🪨 why use many token when few token do trick — Claude Code skill that cuts 65% of tokens by talking like caveman
This report presents the forensic synthetic code analysis of JuliusBrussee/caveman, a Go project with 101,595 GitHub stars. SynthScan v2.0 examined 244,489 lines of code across 1000 source files, recording 866 pattern matches distributed across 17 syntactic categories. The overall adjusted score of 4.9 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 866 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | extension/popup.js | 22 | // ── pixel-flame logo (the CaveMark, 8×8) — white on onyx, no colour ───────── | COMMENT |
| MEDIUM | extension/popup.js | 44 | // ── settings wiring ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | proxy/providers/gemini/content_compress_test.go | 56 | // ── live-zone cost ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | proxy/providers/openai/content_compress_test.go | 163 | // ── live-zone cost ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 79 | // ── Argv ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 181 | // ── Color helpers ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 191 | // ── Env guards ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 215 | // ── Provider matrix ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 287 | // ── Detection ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 392 | // ── Repo root resolution ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 405 | // ── Run helpers ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 464 | // ── Per-provider installers ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 630 | // ── hermes native install ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 692 | // ── opencode native install ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 959 | // ── OpenClaw native install ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 991 | // ── Hooks installer ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1121 | // ── MCP shrink wiring ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1158 | // ── Init writers (per-repo rule files) ──────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1197 | // ── HTTPS download via stdlib ───────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1223 | // ── Integrity verification for downloaded hooks (#262) ───────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1223 | // ── Integrity verification for downloaded hooks (#262) ───────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1253 | // ── Uninstall ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1482 | // ── Interactive prompt (TTY-only) ───────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1500 | // ── --list ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1518 | // ── Help ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 1569 | // ── Main ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/openclaw.js | 140 | // ── Frontmatter helpers ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/openclaw.js | 178 | // ── Bootstrap snippet load ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/openclaw.js | 215 | // ── SOUL.md marker-block append/strip ───────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/openclaw.js | 311 | // ── Public API ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 26 | // ── stripJsonComments ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 64 | // ── stripTrailingCommas ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 95 | // ── readSettings ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 124 | // ── writeSettings ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 139 | // ── validateHookFields ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 161 | // ── Idempotency probe ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 171 | // ── addCommandHook ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 190 | // ── Managed hook scripts ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 229 | // ── removeCavemanHooks ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 258 | // ── rewriteLegacyManagedHookCommands ────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 290 | // ── pruneOrphanedManagedHooks ───────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/lib/settings.js | 376 | // ── claudeConfigDir ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_caveman_stats.js | 464 | // ── Output-reduction share (never a "usage"/"budget" claim) ──────────────── | COMMENT |
| MEDIUM | tests/test_caveman_stats.js | 536 | // ── Mid-session mode-change attribution (#601) ───────────────────────────── | COMMENT |
| MEDIUM | tests/test_caveman_stats.js | 536 | // ── Mid-session mode-change attribution (#601) ───────────────────────────── | COMMENT |
| MEDIUM | tests/test_caveman_stats.js | 637 | // ── Rule-overhead + net (#145/#677) ──────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_caveman_stats.js | 637 | // ── Rule-overhead + net (#145/#677) ──────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_mcp_shrink.js | 182 | // ── Packaging (#597) ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_mcp_shrink.js | 182 | // ── Packaging (#597) ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_repo_local_config.js | 159 | // ── #634: optional startDir param (backward compatible) ──────────────────── | COMMENT |
| MEDIUM | tests/test_repo_local_config.js | 159 | // ── #634: optional startDir param (backward compatible) ──────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_mode_tracker.py | 96 | # ── #598: deactivation word orders ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_mode_tracker.py | 135 | # ── #598: activation guards ───────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_mode_tracker.py | 174 | # ── slash commands ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_mode_tracker.py | 185 | # ── #599: one-shot independent modes ──────────────────────────────── | COMMENT |
| MEDIUM | tests/test_mode_tracker.py | 58 | # ── hook budget: act on the first complete payload, not on EOF ────── | COMMENT |
| MEDIUM | tests/test_cavecrew_model_overrides.js | 30 | // ── patchFrontmatterModel ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_cavecrew_model_overrides.js | 155 | // ── resolvePluginRoot ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_cavecrew_model_overrides.js | 165 | // ── applyOverrides ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_cavecrew_model_overrides.js | 283 | // ── Summary ──────────────────────────────────────────────────────────────── | COMMENT |
| 44 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bin/lib/opencode-agent.js | 56 | function transformOpencodeAgentFrontmatter(content) { | CODE |
| LOW | bin/lib/settings.js | 264 | function rewriteLegacyManagedHookCommands(settings, absoluteNode, platform = process.platform) { | CODE |
| LOW | bin/lib/settings.js | 307 | function pruneOrphanedManagedHooks(settings, configDir, platform = process.platform) { | CODE |
| LOW | …ns/caveman/skills/caveman-compress/scripts/validate.py | 112 | def extract_indented_code_blocks(text): | CODE |
| LOW | tests/verify_repo.py | 116 | def verify_shipped_skills_are_documented() -> None: | CODE |
| LOW | tests/verify_repo.py | 157 | def verify_skill_frontmatter_upload_compatibility() -> None: | CODE |
| LOW | tests/verify_repo.py | 239 | def verify_manifests_and_syntax() -> None: | CODE |
| LOW | tests/verify_repo.py | 638 | def verify_license_boundaries() -> None: | CODE |
| LOW | tests/verify_repo.py | 672 | def verify_untrusted_git_invocations() -> None: | CODE |
| LOW⚡ | tests/test_detect.py | 68 | def test_known_names_case_insensitive(self): | STRING |
| LOW⚡ | tests/test_detect.py | 74 | def test_cmakelists_txt_not_compressible_despite_txt_extension(self): | STRING |
| LOW⚡ | tests/test_detect.py | 80 | def test_shebang_script_is_code(self): | STRING |
| LOW⚡ | tests/test_detect.py | 86 | def test_extensionless_prose_still_compressible(self): | STRING |
| LOW⚡ | tests/test_detect.py | 92 | def test_markdown_still_compressible(self): | STRING |
| LOW⚡ | tests/test_mode_tracker.py | 98 | def test_turn_caveman_mode_off_deactivates(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 104 | def test_turn_caveman_off_deactivates(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 109 | def test_turn_off_caveman_deactivates(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 114 | def test_stop_caveman_multiline_deactivates(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 120 | def test_normal_mode_command_deactivates(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 125 | def test_back_to_normal_mode_deactivates(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 130 | def test_vim_normal_mode_does_not_deactivate(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 137 | def test_enable_caveman_with_stop_elsewhere_activates(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 144 | def test_question_does_not_activate(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 150 | def test_scoped_brevity_does_not_activate(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 154 | def test_unscoped_brevity_activates(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 158 | def test_activate_caveman_still_works(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 162 | def test_turn_on_caveman_mode_still_works(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 166 | def test_talk_like_caveman_still_works(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 170 | def test_bare_caveman_mode_still_works(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 176 | def test_slash_caveman_level_switch(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 187 | def test_commit_restores_prior_level_on_next_prompt(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 195 | def test_commit_with_no_prior_mode_deactivates_after(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 202 | def test_chained_independent_modes_keep_original_prev(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 210 | def test_namespaced_commit_and_review_recognized(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 219 | def test_no_reinforcement_during_independent_turn(self): | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 224 | def test_deactivation_clears_saved_prev(self): | CODE |
| LOW | tests/test_mode_tracker.py | 60 | def test_acts_on_first_complete_payload_without_waiting_for_eof(self): | CODE |
| LOW | tests/test_hooks.py | 40 | def test_install_upgrades_old_two_file_install(self): | CODE |
| LOW | tests/test_hooks.py | 61 | def test_install_reconfigures_missing_statusline(self): | CODE |
| LOW | tests/test_hooks.py | 108 | def test_uninstall_preserves_custom_statusline(self): | CODE |
| LOW | tests/test_hooks.py | 159 | def test_activate_does_not_nudge_when_custom_statusline_exists(self): | CODE |
| LOW | tests/test_hooks.py | 184 | def test_activate_emits_skill_md_not_fallback_from_repo_layout(self): | CODE |
| LOW | tests/test_hooks.py | 197 | def test_activate_finds_skill_beside_config_dir_hooks(self): | CODE |
| LOW | tests/test_hooks.py | 218 | def test_activate_prefers_claude_plugin_root(self): | CODE |
| LOW⚡ | tests/test_compress_safety.py | 46 | def test_empty_compressed_output_does_not_touch_disk(self): | CODE |
| LOW⚡ | tests/test_compress_safety.py | 56 | def test_whitespace_only_compressed_output_does_not_touch_disk(self): | CODE |
| LOW⚡ | tests/test_compress_safety.py | 66 | def test_identical_compressed_output_does_not_touch_disk(self): | CODE |
| LOW⚡ | tests/test_compress_safety.py | 76 | def test_real_compression_writes_backup_and_target(self): | CODE |
| LOW | tests/test_compress_safety.py | 117 | def test_write_text_atomic_leaves_destination_untouched_on_encode_failure(self): | CODE |
| LOW | tests/test_compress_safety.py | 135 | def test_forced_primary_write_failure_leaves_original_and_backup_intact(self): | CODE |
| LOW | tests/test_compress_safety.py | 168 | def test_permission_preserved_across_compression(self): | CODE |
| LOW | tests/test_compress_safety.py | 183 | def test_retry_preamble_output_rejected_and_not_written(self): | CODE |
| LOW | tests/test_compress_safety.py | 233 | def test_crlf_line_endings_survive_the_round_trip(self): | CODE |
| LOW | tests/test_compress_safety.py | 253 | def test_one_crlf_line_does_not_convert_an_lf_document(self): | CODE |
| LOW⚡ | tests/test_compress_safety.py | 290 | def test_two_separate_blocks_are_left_alone(self): | CODE |
| LOW⚡ | tests/test_compress_safety.py | 294 | def test_a_real_wrapper_is_stripped(self): | CODE |
| LOW⚡ | tests/test_compress_safety.py | 298 | def test_a_longer_wrapper_around_inner_fences_is_stripped(self): | CODE |
| LOW⚡ | tests/test_validate_inline.py | 26 | def test_indented_fence_markers_not_leaked_as_inline(self): | CODE |
| LOW⚡ | tests/test_validate_inline.py | 29 | def test_nested_fence_file_validates_against_itself(self): | CODE |
| LOW⚡ | tests/test_validate_inline.py | 34 | def test_deeply_indented_fence_markers_not_leaked(self): | CODE |
| 260 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | rewriter/rewriter.go | 1 | // Package rewriter is the aged-zone reflection rewriter: an external LLM | COMMENT |
| LOW | rewriter/rewriter.go | 21 | // not. | COMMENT |
| LOW | rewriter/rewriter.go | 61 | COMMENT | |
| LOW | rewriter/rewriter.go | 101 | WindowBytes [][]byte // steps s-3..s serialized, per the paper's a+b window | COMMENT |
| LOW | rewriter/tokens.go | 1 | package rewriter | COMMENT |
| LOW | rewriter/gate.go | 1 | package rewriter | COMMENT |
| LOW | rewriter/gate.go | 41 | "warn", "err!", "not found", "no such file", "timed out", "timeout", | COMMENT |
| LOW | rewriter/gate.go | 61 | COMMENT | |
| LOW | rewriter/gate.go | 81 | // on failure lines. | COMMENT |
| LOW | rewriter/prompt.go | 1 | package rewriter | COMMENT |
| LOW | cacheengine/types.go | 141 | COMMENT | |
| LOW | cacheengine/doc.go | 1 | // Package cacheengine plans and applies provider-native prompt caching through | COMMENT |
| LOW | proxy/doc.go | 1 | // Package proxy is the public, byte-safe Caveman reverse proxy: the `caveman` | COMMENT |
| LOW | proxy/cmd/caveman-proxy/main.go | 1 | // Command caveman-proxy is the standalone byte-safe proxy binary. `caveman start` | COMMENT |
| LOW | proxy/providers/toolzone.go | 1 | package providers | COMMENT |
| LOW | proxy/providers/adapter.go | 41 | COMMENT | |
| LOW | proxy/providers/adapter.go | 61 | // Scheme records how the key arrived when it was passed through from the | COMMENT |
| LOW | proxy/providers/adapter.go | 161 | COMMENT | |
| LOW | proxy/providers/adapter.go | 241 | // the cache fields, message_delta carries ONLY the final output_tokens — | COMMENT |
| LOW | proxy/providers/adapter.go | 261 | RawUsage json.RawMessage | COMMENT |
| LOW | proxy/providers/adapter.go | 321 | // body upstream. ok=false opts a provider/route out, so compress mode passes the | COMMENT |
| LOW | proxy/providers/adapter.go | 361 | // injected tool, `mcp__caveman__caveman_retrieve` under Claude Code's MCP | COMMENT |
| LOW | proxy/providers/adapter.go | 1081 | case int64: | COMMENT |
| LOW | proxy/providers/adapter.go | 1101 | // | COMMENT |
| LOW | proxy/providers/gemini/content_compress.go | 81 | } | COMMENT |
| LOW | proxy/providers/gemini/explicit_cache.go | 21 | // ApplyProviderNativeTransforms is an unconditional byte-safe pass-through. | COMMENT |
| LOW | proxy/providers/bedrock/cache_points.go | 81 | COMMENT | |
| LOW | proxy/providers/bedrock/cache_points.go | 101 | if enabled, ok := entry.Capabilities["prompt_cache"].(bool); ok && enabled { | COMMENT |
| LOW | proxy/providers/bedrock/bedrock.go | 1 | package bedrock | COMMENT |
| LOW | proxy/providers/bedrock/usage.go | 21 | COMMENT | |
| LOW | proxy/providers/anthropic/content_compress.go | 101 | // compression) plus the frozen user/system blocks at or below the cache_control | COMMENT |
| LOW | proxy/providers/anthropic/breakpoint_plan.go | 21 | COMMENT | |
| LOW | proxy/providers/anthropic/breakpoint_plan.go | 41 | // changes no model-visible bytes; on any parse anomaly the body is left unchanged. | COMMENT |
| LOW | proxy/providers/anthropic/breakpoint_plan.go | 241 | // The documented semantics (platform.claude.com/docs/en/build-with-claude/prompt-caching): | COMMENT |
| LOW | proxy/providers/anthropic/cogs_bench_test.go | 1 | package anthropic | COMMENT |
| LOW | proxy/providers/vertex/vertex.go | 1 | package vertex | COMMENT |
| LOW | proxy/providers/vertex/vertex.go | 21 | // thoughtsTokenCount) and Claude snake_case (usage.input_tokens/ | COMMENT |
| LOW | proxy/providers/openai/cache_key.go | 21 | providers.Base | COMMENT |
| LOW | proxy/providers/openai/count_tokens.go | 61 | // unprojectableResponsesFields name SERVER-HELD prompt surface: content the | COMMENT |
| LOW | proxy/providers/openai/count_tokens.go | 81 | // | COMMENT |
| LOW | proxy/providers/openai/reasoning_effort.go | 41 | // | COMMENT |
| LOW | proxy/providers/openai/reasoning_effort.go | 141 | } | COMMENT |
| LOW | proxy/providers/openai/session_cache_key.go | 21 | // sessionCacheKeyDomain separates this hash from any other sha256 of the same | COMMENT |
| LOW | proxy/providers/openai/output_brevity.go | 1 | package openai | COMMENT |
| LOW | proxy/providers/openai/stream_usage.go | 1 | package openai | COMMENT |
| LOW | proxy/providers/openai/stream_usage.go | 21 | // OpenAI-compatible client already knows to either consume or ignore an | COMMENT |
| LOW | proxy/providers/openai/stream_usage.go | 61 | } | COMMENT |
| LOW | proxy/internal/standalone/standalone.go | 121 | type Options struct { | COMMENT |
| LOW | proxy/internal/config/config.go | 21 | COMMENT | |
| LOW | proxy/internal/config/config.go | 41 | // "off" disables it; unknown values fail closed to "off". There is | COMMENT |
| LOW | proxy/internal/nativeruntime/runtime.go | 1161 | // elision engine keeps the head and tail rows, keeps one representative of every | COMMENT |
| LOW | proxy/internal/gateway/server.go | 1 | // Package gateway is the byte-safe request lifecycle of the public standalone | COMMENT |
| LOW | proxy/internal/gateway/server.go | 81 | // original block for CCR recovery and returns its deterministic content-addressed | COMMENT |
| LOW | proxy/internal/gateway/server.go | 101 | // deterministic; empty query must match CompressSegment behavior. | COMMENT |
| LOW | proxy/internal/gateway/server.go | 121 | // recovery row is ever written — the estimate is a pure measurement of what | COMMENT |
| LOW | proxy/internal/gateway/server.go | 141 | // the implementation may return only the elided sections most relevant to the | COMMENT |
| LOW | proxy/internal/gateway/server.go | 161 | // rewrite it could not reproduce on the next turn. | COMMENT |
| LOW | proxy/internal/gateway/server.go | 261 | // only a prefix; those rows keep hashes empty and mark this false. | COMMENT |
| LOW | proxy/internal/gateway/server.go | 301 | // on compress candidates), and unlike cacheguard it tolerates append-only | COMMENT |
| 206 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | packages/cli/src/index.ts | 7117 | return None | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 7121 | return None | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 8914 | print({ logged_out: true, remote_session_revoked: true, external_token_cleared: false, external_token_source: "CAVE_T | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 8923 | print({ logged_out: true }); | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 12081 | return False | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 12092 | return False | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 12098 | return None | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 12101 | return None | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 12103 | return None | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 12105 | return None | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 12114 | return None | CODE |
| HIGH⚡ | packages/cli/src/index.ts | 12117 | return None | CODE |
| HIGH | packages/cli/src/index.ts | 692 | print({ | CODE |
| HIGH | packages/cli/src/index.ts | 712 | print({ telemetry: "on", anonymous_id: anonymousId, note: "env override active (DO_NOT_TRACK/CAVEMAN_TELEMETRY) — no | CODE |
| HIGH | packages/cli/src/index.ts | 715 | print({ telemetry: "on", anonymous_id: anonymousId }); | CODE |
| HIGH | packages/cli/src/index.ts | 735 | print({ telemetry: "off", anonymous_id: "none" }); | CODE |
| HIGH | packages/cli/src/index.ts | 1692 | print({ skills: AGENT_SKILL_METADATA, suites: AGENT_SKILL_SUITES }); | CODE |
| HIGH | packages/cli/src/index.ts | 2370 | print({ | CODE |
| HIGH | packages/cli/src/index.ts | 2980 | print({ | CODE |
| HIGH | packages/cli/src/index.ts | 7097 | return False | CODE |
| HIGH | packages/cli/src/index.ts | 7100 | return False | CODE |
| HIGH | packages/cli/src/index.ts | 8051 | print({ ...result, repair: result.components.shared_runtime ? "caveman start" : "caveman setup --install", trust: "n | CODE |
| HIGH | packages/cli/src/index.ts | 8073 | print({ | CODE |
| HIGH | packages/cli/src/index.ts | 8852 | print({ authenticated: true, baseURL, gateway_url: gateway || null, organization_id: organizationId ?? null, token | CODE |
| HIGH | packages/cli/src/index.ts | 11201 | print(receipt); | CODE |
| HIGH | packages/cli/src/index.ts | 11265 | print(explanation); | CODE |
| HIGH | packages/cli/src/index.ts | 13892 | print({ linked: "codex", source: "local_rate_limits", token_store: "none", refresh }); | CODE |
| HIGH | packages/cli/src/index.ts | 13920 | print({ linked: "claude", token_store: tokenStore, basis: "linked_api", refresh }); | CODE |
| HIGH | packages/cli/src/index.ts | 14501 | print({ ...view, native_integrations: integrations }); | CODE |
| HIGH | packages/cli/src/index.ts | 14523 | print({ | CODE |
| HIGH | packages/cli/src/index.ts | 14549 | print(body); | CODE |
| HIGH | packages/cli/src/index.ts | 14581 | print(await response.json()); | CODE |
| HIGH | packages/cli/src/index.ts | 14628 | print(body); | CODE |
| HIGH | packages/cli/src/index.ts | 14933 | print({ | CODE |
| HIGH | packages/cli/src/index.ts | 14972 | print({ exported: out, receipts: Array.isArray(bundle.receipts) ? bundle.receipts.length : 0 }); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | evals/measure.py | 17 | CODE | |
| LOW | evals/plot.py | 12 | CODE | |
| LOW | evals/llm_run.py | 27 | CODE | |
| LOW | …eengine/cachebench/scripts/lmcache_parquet_to_jsonl.py | 4 | CODE | |
| LOW | tests/verify_repo.py | 4 | CODE | |
| LOW | tests/verify_repo.py | 398 | CODE | |
| LOW | tests/verify_repo.py | 400 | CODE | |
| LOW | shared/provider-catalog/validate_catalog.py | 2 | CODE | |
| LOW | packages/sdk/python/tests/test_trace_continuity.py | 3 | CODE | |
| LOW | packages/sdk/python/tests/test_context_pack.py | 1 | CODE | |
| LOW | packages/sdk/python/tests/test_exporter.py | 1 | CODE | |
| LOW | packages/sdk/python/tests/test_sdk.py | 1 | CODE | |
| LOW | packages/sdk/python/tests/test_shared_context.py | 3 | CODE | |
| LOW | packages/sdk/python/tests/test_runtime_policy.py | 16 | CODE | |
| LOW | packages/sdk/python/tests/test_runtime_policy.py | 23 | CODE | |
| LOW | packages/sdk/python/tests/test_parity.py | 12 | CODE | |
| LOW | packages/sdk/python/tests/test_tool_events.py | 3 | CODE | |
| LOW | packages/sdk/python/tests/test_task_profile.py | 1 | CODE | |
| LOW | packages/sdk/python/tests/test_assembly.py | 1 | CODE | |
| LOW | packages/sdk/python/tests/test_structural.py | 6 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 1 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/core.py | 1 | CODE | |
| LOW | mem/py/cavemem.py | 8 | CODE | |
| LOW | mem/py/tests/test_cavemem.py | 1 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | evals/measure.py | 33 | except Exception: | CODE |
| LOW | evals/plot.py | 29 | except Exception: | CODE |
| LOW | evals/llm_run.py | 44 | except Exception: | CODE |
| LOW | evals/llm_run.py | 84 | except Exception: | CODE |
| MEDIUM | evals/llm_run.py | 77 | def claude_version() -> str: | CODE |
| LOW | plugins/caveman/skills/caveman-compress/scripts/cli.py | 19 | except Exception: | CODE |
| LOW | plugins/caveman/skills/caveman-compress/scripts/cli.py | 79 | except Exception as e: | CODE |
| LOW | …ns/caveman/skills/caveman-compress/scripts/compress.py | 24 | except Exception: | CODE |
| LOW | …ns/caveman/skills/caveman-compress/scripts/compress.py | 190 | except Exception: | CODE |
| LOW | …ns/caveman/skills/caveman-compress/scripts/compress.py | 254 | except Exception: | CODE |
| LOW | tests/verify_repo.py | 24 | except Exception: | CODE |
| LOW⚡ | tests/test_mode_tracker.py | 91 | except Exception: | CODE |
| LOW | benchmarks/run.py | 21 | except Exception: | CODE |
| MEDIUM | packages/cli/src/index.ts | 7044 | def _digest(value): | CODE |
| MEDIUM | packages/cli/src/index.ts | 7052 | def _task_type(value): | CODE |
| MEDIUM | packages/cli/src/index.ts | 7076 | def _task_terms(value): | CODE |
| MEDIUM | packages/cli/src/index.ts | 7104 | def _call(event, payload=None): | CODE |
| MEDIUM | packages/cli/src/index.ts | 12071 | def _int_env(name, default): | CODE |
| MEDIUM | packages/cli/src/index.ts | 12078 | def _eligible(command): | CODE |
| MEDIUM | packages/cli/src/index.ts | 12095 | def _transform_terminal_output(command=None, output=None, **kwargs): | CODE |
| LOW⚡ | packages/cli/src/index.ts | 7120 | except Exception: | CODE |
| LOW⚡ | packages/cli/src/index.ts | 12074 | except Exception: | CODE |
| LOW⚡ | packages/cli/src/index.ts | 12091 | except Exception: | CODE |
| LOW⚡ | packages/cli/src/index.ts | 12116 | except Exception: | CODE |
| LOW | packages/cli/src/index.ts | 7048 | except Exception: | CODE |
| LOW | packages/cli/src/index.ts | 7055 | except Exception: | CODE |
| LOW | packages/cli/src/index.ts | 7079 | except Exception: | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 804 | except Exception: # noqa: BLE001 — fail-closed: any failure ⇒ pass-through. | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 1009 | except Exception: # noqa: BLE001 — lossy selector must fail closed to caller-owned context. | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 1925 | except Exception: # noqa: BLE001 — a verifier must fail closed, never raise. | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 2141 | except Exception: # noqa: BLE001 — observability must never break a decision. | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 2297 | except Exception: # noqa: BLE001 — the agent's path must not depend on this call. | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 2303 | except Exception: # noqa: BLE001 | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 2356 | except Exception: # noqa: BLE001 | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 2386 | except Exception: # noqa: BLE001 | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 2418 | except Exception: # noqa: BLE001 — decide() is total: a bug here must not break the agent. | CODE |
| LOW | packages/sdk/python/caveman_cloud/core.py | 2422 | except Exception: # noqa: BLE001 — observability never breaks a decision. | CODE |
| LOW | skills/caveman-compress/scripts/cli.py | 19 | except Exception: | CODE |
| LOW | skills/caveman-compress/scripts/cli.py | 79 | except Exception as e: | CODE |
| LOW | skills/caveman-compress/scripts/compress.py | 24 | except Exception: | CODE |
| LOW | skills/caveman-compress/scripts/compress.py | 190 | except Exception: | CODE |
| LOW | skills/caveman-compress/scripts/compress.py | 254 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | packages/cli/src/index.ts | 3703 | // - valid entitlement (now < expires_at): compression as requested, "entitled". | COMMENT |
| HIGH⚡ | packages/cli/src/index.ts | 3704 | // - lapsed ≤7 days: compression as requested, "grace" (caller kicks a refresh). | COMMENT |
| HIGH⚡ | packages/cli/src/index.ts | 3705 | // - no/expired/unreadable entitlement: compression as requested, "unentitled". | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cacheengine/cachebench/README.md | 69 | [LMCache Agentic Traces](https://huggingface.co/datasets/sammshen/lmcache-agentic-traces) | CODE |
| MEDIUM | …hebench/results/lmcache-agentic-traces-2026-08-10.json | 8 | "url": "https://huggingface.co/datasets/sammshen/lmcache-agentic-traces", | CODE |
| MEDIUM | …ine/cachebench/scripts/fetch_lmcache_agentic_traces.sh | 6 | cachebench_base_url="https://huggingface.co/datasets/sammshen/lmcache-agentic-traces/resolve/${cachebench_revision}/data | CODE |
| MEDIUM | proxy/providers/gemini/explicit_cache.go | 12 | // runtime scaffold. It is not a current policy flag or optimization label. | COMMENT |
| MEDIUM | proxy/providers/anthropic/cogs_bench_test.go | 7 | // body, which prices a million agentic requests at roughly EUR 0.13 of Scaleway | COMMENT |
| MEDIUM | proxy/providers/anthropic/cogs_bench_test.go | 43 | // message history — the shape an agentic caller actually sends. | COMMENT |
| MEDIUM | proxy/internal/gateway/proxy.go | 1489 | // The historical gemini-explicit-cache scaffold is permanently absent: it never | COMMENT |
| MEDIUM | shared/platform/optimizers/optimizers_test.go | 86 | // gemini-explicit-cache was a runtime-policy scaffold, never a money-bearing | COMMENT |
| MEDIUM | shared/platform/optimizers/optimizers.go | 27 | // telemetry join key. The old scaffold never created a cachedContents resource, | COMMENT |
| MEDIUM | packages/cli/src/agent-skills.generated.ts | 17 | "caveman-manage": "---\nname: caveman-manage\ndescription: >\n Inspect Caveman Cloud's eval-gated experiment lifecycl | CODE |
| MEDIUM | src/hooks/caveman-stats.js | 388 | // limit usage — input + cache tokens dominate agentic sessions, count against | COMMENT |
| MEDIUM | src/hooks/caveman-stats.js | 514 | // on the line above, and input + cache tokens (which dominate agentic | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | benchmarks/run.py | 61 | # the eval harness uses (evals/llm_run.py TERSE_PREFIX) so the two agree. | COMMENT |
| MEDIUM | packages/cli/src/index.ts | 10666 | // CLI, robust to PATH: a resolved `caveman`/`cave`, else this very script's node. | COMMENT |
| MEDIUM | engine/compressors/json.go | 54 | anomalyZ float64 // robust |z| (MAD-based) at/above which an item is an anomaly | CODE |
| MEDIUM | engine/compressors/json.go | 174 | // Numeric anomalies (robust MAD-z per numeric leaf path + element length). | COMMENT |
| MEDIUM | engine/compressors/json.go | 329 | // computes a robust MAD-based z over the elements that have that path and flags | COMMENT |
| MEDIUM | engine/compressors/json.go | 388 | // medianAndScale returns the median and a robust scale (MAD) of xs, falling back | COMMENT |
| MEDIUM | engine/compressors/json.go | 575 | // and accepts it when the mean shift across k exceeds zThresh robust scales. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ns/caveman/skills/caveman-compress/scripts/validate.py | 112 | CODE | |
| LOW | …gins/caveman/skills/caveman-compress/scripts/detect.py | 56 | CODE | |
| LOW | tests/verify_repo.py | 82 | CODE | |
| LOW | packages/sdk/python/tests/test_exporter.py | 20 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/core.py | 403 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/core.py | 1745 | CODE | |
| LOW | packages/sdk/python/caveman_cloud/core.py | 2307 | CODE | |
| LOW | skills/caveman-compress/scripts/validate.py | 112 | CODE | |
| LOW | skills/caveman-compress/scripts/detect.py | 56 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/caveman/skills/caveman-compress/scripts/cli.py | 55 | # Check if compressible | COMMENT |
| LOW | …ns/caveman/skills/caveman-compress/scripts/compress.py | 407 | # Check if backup already exists to prevent accidental overwriting | STRING |
| LOW | skills/caveman-compress/scripts/cli.py | 55 | # Check if compressible | COMMENT |
| LOW | skills/caveman-compress/scripts/compress.py | 407 | # Check if backup already exists to prevent accidental overwriting | STRING |
| LOW | src/hooks/install.sh | 48 | # Check if already installed (unless --force). Older installs only had two hook | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | engine/compressors/testdata/axtree_cdp_local_page.json | 614 | "type": "placeholder", | CODE |
| LOW⚡ | engine/compressors/testdata/axtree_cdp_local_page.json | 615 | "attribute": "placeholder", | CODE |
| LOW⚡ | engine/compressors/testdata/axtree_cdp_local_page.json | 619 | "type": "placeholder", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ns/caveman/skills/caveman-compress/scripts/__init__.py | 7 | __all__ = ["cli", "compress", "detect", "validate"] | CODE |
| LOW | packages/sdk/python/caveman_cloud/__init__.py | 28 | __all__ = [ | CODE |
| LOW | skills/caveman-compress/scripts/__init__.py | 7 | __all__ = ["cli", "compress", "detect", "validate"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | proxy/routing/confidence_test.go | 17 | "As an AI language model, I am unable to do that.", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ns/caveman/skills/caveman-compress/scripts/compress.py | 425 | # Step 1: Compress (body only, frontmatter excluded) | STRING |
| LOW | …ns/caveman/skills/caveman-compress/scripts/compress.py | 461 | # Step 2: Validate + Retry | STRING |
| LOW | skills/caveman-compress/scripts/compress.py | 425 | # Step 1: Compress (body only, frontmatter excluded) | STRING |
| LOW | skills/caveman-compress/scripts/compress.py | 461 | # Step 2: Validate + Retry | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ns/caveman/skills/caveman-compress/scripts/compress.py | 425 | # Step 1: Compress (body only, frontmatter excluded) | STRING |
| LOW | …ns/caveman/skills/caveman-compress/scripts/compress.py | 461 | # Step 2: Validate + Retry | STRING |
| LOW | skills/caveman-compress/scripts/compress.py | 425 | # Step 1: Compress (body only, frontmatter excluded) | STRING |
| LOW | skills/caveman-compress/scripts/compress.py | 461 | # Step 2: Validate + Retry | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/sdk/python/caveman_cloud/core.py | 1639 | CODE |