Agentic Coding for Builders who Ship
This report summarizes scanner evidence for Kuberwastaken/claurst, a Rust project with 10,320 GitHub stars. SynthScan examined 191,759 lines of code across 377 source files, recording 584 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 4.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 486 finding(s).
Are imports declared and package/API names verified? 3 finding(s).
Are wrappers, guards, and repeated structures necessary? 231 finding(s).
Which changes need focused human review? 584 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 584 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/workflows/auto-release.yml | 1 | name: Auto Release (commit marker) | COMMENT |
| LOW | .github/workflows/patch-release.yml | 1 | name: Patch Release (re-upload assets to an existing tag) | COMMENT |
| LOW | .github/workflows/release.yml | 241 | COMMENT | |
| LOW | .github/workflows/release.yml | 261 | # 2. Append a "Direct commits" section listing non-merge commits | COMMENT |
| LOW | .github/workflows/release.yml | 321 | # 3. "**Full Changelog**: …compare link" | COMMENT |
| LOW | .github/workflows/release.yml | 381 | draft: false | COMMENT |
| LOW | src-rust/crates/tools/src/repl_tool.rs | 1 | // REPLTool: Executes code in a persistent interpreter session. | COMMENT |
| LOW | src-rust/crates/tools/src/repl_tool.rs | 41 | stdout: BufReader<ChildStdout>, | COMMENT |
| LOW | src-rust/crates/tools/src/team_tool.rs | 1 | // Team tools: create and disband multi-agent swarm teams. | COMMENT |
| LOW | src-rust/crates/tools/src/computer_use.rs | 1 | // Computer Use tool — cross-platform mouse/keyboard/screenshot control. | COMMENT |
| LOW | src-rust/crates/tools/src/pty_bash.rs | 1 | // PTY-backed Bash tool: wraps every command in a real pseudo-terminal so that | COMMENT |
| LOW | src-rust/crates/tools/src/powershell.rs | 1 | // PowerShell tool: execute PowerShell commands (Windows-native). | COMMENT |
| LOW | src-rust/crates/tools/src/send_message.rs | 1 | // SendMessageTool: send a message to another agent or broadcast to all. | COMMENT |
| LOW | src-rust/crates/tools/src/cron.rs | 1 | // Cron tools: schedule recurring and one-shot prompts. | COMMENT |
| LOW | src-rust/crates/tools/src/line_endings.rs | 1 | //! Line-ending detection and preservation for the file-editing tools. | COMMENT |
| LOW | src-rust/crates/tools/src/line_endings.rs | 61 | } | COMMENT |
| LOW | src-rust/crates/tools/src/bundled_skills.rs | 1 | //! Bundled skill definitions for the Skill tool. | COMMENT |
| LOW | src-rust/crates/tools/src/bundled_skills.rs | 21 | /// Optional guidance for the model about when to auto-invoke. | COMMENT |
| LOW | src-rust/crates/tools/src/lib.rs | 101 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | src-rust/crates/tools/src/lib.rs | 181 | COMMENT | |
| LOW | src-rust/crates/tools/src/lib.rs | 301 | /// Set when the query loop has a command queue wired up. | COMMENT |
| LOW | src-rust/crates/tools/src/lib.rs | 521 | /// | COMMENT |
| LOW | src-rust/crates/tools/src/tool_search.rs | 1 | // ToolSearchTool: discover tools by name or keyword. | COMMENT |
| LOW | src-rust/crates/tools/src/mcp_auth_tool.rs | 1 | // McpAuthTool: pseudo-tool surfaced for MCP servers that require OAuth. | COMMENT |
| LOW | src-rust/crates/tools/src/agent_tool.rs | 1 | // AgentTool is defined in cc-query to avoid a circular dependency: | COMMENT |
| LOW | src-rust/crates/tools/src/skill_tool.rs | 1 | // SkillTool: execute user-defined skill (prompt template) files programmatically. | COMMENT |
| LOW | src-rust/crates/tools/src/synthetic_output.rs | 1 | // SyntheticOutputTool: Used by coordinator / non-interactive sessions to emit | COMMENT |
| LOW | src-rust/crates/tools/src/worktree.rs | 41 | #[derive(Debug, Deserialize)] | COMMENT |
| LOW | src-rust/crates/tools/src/todo_write.rs | 141 | priority: Option<String>, | COMMENT |
| LOW | src-rust/crates/core/tests/snapshot_tests.rs | 1 | //! Integration tests for ShadowSnapshot — ported from opencode's snapshot.test.ts. | COMMENT |
| LOW | src-rust/crates/core/src/team_memory_sync.rs | 1 | //! Team memory synchronization with claude.ai API. | COMMENT |
| LOW | src-rust/crates/core/src/team_memory_sync.rs | 61 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | src-rust/crates/core/src/feature_flags.rs | 81 | COMMENT | |
| LOW | src-rust/crates/core/src/provider_id.rs | 1 | // provider_id.rs — Branded newtypes for provider and model identifiers. | COMMENT |
| LOW | src-rust/crates/core/src/prompt_history.rs | 1 | // Prompt history — append-only JSONL log of user prompts. | COMMENT |
| LOW | src-rust/crates/core/src/prompt_history.rs | 61 | COMMENT | |
| LOW | src-rust/crates/core/src/skill_discovery.rs | 1 | //! Skill discovery: load custom prompt-template skills from markdown files | COMMENT |
| LOW | src-rust/crates/core/src/skill_discovery.rs | 21 | /// Skill name (from `name:` frontmatter or file stem). | COMMENT |
| LOW | src-rust/crates/core/src/feature_gates.rs | 1 | // feature_gates.rs — Env-var-based feature gates and dynamic config. | COMMENT |
| LOW | src-rust/crates/core/src/feature_gates.rs | 41 | /// Reads `CLAURST_FEATURE_<NORMALIZED_NAME>` and returns `true` when the | COMMENT |
| LOW | src-rust/crates/core/src/keybindings.rs | 141 | /// Keys that cannot be rebound | COMMENT |
| LOW | src-rust/crates/core/src/oauth_config.rs | 1 | //! OAuth configuration for multiple environments. | COMMENT |
| LOW | src-rust/crates/core/src/oauth_config.rs | 161 | pub oauth_file_suffix: &'static str, | COMMENT |
| LOW | src-rust/crates/core/src/oauth_config.rs | 181 | // extra-usage off and `seven_day_oauth_apps` staying null. A side-by-side run of | COMMENT |
| LOW | src-rust/crates/core/src/oauth_config.rs | 241 | /// | COMMENT |
| LOW | src-rust/crates/core/src/oauth_config.rs | 401 | COMMENT | |
| LOW | src-rust/crates/core/src/output_styles.rs | 1 | //! Output style system — customises how Claude responds to the user. | COMMENT |
| LOW | src-rust/crates/core/src/output_styles.rs | 81 | } | COMMENT |
| LOW | src-rust/crates/core/src/system_prompt.rs | 1 | //! Modular system prompt assembly with caching support. | COMMENT |
| LOW | src-rust/crates/core/src/system_prompt.rs | 121 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | src-rust/crates/core/src/system_prompt.rs | 201 | /// Whether --append-system-prompt is set (affects prefix detection). | COMMENT |
| LOW | src-rust/crates/core/src/system_prompt.rs | 221 | /// Skip auto-injecting platform/shell/date env info (set true only in tests). | COMMENT |
| LOW | src-rust/crates/core/src/keywords.rs | 1 | // keywords.rs — the shared registry of inline prompt keywords. | COMMENT |
| LOW | src-rust/crates/core/src/keywords.rs | 21 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | src-rust/crates/core/src/remote_settings.rs | 1 | // remote_settings.rs — Remote Managed Settings | COMMENT |
| LOW | src-rust/crates/core/src/session_storage.rs | 1 | // session_storage.rs — JSONL transcript persistence for Claurst. | COMMENT |
| LOW | src-rust/crates/core/src/session_storage.rs | 21 | use crate::types::Message; | COMMENT |
| LOW | src-rust/crates/core/src/session_storage.rs | 41 | #[serde(tag = "type", rename_all = "lowercase")] | COMMENT |
| LOW | src-rust/crates/core/src/session_storage.rs | 61 | LastPrompt(LastPromptEntry), | COMMENT |
| 248 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/index.html | 548 | // ── Page registry ────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/index.html | 566 | // ── Search index ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/index.html | 582 | // ── Markdown cache ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/index.html | 596 | // ── Marked config ────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/index.html | 622 | // ── Load page ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/index.html | 744 | // ── Copy code ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/index.html | 754 | // ── Search ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/index.html | 813 | // ── Sidebar toggle (mobile) ──────────────────────────────────── | COMMENT |
| MEDIUM | docs/index.html | 818 | // ── Router ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/index.html | 832 | // ── Init ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/auto-release.yml | 43 | # ── 0. Skip our own bump commits ────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/auto-release.yml | 60 | # ── 1. Parse the marker ─────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/auto-release.yml | 88 | # ── 3. Forward-only enforcement ─────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/auto-release.yml | 120 | # ── 4. Run the bump script ──────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/auto-release.yml | 131 | # ── 5. Commit & push the bump ───────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/auto-release.yml | 149 | # ── 6. Hand off to the existing release workflow ────────────────── | COMMENT |
| MEDIUM | .github/workflows/auto-release.yml | 175 | # ── --patch flow ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/patch-release.yml | 47 | # ── Preflight ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/patch-release.yml | 86 | # ── Build matrix ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/patch-release.yml | 193 | # ── Re-upload assets to the existing release ──────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 27 | # ── Preflight: validate branch, tag, and version match ────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 61 | # ── Build matrix ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 174 | # ── Create GitHub release ─────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 278 | # ── Pass 1: GitHub-generated PR notes ────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 295 | # ── Pass 2: direct commits not associated with a merged PR ───── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 336 | # ── Compose final body in the requested order ────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/repl_tool.rs | 252 | // ── Security gate (issue #209) ─────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/repl_tool.rs | 252 | // ── Security gate (issue #209) ─────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 201 | // ── Screenshot ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 204 | // ── Cursor position ────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 219 | // ── Mouse move ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 236 | // ── Left click ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 256 | // ── Right click ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 276 | // ── Double click ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 299 | // ── Click and drag ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 334 | // ── Type text ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 351 | // ── Key press ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/computer_use.rs | 368 | // ── Scroll ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/pty_bash.rs | 8 | // ────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/pty_bash.rs | 743 | // ── Background path ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/pty_bash.rs | 754 | // ── Windows path (no PTY — use cmd.exe fallback) ───────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/pty_bash.rs | 765 | // ── Unix PTY path ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/powershell.rs | 7 | // ────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/powershell.rs | 123 | // ── Step 1: classify the command ───────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/powershell.rs | 126 | // ── Step 2: apply the risk gate ────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/powershell.rs | 205 | // ── Step 3: execute ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/cron.rs | 320 | // ── Security gate (issue #209) ─────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tools/src/cron.rs | 320 | // ── Security gate (issue #209) ─────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/core/src/ps_classifier.rs | 160 | // ── Critical ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/core/src/ps_classifier.rs | 222 | // ── High ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/core/src/ps_classifier.rs | 296 | // ── Medium ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/core/src/ps_classifier.rs | 368 | // ── Low: everything else ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/core/src/bash_classifier.rs | 110 | // ── Critical patterns ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/core/src/bash_classifier.rs | 180 | // ── Privilege escalation → High ──────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/core/src/bash_classifier.rs | 221 | // ── Medium-risk ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/core/src/bash_classifier.rs | 274 | // ── Low-risk: common dev tools ───────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/core/src/bash_classifier.rs | 331 | // ── Safe: read-only ops ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tui/src/image_paste.rs | 144 | // ── macOS ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tui/src/image_paste.rs | 183 | // ── Linux ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src-rust/crates/tui/src/image_paste.rs | 262 | // ── Windows ──────────────────────────────────────────────────────────────── | COMMENT |
| 35 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | spec/05_components_agents_permissions_design.md | 307 | function getRelativeAgentDirectoryPath(location: SettingSource): string // (private) | CODE |
| LOW⚡ | spec/05_components_agents_permissions_design.md | 316 | function getNewRelativeAgentFilePath(agent: { source: SettingSource | 'built-in'; agentType: string }): string | CODE |
| LOW⚡ | spec/05_components_agents_permissions_design.md | 319 | function getActualRelativeAgentFilePath(agent: AgentDefinition): string | CODE |
| LOW | spec/05_components_agents_permissions_design.md | 427 | function getAgentSourceDisplayName( | CODE |
| LOW | spec/05_components_agents_permissions_design.md | 842 | function usePermissionRequestLogging( | CODE |
| LOW | spec/02_commands.md | 266 | export async function validateDirectoryForWorkspace( | CODE |
| LOW | spec/02_commands.md | 730 | export function createMovedToPluginCommand(options: { | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1541 | export function isProjectOnboardingComplete(): boolean | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1542 | export function maybeMarkProjectOnboardingComplete(): void | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1544 | export function incrementProjectOnboardingSeenCount(): void | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1686 | export function getTotalAPIDurationWithoutRetries(): number | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1696 | export function getTurnClassifierDurationMs(): number | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1697 | export function addToTurnClassifierDuration(duration: number): void | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1698 | export function resetTurnClassifierDuration(): void | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1707 | export function getTotalCacheReadInputTokens(): number | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1708 | export function getTotalCacheCreationInputTokens(): number | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1709 | export function getTotalWebSearchRequests(): number | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1718 | export function getCurrentTurnTokenBudget(): number | null | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1719 | export function snapshotOutputTokensForTurn(budget: number | null): void | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1720 | export function getBudgetContinuationCount(): number | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1721 | export function incrementBudgetContinuationCount(): void | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1765 | export function updateLastInteractionTime(immediate?: boolean): void | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1773 | export function getIsNonInteractiveSession(): boolean | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1775 | export function isSessionPersistenceDisabled(): boolean | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1776 | export function setSessionPersistenceDisabled(v: boolean): void | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1782 | export function getAdditionalDirectoriesForClaudeMd(): string[] | CODE |
| LOW⚡ | spec/01_core_entry_query.md | 1783 | export function setAdditionalDirectoriesForClaudeMd(dirs: string[]): void | CODE |
| LOW | spec/01_core_entry_query.md | 218 | function prefetchSystemContextIfSafe(): void | CODE |
| LOW | spec/01_core_entry_query.md | 220 | function loadSettingSourcesFromFlag(settingSourcesArg: string): void | CODE |
| LOW | spec/01_core_entry_query.md | 307 | export function initializeTelemetryAfterTrust(): void | CODE |
| LOW | spec/01_core_entry_query.md | 1339 | export function clearPendingHistoryEntries(): void | CODE |
| LOW | spec/01_core_entry_query.md | 1440 | export function restoreCostStateForSession(sessionId: string): boolean | CODE |
| LOW | spec/03_tools.md | 618 | function isSearchOrReadBashCommand(command: string): { isSearch: boolean; isRead: boolean } | CODE |
| LOW | spec/03_tools.md | 619 | function detectBlockedSleepPattern(command: string): string | null | CODE |
| LOW | spec/03_tools.md | 678 | function detectBlockedSleepPattern(command: string): string | null | CODE |
| LOW | spec/03_tools.md | 1694 | function clearToolSearchDescriptionCache(): void | CODE |
| LOW | spec/03_tools.md | 1860 | function createSyntheticOutputTool(jsonSchema: object): Tool | CODE |
| LOW | spec/03_tools.md | 1996 | function getToolUseIDFromParentMessage( | CODE |
| LOW⚡ | spec/10_utils.md | 499 | export async function maybeRemoveApiKeyFromMacOSKeychainThrows(): Promise<void> | CODE |
| LOW⚡ | spec/10_utils.md | 506 | export function getApiKeyFromFileDescriptor(): string | null | CODE |
| LOW⚡ | spec/10_utils.md | 507 | export function getOAuthTokenFromFileDescriptor(): OAuthTokens | null | CODE |
| LOW | spec/10_utils.md | 248 | export function createChildAbortController( | CODE |
| LOW | spec/10_utils.md | 322 | export function extractOutputRedirections(command: string): string[] | CODE |
| LOW | spec/10_utils.md | 401 | export function checkHasTrustDialogAccepted(): boolean | CODE |
| LOW | spec/10_utils.md | 403 | export function normalizePathForConfigKey(p: string): string | CODE |
| LOW | spec/10_utils.md | 418 | export function hasSkipDangerousModePermissionPrompt(): boolean | CODE |
| LOW | spec/10_utils.md | 452 | export function getManagedSettingsDropInDir(): string | CODE |
| LOW | spec/10_utils.md | 567 | export function deletePermissionRuleFromSettings(rule: PermissionRuleFromEditableSettings): void | CODE |
| LOW | spec/10_utils.md | 639 | export function permissionRuleValueFromString(s: string): PermissionRuleValue | CODE |
| LOW | spec/10_utils.md | 640 | export function permissionRuleValueToString(v: PermissionRuleValue): string | CODE |
| LOW | spec/10_utils.md | 725 | export function normalizePathForConfigKey(p: string): string | CODE |
| LOW | spec/10_utils.md | 806 | export async function addFileGlobRuleToGitignore( | CODE |
| LOW | spec/10_utils.md | 855 | export function getTranscriptPathForSession(sessionId: string, cwd?: string): string | CODE |
| LOW | spec/10_utils.md | 885 | export function invalidateSessionEnvCache(): void | CODE |
| LOW | spec/10_utils.md | 886 | export async function getSessionEnvironmentVariables(): Promise<Record<string, string>> | CODE |
| LOW | spec/10_utils.md | 1336 | export async function executeUserPromptSubmitHooks( | CODE |
| LOW | spec/10_utils.md | 1340 | export function getUserPromptSubmitHookBlockingMessage(result: HookResult): string | null | CODE |
| LOW | spec/10_utils.md | 1539 | export function updateDeepLinkTerminalPreference(terminal: string): void | CODE |
| LOW | spec/10_utils.md | 1651 | export function getExternalClaudeMdIncludes(cwd?: string): string[] | CODE |
| LOW | spec/10_utils.md | 1652 | export function shouldShowClaudeMdExternalIncludesWarning(): boolean | CODE |
| 76 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | spec/01_core_entry_query.md | 19 | 15. [query/stopHooks.ts — Stop Hook Orchestration](#querystophooksts--stop-hook-orchestration) | CODE |
| MEDIUM | spec/03_tools.md | 18 | 7. [Agent / Multi-Agent Tools](#7-agent--multi-agent-tools) | CODE |
| MEDIUM | spec/10_utils.md | 19 | 13. [Swarm / Multi-Agent System](#13-swarm--multi-agent-system) | CODE |
| MEDIUM | docs/local-models.md | 78 | ## Recommended `llama-server` flags for agentic use | COMMENT |
| MEDIUM | docs/index.md | 56 | ### Multi-agent orchestration | COMMENT |
| MEDIUM | docs/hooks.md | 66 | ### `agent` — agentic verifier | COMMENT |
| MEDIUM | src-rust/crates/core/src/system_prompt.rs | 600 | /// No security guardrails injected. | COMMENT |
| MEDIUM | src-rust/crates/core/src/lib.rs | 285 | /// A sub-task assignment in an agentic workflow. | COMMENT |
| MEDIUM | src-rust/crates/core/src/lib.rs | 769 | /// Max agentic turns for this agent (overrides global) | COMMENT |
| MEDIUM | src-rust/crates/tui/src/app/run.rs | 106 | /// Process a query event from the agentic loop. | COMMENT |
| MEDIUM | src-rust/crates/cli/src/main.rs | 145 | /// Maximum number of agentic turns | COMMENT |
| MEDIUM | src-rust/crates/query/src/compact.rs | 15 | // The summary is generated in a single non-agentic API call so it doesn't | COMMENT |
| MEDIUM | src-rust/crates/query/src/lib.rs | 1 | // cc-query: The core agentic query loop. | COMMENT |
| MEDIUM | src-rust/crates/query/src/lib.rs | 372 | /// Run the agentic query loop. | COMMENT |
| MEDIUM | src-rust/crates/query/src/agent_tool.rs | 8 | // - Runs its own agentic loop | COMMENT |
| MEDIUM | src-rust/crates/query/src/runner/single.rs | 1 | // Single-shot (non-agentic) query: one API call, no tool loop. | COMMENT |
| MEDIUM | src-rust/crates/query/src/runner/single.rs | 7 | /// Run a single (non-agentic) query – no tool loop, just one API call. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | spec/11_special_systems.md | 189 | #### `CompanionSoul` (AI-generated, stored) | COMMENT |
| HIGH | src-rust/crates/core/src/session_storage.rs | 53 | /// An AI-generated session title (written by the auto-titler, not the user). | COMMENT |
| HIGH | src-rust/crates/buddy/src/lib.rs | 6 | /// personality, hatched_at) is AI-generated on first hatch and persisted in | COMMENT |
| HIGH | src-rust/crates/buddy/src/lib.rs | 374 | // Soul (AI-generated, persisted to disk) | COMMENT |
| HIGH | src-rust/crates/buddy/src/lib.rs | 377 | /// The AI-generated identity of a companion. Stored in | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src-rust/crates/tui/src/overlays.rs | 1413 | /// Step 1: user is browsing the message list. | COMMENT |
| LOW⚡ | src-rust/crates/tui/src/overlays.rs | 1415 | /// Step 2: user has chosen a message and must confirm. | COMMENT |
| LOW | src-rust/crates/cli/src/main.rs | 3858 | // Step 1: Request device code | COMMENT |
| LOW | src-rust/crates/cli/src/main.rs | 3871 | // Step 2: Poll for access token | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 568 | // Step 1: Get current git remote + PR info via gh CLI | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 596 | // Step 2: Fetch review comments via gh API | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 926 | // Step 1: Check provider credentials | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 941 | // Step 2: Check SSH agent forwarding (check SSH_AUTH_SOCK) | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 953 | // Step 3: Check claurst config dir exists | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 966 | // Step 4: Check provider endpoint reachability | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src-rust/crates/tui/src/overlays.rs | 1413 | /// Step 1: user is browsing the message list. | COMMENT |
| LOW⚡ | src-rust/crates/tui/src/overlays.rs | 1415 | /// Step 2: user has chosen a message and must confirm. | COMMENT |
| LOW | src-rust/crates/cli/src/main.rs | 3858 | // Step 1: Request device code | COMMENT |
| LOW | src-rust/crates/cli/src/main.rs | 3871 | // Step 2: Poll for access token | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 568 | // Step 1: Get current git remote + PR info via gh CLI | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 596 | // Step 2: Fetch review comments via gh API | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 926 | // Step 1: Check provider credentials | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 941 | // Step 2: Check SSH agent forwarding (check SSH_AUTH_SOCK) | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 953 | // Step 3: Check claurst config dir exists | COMMENT |
| LOW | src-rust/crates/commands/src/named_commands.rs | 966 | // Step 4: Check provider endpoint reachability | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/append-patch-note.py | 21 | CODE | |
| LOW | scripts/bump-version.py | 20 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | spec/11_special_systems.md | 1056 | | `loremIpsum` | — | Lorem ipsum text generation | | CODE |