An open-source background agents coding system
This report summarizes scanner evidence for ColeMurray/background-agents, a TypeScript project with 3,346 GitHub stars. SynthScan examined 559,232 lines of code across 2562 source files, recording 2734 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 6.5 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 2212 finding(s).
Are imports declared and package/API names verified? 169 finding(s).
Are wrappers, guards, and repeated structures necessary? 2414 finding(s).
Which changes need focused human review? 2734 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2734 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/merge-split-users.ts | 51 | function parseWranglerQueryResults(value: unknown): WranglerQueryResult[] { | CODE |
| LOW | scripts/cf-logs.ts | 119 | function parseTelemetryQueryResponse(value: unknown): TelemetryQueryResponse { | CODE |
| LOW | …kages/modal-infra/tests/test_agent_slack_notify_env.py | 37 | async def test_env_omitted_when_disabled(self, monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 84 | async def test_launch_matrix_preserves_common_and_source_specific_behavior( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 234 | async def test_repository_image_create_validates_repo_before_image_lookup(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 256 | async def test_launch_preserves_image_error_classification( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 304 | async def test_base_image_spawn_errors_propagate_without_retry(monkeypatch, missing): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 344 | async def test_launch_returns_handle_despite_tunnel_failures(monkeypatch, image_source, failure): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 415 | async def test_repository_image_not_found_is_reported_explicitly(monkeypatch, fake_llm_secret): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 441 | async def test_missing_secret_does_not_mark_repository_image_unavailable(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 467 | async def test_base_image_not_found_is_not_classified_as_repository_image(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 549 | async def test_docker_launch_selects_vm_runtime_and_named_allocation( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 600 | async def test_docker_launch_does_not_allow_user_env_to_spoof_resolved_access(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 629 | async def test_docker_launch_tags_record_effective_enabled_services_and_ports(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 658 | async def test_expired_vm_launch_cannot_materialize_after_lookup(monkeypatch, image_source): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 685 | async def test_docker_launch_without_a_provisioned_image_never_uses_the_default(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 696 | async def test_malformed_docker_setting_fails_before_any_launch(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 715 | async def test_invalid_wire_resources_neither_retire_nor_allocate( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 743 | async def test_docker_launch_adopts_an_existing_owned_allocation(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 763 | async def test_docker_retry_returns_the_original_access_credentials( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 828 | async def test_access_password_read_arguments_match_enabled_services( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 865 | async def test_docker_adoption_fails_if_original_credentials_cannot_be_recovered( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 895 | async def test_docker_launch_refuses_a_same_named_allocation_it_does_not_own(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 915 | async def test_docker_launch_retires_the_prior_generation_only_when_owned(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 958 | async def test_retire_docker_allocation_succeeds_when_owned_vm_timed_out(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 979 | async def test_late_predecessor_cannot_materialize_beside_successor(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 1015 | async def test_docker_successor_waits_for_confirmed_predecessor_retirement( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_launch.py | 1072 | async def test_launch_rejects_boolean_tunnel_ports(monkeypatch, restore, ports, expected): | CODE |
| LOW | packages/modal-infra/tests/test_code_server.py | 15 | def test_returns_nonempty_password(self): | CODE |
| LOW | packages/modal-infra/tests/test_code_server.py | 19 | def test_generates_unique_passwords(self): | CODE |
| LOW | packages/modal-infra/tests/test_code_server.py | 30 | async def test_code_server_skipped_when_disabled(self, monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_code_server.py | 74 | async def test_code_server_skipped_when_disabled(self, monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 27 | def test_has_repository_accepts_complete_or_absent_metadata(repo_owner, repo_name, expected): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 38 | def test_has_repository_rejects_partial_repo_metadata(repo_owner, repo_name): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 51 | async def test_create_sandbox_rejects_partial_repo_metadata(repo_owner, repo_name): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 73 | async def test_restore_rejects_partial_repo_metadata(session_config): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 86 | async def test_user_env_vars_override_order(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 128 | async def test_restore_user_env_vars_override_order(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 192 | async def test_create_preserves_managed_provider_env_isolation( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 220 | async def test_restore_preserves_managed_provider_env_isolation( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 237 | def test_generated_vnc_password_respects_protocol_limit(): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 242 | async def test_restore_uses_default_timeout(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 300 | async def test_restore_includes_branch_in_session_config(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 324 | async def test_restore_omits_branch_when_none(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 347 | async def test_restore_serializes_typed_session_config(monkeypatch): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 392 | def _assert_identity_without_system_tokens(env: dict[str, str]) -> None: | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 409 | async def test_create_injects_control_plane_identity_without_tokens(monkeypatch, repo_fields): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 424 | async def test_repo_image_boot_preserves_user_github_cli_token(monkeypatch, token_key): | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 452 | async def test_restore_injects_control_plane_identity_without_system_tokens( | CODE |
| LOW | packages/modal-infra/tests/test_sandbox_env_vars.py | 483 | async def test_restore_preserves_user_tokens_without_generating_gh_cli_aliases( | CODE |
| LOW | packages/modal-infra/tests/test_llm_secrets.py | 33 | async def test_create_attaches_the_deployment_wide_secret(captured_launch, fake_llm_secret): | CODE |
| LOW | packages/modal-infra/tests/test_llm_secrets.py | 48 | async def test_restore_attaches_the_deployment_wide_secret( | CODE |
| LOW | packages/modal-infra/tests/test_llm_secrets.py | 68 | async def test_each_launch_resolves_a_fresh_secret(captured_launch, fake_llm_secret): | CODE |
| LOW | packages/modal-infra/tests/test_docker_launch.py | 31 | def test_resource_defaults_match_shared_provider_validation(): | CODE |
| LOW | packages/modal-infra/tests/test_docker_launch.py | 48 | def test_standard_defaults_preserve_existing_launch(settings): | CODE |
| LOW | packages/modal-infra/tests/test_docker_launch.py | 56 | def test_launch_policy_maps_vm_backend_and_resources(): | CODE |
| LOW⚡ | packages/modal-infra/tests/test_docker_launch.py | 89 | def test_malformed_resources_or_removed_settings_are_rejected(settings): | CODE |
| LOW⚡ | packages/modal-infra/tests/test_docker_launch.py | 94 | def test_docker_base_image_requires_provisioning(monkeypatch): | CODE |
| LOW⚡ | packages/modal-infra/tests/test_docker_launch.py | 104 | def test_allocation_name_is_stable_per_session_and_modal_safe(): | CODE |
| LOW⚡ | packages/modal-infra/tests/test_docker_launch.py | 113 | def test_allocation_tags_bind_session_generation_and_backend(): | CODE |
| 2000 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .openinspect/setup.sh | 7 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .openinspect/setup.sh | 9 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .openinspect/setup.sh | 21 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .openinspect/setup.sh | 23 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 36 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 38 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 42 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 44 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 48 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 50 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 58 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 60 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 115 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 117 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 125 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .openinspect/setup.sh | 127 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | terraform/environments/aws-staging/main.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/aws-staging/main.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/web-cloudflare.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/web-cloudflare.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/docs-vercel.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/docs-vercel.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/outputs.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/outputs.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/outputs.tf | 124 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/outputs.tf | 126 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/workers-github.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/workers-github.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/r2.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/r2.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/opencomputer.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/opencomputer.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/modal.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/modal.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/workers-slack.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/workers-slack.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/moved.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/moved.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/e2b.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/e2b.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/workers-linear.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/workers-linear.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/kv.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/kv.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/web-vercel.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/web-vercel.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 1 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 3 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 112 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 114 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 134 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 136 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 161 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 163 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 181 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 183 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 231 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 233 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 278 | # ============================================================================= | COMMENT |
| MEDIUM | terraform/environments/production/variables.tf | 280 | # ============================================================================= | COMMENT |
| 193 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | packages/modal-infra/tests/test_sandbox_launch.py | 227 | handle.modal_sandbox.filesystem.write_text.aio.assert_awaited_once_with( | CODE |
| CRITICAL | packages/web/src/hooks/use-sidebar-sessions.test.tsx | 897 | act(() => first.result.current.sectionPagination.needsAttention.loadMore()); | CODE |
| CRITICAL | packages/web/src/hooks/use-sidebar-sessions.test.tsx | 914 | act(() => second.result.current.sectionPagination.needsAttention.loadMore()); | CODE |
| CRITICAL⚡ | packages/sandbox-runtime/tests/test_opencode_health.py | 20 | client_type.return_value.__aenter__.return_value.get.assert_not_awaited() | CODE |
| CRITICAL | …es/sandbox-runtime/tests/test_entrypoint_build_mode.py | 1043 | supervisor.repository_boot.synchronizer.log.info.assert_any_call( | CODE |
| CRITICAL | …es/sandbox-runtime/tests/test_entrypoint_build_mode.py | 1290 | supervisor.repository_boot.synchronizer.log.warn.assert_called_once() | CODE |
| CRITICAL | …es/sandbox-runtime/tests/test_entrypoint_build_mode.py | 1552 | supervisor.repository_boot.synchronizer.log.warn.assert_any_call( | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 621 | const catalogReads = env.CONTROL_PLANE.fetch.mock.calls.filter( | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 840 | const catalogReads = env.CONTROL_PLANE.fetch.mock.calls.filter( | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 852 | env.CONTROL_PLANE.fetch.mock.calls.filter(([url]) => | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 983 | const catalogReads = env.CONTROL_PLANE.fetch.mock.calls.filter( | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 1223 | env.CONTROL_PLANE.fetch.mock.calls.map(([url]) => new URL(String(url)).pathname) | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 1762 | return env.CONTROL_PLANE.fetch.mock.calls.filter(([input]) => | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 1985 | const publication = env.CONTROL_PLANE.fetch.mock.calls.filter(([url]) => | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 2032 | const [url, init] = env.CONTROL_PLANE.fetch.mock.calls.at(-1)!; | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 2047 | env.CONTROL_PLANE.fetch.mock.calls.some(([url]) => | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 3350 | const sessionCall = env.CONTROL_PLANE.fetch.mock.calls.find(([input]) => { | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 3446 | const sessionCall = env.CONTROL_PLANE.fetch.mock.calls.find(([input]) => { | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 3679 | const catalogReads = env.CONTROL_PLANE.fetch.mock.calls.filter( | CODE |
| CRITICAL | packages/slack-bot/src/index.test.ts | 3749 | expect(env.CONTROL_PLANE.fetch.mock.calls.map(([url]) => String(url))).toEqual( | CODE |
| CRITICAL | …ges/control-plane/src/session/sandbox-shutdown.test.ts | 1420 | f.deps.log.info.mock.calls.filter( | CODE |
| CRITICAL | …ckages/control-plane/src/session/message-queue.test.ts | 1563 | const enqueueLog = h.log.info.mock.calls.find(([event]) => event === "prompt.enqueue")?.[1]; | CODE |
| CRITICAL | …ckages/control-plane/src/session/message-queue.test.ts | 1647 | expect(h.wsManager.send.mock.calls.map(([, command]) => command)).toEqual([ | CODE |
| CRITICAL | …lane/src/session/callback-notification-service.test.ts | 440 | expect(harness.slackBot.fetch.mock.calls.map(([url]) => url)).toEqual([ | CODE |
| CRITICAL | …lane/src/session/callback-notification-service.test.ts | 492 | expect(harness.slackBot.fetch.mock.calls.map(([url]) => url)).toEqual([ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/modal-infra/deploy.py | 35 | CODE | |
| LOW | packages/modal-infra/src/log_config.py | 3 | CODE | |
| LOW | packages/modal-infra/src/log_config.py | 3 | CODE | |
| LOW | packages/modal-infra/src/log_config.py | 3 | CODE | |
| LOW | packages/modal-infra/src/__init__.py | 5 | CODE | |
| LOW | packages/modal-infra/src/__init__.py | 6 | CODE | |
| LOW | packages/modal-infra/src/images/__init__.py | 3 | CODE | |
| LOW | packages/modal-infra/src/images/base.py | 3 | CODE | |
| LOW | packages/modal-infra/src/sandbox/launch_policy.py | 3 | CODE | |
| LOW | packages/modal-infra/src/sandbox/__init__.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/__init__.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/__init__.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 8 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 30 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 30 | CODE | |
| LOW | packages/modal-infra/src/sandbox/manager.py | 49 | CODE | |
| LOW | …dbox-runtime/tests/test_bridge_shutdown_preparation.py | 3 | CODE | |
| LOW | packages/sandbox-runtime/tests/conftest.py | 8 | CODE | |
| LOW | packages/sandbox-runtime/tests/conftest.py | 13 | CODE | |
| LOW | packages/sandbox-runtime/tests/conftest.py | 13 | CODE | |
| LOW | packages/sandbox-runtime/tests/conftest.py | 15 | CODE | |
| LOW | packages/sandbox-runtime/tests/test_claude_translate.py | 3 | CODE | |
| LOW | packages/sandbox-runtime/tests/test_gh_wrapper.py | 15 | CODE | |
| LOW | …/sandbox-runtime/tests/test_claude_harness_shutdown.py | 3 | CODE | |
| LOW | packages/sandbox-runtime/tests/test_claude_harness.py | 9 | CODE | |
| LOW | packages/sandbox-runtime/tests/test_claude_logging.py | 3 | CODE | |
| LOW | …sandbox-runtime/tests/test_bridge_harness_lifecycle.py | 3 | CODE | |
| LOW | …es/sandbox-runtime/tests/test_git_credential_helper.py | 3 | CODE | |
| LOW | …ckages/sandbox-runtime/tests/test_claude_trajectory.py | 3 | CODE | |
| LOW | packages/sandbox-runtime/tests/claude_fakes.py | 3 | CODE | |
| LOW | packages/sandbox-runtime/tests/test_docker_service.py | 11 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/diff_collector.py | 9 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/prompt_budgets.py | 10 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/runtime_config.py | 3 | CODE | |
| LOW | …s/sandbox-runtime/src/sandbox_runtime/claude_stager.py | 18 | CODE | |
| LOW | …s/sandbox-runtime/src/sandbox_runtime/durable_files.py | 3 | CODE | |
| LOW | …es/sandbox-runtime/src/sandbox_runtime/mcp_packages.py | 3 | CODE | |
| LOW | …runtime/src/sandbox_runtime/modal_image_build_start.py | 3 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/docker_service.py | 14 | CODE | |
| LOW | …es/sandbox-runtime/src/sandbox_runtime/web_terminal.py | 1 | CODE | |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 3 | CODE | |
| LOW | …ges/sandbox-runtime/src/sandbox_runtime/boot_events.py | 13 | CODE | |
| LOW | …ndbox-runtime/src/sandbox_runtime/image_environment.py | 3 | CODE | |
| LOW | …box-runtime/src/sandbox_runtime/repo_image_callback.py | 3 | CODE | |
| LOW | …dbox-runtime/src/sandbox_runtime/tunnel_environment.py | 1 | CODE | |
| LOW | …ges/sandbox-runtime/src/sandbox_runtime/sandbox_bin.py | 3 | CODE | |
| LOW | …ges/sandbox-runtime/src/sandbox_runtime/code_server.py | 1 | CODE | |
| 65 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | package-lock.json | 19750 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| MEDIUM | packages/sandbox-runtime/pyproject.toml | 12 | # are what harness/claude.py translates. | COMMENT |
| MEDIUM | …dbox-runtime/tests/test_bridge_shutdown_preparation.py | 474 | # still ask the harness to contain its retained process owner. | COMMENT |
| MEDIUM⚡ | packages/sandbox-runtime/tests/test_claude_env.py | 160 | # and deliver its result on a turn the harness never reads. | COMMENT |
| MEDIUM | packages/sandbox-runtime/tests/test_prompt_budgets.py | 25 | # The harness the env-handling cases run under; the default each harness gets | COMMENT |
| MEDIUM | …/sandbox-runtime/src/sandbox_runtime/prompt_budgets.py | 29 | # Liveness check for a harness that stopped talking, not a budget for how long | COMMENT |
| MEDIUM | …/sandbox-runtime/src/sandbox_runtime/prompt_budgets.py | 33 | # What counts as talking is the harness's, so the budget is too. OpenCode | COMMENT |
| MEDIUM | …s/sandbox-runtime/src/sandbox_runtime/claude_stager.py | 136 | # Nothing the harness writes here is a credential; the directory is | COMMENT |
| MEDIUM⚡ | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 646 | # The `harness completed` line is what tells an early-connected | COMMENT |
| MEDIUM⚡ | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 647 | # bridge to attach its harness and report `ready`. | COMMENT |
| MEDIUM⚡ | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 736 | # Everything up to the harness is boot work: a bridge that exits | COMMENT |
| MEDIUM⚡ | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 738 | # it starting a harness nobody is connected to. | COMMENT |
| MEDIUM | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 97 | # Supervisor half of the harness seam: staging plus any resident | COMMENT |
| MEDIUM | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 254 | # The bridge exits this way from its harness open, so the failure | COMMENT |
| MEDIUM | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 255 | # belongs to the harness phase whether or not the boot is over. | COMMENT |
| MEDIUM | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 712 | # Transport-only until the harness phase completes: the bridge | COMMENT |
| MEDIUM | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 715 | # has a harness. The watcher applies the bridge exit policy | COMMENT |
| MEDIUM | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 768 | # died under a working harness ended the session as a failure. | COMMENT |
| MEDIUM | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 839 | # User containers outlive the harness that drove them, never the reverse. | COMMENT |
| MEDIUM | …kages/sandbox-runtime/src/sandbox_runtime/constants.py | 68 | # Supervisor → bridge handoff for the Claude harness (workdir, config dir, MCP servers). | COMMENT |
| MEDIUM | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 326 | # One lifecycle: whatever the harness acquires in open() is released | COMMENT |
| MEDIUM | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 494 | # failed harness attach, for one). The socket was never | COMMENT |
| MEDIUM | …ges/sandbox-runtime/src/sandbox_runtime/boot_attach.py | 54 | # Building a harness may read supervisor-written handoffs or probe the | COMMENT |
| MEDIUM | …ges/sandbox-runtime/src/sandbox_runtime/boot_attach.py | 220 | # The harness has not been published, so bridge cleanup cannot see it. | COMMENT |
| MEDIUM | packages/sandbox-runtime/src/sandbox_runtime/types.py | 76 | # Which agent runs the session; absent means the built-in OpenCode harness. | COMMENT |
| MEDIUM | …andbox-runtime/src/sandbox_runtime/runtime_manifest.py | 15 | # Per-harness floors for prebuilt-image selection: a harness whose runtime | COMMENT |
| MEDIUM | …es/sandbox-runtime/src/sandbox_runtime/harness/base.py | 78 | # ``None`` means the harness's configured ``prompt_max_duration_seconds``. | COMMENT |
| MEDIUM | packages/control-plane/src/memory/render.ts | 25 | return `\n## Facts (call ${harnessMemoryToolName(harness, "memory_read")} with the id for the full text)\n\n`; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/modal-infra/src/web_api.py | 249 | except Exception as e: | CODE |
| LOW | packages/modal-infra/src/app.py | 109 | except Exception as e: | CODE |
| LOW | packages/modal-infra/src/sandbox/tunnels.py | 145 | except Exception as e: | CODE |
| LOW | packages/modal-infra/src/sandbox/tunnels.py | 215 | except Exception as e: | CODE |
| LOW | …/sandbox-runtime/src/sandbox_runtime/diff_collector.py | 927 | except Exception as error: | CODE |
| LOW | …s/sandbox-runtime/src/sandbox_runtime/claude_stager.py | 144 | except Exception as error: | CODE |
| LOW | …es/sandbox-runtime/src/sandbox_runtime/mcp_packages.py | 254 | except Exception as error: | CODE |
| LOW | …/sandbox-runtime/src/sandbox_runtime/push_operation.py | 122 | except Exception as e: | CODE |
| LOW⚡ | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 170 | except Exception as error: | CODE |
| LOW⚡ | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 179 | except Exception as error: | CODE |
| LOW⚡ | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 637 | except Exception as error: | CODE |
| LOW⚡ | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 642 | except Exception as error: | CODE |
| LOW⚡ | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 727 | except Exception as error: | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 158 | except Exception as error: | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 305 | except Exception as error: | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 334 | except Exception as error: | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 390 | except Exception as error: | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 415 | except Exception as error: | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 486 | except Exception as error: | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 583 | except Exception as error: | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 779 | except Exception as error: | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 800 | except Exception: | CODE |
| LOW | …ges/sandbox-runtime/src/sandbox_runtime/boot_events.py | 211 | except Exception as error: | CODE |
| LOW | …box-runtime/src/sandbox_runtime/repo_image_callback.py | 151 | except Exception as exc: | CODE |
| LOW | …dbox-runtime/src/sandbox_runtime/tunnel_environment.py | 49 | except Exception as error: | CODE |
| LOW | …dbox-runtime/src/sandbox_runtime/tunnel_environment.py | 54 | except Exception as error: | CODE |
| LOW | …dbox-runtime/src/sandbox_runtime/tunnel_environment.py | 87 | except Exception as error: | CODE |
| LOW⚡ | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 1081 | except Exception as e: | CODE |
| LOW⚡ | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 1088 | except Exception as e: | CODE |
| LOW⚡ | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 1100 | except Exception as e: | CODE |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 346 | except Exception as e: | CODE |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 400 | except Exception as close_error: | CODE |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 405 | except Exception as close_error: | CODE |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 529 | except Exception as e: | CODE |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 849 | except Exception as e: | CODE |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 1117 | except Exception as e: | CODE |
| LOW | …ges/sandbox-runtime/src/sandbox_runtime/boot_attach.py | 174 | except Exception as error: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/event_forwarder.py | 220 | except Exception as e: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/event_forwarder.py | 379 | except Exception as e: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/event_forwarder.py | 435 | except Exception as e: | CODE |
| LOW | …andbox-runtime/src/sandbox_runtime/repository_hooks.py | 101 | except Exception as error: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/repository_boot.py | 92 | except Exception as error: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/repository_boot.py | 144 | except Exception as error: | CODE |
| MEDIUM | …sandbox-runtime/src/sandbox_runtime/repository_boot.py | 89 | def _write_repo_manifest(self) -> None: | CODE |
| LOW | …/sandbox-runtime/src/sandbox_runtime/process_output.py | 131 | except Exception as error: | CODE |
| LOW | …ox-runtime/src/sandbox_runtime/shutdown_preparation.py | 113 | except Exception as exc: | CODE |
| LOW | …es/sandbox-runtime/src/sandbox_runtime/diff_capture.py | 226 | except Exception as error: | CODE |
| LOW | …es/sandbox-runtime/src/sandbox_runtime/diff_capture.py | 240 | except Exception as error: | CODE |
| LOW | …es/sandbox-runtime/src/sandbox_runtime/diff_capture.py | 283 | except Exception as report_error: | CODE |
| MEDIUM | …es/sandbox-runtime/src/sandbox_runtime/diff_capture.py | 195 | def _run(self) -> None: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/opencode_server.py | 253 | except Exception as e: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/opencode_server.py | 357 | except Exception as e: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/opencode_server.py | 459 | except Exception as error: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/opencode_server.py | 526 | except Exception as e: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/repository_sync.py | 129 | except Exception as error: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/repository_sync.py | 300 | except Exception as error: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/repository_sync.py | 330 | except Exception as error: | CODE |
| LOW | …/sandbox-runtime/src/sandbox_runtime/managed_skills.py | 536 | except Exception: | CODE |
| LOW | …/sandbox-runtime/src/sandbox_runtime/managed_skills.py | 595 | except Exception: | CODE |
| LOW | …/sandbox-runtime/src/sandbox_runtime/managed_skills.py | 600 | except Exception as error: | CODE |
| 17 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.smoke.yml | 1 | # CI overlay for the compose smoke: the same stack, with a stand-in for the | COMMENT |
| LOW | docker-compose.aws.yml | 1 | # AWS overlay: the same stack the smoke boots, on one EC2 instance. | COMMENT |
| LOW | docker-compose.yml | 1 | # The control plane without Cloudflare: the Node host, an S3-compatible | COMMENT |
| LOW | docker-compose.yml | 41 | COMMENT | |
| LOW | eslint.config.js | 241 | { | COMMENT |
| LOW | terraform/environments/aws-staging/main.tf | 1 | # ============================================================================= | COMMENT |
| LOW | terraform/environments/aws-staging/backend.tf | 1 | # Terraform state for the AWS environments, in S3 with native state locking. | COMMENT |
| LOW | terraform/environments/production/docs-vercel.tf | 1 | # ============================================================================= | COMMENT |
| LOW | terraform/environments/production/backend.tf | 1 | # Terraform State Backend Configuration | COMMENT |
| LOW | terraform/environments/aws-production/backend.tf | 1 | # Terraform state for the AWS environments, in S3 with native state locking. | COMMENT |
| LOW | terraform/modules/aws-control-plane/deploy.tf | 1 | # How CI reaches this deployment, and nothing else. | COMMENT |
| LOW | terraform/modules/aws-control-plane/deploy.tf | 21 | provided_oidc_arn = try(var.github_deploy.oidc_provider_arn, null) | COMMENT |
| LOW | terraform/modules/aws-control-plane/config.tf | 21 | # instance's first boot, while this arrives on every fetch. | COMMENT |
| LOW | terraform/modules/aws-control-plane/config.tf | 61 | # the bucket names -- and every key in it is deliberately non-empty. An | COMMENT |
| LOW | terraform/modules/aws-control-plane/config.tf | 101 | # self-describing placeholder that fails loudly if it reaches a boot, and | COMMENT |
| LOW | terraform/modules/aws-control-plane/config.tf | 121 | COMMENT | |
| LOW | …dules/aws-control-plane/tests/github_deploy.tftest.hcl | 1 | # The deploy role is optional, and "optional" is the case nothing else covers. | COMMENT |
| LOW | terraform/modules/aws-control-plane/files/deploy.sh | 1 | #!/bin/bash | COMMENT |
| LOW | terraform/modules/aws-control-plane/files/deploy.sh | 21 | # broken image never passes, and the deploy that sent this cannot start its | COMMENT |
| LOW | docs/GETTING_STARTED.md | 421 | # daytona_base_snapshot = "your-snapshot-name" | COMMENT |
| LOW | docs/GETTING_STARTED.md | 501 | # Display name shown in the web UI tab title, sign-in page, landing hero, bot | COMMENT |
| LOW | scripts/deploy-aws.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/deploy-aws.sh | 21 | # wrote at its first boot, so anything a deploy assumes is installed there is an | COMMENT |
| LOW | scripts/deploy-aws.sh | 121 | # the document's own bound; we still need the agent's terminal response before | COMMENT |
| LOW | scripts/check-aws-stack.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/check-aws-stack.sh | 61 | lint_shell "$RENDERED" | COMMENT |
| LOW | scripts/compose-smoke.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/compose-smoke.sh | 21 | COMMENT | |
| LOW | scripts/compose-smoke.sh | 141 | # the compose files still define. --remove-orphans covers the rest: a run | COMMENT |
| LOW | …kages/sandbox-runtime/src/sandbox_runtime/constants.py | 41 | # services via `--env-file` or direct read. | COMMENT |
| LOW | …kages/sandbox-runtime/src/sandbox_runtime/constants.py | 61 | # channel) and relayed by the bridge: phase lines become `boot_progress` | COMMENT |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/types.py | 81 | # Ordered member list for multi-repo sessions; absent for scalar sessions | COMMENT |
| LOW | …ntime/src/sandbox_runtime/image_build_context_start.py | 61 | #: One launch per sandbox. The exclusive create is the whole mechanism: a | COMMENT |
| LOW | packages/control-plane/docker/litestream.yml | 1 | # Litestream configuration for the control plane's global store. | COMMENT |
| LOW | packages/control-plane/docker/entrypoint.sh | 1 | #!/bin/sh | COMMENT |
| LOW | packages/control-plane/src/image-builds/reaper.ts | 201 | // its hard lifetime can a later artifact no longer arrive. | COMMENT |
| LOW | …es/control-plane/src/sandbox/providers/e2b-provider.ts | 601 | // bake its filesystem; never auto-pause/resume it. | COMMENT |
| LOW | …ages/control-plane/src/session/pull-request-service.ts | 521 | // head, so proceeding is only safe when the head IS the checkout: an | COMMENT |
| LOW | .github/dependabot.yml | 1 | version: 2 | COMMENT |
| LOW | .github/workflows/aws-stack.yml | 1 | # Everything that parses the AWS deployment without deploying it. | COMMENT |
| LOW | .github/workflows/deploy-aws.yml | 1 | # Deploys the control-plane image to an AWS instance, and puts the previous one | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/OPENAI_MODELS.md | 24 | ### Step 1: Connect ChatGPT | COMMENT |
| LOW | docs/OPENAI_MODELS.md | 38 | ### Step 2: Configure Defaults | COMMENT |
| LOW | docs/OPENAI_MODELS.md | 51 | ### Step 3: Select Authentication | COMMENT |
| LOW | docs/CLAUDE_AGENT.md | 129 | ### Step 1: Connect a Claude account | COMMENT |
| LOW | docs/CLAUDE_AGENT.md | 157 | ### Step 2: Configure defaults | COMMENT |
| LOW | docs/CLAUDE_AGENT.md | 164 | ### Step 3: Create a Claude Agent session | COMMENT |
| LOW | docs/GETTING_STARTED.md | 136 | ## Step 1: Fork the Repository | COMMENT |
| LOW | docs/GETTING_STARTED.md | 165 | ## Step 2: Create Cloud Provider Credentials | COMMENT |
| LOW | docs/GETTING_STARTED.md | 259 | ## Step 3: Create GitHub App | COMMENT |
| LOW | docs/GETTING_STARTED.md | 346 | ## Step 4: Generate Security Secrets | COMMENT |
| LOW | docs/GETTING_STARTED.md | 371 | ## Step 5: Configure Terraform | COMMENT |
| LOW | docs/GETTING_STARTED.md | 567 | ## Step 6: Deploy with Terraform | COMMENT |
| LOW | docs/GETTING_STARTED.md | 619 | ## Step 7: Deploy the Web App | COMMENT |
| LOW | docs/GETTING_STARTED.md | 661 | ## Step 8: Verify Deployment | COMMENT |
| LOW | docs/GETTING_STARTED.md | 694 | ## Step 9: Bootstrap the Workspace Owner | COMMENT |
| LOW | docs/GETTING_STARTED.md | 748 | ## Step 10: Create the First Team and Test a Session | COMMENT |
| LOW | docs/GROK_MODELS.md | 23 | ### Step 1: Connect SuperGrok | COMMENT |
| LOW | docs/GROK_MODELS.md | 37 | ### Step 2: Configure Defaults | COMMENT |
| LOW | docs/GROK_MODELS.md | 48 | ### Step 3: Enable and Select Grok | COMMENT |
| LOW | docs/SETUP_GUIDE.md | 49 | ## Step 0: Bootstrap the Repo | COMMENT |
| LOW⚡ | packages/control-plane/src/db/user-store.ts | 409 | // Step 1: Look up by provider identity | COMMENT |
| LOW⚡ | packages/control-plane/src/db/user-store.ts | 413 | // Step 2: Existing identity → load linked user, update if needed | COMMENT |
| LOW | packages/control-plane/src/db/user-store.ts | 472 | // Step 3: No identity found — try email-based cross-provider linking | COMMENT |
| LOW | packages/control-plane/src/db/user-store.ts | 492 | // Step 4: Brand new user — batch user + identity creation so a UNIQUE | COMMENT |
| LOW | packages/control-plane/src/session/initialize.ts | 172 | // Step 1: D1 index (must succeed before DO init starts sandbox warming) | COMMENT |
| LOW | packages/control-plane/src/session/initialize.ts | 213 | // Step 2: runtime init | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/modal-infra/src/web_api.py | 276 | CODE | |
| LOW | packages/modal-infra/src/sandbox/tunnels.py | 121 | CODE | |
| LOW | …dbox-runtime/tests/test_opencode_reasoning_contract.py | 109 | CODE | |
| LOW | …dbox-runtime/tests/test_opencode_reasoning_contract.py | 268 | CODE | |
| LOW | …ckages/sandbox-runtime/tests/test_mcp_package_cache.py | 84 | CODE | |
| LOW | …es/sandbox-runtime/src/sandbox_runtime/mcp_packages.py | 33 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/push_operation.py | 30 | CODE | |
| LOW | …es/sandbox-runtime/src/sandbox_runtime/web_terminal.py | 90 | CODE | |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 121 | CODE | |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 361 | CODE | |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/supervisor.py | 651 | CODE | |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/event_size.py | 21 | CODE | |
| LOW | …dbox-runtime/src/sandbox_runtime/tunnel_environment.py | 57 | CODE | |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 309 | CODE | |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 473 | CODE | |
| LOW | packages/sandbox-runtime/src/sandbox_runtime/bridge.py | 656 | CODE | |
| LOW | …ges/sandbox-runtime/src/sandbox_runtime/boot_attach.py | 179 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/docker_control.py | 71 | CODE | |
| LOW | …sandbox-runtime/src/sandbox_runtime/event_forwarder.py | 150 | CODE | |
| LOW | …sandbox-runtime/src/sandbox_runtime/repository_boot.py | 164 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/process_output.py | 33 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/process_output.py | 42 | CODE | |
| LOW | …ges/sandbox-runtime/src/sandbox_runtime/repo_config.py | 178 | CODE | |
| LOW | …ox-runtime/src/sandbox_runtime/shutdown_preparation.py | 61 | CODE | |
| LOW | …sandbox-runtime/src/sandbox_runtime/opencode_server.py | 297 | CODE | |
| LOW | …sandbox-runtime/src/sandbox_runtime/browser_desktop.py | 169 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/managed_skills.py | 404 | CODE | |
| LOW | …/sandbox-runtime/src/sandbox_runtime/managed_skills.py | 573 | CODE | |
| LOW | …ox-runtime/src/sandbox_runtime/harness/claude_tools.py | 486 | CODE | |
| LOW | …runtime/src/sandbox_runtime/harness/opencode_client.py | 160 | CODE | |
| LOW | …runtime/src/sandbox_runtime/harness/opencode_client.py | 205 | CODE | |
| LOW | …runtime/src/sandbox_runtime/harness/opencode_stream.py | 170 | CODE | |
| LOW | …runtime/src/sandbox_runtime/harness/opencode_stream.py | 312 | CODE | |
| LOW | …runtime/src/sandbox_runtime/harness/opencode_stream.py | 385 | CODE | |
| LOW | …runtime/src/sandbox_runtime/harness/opencode_stream.py | 610 | CODE | |
| LOW | …runtime/src/sandbox_runtime/harness/opencode_stream.py | 925 | CODE | |
| LOW | …untime/src/sandbox_runtime/harness/claude_translate.py | 173 | CODE | |
| LOW | packages/sandbox-images/verify/smoke_test.py | 166 | CODE | |
| LOW | packages/sandbox-images/verify/smoke_test.py | 69 | CODE | |
| LOW | packages/sandbox-images/verify/smoke_test.py | 133 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …es/sandbox-runtime/src/sandbox_runtime/mcp_packages.py | 168 | except FileNotFoundError: | CODE |
| HIGH | …/sandbox-runtime/src/sandbox_runtime/docker_control.py | 101 | except (Exception, asyncio.CancelledError): | CODE |
| HIGH | …ox-runtime/src/sandbox_runtime/shutdown_preparation.py | 82 | except OverflowError: | CODE |
| HIGH | …sandbox-runtime/src/sandbox_runtime/opencode_server.py | 524 | except httpx.ConnectError: | CODE |
| HIGH | …/sandbox-runtime/src/sandbox_runtime/managed_skills.py | 422 | except (OSError, UnicodeDecodeError): | CODE |
| HIGH | …-runtime/src/sandbox_runtime/harness/claude_logging.py | 139 | except Exception: | CODE |
| HIGH | packages/sandbox-images/verify/smoke_test.py | 158 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | packages/sandbox-runtime/tests/test_mcp.py | 243 | "pkg && cat /etc/passwd", | CODE |
| HIGH | …ox-runtime/src/sandbox_runtime/harness/claude_tools.py | 530 | # rejects JSON null, and ``draft`` omitted means "the repository's default". | COMMENT |
| HIGH | packages/sandbox-images/verify/docker_smoke.py | 53 | f"FROM {ROOTFS_IMAGE}\nRUN mkdir -p /www && printf {MARKER} > /www/marker\n" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | terraform/environments/aws-staging/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | terraform/environments/production/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | …raform/environments/aws-production/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | terraform/modules/aws-control-plane/deploy.tf | 23 | # Create the provider unless handed one. It is an account-wide singleton, so | COMMENT |
| MEDIUM | terraform/modules/aws-control-plane/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | …es/sandbox-runtime/tests/test_entrypoint_build_mode.py | 1315 | # Create the directory so _update_existing_repo proceeds after clone. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/modal-infra/deploy.py | 155 | __all__ = ["app"] | CODE |
| LOW | packages/modal-infra/src/log_config.py | 5 | __all__ = ["StructuredLogger", "configure_logging", "get_logger"] | CODE |
| LOW | packages/modal-infra/src/__init__.py | 8 | __all__ = ["app", "web_api"] | CODE |
| LOW | packages/modal-infra/src/images/__init__.py | 5 | __all__ = ["base_image"] | CODE |
| LOW | packages/modal-infra/src/sandbox/__init__.py | 10 | __all__ = [ | CODE |
| LOW | packages/modal-infra/src/sandbox/manager.py | 58 | __all__ = [ | CODE |
| LOW | packages/sandbox-runtime/tests/conftest.py | 103 | def set_prompt_limits(bridge: "AgentBridge", **overrides: float) -> None: | CODE |
| LOW | packages/sandbox-runtime/tests/conftest.py | 196 | __all__ = [ | CODE |
| LOW | …ages/sandbox-runtime/src/sandbox_runtime/event_size.py | 64 | def _set_arg(container: dict[str, Any] | list[Any], key: str | int, text: str) -> None: | CODE |
| LOW | …ckages/sandbox-runtime/src/sandbox_runtime/__init__.py | 19 | __all__ = [ | CODE |
| LOW | …ges/sandbox-runtime/src/sandbox_runtime/git_signing.py | 209 | async def _set_git_config(self, repository: Path, key: str, value: str) -> None: | CODE |
| LOW | …es/sandbox-runtime/src/sandbox_runtime/diff_capture.py | 211 | async def _settle(self, attempt: _RefreshAttempt) -> None: | CODE |
| LOW | …sandbox-runtime/src/sandbox_runtime/opencode_server.py | 297 | def _setup_managed_oauth(self) -> None: | CODE |
| LOW | …s/sandbox-runtime/src/sandbox_runtime/auth/__init__.py | 9 | __all__ = [ | CODE |
| LOW | …andbox-runtime/src/sandbox_runtime/harness/__init__.py | 149 | __all__ = [ | CODE |
| LOW | packages/sandbox-images/src/sandbox_images/locks.py | 15 | def update_locks(root: Path, *, check: bool = False) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/web/src/components/safe-markdown.tsx | 86 | imageMode?: "omit" | "placeholder"; | CODE |
| LOW | packages/web/src/components/safe-markdown.tsx | 179 | if (imageMode !== "placeholder") return null; | CODE |
| LOW | packages/web/src/components/github-autofix-feedback.tsx | 132 | imageMode="placeholder" | CODE |
| LOW | packages/web/src/components/github-autofix-feedback.tsx | 257 | imageMode="placeholder" | CODE |
| LOW | …ponents/settings/session-cost-settings-fields.test.tsx | 20 | expect(screen.getByLabelText("Cost limit (USD)")).toHaveAttribute("placeholder", "Inherit"); | CODE |
| LOW | …runtime/src/sandbox_runtime/plugins/xai-auth-plugin.js | 10 | const OAUTH_DUMMY_KEY = "opencode-oauth-dummy-key"; | CODE |
| LOW | …ntime/src/sandbox_runtime/plugins/codex-auth-plugin.js | 20 | const OAUTH_DUMMY_KEY = "opencode-oauth-dummy-key"; | CODE |
| LOW | packages/shared/src/slack/resolve-users.test.ts | 65 | real_name: "John Doe", | CODE |
| LOW | packages/shared/src/slack/resolve-users.test.ts | 66 | profile: { display_name: "", real_name: "John Doe" }, | CODE |
| LOW | packages/slack-bot/src/index.test.ts | 3264 | real_name: "Jane Doe", | CODE |
| LOW | …ckages/slack-bot/src/sessions/session-launcher.test.ts | 64 | email: "user@example.com", | CODE |
| LOW | …ne/test/integration/provider-account-atomicity.test.ts | 24 | VALUES ('user-1', 'Test User', 'user@example.com', ?, ?)` | CODE |
| LOW | …e/test/integration/provider-account-foundation.test.ts | 123 | VALUES ('user-1', 'Test User', 'user@example.com', ?, ?)` | CODE |
| LOW | …e/test/integration/provider-account-foundation.test.ts | 163 | VALUES ('user-1', 'Test User', 'user@example.com', ?, ?)` | CODE |
| LOW | …e/test/integration/provider-account-foundation.test.ts | 199 | VALUES ('user-1', 'Test User', 'user@example.com', ?, ?)` | CODE |
| LOW | …e/src/source-control/providers/github-provider.test.ts | 56 | privateKey: "fake-key", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/control-plane/src/db/user-store.ts | 409 | // Step 1: Look up by provider identity | COMMENT |
| LOW⚡ | packages/control-plane/src/db/user-store.ts | 413 | // Step 2: Existing identity → load linked user, update if needed | COMMENT |
| LOW | packages/control-plane/src/db/user-store.ts | 472 | // Step 3: No identity found — try email-based cross-provider linking | COMMENT |
| LOW | packages/control-plane/src/db/user-store.ts | 492 | // Step 4: Brand new user — batch user + identity creation so a UNIQUE | COMMENT |
| LOW | packages/control-plane/src/session/initialize.ts | 172 | // Step 1: D1 index (must succeed before DO init starts sandbox warming) | COMMENT |
| LOW | packages/control-plane/src/session/initialize.ts | 213 | // Step 2: runtime init | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …s/sandbox-runtime/src/sandbox_runtime/auth/internal.py | 51 | Verify an internal API token from the Authorization header. Token format: `Bearer timestamp.signature` where: | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …l-plane/test/integration/browser-auth-callback.test.ts | 25 | function handleRequest( | CODE |
| LOW | …trol-plane/test/integration/auth-sign-in-claim.test.ts | 28 | function handleRequest( | CODE |
| LOW | …rol-plane/test/integration/browser-auth-router.test.ts | 11 | function handleRequest( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/modal-infra/src/sandbox/manager.py | 305 | CODE |