Run agents like Hermes, LangChain Deep Agents, and OpenClaw more securely inside NVIDIA OpenShell with managed inference
This report summarizes scanner evidence for NVIDIA/NemoClaw, a TypeScript project with 22,703 GitHub stars. SynthScan examined 1,732,968 lines of code across 5566 source files, recording 9893 pattern matches distributed across 20 syntactic categories. The legacy adjusted pattern signal is 8.2 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 8560 finding(s).
Are imports declared and package/API names verified? 779 finding(s).
Are wrappers, guards, and repeated structures necessary? 8580 finding(s).
Which changes need focused human review? 9893 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 9893 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/mcp-tool-discovery-runtime/tool-discovery-core.ts | 59 | export function parseMcpToolDiscoveryArguments(args: string[]): McpToolDiscoveryArguments { | CODE |
| LOW | tools/mcp-tool-discovery-runtime/tool-discovery-core.ts | 77 | export function buildMcpToolDiscoveryAuthorizationPlaceholder( | CODE |
| LOW | tools/mcp-tool-discovery-runtime/tool-discovery-core.ts | 233 | export async function runMcpToolDiscoverySession(session: McpToolDiscoverySession): Promise<void> { | CODE |
| LOW | tools/mcp-tool-discovery-runtime/tool-discovery-core.ts | 350 | export function safeToolDiscoveryErrorDetail(error: unknown): string { | CODE |
| LOW | tools/e2e/risk-signal.ts | 54 | export function configuredRiskSignalEnvironment( | CODE |
| LOW | test/nemoclaw-start-gateway.test-helpers.ts | 43 | export function extractGatewayLogAppendFunction(src: string, gatewayLog: string): string { | CODE |
| LOW | test/messaging-plan-test-helper.ts | 59 | export function withLegacyMessagingPlanEnv( | CODE |
| LOW | test/messaging-plan-test-helper.ts | 78 | export async function withLegacyMessagingPlanEnvDirect( | CODE |
| LOW | …ler-integration/install-station-resume-cleanup.test.ts | 18 | function writeStationExpressInstallerResume(mode: "express" | "provider") { | CODE |
| LOW | …ller-integration/install-openshell-version-pin.test.ts | 135 | function createFakeStickyOpenshell(binDir: string, version: string): void { | CODE |
| LOW | …r-integration/install-station-host-preparation.test.ts | 42 | function runNonInteractiveStationSelector(home: string) { | CODE |
| LOW | test/installer-integration/install-preflight.test.ts | 40 | function runFailedSessionPromptChoice(answer: string) { | CODE |
| LOW | test/installer-integration/install-preflight.test.ts | 2038 | function callEnsureSupportedRuntime( | CODE |
| LOW | test/installer-integration/install-preflight.test.ts | 2834 | function runInstallerWithPipedStdinAndTty(answer: string) { | CODE |
| LOW | test/installer-integration/install-preflight.test.ts | 2838 | function runInstallerWithInteractiveStdin(answer: string) { | CODE |
| LOW | …t/installer-integration/install-express-prompt.test.ts | 120 | function detectExpressPlatformForProductName(productName: string) { | CODE |
| LOW | …t/installer-integration/install-express-prompt.test.ts | 124 | function detectExpressPlatformForStockDgxRelease(productName: string, dgxRelease: string) { | CODE |
| LOW | …-integration/install-station-vllm-continuation.test.ts | 27 | function runStationPreparationSourced(body: string) { | CODE |
| LOW | …ller-integration/install-station-package-state.test.ts | 30 | function runRealApplyPackagePreflight(body: string) { | CODE |
| LOW | …ler-integration/install-hermes-forward-restore.test.ts | 144 | function seedInactiveLegacyWatcher(h: ReturnType<typeof fixture>): void { | CODE |
| LOW | …ler-integration/install-express-noninteractive.test.ts | 13 | function expectCiQualificationHelp(installer: string) { | CODE |
| LOW | …nstaller-integration/install-managed-cli-reuse.test.ts | 82 | function setupGroupAccessibleStateRoot({ home }: Parameters<InitialStateSetup>[0]) { | CODE |
| LOW | …nstaller-integration/install-managed-cli-reuse.test.ts | 93 | function runManagedCliInstallTwice({ | CODE |
| LOW | test/repository/cli-coverage-sequencer.test.ts | 51 | function currentCliCoverageEntries(): WeightedShardEntry<string>[] { | CODE |
| LOW | test/repository/workflow-vitest-paths.test.ts | 17 | function collectWorkflowTestReferences(workflowRoots: readonly string[]) { | CODE |
| LOW | …t/repository/github-actions-node-npm-invariant.test.ts | 117 | function runsSanitizedReviewedNpmBootstrap(step: Step): boolean { | CODE |
| LOW | test/install/install-openshell-gateway-service.test.ts | 122 | function writeUpstreamSystemctlStub( | CODE |
| LOW | test/install/install-openshell-gateway-service.test.ts | 167 | function writeQualifiedDefaultPortActivation(home: string) { | CODE |
| LOW | test/install/install-openshell-gateway-service.test.ts | 196 | function writeUnavailableUserManagerStub(home: string) { | CODE |
| LOW | test/install/install-agent-alias-parity.test.ts | 30 | function installerCanonicalAgentName(input: string): string { | CODE |
| LOW | test/install/install-openshell-upgrade-prompt.test.ts | 39 | async function runInstallerOpenshellVersionFlow( | CODE |
| LOW | test/install/install-openshell-upgrade-prompt.test.ts | 124 | async function runPreinstallUpgradeGuard( | CODE |
| LOW | test/install/dev-setup-doctor.test.ts | 43 | function writeUnsupportedPythonTools(fakeBin: string): void { | CODE |
| LOW | test/install/install-orphaned-sandbox-recovery.test.ts | 38 | function runRecoveryClassification( | CODE |
| LOW | test/install/install-orphaned-sandbox-recovery.test.ts | 107 | function runStrictBackupRecoveryFlow(): { output: string; cleanup: () => void } { | CODE |
| LOW | test/install/install-onboard-exit.test.ts | 54 | function runOnboardInterruptedStatus(env: Record<string, string>): number | null { | CODE |
| LOW | test/install/uninstall.test.ts | 102 | function seedManagedHermesStateVolume(tmp: string): string { | CODE |
| LOW | test/install/uninstall.test.ts | 110 | function seedCompletedDefaultAuthority( | CODE |
| LOW | test/install/uninstall.test.ts | 201 | function writeManagedHermesVolumeDocker(fakeBin: string, tmp: string) { | CODE |
| LOW | test/install/uninstall.test.ts | 241 | function writeManagedGatewayConfig(tmp: string): string { | CODE |
| LOW | test/install/uninstall.test.ts | 262 | function startManagedGatewayProcess(tmp: string): ChildProcess { | CODE |
| LOW | test/install/uninstall.test.ts | 289 | function startPackagedGatewayProcess( | CODE |
| LOW | test/install/install-onboard-yes.test.ts | 591 | function runDeferredOnboardingMain(options: DeferredOnboardingMainOptions = {}) { | CODE |
| LOW | test/install/reviewed-npm-archive.test.ts | 106 | function cachedArchivePackResponse( | CODE |
| LOW | test/install/patch-bundled-npm-brace-expansion.test.ts | 62 | function expectAffectedTreeUnchanged(target: ReturnType<typeof fixture>): void { | CODE |
| LOW | test/install/install-openshell-macos-upgrade.test.ts | 17 | function runDarwinGatewayProcessStop( | CODE |
| LOW | test/install/install-openshell-macos-upgrade.test.ts | 229 | function runVerifiedHomebrewInstallSelection( | CODE |
| LOW | test/install/install-openshell-macos-upgrade.test.ts | 283 | function runVerifiedStandaloneInstallSelection( | CODE |
| LOW | test/install/install-openshell-macos-upgrade.test.ts | 331 | function runDarwinGatewayServiceStop( | CODE |
| LOW | test/install/install-openshell-macos-upgrade.test.ts | 447 | function runDarwinRetirementFallback() { | CODE |
| LOW | test/install/native-security-packages.test.ts | 104 | function runPythonFixPackageHarness(architecture: "amd64" | "arm64", sourceHashFailure = false) { | CODE |
| LOW⚡ | …st/install/installer-supervisor-manifest-trust.test.ts | 56 | function selectSharedGatewayStateResolver(source: string): string { | CODE |
| LOW⚡ | …st/install/installer-supervisor-manifest-trust.test.ts | 57 | const localResolver = ` function getDockerDriverGatewayStateDir(): string { | CODE |
| LOW⚡ | …st/install/installer-supervisor-manifest-trust.test.ts | 63 | const sharedResolver = ` function getDockerDriverGatewayStateDir(): string { | CODE |
| LOW | …st/install/installer-supervisor-manifest-trust.test.ts | 77 | function selectThreadGroupExecutableRuntime(source: string): string { | CODE |
| LOW | …st/install/installer-supervisor-manifest-trust.test.ts | 110 | function writeRegularSupervisorRuntime(runtimePath: string, source: string): void { | CODE |
| LOW | …st/install/installer-supervisor-manifest-trust.test.ts | 114 | function writeSymlinkedSupervisorRuntime(runtimePath: string, source: string): void { | CODE |
| LOW | …st/install/installer-supervisor-manifest-trust.test.ts | 377 | " function getOpenShellDockerSupervisorImage(", | CODE |
| LOW | …st/install/installer-supervisor-manifest-trust.test.ts | 382 | function getOpenShellDockerSupervisorImage(`, | CODE |
| LOW | test/install/install-npm-resolution.test.ts | 107 | function normalizeShellPathForAssert(value: string): string { | CODE |
| 7966 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/installer-integration/install-downgrade-guard.test.ts | 134 | elif [[ "${targetVersion}" == annotated-* ]]; then | CODE |
| HIGH | …/installer-integration/install-downgrade-guard.test.ts | 138 | elif [[ "${targetVersion}" == 'many-tags' ]]; then | CODE |
| HIGH | test/install/dev-setup-doctor.test.ts | 138 | elif [ "\${1:-}" = "${repo}/bin/nemoclaw.js" ] && [ "\${2:-}" = "onboard" ]; then | CODE |
| HIGH | test/install/dev-setup-doctor.test.ts | 140 | elif [[ "\${1:-}" == */scripts/lib/openshell-sdk-install.mts ]]; then | CODE |
| HIGH⚡ | test/install/dev-setup-doctor.test.ts | 153 | elif [ "\${FAKE_NPM_ROOT_INSTALL_FAIL:-}" = "1" ] && [ "\${1:-}" = "install" ]; then | CODE |
| HIGH⚡ | test/install/dev-setup-doctor.test.ts | 155 | elif [ "\${FAKE_NPM_PLUGIN_INSTALL_FAIL:-}" = "1" ] && [ "\${1:-}" = "--prefix" ] && [ "\${2:-}" = "nemoclaw" ] && [ "\$ | CODE |
| HIGH⚡ | test/install/dev-setup-doctor.test.ts | 157 | elif [ "\${FAKE_NPM_CLI_TYPECHECK_OOM:-}" = "1" ] && [ "\${1:-}" = "run" ] && [ "\${2:-}" = "typecheck:cli" ]; then | CODE |
| HIGH | test/install/dev-setup-doctor.test.ts | 225 | elif [ "\${1:-}" = "auth" ] && [ "\${2:-}" = "status" ]; then | CODE |
| HIGH⚡ | test/install/install-cdi-repair.test.ts | 72 | return False | CODE |
| HIGH⚡ | test/install/install-cdi-repair.test.ts | 75 | return True | CODE |
| HIGH⚡ | test/install/install-cdi-repair.test.ts | 78 | return True | CODE |
| HIGH⚡ | test/install/install-cdi-repair.test.ts | 80 | return False | CODE |
| HIGH | …t/install/install-preexisting-sandbox-recovery.test.ts | 126 | elif [ "${options.orphanedRecovery ? "1" : "0"}" = "1" ]; then | CODE |
| HIGH | …e-runtime/image-compatibility-docker-lifecycle.test.ts | 72 | elif [[ "\${1:-}" == "rm" && "\${2:-}" == "-f" ]]; then | CODE |
| HIGH | test/e2e-runtime/pull-public-exact-digest.test.ts | 121 | elif [ "$SCENARIO" = "late-success" ]; then | CODE |
| HIGH | …st/platform/images/publish-base-image-manifest.test.ts | 64 | elif [[ "$1" == *"${SHA_AMD64}"* ]]; then | CODE |
| HIGH⚡ | test/runtime/gateway/startup-process-identity.test.ts | 127 | elif namespace_access == "child_only": | CODE |
| HIGH⚡ | test/runtime/gateway/startup-process-identity.test.ts | 135 | return None | CODE |
| HIGH | test/runtime/gateway/startup-process-identity.test.ts | 275 | print(json.dumps(proof)) | CODE |
| HIGH | …gents/openclaw/openclaw-device-approval-policy.test.ts | 39 | print(json.dumps(payload, default=lambda value: sorted(value))) | CODE |
| HIGH | …gents/openclaw/openclaw-device-approval-policy.test.ts | 63 | print(json.dumps(result, sort_keys=True)) | CODE |
| HIGH | …gents/openclaw/openclaw-device-approval-policy.test.ts | 84 | print(json.dumps(result, sort_keys=True)) | CODE |
| HIGH | …gents/openclaw/runtime/auto-pair-settlement-fixture.ts | 120 | elif [ "$count" -le 6 ]; then printf '%s\n' ${JSON.stringify(browserPaired)} | CODE |
| HIGH | …gents/openclaw/runtime/auto-pair-settlement-fixture.ts | 121 | elif [ "$count" -le 10 ]; then printf '%s\n' ${JSON.stringify(lateCli)} | CODE |
| HIGH | …law/runtime/nemoclaw-start-auto-pair-bootstrap.test.ts | 138 | elif [ "$phase" = "scope-upgrade-pending" ]; then printf '%s\n' ${JSON.stringify(pendingList)} | CODE |
| HIGH | …law/runtime/nemoclaw-start-auto-pair-bootstrap.test.ts | 1154 | elif [ "$count" -eq 2 ]; then | CODE |
| HIGH | …law/runtime/nemoclaw-start-auto-pair-bootstrap.test.ts | 1156 | elif [ "$count" -eq 3 ]; then | CODE |
| HIGH⚡ | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 602 | return True, type(error).__name__ | CODE |
| HIGH⚡ | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 603 | return False, "none" | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 65 | print(json.dumps(errors)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 132 | print(json.dumps(results)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 161 | print(json.dumps(errors)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 188 | print(json.dumps({"ok": True})) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 239 | print(json.dumps({ | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 304 | print(json.dumps(accepted)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 365 | print(json.dumps({"exit_code": module.main()})) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 429 | print(json.dumps({"results": results, "null_result": null_result})) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 481 | print(json.dumps({"exit_code": module.main()})) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 513 | print(json.dumps([ | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 537 | print(str(error)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 740 | print(json.dumps(results, sort_keys=True)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 819 | print(json.dumps(errors)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 846 | print(str(error)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 870 | print(str(error)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 900 | print(str(error)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 910 | print(str(error)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 966 | print(json.dumps({ | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1008 | print(str(error)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1075 | print(json.dumps({ | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1115 | print(json.dumps({str(pid): module._is_trusted_gateway_process(pid) for pid in arguments})) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1161 | return True | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1179 | return True | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1191 | return True, "waiting-for-stable-replacement-identity" | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1203 | print(json.dumps(observed, sort_keys=True)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1281 | print(json.dumps({"changed": changed})) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1323 | print(json.dumps(errors)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1357 | print(json.dumps(errors)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1377 | print(json.dumps({str(pid): module._is_service_manager_process(pid) for pid in arguments})) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1409 | print(json.dumps(result, sort_keys=True)) | CODE |
| HIGH | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 1475 | print(json.dumps({"error": str(error), "signals": signals})) | CODE |
| 607 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .pre-commit-config.yaml | 45 | # ── Priority 0: general file fixers ─────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 62 | # ── Priority 0: reject force-added ignored files ─────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 87 | # ── Priority 3: sync generated docs before read-only validation ─────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 98 | # ── Priority 5: formatters ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 122 | # ── Priority 6: auto-fix after formatting ───────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 142 | # ── Priority 10: linters and validation ───────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 245 | # ── commit-msg hooks ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 254 | # ── pre-push hooks ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 296 | # ── post-merge / post-checkout: warn about stale compiled dist/ ─────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 312 | # ── Priority 20: project-level checks (full coverage is manual) ──────────── | COMMENT |
| MEDIUM | test/e2e-non-root-smoke.sh | 116 | # ── Summary ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 89 | # ── Test 1: Default port works through real entrypoint ────────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 99 | # ── Test 2: Valid port override accepted by real entrypoint ───── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 109 | # ── Test 3: Non-numeric port rejected by real entrypoint ──────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 114 | # ── Test 4: Privileged port rejected by real entrypoint ───────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 119 | # ── Test 5: Port above 65535 rejected by real entrypoint ──────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 124 | # ── Test 6: Pattern injection rejected by real entrypoint ─────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 148 | # ── Test 8: Node.js ports module rejects invalid port ─────────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 160 | # ── Test 9: Boundary port 1024 accepted by real entrypoint ────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 180 | # ── Test 11: NIM maps host port to fixed internal 8000 ────────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 198 | # ── Test 12: docker port queries container internal 8000 ──────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 216 | # ── Test 13: Entrypoint has fail-fast validation block ────────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 229 | # ── Summary ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 23 | # ── Helpers ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 39 | # ── Copy the guard JS preload source ───────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 55 | # ── Test runner ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 70 | # ══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 72 | # ══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 88 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 104 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 120 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 134 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 148 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 163 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 176 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 192 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 206 | # ══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/local-slack-auth-test.sh | 208 | # ══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-sandbox-tar-traversal.test.ts | 20 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-sandbox-tar-traversal.test.ts | 22 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/security/security-sandbox-tar-traversal.test.ts | 154 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/security/security-sandbox-tar-traversal.test.ts | 156 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/security/security-sandbox-tar-traversal.test.ts | 162 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-sandbox-tar-traversal.test.ts | 193 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-sandbox-tar-traversal.test.ts | 195 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-c2-dockerfile-injection.test.ts | 40 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-c2-dockerfile-injection.test.ts | 42 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-c2-dockerfile-injection.test.ts | 77 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-c2-dockerfile-injection.test.ts | 79 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-c2-dockerfile-injection.test.ts | 120 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security/security-c2-dockerfile-injection.test.ts | 122 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/agents/agents-manifest-policy-conformance.test.ts | 68 | // ─── OpenClaw policy mirror ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …w/runtime/nemoclaw-start-shared-state-topology.test.ts | 40 | "# ── Main ─────────────────────────────────────────────────────────", | CODE |
| MEDIUM | …w/runtime/nemoclaw-start-shared-state-topology.test.ts | 66 | "# ── Main ─────────────────────────────────────────────────────────", | CODE |
| MEDIUM | test/package-contract/ssrf-parity.test.ts | 88 | // ── Schema checks ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/package-contract/ssrf-parity.test.ts | 137 | // ── Boundary parity ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/package-contract/ssrf-parity.test.ts | 391 | // ── Wrapper-level cases (bracket handling, cross-family, DNS) ─────── | COMMENT |
| MEDIUM | test/inference/ollama/ollama-tools-capability.test.ts | 218 | // ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/inference/ollama/ollama-tools-capability.test.ts | 230 | // ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/inference/ollama/ollama-tools-capability.test.ts | 533 | // ───────────────────────────────────────────────────────────────── | COMMENT |
| 240 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL⚡ | …ts/openclaw/openclaw-slack-deny-feedback-patch.test.ts | 53 | "\t\tawait params.ctx.app.client.chat.postEphemeral({ text: SLACK_CHANNEL_ACCESS_DOCS_URL });", | CODE |
| CRITICAL | test/onboarding/vllm-export-docker-format.test.ts | 24 | fixture.objects.container.HostConfig.Ulimits.reverse(); | CODE |
| CRITICAL | test/onboarding/vllm-export-docker-format.test.ts | 38 | fixture.objects.container.Config.Env.unshift("HF_HOME=/root/.cache/huggingface"); | CODE |
| CRITICAL | test/onboarding/vllm-export-docker-format.test.ts | 56 | ["command", (f: Fixture) => f.objects.container.Config.Cmd.push("--unrepresented")], | CODE |
| CRITICAL | test/onboarding/vllm-export-docker-format.test.ts | 59 | (f: Fixture) => f.objects.container.Config.Env.push('INJECTION={{printf "unsafe"}}'), | CODE |
| CRITICAL | test/onboarding/vllm-export-docker-format.test.ts | 104 | fixture.objects.image.Config.Env.push(literal); | CODE |
| CRITICAL | test/onboarding/vllm-export-docker-format.test.ts | 105 | fixture.objects.container.Config.Env.push(literal, literal); | CODE |
| CRITICAL | test/generation/providerless-agent-config.test.ts | 266 | deps.calls.captureOpenshell.mock.calls.some( | CODE |
| CRITICAL | test/channels/channels-remove-full-teardown.test.ts | 692 | messagingPlanUpdate.updates.messaging.plan.channels.map( | CODE |
| CRITICAL | …board/setup-nim-flow-managed-llama-cpp-profile.test.ts | 668 | estimatedModelDownloadBytes: expectedSelection.recipe.spec.model.files.reduce( | CODE |
| CRITICAL⚡ | …oard/experimental/portable-demo-lifecycle-stop.test.ts | 250 | const commands = harness.runtime.podman.mock.calls.map(([args]) => | CODE |
| CRITICAL | …oard/experimental/portable-demo-lifecycle-stop.test.ts | 278 | harness.runtime.podman.mock.calls.some(([args]) => { | CODE |
| CRITICAL | …oard/experimental/portable-demo-lifecycle-stop.test.ts | 295 | harness.runtime.podman.mock.calls.some(([args]) => { | CODE |
| CRITICAL | …oard/experimental/portable-demo-lifecycle-stop.test.ts | 338 | harness.runtime.podman.mock.calls.some(([args]) => { | CODE |
| CRITICAL | …runtime-provider/docker-llama-cpp-managed-lifecycle.ts | 581 | `models--${options.plan.acquisition.source.repository.replaceAll("/", "--")}`, | CODE |
| CRITICAL | …runtime-provider/docker-llama-cpp-managed-lifecycle.ts | 588 | `models--${options.plan.acquisition.source.repository.replaceAll("/", "--")}`, | CODE |
| CRITICAL | …ine/handlers/sandbox-checkpoint-crash-recovery.test.ts | 1193 | expect(resumedRun.calls.error.mock.calls.flat().join("\n")).toContain("--recreate-sandbox"); | CODE |
| CRITICAL | …ine/handlers/sandbox-checkpoint-crash-recovery.test.ts | 1398 | resumedRun.calls.updateSandbox.mock.calls.some(([, updates]) => | CODE |
| CRITICAL | src/lib/adapters/sandbox/command-transport.test.ts | 127 | deps.commandExecutor.runBuffered.mock.calls.map(([request]) => request.timeoutMilliseconds), | CODE |
| CRITICAL | src/lib/actions/inference-set-hermes-run.test.ts | 251 | const logs = deps.calls.log.mock.calls.map((call) => String(call[0])).join("\n"); | CODE |
| CRITICAL | src/lib/actions/inference-set-hermes-run.test.ts | 346 | const logs = deps.calls.log.mock.calls.map((call) => String(call[0])); | CODE |
| CRITICAL | src/lib/actions/inference-set-hermes-run.test.ts | 415 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL | …/lib/actions/inference-set-compatible-provider.test.ts | 1248 | deps.calls.captureOpenshell.mock.calls.some( | CODE |
| CRITICAL | …c/lib/actions/inference-set-no-auth-compatible.test.ts | 260 | expect(deps.calls.log.mock.calls.flat().join("\n")).toMatch( | CODE |
| CRITICAL | …actions/inference-set-openclaw-gateway-restart.test.ts | 301 | expect(deps.calls.log.mock.calls.map(([line]) => String(line)).join("\n")).not.toContain( | CODE |
| CRITICAL | …actions/inference-set-openclaw-gateway-restart.test.ts | 362 | expect(deps.calls.log.mock.calls.map(([line]) => String(line)).join("\n")).not.toContain( | CODE |
| CRITICAL | …actions/inference-set-openclaw-gateway-restart.test.ts | 458 | expect(deps.calls.log.mock.calls.map(([line]) => String(line)).join("\n")).not.toContain( | CODE |
| CRITICAL | src/lib/actions/inference-set-openclaw-run.test.ts | 399 | const departureUpdate = deps.calls.updateSandbox.mock.calls.find( | CODE |
| CRITICAL | src/lib/actions/inference-set-openclaw-run.test.ts | 726 | deps.calls.captureOpenshell.mock.calls.filter( | CODE |
| CRITICAL | src/lib/actions/inference-set-degraded-state.test.ts | 49 | const routeSetCalls = deps.calls.captureOpenshell.mock.calls.filter( | CODE |
| CRITICAL | src/lib/actions/inference-set-degraded-state.test.ts | 91 | const logged = deps.calls.log.mock.calls.map((args) => String(args[0])).join("\n"); | CODE |
| CRITICAL | src/lib/actions/inference-set-degraded-state.test.ts | 191 | deps.calls.captureOpenshell.mock.calls.map(([args]) => args.slice(0, 2)), | CODE |
| CRITICAL | src/lib/actions/inference-set-degraded-state.test.ts | 194 | deps.calls.captureOpenshell.mock.calls.map(([args]) => args.slice(0, 2)), | CODE |
| CRITICAL | src/lib/actions/inference-set-local-provider.test.ts | 71 | const logged = deps.calls.log.mock.calls.map((a) => String(a[0])).join("\n"); | CODE |
| CRITICAL | …ctions/inference-set-gateway-route-containment.test.ts | 112 | const messages = deps.calls.log.mock.calls.map(([message]) => message); | CODE |
| CRITICAL | …ctions/inference-set-gateway-route-containment.test.ts | 729 | deps.calls.captureOpenshell.mock.calls.filter( | CODE |
| CRITICAL | …ctions/inference-set-gateway-route-containment.test.ts | 738 | deps.calls.log.mock.calls.some(([message]) => | CODE |
| CRITICAL | src/lib/actions/inference-set-context-window.test.ts | 44 | const logged = deps.calls.log.mock.calls.map((a) => String(a[0])).join("\n"); | CODE |
| CRITICAL | src/lib/actions/inference-set-context-window.test.ts | 55 | const logged = deps.calls.log.mock.calls.map((a) => String(a[0])).join("\n"); | CODE |
| CRITICAL | src/lib/actions/inference-set-context-window.test.ts | 86 | const logged = deps.calls.log.mock.calls.map((a) => String(a[0])).join("\n"); | CODE |
| CRITICAL | …/inference/serving/managed-cluster-materialize.test.ts | 363 | selection.recipe.spec.serve.arguments.forEach((argument) => { | CODE |
| CRITICAL | …ib/inference/serving/host-local-vllm-selection.test.ts | 156 | selection.recipe.spec.serve.arguments.find(({ name }) => name === "--gpu-memory-utilization") | CODE |
| CRITICAL | …ib/inference/serving/managed-cluster-installer.test.ts | 296 | selection.recipe.spec.serve.arguments.find(({ name }) => name === "--port")?.value, | CODE |
| CRITICAL | …ib/inference/serving/managed-cluster-installer.test.ts | 399 | selection.recipe.spec.serve.arguments.find(({ name }) => name === "--port")?.value, | CODE |
| CRITICAL | src/lib/inference/llama-cpp/managed-selection.ts | 65 | const requiresDocker = selection.preset.spec.requirements.all.some( | CODE |
| CRITICAL | src/lib/inference/llama-cpp/managed-selection.ts | 168 | left.selection.preset.metadata.id.localeCompare(right.selection.preset.metadata.id), | CODE |
| CRITICAL | src/lib/inference/llama-cpp/managed-selection.ts | 361 | left.selection.preset.metadata.id.localeCompare(right.selection.preset.metadata.id), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .markdownlint-cli2.yaml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | .pre-commit-config.yaml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | vitest.config.ts | 261 | name: "e2e-live", | COMMENT |
| LOW | test/e2e-non-root-smoke.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | test/e2e-non-root-smoke.sh | 21 | # CAVEAT: no-new-privileges ≠ Landlock. We catch #2472-class bugs only | COMMENT |
| LOW | test/e2e-port-overrides.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | test/local-slack-auth-test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | test/installer-integration/install-preflight.test.ts | 2181 | // Source scripts/install.sh and invoke show_usage_notice in a fresh | COMMENT |
| LOW | test/install/uninstall-prompt-pty.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/security/security-sandbox-tar-traversal.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/security/strict-tool-call-probe.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/networking/host-proxy-inference-local-e2e.test.ts | 41 | const curlOk = curlAvailable(); | COMMENT |
| LOW | test/networking/corporate-ca-tls-e2e.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/networking/http-proxy-fix-e2e.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/networking/http-proxy-fix-rewrite.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …networking/tunnel-gateway-port-release-runtime.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/runtime/sandbox/reboot-identity-drift.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/runtime/messaging/wechat-diagnostics.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | test/runtime/messaging/whatsapp-qr-compact.test.ts | 21 | "whatsapp-qr-compact.ts", | COMMENT |
| LOW | test/runtime/messaging/telegram-diagnostics.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | test/runtime/policy/policy-tiers.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …t/runtime/policy/repro-5978-policy-denial-hint.test.ts | 41 | // sandbox base image — the image's own /etc/profile.d + /etc/bash.bashrc hooks | COMMENT |
| LOW | …t/runtime/policy/repro-5978-policy-denial-hint.test.ts | 81 | // Run a snippet under a pseudo-terminal so `[ -t 2 ]` is true and the shell is | COMMENT |
| LOW | …t/runtime/gateway/gateway-state-reconcile-2276.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | test/runtime/gateway/gateway-http-reuse-wait.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/agents/agents-manifest-policy-conformance.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | …openclaw/runtime/nemoclaw-start-gateway-marker.test.ts | 61 | describe("nemoclaw-start in-container gateway healthcheck marker (#4503, #4710)", () => { | COMMENT |
| LOW | …openclaw/runtime/nemoclaw-start-gateway-marker.test.ts | 261 | expect(result.status).toBe(0); | COMMENT |
| LOW | …st/agents/hermes/hermes-wrapper-provider-merge.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/agents/hermes/hermes-gateway-wrapper.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/agents/hermes/hermes-gateway-wrapper.test.ts | 1001 | expect(result.stdout).toContain("'api_key': 'sk-****'"); | COMMENT |
| LOW | …t/agents/deepagents/dcode-wrapper-empty-prompt.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/cli/exit-code-user-error-surfaces.test.ts | 201 | }, | COMMENT |
| LOW | test/cli/repro-2666-silent-list-status.test.ts | 141 | // Fallback synthesizes recovery flags so downstream rendering treats the | COMMENT |
| LOW | test/package-contract/ssrf-parity.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …/inference/ollama/ollama-auth-proxy-bind-probe.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/inference/ollama/ollama-tools-capability.test.ts | 521 | rawError: "connection refused", | COMMENT |
| LOW | test/inference/ollama/ollama-auth-proxy-handler.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …/e2e/e2e-cloud-experimental/openclaw-tui-in-sandbox.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/e2e/e2e-cloud-experimental/check-docs.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | test/e2e/e2e-cloud-experimental/check-docs.sh | 221 | # ── Phase 3/3: flag-level parity (NemoClaw#3224) ────────────────────────── | COMMENT |
| LOW | test/e2e/e2e-cloud-experimental/check-docs.sh | 541 | fi | COMMENT |
| LOW | test/e2e/e2e-cloud-experimental/cleanup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …erimental/checks/04-deepagents-code-fresh-reonboard.sh | 361 | pass "live dcode identity preserves the selected model" | COMMENT |
| LOW | …xperimental/checks/06-deepagents-code-python-egress.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …xperimental/checks/11-deepagents-code-observability.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …2e/e2e-cloud-experimental/checks/03-security-checks.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …/e2e-cloud-experimental/checks/04-landlock-readonly.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …al/checks/03-deepagents-code-nemotron-ultra-profile.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …ntal/checks/12-deepagents-code-thread-auto-approval.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …mental/checks/07-deepagents-code-headless-inference.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …-experimental/checks/10-deepagents-code-tui-startup.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …ental/features/skill/verify-sandbox-skill-via-agent.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/e2e/support/messaging-endpoint-classifiers.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/e2e/support/fixture-umask-normalization.test.ts | 21 | COMMENT | |
| LOW | test/e2e/support/skill-agent-classifiers.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/e2e/live/inference-routing.test.ts | 881 | model, | COMMENT |
| LOW | test/e2e/live/onboard-interactive-pty.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/e2e/live/onboard-policy-preset-sequencing.test.ts | 21 | // does not reproduce the raw-mode selectors this wizard uses) and asserts | COMMENT |
| LOW | test/e2e/registry/expected-states.ts | 101 | // switch on emission without touching target data. "optional" | COMMENT |
| 273 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 598 | def blocked(operation): | CODE |
| LOW⚡ | …st/agents/hermes/hermes-mcp-config-transaction.test.ts | 601 | except Exception as error: | CODE |
| LOW | …hermes/hermes-mcp-credential-boundary-manifest.test.ts | 47 | except Exception as error: | CODE |
| LOW | …t/agents/hermes/hermes-profile-policy-defaults.test.ts | 131 | except Exception: | CODE |
| MEDIUM | …t/agents/hermes/hermes-profile-policy-defaults.test.ts | 128 | def _resolve_pre_update_backup_mode(args=None): | CODE |
| LOW | test/agents/hermes/hermes-mcp-api-port.test.ts | 147 | except Exception as error: | CODE |
| LOW | test/agents/hermes/hermes-mcp-api-port.test.ts | 220 | except Exception as error: | CODE |
| LOW | test/agents/hermes/hermes-mcp-api-port.test.ts | 364 | except Exception as error: | CODE |
| LOW⚡ | test/agents/hermes/hermes-mcp-apply-race.test.ts | 359 | except Exception as exc: | CODE |
| LOW⚡ | test/agents/hermes/hermes-mcp-apply-race.test.ts | 459 | except Exception as exc: | CODE |
| LOW⚡ | test/agents/hermes/hermes-mcp-apply-race.test.ts | 466 | except Exception as exc: | CODE |
| LOW | test/agents/hermes/hermes-mcp-apply-race.test.ts | 134 | except Exception as exc: | CODE |
| LOW | test/agents/hermes/hermes-mcp-apply-race.test.ts | 285 | except Exception as exc: | CODE |
| LOW | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 494 | except Exception: | CODE |
| LOW | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 538 | except Exception as exc: | CODE |
| LOW | …in-deepagents-code-progressive-tool-disclosure.test.ts | 326 | except Exception as e: | CODE |
| MEDIUM | …in-deepagents-code-progressive-tool-disclosure.test.ts | 323 | def run_non_interactive(*args, **kwargs): | CODE |
| LOW | …xperimental/checks/09-deepagents-code-tavily-opt-in.sh | 105 | except Exception: | CODE |
| LOW | …xperimental/checks/09-deepagents-code-tavily-opt-in.sh | 124 | except Exception as exc: | CODE |
| LOW | …xperimental/checks/06-deepagents-code-python-egress.sh | 75 | except Exception: | CODE |
| LOW | …xperimental/checks/06-deepagents-code-python-egress.sh | 94 | except Exception as exc: | CODE |
| LOW | …xperimental/checks/11-deepagents-code-observability.sh | 199 | except Exception as error: | CODE |
| LOW | test/e2e/live/hermes-discord.test.ts | 146 | except Exception as exc: | CODE |
| LOW⚡ | test/e2e/live/hermes-discord.test.ts | 259 | except Exception as exc: | CODE |
| LOW⚡ | test/e2e/live/hermes-slack-credential-transport.ts | 55 | except Exception: | CODE |
| LOW⚡ | test/e2e/live/hermes-slack-credential-transport.ts | 67 | except Exception: | CODE |
| LOW | …ive/bedrock-runtime-compatible-anthropic-leak-probe.py | 58 | except Exception: | CODE |
| LOW | …ive/bedrock-runtime-compatible-anthropic-leak-probe.py | 215 | except Exception: | CODE |
| LOW | …ive/bedrock-runtime-compatible-anthropic-leak-probe.py | 230 | except Exception: | CODE |
| LOW⚡ | test/e2e/live/hermes-slack-e2e-helpers.ts | 703 | except Exception: | CODE |
| LOW⚡ | test/e2e/live/hermes-slack-e2e-helpers.ts | 738 | except Exception as exc: | CODE |
| LOW⚡ | test/e2e/live/hermes-slack-e2e-helpers.ts | 749 | except Exception as exc: | CODE |
| LOW | test/e2e/live/hermes-slack-e2e-helpers.ts | 428 | except Exception as exc: | CODE |
| LOW | test/e2e/lib/issue-4462-fresh-agent-gateway-snapshot.py | 90 | except Exception: | CODE |
| MEDIUM | test/e2e/lib/issue-4462-fresh-agent-gateway-snapshot.py | 31 | def load_map(path): | CODE |
| LOW | test/e2e/lib/issue-4462-admin-request-selector.py | 129 | except Exception: | CODE |
| LOW | test/e2e/lib/issue-4462-admin-request-selector.py | 153 | except Exception: | CODE |
| LOW | test/helpers/langchain-deepagents-code-patch-fixture.ts | 761 | except Exception as e: | CODE |
| MEDIUM | agents/hermes/runtime-config-guard.py | 731 | def _startup_ready_marker_absent() -> bool: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 975 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 1055 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 1110 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 1114 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 1999 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2092 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2449 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2616 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2620 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2785 | except Exception as exc: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2873 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2878 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 3042 | except Exception as exc: | CODE |
| LOW | agents/hermes/cron-restore-control.py | 346 | except Exception as error: | CODE |
| LOW | agents/hermes/cron-restore-control.py | 351 | except Exception as error: | CODE |
| LOW | agents/hermes/cron-restore-control.py | 842 | except Exception as error: | CODE |
| LOW | agents/hermes/cron-restore-control.py | 933 | except Exception as error: | CODE |
| LOW | agents/hermes/cron-restore-control.py | 1008 | except Exception as release_error: | CODE |
| LOW | agents/hermes/migrate-dashboard-state.py | 330 | except Exception: | CODE |
| LOW | agents/hermes/migrate-dashboard-state.py | 1412 | except Exception: | CODE |
| LOW | agents/hermes/mcp-config-transaction.py | 917 | except Exception as hash_error: | CODE |
| 148 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …-update-dependencies/scripts/collect-release-ledger.py | 297 | except BrokenPipeError: | CODE |
| HIGH | …-update-dependencies/scripts/collect-release-ledger.py | 255 | except ProcessLookupError: | CODE |
| HIGH | …endencies/scripts/collect-hermes-release-supplement.py | 485 | except FileNotFoundError: | CODE |
| HIGH | agents/hermes/validate-env-secret-boundary.py | 131 | except KeyError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 2271 | except FileNotFoundError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 746 | except FileNotFoundError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 1764 | except FileExistsError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 1876 | except FileNotFoundError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 2530 | except FileNotFoundError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 1028 | except FileNotFoundError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 1058 | except FileNotFoundError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 1062 | except OSError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 2878 | except Exception: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 2101 | except OSError: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 2620 | except Exception: | CODE |
| HIGH | agents/hermes/runtime-config-guard.py | 1114 | except Exception: | CODE |
| HIGH | agents/hermes/hermes-wrapper.py | 206 | except OSError: | CODE |
| HIGH | agents/hermes/cron-restore-control.py | 484 | except FileExistsError: | CODE |
| HIGH | agents/hermes/managed_policy.py | 43 | except OSError: | CODE |
| HIGH | agents/hermes/mcp-config-transaction.py | 1530 | except ProcessLookupError: | CODE |
| HIGH | agents/hermes/plugin/__init__.py | 144 | except Exception: | CODE |
| HIGH | agents/hermes/plugin/__init__.py | 184 | except Exception: | CODE |
| HIGH | agents/hermes/plugin/__init__.py | 309 | except Exception: | CODE |
| HIGH | agents/hermes/plugin/__init__.py | 475 | except Exception: | CODE |
| HIGH | agents/hermes/plugin/__init__.py | 487 | except Exception: | CODE |
| HIGH | agents/hermes/plugin/__init__.py | 1094 | except Exception: | CODE |
| HIGH | agents/hermes/plugin/__init__.py | 436 | except Exception: | CODE |
| HIGH | agents/hermes/plugin/__init__.py | 692 | except Exception: | CODE |
| HIGH | …nts/langchain-deepagents-code/managed-dcode-runtime.py | 1238 | except OSError: | CODE |
| HIGH | …nts/langchain-deepagents-code/managed-dcode-runtime.py | 1409 | except OSError: | CODE |
| HIGH | …nts/langchain-deepagents-code/managed-dcode-runtime.py | 1471 | except OSError: | CODE |
| HIGH | …nts/langchain-deepagents-code/managed-dcode-runtime.py | 891 | except OSError: | CODE |
| HIGH | …nts/langchain-deepagents-code/managed-dcode-runtime.py | 897 | except OSError: | CODE |
| HIGH | …eepagents-code/validate-progressive-tool-disclosure.py | 258 | except ValidationError: | CODE |
| HIGH | …ts/langchain-deepagents-code/nemoclaw_observability.py | 935 | except Exception: # noqa: BLE001 - optional instrumentation is fail-open | CODE |
| HIGH | …ts/langchain-deepagents-code/nemoclaw_observability.py | 983 | except Exception: # noqa: BLE001 - optional instrumentation is fail-open | CODE |
| HIGH | …ts/langchain-deepagents-code/nemoclaw_observability.py | 1060 | except Exception: # noqa: BLE001 - optional instrumentation is fail-open | CODE |
| HIGH | …ts/langchain-deepagents-code/nemoclaw_observability.py | 1121 | except Exception: # noqa: BLE001 - optional instrumentation is fail-open | CODE |
| HIGH | …/langchain-deepagents-code/dcode-session-supervisor.py | 147 | except (ProcessLookupError, PermissionError): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …t/runtime/gateway/gateway-state-reconcile-2276.test.ts | 422 | // Step 3: routine connect must preserve the registry entry. | COMMENT |
| LOW | …t/runtime/gateway/gateway-state-reconcile-2276.test.ts | 433 | // Step 4: rebuild locates the stale registry entry but refuses to create a | COMMENT |
| LOW | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 21 | ## Step 1: Fetch candidate PRs | COMMENT |
| LOW | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 40 | ## Step 2: Extract linked issues | COMMENT |
| LOW | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 53 | ## Step 3: Detect duplicates | COMMENT |
| LOW | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 64 | ## Step 4: Check for superseded PRs | COMMENT |
| LOW | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 100 | ## Step 5: Present results | COMMENT |
| LOW | …oclaw-maintainer-refactor-docs/references/structure.md | 4 | # Step 1: Inventory Before Editing | COMMENT |
| LOW | …oclaw-maintainer-refactor-docs/references/structure.md | 29 | ## Step 2: Design Around the User Journey | COMMENT |
| LOW | …oclaw-maintainer-refactor-docs/references/structure.md | 54 | ## Step 3: Establish Canonical Ownership | COMMENT |
| LOW | …claw-maintainer-refactor-docs/references/validation.md | 4 | # Step 7: Validate the Refactor | COMMENT |
| LOW | …claw-maintainer-refactor-docs/references/validation.md | 36 | ## Step 8: Run an Independent Docs Review | COMMENT |
| LOW | …oclaw-maintainer-refactor-docs/references/migration.md | 4 | # Step 4: Define the URL Migration Contract | COMMENT |
| LOW | …oclaw-maintainer-refactor-docs/references/migration.md | 35 | ## Step 5: Implement in a Content-Safe Order | COMMENT |
| LOW | …oclaw-maintainer-refactor-docs/references/migration.md | 50 | ## Step 6: Run a Readability Pass | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 21 | ## Step 1: Parse the GitHub URL | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 48 | ## Step 2: Check Out the Code | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 66 | ## Step 3: Identify Changed Files | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 80 | ## Step 4: Read Each Changed File and Diff | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 96 | ## Step 5: Analyze Against the Security Rubric | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 108 | ## Step 6: Produce the Report | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 34 | ### Step 1: Parse issue | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 44 | ### Step 2: Discover candidate PRs | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 52 | ### Step 3: Detect supersession and transferred work | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 79 | ### Step 4: Tier 0 gates | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 96 | ### Step 5: Tier 1 correctness | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 100 | ### Step 6: Tier 2 quality | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 104 | ### Step 7: Weighted score | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 115 | ### Step 8: Tier 3 ranking | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 125 | ### Step 9: Emit verdict | COMMENT |
| LOW⚡ | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 35 | # Step 1: PRs that explicitly link the issue. | COMMENT |
| LOW⚡ | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 43 | # Step 2: Expand by files mentioned in issue body. | COMMENT |
| LOW | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 56 | # Step 3: Expand by title-token Jaccard. | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-morning/SKILL.md | 13 | ## Step 1: Determine Target Version and Stragglers | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-morning/SKILL.md | 21 | ## Step 2: Triage | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-morning/SKILL.md | 33 | ## Step 3: Label Version Targets | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-morning/SKILL.md | 43 | ## Step 4: Save State and Output the Plan | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 15 | ## Step 1: Load Canonical Policy | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 27 | ## Step 2: Determine Mode | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 53 | ## Step 3: Present the Dry Run | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 70 | ## Step 4: Apply Only the Accepted Write Set | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 88 | ## Step 5: Report | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/HOTSPOTS.md | 8 | ## Step 1: Run the Hotspot Script | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/HOTSPOTS.md | 23 | ## Step 2: Prioritize | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/HOTSPOTS.md | 28 | ## Step 3: Select a change | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/HOTSPOTS.md | 40 | ## Step 4: Keep Small | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/HOTSPOTS.md | 45 | ## Step 5: Validate | COMMENT |
| LOW⚡ | .agents/skills/nemoclaw-maintainer-day/SEQUENCE-WORK.md | 8 | ## Step 1: Read the context | COMMENT |
| LOW⚡ | .agents/skills/nemoclaw-maintainer-day/SEQUENCE-WORK.md | 16 | ## Step 2: List related changes | COMMENT |
| LOW⚡ | .agents/skills/nemoclaw-maintainer-day/SEQUENCE-WORK.md | 21 | ## Step 3: Define Slices | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/SEQUENCE-WORK.md | 32 | ## Step 4: Rank | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/SEQUENCE-WORK.md | 40 | ## Step 5: Output | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/TEST-GAPS.md | 10 | ## Step 1: Collect File Set | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/TEST-GAPS.md | 15 | ## Step 2: Map to Existing Tests | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/TEST-GAPS.md | 26 | ## Step 3: Select tests | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/TEST-GAPS.md | 37 | ## Step 4: Extract code when needed | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/TEST-GAPS.md | 48 | ## Step 5: Add Tests | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/TEST-GAPS.md | 56 | ## Step 6: Validate | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/TEST-GAPS.md | 67 | ## Step 7: Report remaining gaps | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-day/SKILL.md | 29 | ## Step 1: Check Version Progress | COMMENT |
| 43 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/support/setup-inference-test-harness.ts | 487 | // #9110: neutralize the GPU-release seams so harness consumers backed by | COMMENT |
| MEDIUM | …al/checks/03-deepagents-code-nemotron-ultra-profile.sh | 6 | # harness profile, and the installed managed resolver supplies the reviewed | COMMENT |
| MEDIUM | …-experimental/checks/10-deepagents-code-tui-startup.sh | 256 | # complete sequence before returning a failed session to the shell harness. | COMMENT |
| MEDIUM | agents/langchain-deepagents-code/policy-additions.yaml | 5 | # default, allow the terminal harness, managed inference, and normal code-hosting | COMMENT |
| MEDIUM | agents/langchain-deepagents-code/policy-additions.yaml | 32 | # Deep Agents Code is a terminal coding harness, so filesystem policy must | COMMENT |
| MEDIUM | agents/langchain-deepagents-code/manifest.yaml | 5 | # This is a terminal-oriented harness: there is no long-running gateway or | COMMENT |
| MEDIUM | agents/langchain-deepagents-code/dcode-wrapper.sh | 681 | # state and therefore invalid in the managed harness. | COMMENT |
| MEDIUM | scripts/nemoclaw-start.sh | 2133 | # exit, timeout reduction, and token cleanup for a more comprehensive fix. | COMMENT |
| MEDIUM | scripts/nemoclaw-start.sh | 3964 | # is robust to every here-doc shape, not only the | COMMENT |
| MEDIUM | scripts/security/build-perl-security-packages.sh | 73 | # Remove this split only after the unsplit parallel harness passes in two | COMMENT |
| MEDIUM | scripts/security/build-perl-security-packages.sh | 93 | # harness -dumptests reports paths from the source root and removes ../. | COMMENT |
| MEDIUM | src/lib/actions/sandbox/policy-list-render.test.ts | 60 | // description, so keying off the marker+name is robust to that suffix. | COMMENT |
| MEDIUM | …c/lib/actions/sandbox/sessions/gateway-rpc-envelope.ts | 35 | // 1. Single-line JSON candidates in reverse order — robust to log noise | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …law-maintainer-pr-comparator/scripts/render-verdict.py | 38 | CODE | |
| LOW | …-maintainer-cross-issue-sweep/scripts/render-report.py | 36 | CODE | |
| LOW | …law-maintainer-verify-stale/scripts/redact-evidence.py | 7 | CODE | |
| LOW | …-update-dependencies/scripts/collect-release-ledger.py | 7 | CODE | |
| LOW | …endencies/scripts/collect-hermes-release-supplement.py | 7 | CODE | |
| LOW | agents/hermes/patch-mcp-http-proxy.py | 23 | CODE | |
| LOW | agents/hermes/validate-env-secret-boundary.py | 17 | CODE | |
| LOW | agents/hermes/patch-discord-recovery-permissions.py | 18 | CODE | |
| LOW | agents/hermes/image-build-probes.py | 6 | CODE | |
| LOW | agents/hermes/patch-gateway-runtime-metadata.py | 24 | CODE | |
| LOW | agents/hermes/patch-external-supervisor-recovery.py | 21 | CODE | |
| LOW | agents/hermes/patch-gateway-process-identity.py | 28 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 7 | CODE | |
| LOW | agents/hermes/patch-auxiliary-token-limit.py | 17 | CODE | |
| LOW | agents/hermes/finalize-tirith-marker.py | 5 | CODE | |
| LOW | agents/hermes/cron-restore-control.py | 20 | CODE | |
| LOW | agents/hermes/managed_policy.py | 5 | CODE | |
| LOW | agents/hermes/patch-cron-execution-runtime.py | 21 | CODE | |
| LOW | agents/hermes/migrate-dashboard-state.py | 14 | CODE | |
| LOW | agents/hermes/patch-session-list-preview.py | 28 | CODE | |
| LOW | agents/hermes/patch-hermes-sqlite-temp-store.py | 35 | CODE | |
| LOW | agents/hermes/patch-profile-policy-defaults.py | 39 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 25 | CODE | |
| LOW | agents/hermes/patch-cron-restore-drain.py | 24 | CODE | |
| LOW | agents/hermes/patch-external-supervisor-restart.py | 24 | CODE | |
| LOW | agents/hermes/plugin/test_register_tools.py | 16 | CODE | |
| LOW | agents/hermes/plugin/test_private_url_opt_in.py | 5 | CODE | |
| LOW | agents/hermes/plugin/test_private_url_opt_in.py | 10 | CODE | |
| LOW | …ain-deepagents-code/validate-nemotron-ultra-profile.py | 5 | CODE | |
| LOW | …nts/langchain-deepagents-code/managed-dcode-runtime.py | 6 | CODE | |
| LOW | …ts/langchain-deepagents-code/nemoclaw_read_only_mcp.py | 6 | CODE | |
| LOW | …ts/langchain-deepagents-code/validate-observability.py | 5 | CODE | |
| LOW | …eepagents-code/validate-progressive-tool-disclosure.py | 5 | CODE | |
| LOW | …nts/langchain-deepagents-code/patch-managed-quickjs.py | 5 | CODE | |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 5 | CODE | |
| LOW | …chain-deepagents-code/patch-managed-deepagents-code.py | 22 | CODE | |
| LOW | …/langchain-deepagents-code/validate-quickjs-runtime.py | 5 | CODE | |
| LOW | …/langchain-deepagents-code/dcode-session-supervisor.py | 5 | CODE | |
| LOW | …ile-plugin/src/nemoclaw_deepagents_profile/__init__.py | 5 | CODE | |
| LOW | scripts/generate-platform-docs.py | 19 | CODE | |
| LOW | scripts/e2e/sanitize-trace-timing.py | 19 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …-update-dependencies/scripts/collect-release-ledger.py | 265 | CODE | |
| LOW | …-update-dependencies/scripts/collect-release-ledger.py | 1506 | CODE | |
| LOW | agents/hermes/validate-env-secret-boundary.py | 179 | CODE | |
| LOW | agents/hermes/validate-cli-adapter.py | 89 | CODE | |
| LOW | agents/hermes/image-build-probes.py | 407 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 340 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 474 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 661 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 1089 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 1948 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 2276 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 2421 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 3029 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 3280 | CODE | |
| LOW | agents/hermes/hermes-wrapper.py | 162 | CODE | |
| LOW | agents/hermes/hermes-wrapper.py | 247 | CODE | |
| LOW | agents/hermes/hermes-wrapper.py | 581 | CODE | |
| LOW | agents/hermes/cron-restore-control.py | 628 | CODE | |
| LOW | agents/hermes/cron-restore-control.py | 751 | CODE | |
| LOW | agents/hermes/cron-restore-control.py | 1252 | CODE | |
| LOW | agents/hermes/migrate-dashboard-state.py | 185 | CODE | |
| LOW | agents/hermes/migrate-dashboard-state.py | 790 | CODE | |
| LOW | agents/hermes/migrate-dashboard-state.py | 1268 | CODE | |
| LOW | agents/hermes/migrate-dashboard-state.py | 1417 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 958 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 1060 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 1081 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 1462 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 1610 | CODE | |
| LOW | agents/hermes/plugin/__init__.py | 132 | CODE | |
| LOW | agents/hermes/plugin/__init__.py | 1024 | CODE | |
| LOW | …nts/langchain-deepagents-code/managed-dcode-runtime.py | 1251 | CODE | |
| LOW | …ts/langchain-deepagents-code/nemoclaw_read_only_mcp.py | 133 | CODE | |
| LOW | …ts/langchain-deepagents-code/nemoclaw_read_only_mcp.py | 149 | CODE | |
| LOW | …ts/langchain-deepagents-code/validate-observability.py | 776 | CODE | |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 1245 | CODE | |
| LOW | …chain-deepagents-code/patch-managed-deepagents-code.py | 1653 | CODE | |
| LOW | …ngchain-deepagents-code/validate-read-only-mcp-call.py | 252 | CODE | |
| LOW | …ngchain-deepagents-code/validate-read-only-mcp-call.py | 495 | CODE | |
| LOW | …/langchain-deepagents-code/dcode-session-supervisor.py | 31 | CODE | |
| LOW | …/langchain-deepagents-code/dcode-session-supervisor.py | 123 | CODE | |
| LOW | scripts/generate-platform-docs.py | 205 | CODE | |
| LOW | scripts/lib/refresh-openclaw-wechat-placeholder.py | 148 | CODE | |
| LOW | …essaging/channels/googlechat/runtime/hermes-adapter.py | 73 | CODE | |
| LOW | …essaging/channels/googlechat/runtime/hermes-adapter.py | 215 | CODE | |
| LOW | …essaging/channels/googlechat/runtime/hermes-adapter.py | 258 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/runtime/policy/policy-preset-picker.test.ts | 70 | // No `if`: changed test files may not add one (codebase-growth-guardrails). | COMMENT |
| MEDIUM | agents/openclaw/manifest.yaml | 7 | # level for backward compatibility. Phase 3 of the multi-agent plan will | COMMENT |
| MEDIUM | …ts/langchain-deepagents-code/nemoclaw_observability.py | 399 | # base64 pickle or attacker-controlled string output before guardrails | COMMENT |
| MEDIUM | scripts/nemoclaw-start.sh | 5362 | # Provision per-agent workspaces for multi-agent OpenClaw deployments. | COMMENT |
| MEDIUM | src/lib/onboard/host-proxy-env.ts | 76 | // entrypoint is line-budget-constrained per codebase-growth-guardrails. | COMMENT |
| MEDIUM | src/lib/actions/README.md | 18 | dns/index.ts # internal dns fix-coredns/setup-proxy orchestration | CODE |
| MEDIUM | src/lib/actions/README.md | 19 | dev/npm-link-or-shim.ts # prepare-time dev shim orchestration | CODE |
| MEDIUM | src/lib/inference/onboard-probes-curl-harness.ts | 11 | // codebase-growth-guardrails "if count" for *.test.ts stays flat; see PR | COMMENT |
| MEDIUM | src/lib/policy/index.ts | 2367 | // fresh sandbox whose unknown policy may be replaced with a scaffold. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-config.yaml | 12 | # Usage: | COMMENT |
| LOW | …/e2e/e2e-cloud-experimental/openclaw-tui-in-sandbox.sh | 13 | # Usage: | COMMENT |
| LOW | test/e2e/e2e-cloud-experimental/cleanup.sh | 9 | # Usage: | COMMENT |
| LOW | …r-cross-issue-sweep/scripts/search-candidate-issues.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/check-spdx-headers.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/debug.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/check-installer-hash.sh | 13 | # Usage: | COMMENT |
| LOW | scripts/start-services.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/update-hermes-agent.sh | 34 | # Usage: | COMMENT |
| LOW | scripts/update-docker-pin.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/walkthrough.sh | 30 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 108 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 371 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 413 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 453 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/agents/openclaw/runtime/nemoclaw-start.test.ts | 3360 | expect(hashContents).toBe("placeholder"); | CODE |
| LOW | test/e2e/live/channels-stop-start-googlechat-proof.ts | 86 | "placeholder": "revision-scoped", | CODE |
| LOW | test/e2e/live/inference-routing.test.ts | 135 | const compatibleKey = "fake-key-for-unreachable-test"; | CODE |
| LOW | test/e2e/live/inference-routing.test.ts | 897 | chatContent: "placeholder", | CODE |
| LOW | test/e2e/live/token-rotation.test.ts | 44 | telegram: process.env.TELEGRAM_BOT_TOKEN_A ?? "test-fake-token-A-rotation-e2e", | CODE |
| LOW | test/e2e/live/token-rotation.test.ts | 51 | telegram: process.env.TELEGRAM_BOT_TOKEN_B ?? "test-fake-token-B-rotation-e2e", | CODE |
| LOW | test/onboarding/onboard-selection.test.ts | 3205 | retryAnswer: "nvapi-fake-key-value", | CODE |
| LOW | scripts/nemoclaw-start.sh | 805 | states[key] = {"kind": "placeholder", "value": value} | CODE |
| LOW | scripts/nemoclaw-start.sh | 852 | kind = "placeholder" if unversioned == key else "placeholder-mismatch" | CODE |
| LOW | scripts/nemoclaw-start.sh | 859 | if state.get("kind") == "placeholder" and value != f"{prefix}{key}": | CODE |
| LOW | scripts/nemoclaw-start.sh | 898 | and state.get("kind") == "placeholder" | CODE |
| LOW | scripts/nemoclaw-start.sh | 991 | elif state.get("kind") != "placeholder": | CODE |
| LOW | .github/workflows/e2e.yaml | 6295 | # the legacy fake-token defaults, optional _REAL secret overrides, | COMMENT |
| LOW | src/lib/onboard/web-search-verify.test.ts | 649 | expect(classifyWebSearchEnvBoundary("__nemoclaw_wsenv__:placeholder")).toBe("placeholder"); | CODE |
| LOW | src/lib/onboard/web-search-verify.ts | 28 | export type WebSearchEnvBoundary = "absent" | "placeholder" | "raw-secret" | "unknown"; | CODE |
| LOW | src/lib/onboard/web-search-verify.ts | 118 | if (boundary === "absent" || boundary === "placeholder") return false; | CODE |
| LOW | …/onboard/runtime-provider/host-local-inference.test.ts | 497 | bounded.captureWithEnvironment?.(["inspect-env"], { TOKEN: "placeholder" }, 5_000); | CODE |
| LOW | …/onboard/runtime-provider/host-local-inference.test.ts | 500 | { TOKEN: "placeholder" }, | CODE |
| LOW | src/lib/onboard/managed-startup/profile.ts | 1139 | path[4] === "placeholder"; | CODE |
| LOW | src/lib/messaging/persistence.ts | 53 | "credentialId" | "sourceInput" | "providerName" | "placeholder" | CODE |
| LOW | src/lib/messaging/applier/setup-applier.test.ts | 79 | GOOGLECHAT_ALLOWED_USERS: "user@example.com", | CODE |
| LOW | …essaging/channels/googlechat/template-resolver.test.ts | 64 | ).toEqual(["users/111", "user@example.com"]); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …t/runtime/gateway/gateway-state-reconcile-2276.test.ts | 422 | // Step 3: routine connect must preserve the registry entry. | COMMENT |
| LOW | …t/runtime/gateway/gateway-state-reconcile-2276.test.ts | 433 | // Step 4: rebuild locates the stale registry entry but refuses to create a | COMMENT |
| LOW⚡ | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 35 | # Step 1: PRs that explicitly link the issue. | COMMENT |
| LOW⚡ | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 43 | # Step 2: Expand by files mentioned in issue body. | COMMENT |
| LOW | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 56 | # Step 3: Expand by title-token Jaccard. | COMMENT |
| LOW⚡ | scripts/update-docker-pin.sh | 35 | # Step 1: get an auth token for the Docker Hub library repo | COMMENT |
| LOW | scripts/update-docker-pin.sh | 46 | # Step 2: fetch the tag headers and use Docker-Content-Digest for the index. | COMMENT |
| LOW | src/lib/adapters/openshell/resolve.ts | 70 | // Step 1: command -v | COMMENT |
| LOW | src/lib/adapters/openshell/resolve.ts | 91 | // Step 2: fallback candidates | COMMENT |
| LOW | src/lib/actions/sandbox/rebuild-destroy-phase.ts | 205 | // Step 3: Delete sandbox without tearing down gateway or session. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | agents/pi/start.sh | 324 | # This file is intentionally volatile: it holds no state that must survive a | COMMENT |
| MEDIUM | agents/hermes/start.sh | 2770 | # This function is called from an `if ! ...` recovery branch, where Bash | COMMENT |
| MEDIUM | …ts/langchain-deepagents-code/nemoclaw_observability.py | 908 | # This method is called only after leaving the handler's ``except`` | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …law-maintainer-pr-comparator/scripts/render-verdict.py | 29 | "closest_to_ready": null, | STRING |
| HIGH | …ts/langchain-deepagents-code/nemoclaw_observability.py | 681 | handle = nemo_relay.scope.push( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | agents/hermes/runtime-config-guard.py | 1464 | def _set_inode_flags(fd: int, flags: int) -> None: | CODE |
| LOW | …ngchain-deepagents-code/progressive_tool_disclosure.py | 651 | __all__ = [ | CODE |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 76 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 838 | def set_handler(self, _handler: Any, inherit: bool = True) -> None: | CODE |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 841 | def set_handlers(self, _handlers: list[Any], inherit: bool = True) -> None: | CODE |
| LOW | …chain-deepagents-code/patch-managed-deepagents-code.py | 1477 | def set_auto_update(enabled: bool) -> None: | CODE |
| LOW | …ile-plugin/src/nemoclaw_deepagents_profile/__init__.py | 344 | __all__ = ["register"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/lib/state/config-io.ts | 84 | " # If you can use sudo, repair the existing config directory:", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/lib/adapters/http/voice-gateway-server.ts | 230 | async function handleRequest(options: { | CODE |