Repository Analysis

Dicklesworthstone/destructive_command_guard

The Destructive Command Guard (dcg) is for blocking dangerous git and shell commands from being executed by agents.

8.2 Low AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of Dicklesworthstone/destructive_command_guard, a Rust project with 4,324 GitHub stars. SynthScan v2.0 examined 243,044 lines of code across 446 source files, recording 1113 pattern matches distributed across 14 syntactic categories. The overall adjusted score of 8.2 places this repository in the Low AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

8.2
Adjusted Score
8.2
Raw Score
100%
Time Factor
2026-07-13
Last Push
4.3K
Stars
Rust
Language
243.0K
Lines of Code
446
Files
1.1K
Pattern Hits
2026-07-14
Scan Date
0.00
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 2MEDIUM 409LOW 702

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 1113 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Decorative Section Separators366 hits · 1149 pts
SeverityFileLineSnippetContext
MEDIUMinstall.sh158# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh160# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh1205# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh1207# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh1289# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh1291# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh3030# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh3032# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh3107# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh3109# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh3145# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMinstall.sh3147# ═══════════════════════════════════════════════════════════════════════════════COMMENT
MEDIUM.config/nextest.toml4# =============================================================================COMMENT
MEDIUM.config/nextest.toml6# =============================================================================COMMENT
MEDIUM.config/nextest.toml20# =============================================================================COMMENT
MEDIUM.config/nextest.toml22# =============================================================================COMMENT
MEDIUM.config/nextest.toml46# =============================================================================COMMENT
MEDIUM.config/nextest.toml48# =============================================================================COMMENT
MEDIUM.config/nextest.toml66# =============================================================================COMMENT
MEDIUM.config/nextest.toml68# =============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml6# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml8# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml37# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml39# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml68# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml70# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml88# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml90# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml113# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml115# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml138# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml140# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml173# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml175# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml199# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/multi_segment.toml201# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml12# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml14# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml31# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml33# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml50# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml52# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml69# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml71# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml83# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml85# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml97# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/regex_worst_case.toml99# -----------------------------------------------------------------------------COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml5# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml7# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml24# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml26# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml48# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml50# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml73# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml75# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml87# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml89# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml106# ============================================================================COMMENT
MEDIUMtests/corpus/edge_cases/quoting.toml108# ============================================================================COMMENT
306 more matches not shown…
Over-Commented Block531 hits · 450 pts
SeverityFileLineSnippetContext
LOWuninstall.sh1#!/usr/bin/env bashCOMMENT
LOWinstall.sh1#!/usr/bin/env bashCOMMENT
LOWinstall.sh941 return 0COMMENT
LOWinstall.sh961 # The earlier form of this function unconditionally passed --new-bundle-formatCOMMENT
LOWinstall.sh1961COMMENT
LOWinstall.sh2001 # Codex 0.125.0 marked PreToolUse hooks as STABLE (codex_hooks feature isCOMMENT
LOWinstall.sh2021 # payloads dcg switches to codex's documented alternativeCOMMENT
LOWinstall.sh2761 # Hermes Agent (NousResearch — https://github.com/NousResearch/hermes-agent)COMMENT
LOWinstall.sh3001 fiCOMMENT
LOWrust-toolchain.toml1[toolchain]COMMENT
LOW.config/nextest.toml1# cargo-nextest configuration for git_safety_guardCOMMENT
LOWpatches/uring-fs/src/lib.rs1COMMENT
LOWpatches/uring-fs/src/lib.rs21//! let info = io.stat("src/file.txt").await?;COMMENT
LOWtests/codex_hook_protocol.rs1//! Subprocess integration tests for Codex CLI hook protocol.COMMENT
LOWtests/codex_hook_protocol.rs201 )COMMENT
LOWtests/codex_hook_protocol.rs401 outcome.is_claude_block_shape(),COMMENT
LOWtests/codex_hook_protocol.rs1441 assert!(claude.stdout.is_empty());COMMENT
LOWtests/codex_hook_protocol.rs1761// and Claude. Users use these to opt out of specific protections withoutCOMMENT
LOWtests/temporary_allowlist_tests.rs1//! Comprehensive tests for Temporary/Expiring Allowlist Entries (Epic 6).COMMENT
LOWtests/suggestion_integration.rs1//! Integration tests for Command Rewriting Suggestions end-to-end flow.COMMENT
LOWtests/agent_exit_codes.rs1//! Tests for exit code compliance with Claude Code hook protocol.COMMENT
LOWtests/config_schema_drift.rs1//! Drift check for the committed `config.schema.json`.COMMENT
LOWtests/suggest_allowlist_e2e.rs1#![allow(clippy::uninlined_format_args)]COMMENT
LOWtests/agent_hook_output.rs381 let alt_str = safe_alt.as_str().unwrap();COMMENT
LOWtests/golden_isomorphism.rs1//! Golden isomorphism tests for the evaluator.COMMENT
LOWtests/robot_mode.rs1//! Tests for robot mode (`--robot` flag and `DCG_ROBOT` env var).COMMENT
LOWtests/debug_heredoc_extraction.rs21 );COMMENT
LOWtests/cli_e2e.rs1#![allow(clippy::needless_raw_string_hashes)]COMMENT
LOWtests/stdin_batch_mode.rs1//! End-to-end tests for stdin batch mode (`dcg hook --batch`).COMMENT
LOWtests/suggestion_scoring.rs1//! Comprehensive tests for Command Rewriting Suggestions scoring and analysis.COMMENT
LOWtests/security_regressions_v2.rs1//! Regression tests for security bypasses fixed in Jan 2025.COMMENT
LOWtests/regression_corpus.rs1//! Regression corpus test harness with full isomorphism verification.COMMENT
LOWtests/regression_corpus.rs21//! command = "git reset --hard"COMMENT
LOWtests/regression_corpus.rs41//! - `rule_id` (pack:pattern format)COMMENT
LOWtests/config_toggles_e2e.rs1#![allow(COMMENT
LOWtests/memory_tests.rs1//! Memory leak detection tests for DCGCOMMENT
LOWtests/memory_tests.rs101 }COMMENT
LOWtests/agent_profile_comprehensive.rs1//! Comprehensive testing for Agent-Specific Profiles (Epic 9).COMMENT
LOWtests/golden_json_tests.rs1//! Golden file tests for JSON output stability.COMMENT
LOWtests/golden_json_tests.rs21//!COMMENT
LOWtests/repro_newline_separator.rs21 "Destructive command after newline was incorrectly allowed (likely masked as argument)"COMMENT
LOWtests/tui_e2e.rs1#![allow(clippy::doc_markdown)]COMMENT
LOWtests/test_explanations.rs1//! Comprehensive E2E Tests for Natural Language Explanations (Epic 2)COMMENT
LOWtests/corpus/edge_cases/regex_worst_case.toml1# Edge cases: regex worst-case inputsCOMMENT
LOWtests/corpus/bypass_attempts/heredoc_inline.toml1# Bypass attempts: destructive commands in heredocs and inline scriptsCOMMENT
LOWtests/corpus/bypass_attempts/heredoc_inline.toml101COMMENT
LOWtests/corpus/bypass_attempts/heredoc_inline.toml161# command = "echo 'git reset --hard' | sh"COMMENT
LOWtests/corpus/false_positives/heredoc_data.toml1# False positives: heredocs to non-executing commandsCOMMENT
LOWtests/common/logging.rs1//! Test logging utilities for history E2E tests.COMMENT
LOWtests/common/logging.rs21///COMMENT
LOWtests/common/db.rs1//! Test database factory for history tests.COMMENT
LOWtests/common/db.rs21/// An isolated test database with automatic cleanup.COMMENT
LOWtests/common/mod.rs1//! Common test utilities for DCG history E2E tests.COMMENT
LOWtests/common/fixtures.rs321COMMENT
LOWtests/e2e/run_tui_e2e.sh1#!/bin/bashCOMMENT
LOWtests/e2e/run_agent_e2e.sh1#!/usr/bin/env bashCOMMENT
LOWtests/e2e/run_install_e2e.sh1#!/bin/bashCOMMENT
LOWtests/e2e/robot_mode_test.sh1#!/usr/bin/env bashCOMMENT
LOWtests/e2e/mod.rs1//! End-to-End Test Framework for DCGCOMMENT
LOWtests/e2e/mod.rs21//! │ test_suggestions.rs │ Epic 3: Command rewriting │COMMENT
471 more matches not shown…
Verbosity Indicators59 hits · 96 pts
SeverityFileLineSnippetContext
LOWtests/codex_hook_protocol.rs1268 // Step 1: Get a Claude deny with allow-once codeCOMMENT
LOWtests/codex_hook_protocol.rs1314 // Step 2: Redeem the allow-once code using `dcg allow-once <code> --yes`COMMENT
LOWtests/codex_hook_protocol.rs1338 // Step 3: Retry the same command — should now be allowedCOMMENT
LOWtests/codex_hook_protocol.rs1965 // Step 1: Codex deny — creates pending exception in hermetic HOMECOMMENT
LOWtests/codex_hook_protocol.rs2003 // Step 2: Redeem the allow-once codeCOMMENT
LOWtests/codex_hook_protocol.rs2027 // Step 3: Retry under Codex — must now be allowed (exit 0)COMMENT
LOWtests/cli_e2e.rs922 // Step 2: Use dcg allow-once <code> --yes to activate the exceptionCOMMENT
LOWtests/cli_e2e.rs931 // Step 3: Re-run the same command, should now be allowedCOMMENT
LOWtests/cli_e2e.rs935 // Step 4: Run it again to verify reusable (not single-use)COMMENT
LOWtests/cli_e2e.rs972 // Step 1: Block and get codeCOMMENT
LOWtests/cli_e2e.rs977 // Step 2: Allow itCOMMENT
LOWtests/cli_e2e.rs981 // Step 3: Same command in same directory is allowedCOMMENT
LOWtests/cli_e2e.rs985 // Step 4: Create a different directory outside the original temp dirCOMMENT
LOWtests/cli_e2e.rs989 // Step 5: Same command in different directory is still blockedCOMMENT
LOWtests/cli_e2e.rs999 // Step 1: Block and get codeCOMMENT
LOWtests/cli_e2e.rs1004 // Step 2: Allow it with --single-useCOMMENT
LOWtests/cli_e2e.rs1013 // Step 3: First run is allowedCOMMENT
LOWtests/cli_e2e.rs1017 // Step 4: Second run is blocked again (single-use consumed)COMMENT
LOWtests/cli_e2e.rs1027 // Step 1: Block to create pending entryCOMMENT
LOWtests/cli_e2e.rs1032 // Step 2: Check list shows pendingCOMMENT
LOWtests/cli_e2e.rs1042 // Step 3: Allow itCOMMENT
LOWtests/cli_e2e.rs1046 // Step 4: Check list shows active entryCOMMENT
LOWtests/cli_e2e.rs1193 // Step 2: Revoke the exception before it's usedCOMMENT
LOWtests/cli_e2e.rs1202 // Step 3: Command should be blocked againCOMMENT
LOWtests/cli_e2e.rs1212 // Step 1: Block and get codeCOMMENT
LOWtests/cli_e2e.rs1217 // Step 2: Dry-run allowCOMMENT
LOWtests/cli_e2e.rs1224 // Step 3: Command should still be blocked (dry-run doesn't write)COMMENT
LOWtests/cli_e2e.rs911 // Step 1: Run blocked command in hook mode, verify it's denied with a codeCOMMENT
LOWtests/cli_e2e.rs1108 // Step 2: Try to allow without --force - should failCOMMENT
LOWtests/cli_e2e.rs1182 // Step 1: Block and allowCOMMENT
LOWsrc/evaluator.rs2527 // Step 1: Check allow-once overrides (may be superseded by config blocklist).COMMENT
LOWsrc/evaluator.rs2530 // Step 2: Check precompiled block overrides before allow overrides. DenyCOMMENT
LOWsrc/evaluator.rs2591 // Step 4: Quick rejection - if no relevant keywords, allow immediatelyCOMMENT
LOWsrc/evaluator.rs2599 // Step 5: False-positive immunity - strip known-safe string arguments (commit messages, searchCOMMENT
LOWsrc/evaluator.rs2634 // Step 7: Check legacy safe patterns (whitelist, reusing normalized from quick-reject)COMMENT
LOWsrc/evaluator.rs2644 // Step 8: Check legacy destructive patterns (blacklist)COMMENT
LOWsrc/evaluator.rs1598 // Step 1: Check precompiled block overrides first. Deny wins whenCOMMENT
LOWsrc/evaluator.rs1613 // Step 2: Self-inspection exemption (dcg#170).COMMENT
LOWsrc/evaluator.rs1640 // Step 3: Heredoc / inline-script detection (Tier 1/2/3, fail-open).COMMENT
LOWsrc/evaluator.rs1687 // Step 4: Quick rejection - if no relevant keywords, allow immediately.COMMENT
LOWsrc/evaluator.rs1711 // Step 5: False-positive immunity - strip known-safe string arguments (commit messages, searchCOMMENT
LOWsrc/evaluator.rs1791 // Step 7: Mask heredoc content for non-executing targets (cat, tee, etc.)COMMENT
LOWsrc/evaluator.rs2556 // Step 3: Heredoc / inline-script detection (Tier 1/2/3, fail-open).COMMENT
LOWsrc/evaluator.rs2658 // Step 9: Check enabled packs with allowlist override semantics.COMMENT
LOWsrc/main.rs1652 // Step 1: pack_aware_quick_reject should NOT reject this commandCOMMENT
LOWsrc/main.rs1658 // Step 2: Normalize commandCOMMENT
LOWsrc/main.rs1661 // Step 3: Check against pack registry (should block)COMMENT
LOWsrc/scan.rs4101 // Step 1: ExtractCOMMENT
LOWsrc/scan.rs4108 // Step 2: EvaluateCOMMENT
LOWsrc/cli.rs3236 // Step 7: Check for empty packCOMMENT
LOWsrc/cli.rs3246 // Step 8: Check for duplicate pattern namesCOMMENT
LOWsrc/cli.rs3149 // Step 1: Check if file existsCOMMENT
LOWsrc/cli.rs3160 // Step 2: Read file contentCOMMENT
LOWsrc/cli.rs3174 // Step 3: Parse YAMLCOMMENT
LOWsrc/cli.rs3193 // Step 4: Validate schema versionCOMMENT
LOWsrc/cli.rs3208 // Step 5: Validate ID formatCOMMENT
LOWsrc/cli.rs3222 // Step 6: Validate version format (semver)COMMENT
LOWsrc/cli.rs3269 // Step 9: Validate regex patternsCOMMENT
LOWsrc/cli.rs3291 // Step 10: Check for collision with built-in packsCOMMENT
Structural Annotation Overuse59 hits · 96 pts
SeverityFileLineSnippetContext
LOWtests/codex_hook_protocol.rs1268 // Step 1: Get a Claude deny with allow-once codeCOMMENT
LOWtests/codex_hook_protocol.rs1314 // Step 2: Redeem the allow-once code using `dcg allow-once <code> --yes`COMMENT
LOWtests/codex_hook_protocol.rs1338 // Step 3: Retry the same command — should now be allowedCOMMENT
LOWtests/codex_hook_protocol.rs1965 // Step 1: Codex deny — creates pending exception in hermetic HOMECOMMENT
LOWtests/codex_hook_protocol.rs2003 // Step 2: Redeem the allow-once codeCOMMENT
LOWtests/codex_hook_protocol.rs2027 // Step 3: Retry under Codex — must now be allowed (exit 0)COMMENT
LOWtests/cli_e2e.rs922 // Step 2: Use dcg allow-once <code> --yes to activate the exceptionCOMMENT
LOWtests/cli_e2e.rs931 // Step 3: Re-run the same command, should now be allowedCOMMENT
LOWtests/cli_e2e.rs935 // Step 4: Run it again to verify reusable (not single-use)COMMENT
LOWtests/cli_e2e.rs972 // Step 1: Block and get codeCOMMENT
LOWtests/cli_e2e.rs977 // Step 2: Allow itCOMMENT
LOWtests/cli_e2e.rs981 // Step 3: Same command in same directory is allowedCOMMENT
LOWtests/cli_e2e.rs985 // Step 4: Create a different directory outside the original temp dirCOMMENT
LOWtests/cli_e2e.rs989 // Step 5: Same command in different directory is still blockedCOMMENT
LOWtests/cli_e2e.rs999 // Step 1: Block and get codeCOMMENT
LOWtests/cli_e2e.rs1004 // Step 2: Allow it with --single-useCOMMENT
LOWtests/cli_e2e.rs1013 // Step 3: First run is allowedCOMMENT
LOWtests/cli_e2e.rs1017 // Step 4: Second run is blocked again (single-use consumed)COMMENT
LOWtests/cli_e2e.rs1027 // Step 1: Block to create pending entryCOMMENT
LOWtests/cli_e2e.rs1032 // Step 2: Check list shows pendingCOMMENT
LOWtests/cli_e2e.rs1042 // Step 3: Allow itCOMMENT
LOWtests/cli_e2e.rs1046 // Step 4: Check list shows active entryCOMMENT
LOWtests/cli_e2e.rs1193 // Step 2: Revoke the exception before it's usedCOMMENT
LOWtests/cli_e2e.rs1202 // Step 3: Command should be blocked againCOMMENT
LOWtests/cli_e2e.rs1212 // Step 1: Block and get codeCOMMENT
LOWtests/cli_e2e.rs1217 // Step 2: Dry-run allowCOMMENT
LOWtests/cli_e2e.rs1224 // Step 3: Command should still be blocked (dry-run doesn't write)COMMENT
LOWtests/cli_e2e.rs911 // Step 1: Run blocked command in hook mode, verify it's denied with a codeCOMMENT
LOWtests/cli_e2e.rs1108 // Step 2: Try to allow without --force - should failCOMMENT
LOWtests/cli_e2e.rs1182 // Step 1: Block and allowCOMMENT
LOWsrc/evaluator.rs2527 // Step 1: Check allow-once overrides (may be superseded by config blocklist).COMMENT
LOWsrc/evaluator.rs2530 // Step 2: Check precompiled block overrides before allow overrides. DenyCOMMENT
LOWsrc/evaluator.rs2591 // Step 4: Quick rejection - if no relevant keywords, allow immediatelyCOMMENT
LOWsrc/evaluator.rs2599 // Step 5: False-positive immunity - strip known-safe string arguments (commit messages, searchCOMMENT
LOWsrc/evaluator.rs2634 // Step 7: Check legacy safe patterns (whitelist, reusing normalized from quick-reject)COMMENT
LOWsrc/evaluator.rs2644 // Step 8: Check legacy destructive patterns (blacklist)COMMENT
LOWsrc/evaluator.rs1598 // Step 1: Check precompiled block overrides first. Deny wins whenCOMMENT
LOWsrc/evaluator.rs1613 // Step 2: Self-inspection exemption (dcg#170).COMMENT
LOWsrc/evaluator.rs1640 // Step 3: Heredoc / inline-script detection (Tier 1/2/3, fail-open).COMMENT
LOWsrc/evaluator.rs1687 // Step 4: Quick rejection - if no relevant keywords, allow immediately.COMMENT
LOWsrc/evaluator.rs1711 // Step 5: False-positive immunity - strip known-safe string arguments (commit messages, searchCOMMENT
LOWsrc/evaluator.rs1791 // Step 7: Mask heredoc content for non-executing targets (cat, tee, etc.)COMMENT
LOWsrc/evaluator.rs2556 // Step 3: Heredoc / inline-script detection (Tier 1/2/3, fail-open).COMMENT
LOWsrc/evaluator.rs2658 // Step 9: Check enabled packs with allowlist override semantics.COMMENT
LOWsrc/main.rs1652 // Step 1: pack_aware_quick_reject should NOT reject this commandCOMMENT
LOWsrc/main.rs1658 // Step 2: Normalize commandCOMMENT
LOWsrc/main.rs1661 // Step 3: Check against pack registry (should block)COMMENT
LOWsrc/scan.rs4101 // Step 1: ExtractCOMMENT
LOWsrc/scan.rs4108 // Step 2: EvaluateCOMMENT
LOWsrc/cli.rs3236 // Step 7: Check for empty packCOMMENT
LOWsrc/cli.rs3246 // Step 8: Check for duplicate pattern namesCOMMENT
LOWsrc/cli.rs3149 // Step 1: Check if file existsCOMMENT
LOWsrc/cli.rs3160 // Step 2: Read file contentCOMMENT
LOWsrc/cli.rs3174 // Step 3: Parse YAMLCOMMENT
LOWsrc/cli.rs3193 // Step 4: Validate schema versionCOMMENT
LOWsrc/cli.rs3208 // Step 5: Validate ID formatCOMMENT
LOWsrc/cli.rs3222 // Step 6: Validate version format (semver)COMMENT
LOWsrc/cli.rs3269 // Step 9: Validate regex patternsCOMMENT
LOWsrc/cli.rs3291 // Step 10: Check for collision with built-in packsCOMMENT
Self-Referential Comments16 hits · 57 pts
SeverityFileLineSnippetContext
MEDIUMtests/install/test_helper.bash4# This file is sourced by Bats test files to provide:COMMENT
MEDIUMtests/install/test_helper.bash20 # Create a modified version of install.sh that can be sourced.COMMENT
MEDIUMtests/install/test_helper.bash263# Create a test file with known content and checksumCOMMENT
MEDIUMtests/e2e/run_agent_e2e.sh107 # Create a minimal configCOMMENT
MEDIUMtests/e2e/run_history_e2e.sh128 # Create a minimal config that enables historyCOMMENT
MEDIUMscripts/scan_gitdiff_e2e.sh288 # Create a safe script firstCOMMENT
MEDIUMscripts/scan_gitdiff_e2e.sh352 # Create a scriptCOMMENT
MEDIUMscripts/scan_gitdiff_e2e.sh137# Create a fixture git repo with test filesCOMMENT
MEDIUMscripts/scan_gitdiff_e2e.sh465 # Create a markdown file with dangerous commands as documentationCOMMENT
MEDIUMscripts/scan_gitdiff_e2e.sh601 # Create a file with a destructive command (error level)COMMENT
MEDIUMscripts/scan_precommit_e2e.sh202 # Create a shell script with a destructive commandCOMMENT
MEDIUMscripts/scan_precommit_e2e.sh289 # Create a markdown file that mentions dangerous commands but doesn't execute themCOMMENT
MEDIUMscripts/scan_precommit_e2e.sh358 # Create a safe shell scriptCOMMENT
MEDIUMscripts/scan_precommit_e2e.sh366 # Create a dangerous DockerfileCOMMENT
MEDIUMscripts/scan_precommit_e2e.sh432 # Create a shell script with destructive command (use git reset --hard which is always error)COMMENT
MEDIUMscripts/scan_precommit_e2e.sh128# Create a fixture git repo with test filesCOMMENT
AI Slop Vocabulary14 hits · 44 pts
SeverityFileLineSnippetContext
MEDIUMtests/security_regressions.rs12/// Fix: `check_fallback_patterns` performs a robust substring/regex checkCOMMENT
MEDIUMtests/corpus/canonical.toml1# Canonical command corpus for golden tests and the shared e2e harness.COMMENT
MEDIUMtests/e2e/framework.rs590# All features enabled for comprehensive testingCOMMENT
MEDIUMtests/e2e/run_agent_e2e.sh4# This script runs comprehensive end-to-end tests for AI agent integration features.COMMENT
MEDIUMtests/e2e/run_install_e2e.sh339 # Extract and source install.sh functions using the robust methodCOMMENT
MEDIUMtests/e2e/run_history_e2e.sh4# This script runs comprehensive end-to-end tests for the DCG history system.COMMENT
MEDIUMscripts/e2e_codex.sh3# Real Codex CLI end-to-end harness for dcg.COMMENT
MEDIUMscripts/e2e_destructive_equivalents.sh272# harness contract by exercising the closed bypass family)COMMENT
MEDIUMscripts/e2e_destructive_equivalents.sh5# Shared end-to-end test harness for the EPIC tracked atCOMMENT
MEDIUMscripts/templates/test_pack.sh89 # Create JSON input using robust escapingCOMMENT
MEDIUM.github/workflows/ci.yml1241 # Also fail if new unexpected cases are added (keeps the harness stable)COMMENT
MEDIUMsrc/heredoc.rs794 // Use robust wrapper stripping to handle env flags (e.g. -u, -C) correctly.COMMENT
MEDIUMsrc/evaluator.rs3176 // These patterns must be robust to whitespace variations where applicable.COMMENT
MEDIUMsrc/packs/platform/github.rs40 // We use a robust value matcher that handles quoted strings to prevent bypasses.COMMENT
Redundant / Tautological Comments19 hits · 24 pts
SeverityFileLineSnippetContext
LOWuninstall.sh344 # Check if dcg is configuredCOMMENT
LOWuninstall.sh447 # Check if dcg is configuredCOMMENT
LOWuninstall.sh664 # Check if our settings existCOMMENT
LOWuninstall.sh680 # Check if file is now empty (just whitespace)COMMENT
LOWinstall.sh393# Check if a specific agent was detectedCOMMENT
LOWinstall.sh402# Check if installed version matches targetCOMMENT
LOWinstall.sh763 # Check if the completions subcommand exists (added in v0.2.11+)COMMENT
LOWinstall.sh1082# Check if already at target version (skip download if so, unless --force)COMMENT
LOWinstall.sh1097 # Check if existing lock is stale (process no longer running)COMMENT
LOWinstall.sh1343 # Check if the exact current dcg hook is already configured. A stale dcgCOMMENT
LOWinstall.sh1638 # Check if Gemini CLI appears to be installed (has config dir or gemini command exists)COMMENT
LOWinstall.sh1892 # Check if Aider is installed (command exists)COMMENT
LOWinstall.sh1909 # Check if git-commit-verify is already set to trueCOMMENT
LOWinstall.sh1916 # Check if git-commit-verify exists but is falseCOMMENT
LOWinstall.sh1975 # Check if Continue is installedCOMMENT
LOWinstall.sh2037 # Check if Codex is installedCOMMENT
LOWinstall.sh2061 # Check if the exact current dcg hook is already configured. A stale dcgCOMMENT
LOWtests/e2e/run_agent_e2e.sh141# Check if jq is availableCOMMENT
LOWtests/e2e/run_install_e2e.sh284 # Check if detection worksCOMMENT
Modern AI Meta-Vocabulary8 hits · 22 pts
SeverityFileLineSnippetContext
MEDIUMREADME.md367 # Containers and orchestrationCOMMENT
MEDIUMtests/codex_hook_protocol.rs366// Smoke tests — validate the scaffold helpers work before leaf tests dependCOMMENT
MEDIUMtests/scripts/run_e2e_tests.sh5# This script orchestrates all E2E tests for the Destructive Command Guard.COMMENT
MEDIUMdocs/planning/DGC_IMPROVEMENT_PLAN__GPT.md443. [Design principles](#design-principles-guardrails-for-the-whole-project)CODE
MEDIUMdocs/planning/DGC_IMPROVEMENT_PLAN__GPT.md128## Design principles (guardrails for the whole project)COMMENT
MEDIUMdocs/planning/DGC_IMPROVEMENT_PLAN__GPT.md904### Cross-cutting: Performance + safety guardrails (limits, hardening, benchmarks)COMMENT
MEDIUMdocs/planning/DCG_IMPROVEMENT_PLAN__OPUS.md499. [Test Infrastructure & Performance Guardrails](#7-test-infrastructure--performance-guardrails)CODE
MEDIUMscripts/e2e_codex.sh5# This scaffold mirrors scripts/e2e_test.sh logging conventions, but drives theCOMMENT
Excessive Try-Catch Wrapping19 hits · 21 pts
SeverityFileLineSnippetContext
MEDIUMinstall.sh2563def main():CODE
LOWinstall.sh2566 except Exception:CODE
LOWinstall.sh2575 except Exception:CODE
LOWinstall.sh2596 except Exception:CODE
LOWinstall.sh2607 except Exception:CODE
LOWinstall.sh2645except Exception:CODE
LOWinstall.sh2701except Exception:CODE
LOWtests/install/test_helper.bash252except Exception:CODE
LOWscripts/audit_patterns.py19 except Exception as e:CODE
MEDIUMscripts/audit_patterns.py20 print(f"Error reading {filepath}: {e}")CODE
MEDIUMscripts/audit_patterns.py15def scan_file(filepath):CODE
LOWscripts/perf_baseline.py63 except Exception:CODE
LOWscripts/perf_baseline.py118 except Exception as exc: # noqa: BLE001CODE
LOWscripts/perf_baseline.py136 except Exception as exc: # noqa: BLE001CODE
LOWscripts/perf_baseline.py150 except Exception:CODE
LOWscripts/perf_baseline.py176 except Exception:CODE
LOWscripts/perf_baseline.py255 except Exception as exc: # noqa: BLE001CODE
MEDIUMscripts/perf_baseline.py122def capture_rustc_version() -> Tuple[str, Optional[str]]:CODE
MEDIUMscripts/perf_baseline.py140def capture_git_sha() -> Optional[str]:CODE
Example Usage Blocks14 hits · 19 pts
SeverityFileLineSnippetContext
LOWtests/e2e/run_tui_e2e.sh12# Usage:COMMENT
LOWtests/e2e/run_agent_e2e.sh8# Usage:COMMENT
LOWtests/e2e/run_install_e2e.sh11# Usage:COMMENT
LOWtests/e2e/robot_mode_test.sh11# Usage:COMMENT
LOWtests/e2e/test_doctor_install_uninstall.sh9# Usage:COMMENT
LOWtests/e2e/run_history_e2e.sh7# Usage:COMMENT
LOWtests/e2e/run_update_e2e.sh11# Usage:COMMENT
LOWscripts/check_benchmark_budgets.sh8# Usage:COMMENT
LOWscripts/scan_gitdiff_e2e.sh11# Usage:COMMENT
LOWscripts/e2e_test.sh8# Usage:COMMENT
LOWscripts/scan_precommit_e2e.sh11# Usage:COMMENT
LOWscripts/test-quick.sh5# Usage:COMMENT
LOWscripts/coverage.sh5# Usage:COMMENT
LOWscripts/templates/test_pack.sh8# Usage:COMMENT
Synthetic Comment Markers2 hits · 15 pts
SeverityFileLineSnippetContext
HIGHdocs/planning/DCG_IMPROVEMENT_PLAN__OPUS.md2031*Document generated by Claude Opus 4.5 on 2026-01-08 (Enhanced Hybrid Version)*COMMENT
HIGHdocs/planning/AGENT_FRIENDLINESS_REPORT.md205*Generated by Claude Opus 4.5 during bd-dpr execution*COMMENT
Hyper-Verbose Identifiers3 hits · 2 pts
SeverityFileLineSnippetContext
LOWuninstall.sh585def strip_dcg_platform_fields(entry):CODE
LOWinstall.sh2386def strip_dcg_platform_fields(entry):CODE
LOWscripts/check_cli_versions.sh118def github_repo_from_releases_url(url)CODE
Deep Nesting2 hits · 2 pts
SeverityFileLineSnippetContext
LOWscripts/audit_patterns.py42CODE
LOWscripts/perf_baseline.py39CODE
Unused Imports1 hit · 1 pts
SeverityFileLineSnippetContext
LOWscripts/perf_baseline.py11CODE