settings/store.ts | 81 | value TEXT NOT NULL, | COMMENT |
| LOW | packages/core/src/chat-threads/store.ts | 101 | // `CREATE INDEX` still takes a lock that, in a fresh background-worker | COMMENT |
| LOW | packages/core/src/chat-threads/store.ts | 141 | "created_at", | COMMENT |
| LOW | packages/core/src/ingestion/pptx.ts | 2581 | COMMENT | |
| LOW | packages/core/src/ingestion/pptx.ts | 2601 | // `a:spcPct` is a percentage of *single* line spacing, and single spacing in | COMMENT |
| LOW | packages/core/src/ingestion/figma-node-to-html.ts | 841 | // an unset size looks like, so the export hop could not recover the | COMMENT |
| LOW | packages/core/src/ingestion/figma-node-to-html.ts | 1261 | (effect) => effect.visible !== false, | COMMENT |
| LOW | packages/core/src/ingestion/figma-node-to-html.ts | 1561 | if (node.layoutWrap === "WRAP") styles["flex-wrap"] = "wrap"; | COMMENT |
| LOW | packages/core/src/ingestion/figma-node-to-html.ts | 1761 | } | COMMENT |
| LOW | packages/core/src/ingestion/figma-node-to-html.ts | 1801 | } else if (node.layoutSizingVertical === "HUG") { | COMMENT |
| LOW | packages/core/src/ingestion/figma-node-to-html.ts | 2721 | // via the Plugin API -- e.g. an authored 15deg/20deg rotation comes back | COMMENT |
| LOW | packages/core/src/sharing/access.ts | 561 | // deliberately grants a stronger public-by-link role or explicit shares | COMMENT |
| LOW | packages/core/src/triggers/dispatcher.spec.ts | 321 | COMMENT | |
| LOW | packages/core/src/org/migrations.ts | 61 | version: 1008, | COMMENT |
| LOW | packages/core/src/a2a/handlers.ts | 781 | } | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 201 | // | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 441 | : "Approval execution failed", | COMMENT |
| LOW | packages/core/src/deploy/function-bundle.ts | 401 | (name) => fs.existsSync(path.join(nodeModulesDir, ...name.split("/"))), | COMMENT |
| LOW | packages/core/src/deploy/build.ts | 2281 | } | COMMENT |
| LOW | packages/core/src/deploy/build.ts | 2301 | .filter((n) => !nodeBuiltinStubs.has(n)) | COMMENT |
| LOW | packages/core/src/deploy/build.ts | 2381 | // (Workers-on-the-edge use v2 and require the prefix; Pages lags.) | COMMENT |
| LOW | packages/core/src/deploy/build.ts | 2521 | // unavailable proxies for builtins that Pages Functions reject at upload | COMMENT |
| LOW | packages/core/src/deploy/build.ts | 5421 | process.env, | COMMENT |
| LOW | packages/core/src/secrets/storage.ts | 41 | // BIGINT on Postgres, which we need for millisecond timestamps. | COMMENT |
| LOW | packages/core/src/secrets/storage.ts | 181 | // `INSERT ... ON CONFLICT DO UPDATE` closes that window — it's one | COMMENT |
| LOW | packages/core/src/resources/store.ts | 901 | expires_at ${intType()}, | COMMENT |
| LOW | packages/core/src/resources/store.ts | 961 | COMMENT | |
| LOW | packages/core/src/resources/store.ts | 981 | }); | COMMENT |
| LOW | packages/core/src/feature-flags/index.ts | 21 | // Plugin and A2A auth stay on `./server` and `@agent-native/core/server`. | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1101 | } | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1121 | // and MCP tools remain discoverable through tool-search. | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1141 | const mcpOnlyActions = filterFrameworkToolGroups( | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1241 | await import("../extensions/fetch-tool.js"); | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1401 | COMMENT | |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1521 | // provider-corpus-job / query-staged-dataset / run-code BY NAME | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1741 | }; | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1761 | // the request context, so the metadata fallback was only ever used | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 1781 | // - NODE_ENV strictly === "development" (not "test", not unset). | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 2921 | // hooks are useful, but they should never leave agent_runs stuck | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 3881 | const { createDevScriptRegistry } = | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 4281 | const modelCandidate = | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 5541 | // the last reached `_process-run` worker stage (JSON | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 5561 | // — silently recovering server-side via the unclaimed-background-run | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 6721 | // off wherever `shouldDisableInProcessSweeps` is on — i.e. every | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 6901 | } | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 6921 | // fresh each tick and gated by `shouldRedispatchUnclaimedBackgroundRun` | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 6941 | // THREE-SITE INVARIANT (keep in lockstep): this sweep only ever sees the | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 6961 | // The marker below asserts `payloadRef: true`, and a worker that then | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 6981 | // chunk recovered here always starts a fresh nested-dispatch | COMMENT |
| LOW | packages/core/src/server/agent-chat-plugin.ts | 7041 | // at it again, so a dead producer was only reaped when some | COMMENT |
| LOW | packages/core/src/server/db-pressure.ts | 1 | // Database pressure — the three signals that precede an outage, measured from | COMMENT |
| 680 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/agent-native-visual-plans/skills/visual-plan/SKILL.md | 458 | `targetNodePath` (e.g. `card > list > listItem "Acme Inc"`) identifying the | CODE |
| LOW | .agents/skills/secrets/SKILL.md | 335 | "user@example.com", | CODE |
| LOW | .agents/skills/tracking/SKILL.md | 44 | { userId: "user@example.com" }, | CODE |
| LOW | .agents/skills/tracking/SKILL.md | 65 | identify("user@example.com", { plan: "pro", company: "ExampleCo" }); | CODE |
| LOW | .agents/skills/automations/SKILL.md | 155 | }, { owner: "user@example.com" }); | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 886 | "placeholder", | CODE |
| LOW | scripts/guard-i18n-catalogs.ts | 906 | "placeholder", | CODE |
| LOW | packages/core/src/demo/redact.spec.ts | 301 | session_id: "Acme Corp", | CODE |
| LOW | packages/core/src/demo/redact.spec.ts | 315 | expect(out.session_id).toBe("Acme Corp"); | CODE |
| LOW | packages/core/src/demo/redact.spec.ts | 351 | ids: ["John Smith", "Jane Doe"], | CODE |
| LOW⚡ | packages/core/src/chat-threads/store.spec.ts | 657 | const defaultList = await listThreads("user@example.com", { limit: 10 }); | CODE |
| LOW⚡ | packages/core/src/chat-threads/store.spec.ts | 661 | const listWithArchived = await listThreads("user@example.com", { | CODE |
| LOW⚡ | packages/core/src/chat-threads/store.spec.ts | 671 | const defaultSearch = await searchThreads("user@example.com", "Thread"); | CODE |
| LOW⚡ | packages/core/src/chat-threads/store.spec.ts | 676 | "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 87 | owner_email: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 357 | message: { id: "placeholder", role: "assistant", content: [] }, | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 361 | headId: "placeholder", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 453 | ownerEmail: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 466 | ownerEmail: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 484 | await searchThreads("user@example.com", "100%_done"); | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 532 | const result = await listThreads("user@example.com", { limit: 10 }); | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 577 | const result = await listThreads("user@example.com", { | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 607 | owner_email: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 690 | const afterUnarchive = await listThreads("user@example.com", { | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 743 | await freshStore.listThreads("user@example.com"); | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 873 | const forked = await forkThread("thread-unflushed", "user@example.com", { | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 907 | owner_email: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 961 | const forked = await forkThread("thread-stale", "user@example.com", { | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 991 | owner_email: "user@example.com", | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 1048 | const forked = await forkThread("thread-fresh", "user@example.com", { | CODE |
| LOW | packages/core/src/chat-threads/store.spec.ts | 1119 | owner_email: "user@example.com", | CODE |
| LOW | packages/core/src/org/context.spec.ts | 662 | name: "Jane Doe", | CODE |
| LOW | packages/core/src/org/context.spec.ts | 685 | expect(ctx.orgName).toBe("Jane Doe's workspace"); | CODE |
| LOW | packages/core/src/org/context.spec.ts | 1015 | expect(result.name).toBe("Acme Inc"); | CODE |
| LOW | packages/core/src/org/context.spec.ts | 1025 | expect(calls[0].args[1]).toBe("Acme Inc"); | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 103 | vi.mocked(getSession).mockResolvedValue({ email: "test@test.com" } as any); | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 105 | email: "test@test.com", | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 115 | { id: "1", path: "a.md", owner: "test@test.com" }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 123 | expect(mockEnsurePersonalDefaults).toHaveBeenCalledWith("test@test.com"); | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 125 | "test@test.com", | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 127 | { userEmail: "test@test.com", orgId: null }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 216 | expect(mockEnsurePersonalDefaults).toHaveBeenCalledWith("test@test.com"); | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 218 | "test@test.com", | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 220 | { userEmail: "test@test.com", orgId: null }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 930 | { id: "1", path: "README.md", owner: "test@test.com" }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 931 | { id: "2", path: "skills/learn.md", owner: "test@test.com" }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 932 | { id: "3", path: "skills/review.md", owner: "test@test.com" }, | CODE |
| LOW⚡ | packages/core/src/resources/handlers.spec.ts | 933 | { id: "4", path: "docs/api/auth.md", owner: "test@test.com" }, | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 48 | getSession: vi.fn().mockResolvedValue({ email: "test@test.com" }), | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 52 | email: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 138 | expect(mockResourceList).toHaveBeenCalledWith("test@test.com", undefined); | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 160 | userEmail: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 173 | "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 175 | { userEmail: "test@test.com", orgId: null }, | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 188 | "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 192 | userEmail: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 239 | owner: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 318 | owner: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 342 | owner: "test@test.com", | CODE |
| LOW | packages/core/src/resources/handlers.spec.ts | 383 | owner: "test@test.com", | CODE |
| 386 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 4 | ## The framework for agentic apps | COMMENT |
| MEDIUM | .agents/skills/external-agents/SKILL.md | 217 | ### 1a. Generic cross-app verbs + scaffolding | COMMENT |
| MEDIUM | .agents/skills/create-skill/SKILL.md | 114 | ### Generator (scaffolding) | COMMENT |
| MEDIUM | packages/core/README.md | 4 | ## The framework for agentic apps | COMMENT |
| MEDIUM | packages/core/src/index.ts | 23 | // In-loop processors (observers/guardrails for runAgentLoop) | COMMENT |
| MEDIUM | packages/core/src/triggers/dispatcher.ts | 78 | // In-flight agentic dispatches keyed by `${owner}:${path}`. Guards against the | COMMENT |
| MEDIUM | …es/core/src/server/agent-chat-plugin.resources.spec.ts | 80 | content: "# Organization Guardrails\n\nNarrow workspace guardrails.", | CODE |
| MEDIUM | packages/core/src/server/framework-request-handler.ts | 927 | // at a TS source file (the scaffold default), but Node can't | COMMENT |
| MEDIUM | packages/core/src/cli/plan-local.ts | 1776 | // `plan local init` scaffold fails its own `plan local check`/`serve` lint. | COMMENT |
| MEDIUM | packages/core/src/cli/plan-local.ts | 3158 | // subcommand (e.g. `plan local init --help` must not scaffold a folder). | COMMENT |
| MEDIUM | packages/core/src/cli/create-e2e.spec.ts | 544 | // The commit landed in the scaffold, not in the inherited repository. | COMMENT |
| MEDIUM | packages/core/src/cli/create-e2e.spec.ts | 591 | // The scaffold landed in the current directory. | COMMENT |
| MEDIUM | packages/core/src/cli/create-e2e.spec.ts | 607 | // Fail the scaffold mid-flight by rejecting writes into the staging dir, | COMMENT |
| MEDIUM | packages/core/src/cli/create-e2e.spec.ts | 655 | // ...no partial scaffold leaked into it... | COMMENT |
| MEDIUM | packages/core/src/cli/create-e2e.spec.ts | 774 | // The scaffold must be linked to the local core build (file: URL), not | COMMENT |
| MEDIUM | packages/core/src/cli/create-e2e.spec.ts | 1502 | // core package and produce a scaffold that fails during SSR startup. | COMMENT |
| MEDIUM | packages/core/src/cli/index.ts | 39 | // first fails deep inside a scaffold dynamic import with a cryptic | COMMENT |
| MEDIUM | packages/core/src/cli/index.ts | 923 | // refresh scaffold skills, and verify — without framework patches. | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 192 | // `create .` (or `./`) means "scaffold into the current folder" — derive the | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 220 | // standalone scaffold (script-friendly, matches historic behavior). | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 246 | // Template creates a workspace, while Community and Headless scaffold a | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 250 | // it must skip the start-shape prompt and scaffold a workspace directly. | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 599 | // in-place scaffold `targetDir` is the private staging dir, so this never | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 1006 | // `targetDir` is the private staging dir for an in-place scaffold, so this | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 3458 | // the scaffold via getOwnPackageDependencyVersion() — reintroducing the | COMMENT |
| MEDIUM | packages/core/src/cli/create.ts | 4033 | // Preserve anything already at the destination (in-place scaffold merges | COMMENT |
| MEDIUM | packages/core/src/cli/plan-install.spec.ts | 97 | // The full core lane runs this filesystem-heavy scaffold suite under load; | COMMENT |
| MEDIUM | packages/core/src/cli/plan-install.spec.ts | 170 | // _gitignore must be renamed to .gitignore so the scaffold is git-clean. | COMMENT |
| MEDIUM | packages/core/src/cli/plan-local.spec.ts | 338 | // Mirrors the `plan local init` scaffold prose, which documents block usage | COMMENT |
| MEDIUM | packages/core/src/cli/plan-local.spec.ts | 729 | // The scaffold's `<WireframeBlock><Screen>...` is a documentation example in | COMMENT |
| MEDIUM | packages/core/src/cli/create-workspace.ts | 25 | // Preserve the alias's contract: always scaffold a workspace, never the | COMMENT |
| MEDIUM | packages/core/src/observability/traces.ts | 790 | // Some guardrails intentionally stop the loop by emitting a terminal | COMMENT |
| MEDIUM | packages/core/src/templates/chat-shell-sync.spec.ts | 11 | * # scaffold → chat | COMMENT |
| MEDIUM | packages/core/src/templates/chat-shell-sync.spec.ts | 17 | * # chat → scaffold | COMMENT |
| MEDIUM | …/core/src/templates/workspace-root/pnpm-workspace.yaml | 19 | # Keep a fresh scaffold on one tested family: otherwise extension-list can | COMMENT |
| MEDIUM | packages/core/src/templates/default/pnpm-workspace.yaml | 6 | # Keep a fresh scaffold on one tested family so extension-list does not | COMMENT |
| MEDIUM | packages/core/src/client/builder-frame.ts | 182 | // Detect "build/create/make/scaffold a new app/agent" style prompts. | COMMENT |
| MEDIUM | packages/core/src/guards/no-env-credentials.spec.ts | 46 | // The Builder database scaffold writes both of these files verbatim, so | COMMENT |
| MEDIUM | …patch/src/server/lib/workspace-resources-store.spec.ts | 822 | content: "# Workspace guardrails", | CODE |
| MEDIUM | …patch/src/server/lib/workspace-resources-store.spec.ts | 968 | content: "# Updated guardrails", | CODE |
| MEDIUM | …patch/src/server/lib/workspace-resources-store.spec.ts | 988 | content: "# Updated guardrails", | CODE |
| MEDIUM | packages/dispatch/src/routes/pages/workspace.tsx | 458 | : "# Instructions\n\nAlways-on guardrails for agents across apps..." | CODE |
| MEDIUM | packages/desktop-app/MULTI_FRONTIER_PROOF.md | 141 | ## Phases 3-5 live orchestration proof | COMMENT |
| MEDIUM | packages/desktop-app/src/main/index.ts | 8407 | // scaffold command. Start the runner from the framework workspace so the | COMMENT |
| MEDIUM | packages/toolkit/src/composer/TiptapComposer.tsx | 3361 | // the local agent (dispatch, mail, etc.) cannot scaffold workspace | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 244 | # scaffold e2e test (real `createApp`, needs AGENT_NATIVE_CREATE_USE_LOCAL_CORE | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 245 | # + disk setup) — it runs in the dedicated scaffold-e2e job, not here. | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 791 | # `--headless` scaffold must `pnpm typecheck` (no inherited vite/client | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 798 | # Applying it to the whole create-e2e file makes lightweight scaffold | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 812 | # packages/scheduling scaffold path. Together they guard the two | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 816 | # the scaffold against the core build checked out by this job. | COMMENT |
| MEDIUM | …n/app/components/design/bridge/editor-chrome.bridge.ts | 7108 | "<!doctype html><html><head></head>" + trimmed + "</html>", // i18n-ignore parser scaffold | CODE |
| MEDIUM | …es/design/.generated/bridge/editor-chrome.generated.ts | 5154 | // i18n-ignore parser scaffold | COMMENT |
| MEDIUM | templates/plan/server/plan-content.spec.ts | 99 | // `tabs`) AND strip the document scaffold so the block validates and renders | COMMENT |
| MEDIUM | templates/plan/server/plan-content.spec.ts | 726 | // one as a full standalone page, drop the scaffold (doctype/html/head/body) | COMMENT |
| MEDIUM | templates/plan/server/plan-content.ts | 480 | // scaffold stripped and the whole columns block degrades to an "Unsupported | COMMENT |
| MEDIUM | templates/brain/evals/slack-pilot-corpus.ts | 113 | captureTitle: "#brain-pilot Slack history guardrails", | CODE |
| MEDIUM | templates/factory/README.md | 84 | ## Agents and agentic apps | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …tes/design/app/components/design/MultiScreenCanvas.tsx | 2177 | // into id-less AI-generated screens can never flow-insert. | COMMENT |
| HIGH | …n/app/components/design/bridge/editor-chrome.bridge.ts | 2098 | // Id-on-demand (empty-node-id fix, bridge side): AI-generated screens | COMMENT |
| HIGH | …n/app/components/design/bridge/editor-chrome.bridge.ts | 5842 | // common for hover states, toggles, carousels in AI-generated prototypes) | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 6838 | // ── Real-usage regressions from the user's AI-generated design (Batch 5) ──── | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 6852 | // Mirrors the user's AI-generated screen shape: a block container with | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 7395 | // AI-generated-design shape: NO data-agent-native-node-id anywhere. | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 8200 | // anywhere (the common case for default AI-generated content) used to | COMMENT |
| HIGH | …sign/app/components/design/bridge/bridge.guard.spec.ts | 8321 | // No data-agent-native-node-id anywhere — default AI-generated shape. | COMMENT |
| HIGH | …nents/design/edit-panel/element-classification.test.ts | 46 | // AI-generated todo design: div tag, draft-text-* source id, no | COMMENT |
| HIGH | templates/design/app/pages/Index.tsx | 197 | // Designs the user has manually renamed since creation — an AI-generated | COMMENT |
| HIGH | templates/design/app/pages/Index.tsx | 500 | // immediately, then a short AI-generated name replaces it in the | COMMENT |
| HIGH | …pp/pages/DesignEditor.styleCommitAndDropAnchor.spec.ts | 78 | // Mirrors a fresh AI-generated screen: no data-agent-native-node-id | COMMENT |
| HIGH | …/pages/design-editor/commands/screen-element-select.ts | 137 | // Node-id integrity (id-on-demand): AI-generated/duplicated screens | COMMENT |
| HIGH | …/pages/design-editor/commands/screen-element-select.ts | 207 | // repeater (common in AI-generated Alpine.js list/task UIs) have no | COMMENT |
| HIGH | …es/design-editor/commands/cross-screen-element-drop.ts | 392 | // persist-on-select path above): AI-generated/duplicated screens often | COMMENT |
| HIGH | templates/design/actions/generate-screens.ts | 31 | // fixed desktop-shaped region regardless of content (B5-10: AI-generated | COMMENT |
| HIGH | templates/design/actions/generate-screens.spec.ts | 268 | // B5-10: AI-generated desktop designs were being placed in mobile-width | COMMENT |
| HIGH | …analytics/.agents/skills/dashboard-management/SKILL.md | 511 | // Use "dashboard" for AI-generated first-party panels by default. | COMMENT |
| HIGH | …plates/analytics/server/lib/data-dictionary-context.ts | 249 | "## AI-generated suggestions", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/qa/SKILL.md | 46 | ### Step 1: Parse Args | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 53 | ### Step 2: Check Credential Readiness | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 72 | ### Step 3: Start Dev Servers | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 93 | ### Step 4: Generate Test Plans | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 114 | ### Step 5: Create Team and Spawn Testers | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 135 | ### Step 6: Monitor and Alert | COMMENT |
| LOW | .agents/skills/qa/SKILL.md | 143 | ### Step 7: Compile Report and Shutdown | COMMENT |
| LOW⚡ | packages/pinpoint/README.md | 15 | ### Step 1: Install | COMMENT |
| LOW⚡ | packages/pinpoint/README.md | 21 | ### Step 2: Initialize agent actions and skill | COMMENT |
| LOW⚡ | packages/pinpoint/README.md | 29 | ### Step 3: Mount the client overlay | COMMENT |
| LOW | packages/pinpoint/README.md | 47 | ### Step 4: Add server middleware | COMMENT |
| LOW | packages/pinpoint/README.md | 60 | ### Step 5: Verify | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 170 | // Step 1: Peek at JWT claims WITHOUT verification to get org_domain. | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 184 | // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 200 | // Step 3: Verify JWT with the candidate secrets. | COMMENT |
| LOW⚡ | packages/core/src/server/auth.spec.ts | 725 | // Step 1: Better Auth's own `url.searchParams.set(name, value)` when it | COMMENT |
| LOW⚡ | packages/core/src/server/auth.spec.ts | 727 | // Step 2: the automatic single decode a browser/HTTP layer performs | COMMENT |
| LOW⚡ | packages/core/src/server/auth.spec.ts | 729 | // Step 3: Better Auth's own EXTRA `decodeURIComponent` inside its | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 413 | // Step 1: Let the adapter cache the raw body and identify any challenge. | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 419 | // Step 2: Verify webhook signature | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 428 | // Step 3: Parse the incoming message | COMMENT |
| LOW | …s/plan/actions/update-visual-plan-comment-flow.spec.ts | 914 | // Step 1: reviewer comment-only call (no authoring changes). | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 37 | ### Step 1: Understand the Question (catalog-first, clarify-first) | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 48 | ### Step 2: Gather Data from Multiple Sources | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 88 | ### Step 3: Analyze and Synthesize | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 102 | ### Step 4: Generate Charts (when useful) | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 126 | ### Step 5: Format Results as Markdown | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 162 | ### Step 6: Save the Dashboard Artifact (only when requested) | COMMENT |
| LOW | …lates/analytics/.agents/skills/adhoc-analysis/SKILL.md | 183 | ### Step 7: Navigate to the Result | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 586 | // Step 1: Look up user by email | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 601 | // Step 2: Open/get DM channel | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 620 | // Step 3: Send message | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 74 | // Step 1: HubSpot deal-property cohort IN-search. | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 125 | // Step 2: batched deal -> company associations. Big intermediate | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 148 | // Step 3: batched company -> domain lookup. | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 176 | // Step 4: Pylon account sentiment, keyed by domain. Second provider, | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 206 | // Step 5: join + emit. csm_name is computed HERE, in the program — never | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | packages/desktop-app/src/main/desktop-identity.spec.ts | 2812 | const navigationHandler = record.webContents.on.mock.calls.find( | CODE |
| CRITICAL | packages/desktop-app/src/main/desktop-identity.spec.ts | 3084 | const navigationHandler = record.webContents.on.mock.calls.find( | CODE |
| CRITICAL | templates/design/actions/generate-design.spec.ts | 626 | const fileTypeCall = mocks.fileUpdateChain.set.mock.calls.find( | CODE |
| CRITICAL | templates/plan/actions/view-screen.ts | 108 | screens: bundle.plan.content.prototype.screens.map( | CODE |
| CRITICAL | templates/slides/actions/patch-deck.test.ts | 834 | const slidePatch = parameters.properties.operations.items.anyOf.find( | CODE |
| CRITICAL | templates/brain/server/lib/brain.test.ts | 822 | const updatedTables = mocks.db.update.mock.calls.map(([tableRef]) => | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/core/src/a2a/server.ts | 170 | // Step 1: Peek at JWT claims WITHOUT verification to get org_domain. | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 184 | // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by | COMMENT |
| LOW | packages/core/src/a2a/server.ts | 200 | // Step 3: Verify JWT with the candidate secrets. | COMMENT |
| LOW⚡ | packages/core/src/server/auth.spec.ts | 725 | // Step 1: Better Auth's own `url.searchParams.set(name, value)` when it | COMMENT |
| LOW⚡ | packages/core/src/server/auth.spec.ts | 727 | // Step 2: the automatic single decode a browser/HTTP layer performs | COMMENT |
| LOW⚡ | packages/core/src/server/auth.spec.ts | 729 | // Step 3: Better Auth's own EXTRA `decodeURIComponent` inside its | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 413 | // Step 1: Let the adapter cache the raw body and identify any challenge. | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 419 | // Step 2: Verify webhook signature | COMMENT |
| LOW⚡ | packages/core/src/integrations/webhook-handler.ts | 428 | // Step 3: Parse the incoming message | COMMENT |
| LOW | …s/public/mediapipe/wasm/vision_wasm_nosimd_internal.js | 23 | // We need to check if Module already exists (e.g. case 3 above). | COMMENT |
| LOW | …es/clips/public/mediapipe/wasm/vision_wasm_internal.js | 23 | // We need to check if Module already exists (e.g. case 3 above). | COMMENT |
| LOW | …s/plan/actions/update-visual-plan-comment-flow.spec.ts | 914 | // Step 1: reviewer comment-only call (no authoring changes). | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 586 | // Step 1: Look up user by email | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 601 | // Step 2: Open/get DM channel | COMMENT |
| LOW | templates/analytics/server/lib/slack.ts | 620 | // Step 3: Send message | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 74 | // Step 1: HubSpot deal-property cohort IN-search. | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 125 | // Step 2: batched deal -> company associations. Big intermediate | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 148 | // Step 3: batched company -> domain lookup. | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 176 | // Step 4: Pylon account sentiment, keyed by domain. Second provider, | COMMENT |
| LOW | …s/analytics/seeds/data-programs/risk-meeting-cohort.js | 206 | // Step 5: join + emit. csm_name is computed HERE, in the program — never | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/core/src/server/agent-teams-run-queue.spec.ts | 5 | // robust to formatting. | COMMENT |
| MEDIUM | packages/core/src/client/org/TeamPage.tsx | 1767 | // "email" per line. A robust full CSV parser would be overkill here. | COMMENT |
| LOW | .github/workflows/auto-publish.yml | 274 | # (actions/runner-images#13883), so we just use a Node version that | COMMENT |
| MEDIUM | templates/design/app/pages/DesignEditor.tsx | 5727 | // `boundingRect.width / iframe.clientWidth` (robust to any wrapper transform) | COMMENT |
| MEDIUM | …pp/pages/design-editor/commands/duplicate-selection.ts | 160 | // Absolutely-positioned board items land exactly in place (or at | COMMENT |
| MEDIUM | templates/design/actions/get-motion-timeline.ts | 107 | // Timeline span (max delay + duration) is robust when tracks carry | COMMENT |
| MEDIUM | templates/design/e2e/landing-page-authoring.spec.ts | 505 | // Absolutely-positioned text moves in x/y when dragged, as in Figma; the | COMMENT |
| MEDIUM | templates/design/e2e/effects-heavy-geometry.spec.ts | 249 | // robust to any outer iframe offset while still catching a layout | COMMENT |
| MEDIUM | templates/clips/desktop/src/lib/recorder.ts | 4424 | // also means the preview → recording transition is seamless (no black | COMMENT |
| MEDIUM | …plates/content/app/components/editor/BubbleToolbar.tsx | 562 | // Capture a robust anchor (quote + surrounding context + offset) | COMMENT |
| MEDIUM | templates/content/server/plugins/db.ts | 278 | // v28-v31: robust text-anchor + @mention metadata for document comments. | COMMENT |
| MEDIUM | templates/slides/app/components/deck/SlideRenderer.tsx | 294 | // Absolutely positioned objects intentionally move independently of the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/trusted-acceptance.yml | 335 | # This file is a trusted, redacted resource allowlist, not a credential | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ckages/core/src/cli/skills-content/document-quality.ts | 16 | drop the old idea", "as discussed above", "this revision", "unlike the prior | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/docs/app/entry.server.tsx | 19 | export default async function handleRequest( | CODE |
| LOW | packages/migrate/src/adapters/agent-native-target.ts | 355 | export default async function handleRequest( | CODE |