Run agents like Hermes, LangChain Deep Agents, and OpenClaw more securely inside NVIDIA OpenShell with managed inference
This report presents the forensic synthetic code analysis of NVIDIA/NemoClaw, a TypeScript project with 21,780 GitHub stars. SynthScan v2.0 examined 829,025 lines of code across 3383 source files, recording 5478 pattern matches distributed across 19 syntactic categories. The overall adjusted score of 10.3 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 5478 distinct pattern matches across 19 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/messaging-build-applier.test.ts | 48 | function fakeOpenClawPluginNpmPackScriptLines(): string[] { | CODE |
| LOW | test/gateway-watchdog-kill-marker.test.ts | 52 | function extractRespawnCriticalSection(scriptPath: string): string { | CODE |
| LOW | test/gateway-watchdog-kill-marker.test.ts | 67 | function runRespawnCriticalSection(setup: string): { status: number; stdout: string } { | CODE |
| LOW | test/hermes-mcp-integrity-state.test.ts | 523 | def race_after_authentication(*args): | CODE |
| LOW | …/langchain-deepagents-code-managed-entrypoints.test.ts | 34 | function writeAutoApprovalCapability(path: string, content?: string): void { | CODE |
| LOW | test/onboard-brave-validation.test.ts | 142 | function runInteractiveConfigureWebSearch(spec: { answers: string[] }): { | CODE |
| LOW | test/nemoclaw-start-gateway-marker.test.ts | 15 | function extractShellFunctionFromSource(src, name) { | CODE |
| LOW | test/openclaw-mcp-npx-patch.test.ts | 46 | function writeMcpTransportOnlyFixture(dist: string): string { | CODE |
| LOW | test/validate-config-schemas.test.ts | 102 | function registerOpenShellJsonRpcMcpMatcherTests( | CODE |
| LOW | test/mcp-policy-key-ownership.test.ts | 169 | function runSuccessfulPolicyRemoval(skipRegistryUpdate: boolean) { | CODE |
| LOW⚡ | test/openclaw-issue-4434-diagnostics-patch.test.ts | 20 | function writeAssistantErrorFormatFixture(dist: string): string { | CODE |
| LOW⚡ | test/openclaw-issue-4434-diagnostics-patch.test.ts | 29 | "function isCloudflareOrHtmlErrorPage(raw) { return false; }", | CODE |
| LOW⚡ | test/openclaw-issue-4434-diagnostics-patch.test.ts | 30 | "function isGenericProviderInternalError(raw) { return false; }", | CODE |
| LOW⚡ | test/openclaw-issue-4434-diagnostics-patch.test.ts | 32 | "function formatRawAssistantErrorForUi(raw) {", | CODE |
| LOW⚡ | test/openclaw-issue-4434-diagnostics-patch.test.ts | 56 | function writeUnrecognizedAssistantFormatterFixture(dist: string): string { | CODE |
| LOW⚡ | test/openclaw-issue-4434-diagnostics-patch.test.ts | 63 | "function formatRawAssistantErrorForUi(raw) {", | CODE |
| LOW⚡ | test/openclaw-issue-4434-diagnostics-patch.test.ts | 73 | function writeRenamedArrowAssistantFormatterFixture(dist: string): string { | CODE |
| LOW | test/openclaw-issue-4434-diagnostics-patch.test.ts | 242 | "function formatRawAssistantErrorForUi(raw) {", | CODE |
| LOW | test/openclaw-issue-4434-diagnostics-patch.test.ts | 243 | "function formatRawAssistantErrorForUi(raw, options) {", | CODE |
| LOW | test/onboard-resume-provider-recovery.test.ts | 21 | function isProviderRecoveryInternals(value: object | null): value is ProviderRecoveryInternals { | CODE |
| LOW | test/openclaw-tui-chat-correlation.test.ts | 606 | function looksLikeEventCaptureFailure(repro: LiveIssue2603Trace): boolean { | CODE |
| LOW | test/nemoclaw-start-telegram-runtime.test.ts | 18 | function messagingRuntimeSetupSection( | CODE |
| LOW | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 255 | function makeValidatorDependencyStubRoot(): string { | CODE |
| LOW | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 268 | "_HARNESS_PROFILES = {}\nclass HarnessProfile: pass\ndef _harness_profile_for_model(*args, **kwargs): return Harne | CODE |
| LOW | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 307 | function buildAndInstallPluginWheel(version: string): string { | CODE |
| LOW | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 375 | function runEntryPointValidationWithRoots(pythonRoots: string[]) { | CODE |
| LOW | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 518 | def internal_whitespace_handler(request): | CODE |
| LOW | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 606 | function expectOfficialSourcesUnchanged( | CODE |
| LOW | test/hermes-runtime-api-key.test.ts | 35 | function extractShellFunctionFromSource(src: string, name: string): string { | CODE |
| LOW | test/hermes-runtime-api-key.test.ts | 69 | function runHermesRuntimeApiServerKeyMint( | CODE |
| LOW | test/hermes-runtime-api-key.test.ts | 185 | function runExtractedProviderPlaceholderRefresh(opts: { | CODE |
| LOW | test/hermes-runtime-api-key.test.ts | 255 | function runHermesDockerfileRuntimePlanGuard(runtimePlan: unknown) { | CODE |
| LOW | test/hermes-runtime-api-key.test.ts | 289 | function runHermesRuntimeProviderPlaceholderRefresh(opts: { | CODE |
| LOW | …in-deepagents-code-progressive-tool-disclosure.test.ts | 66 | async def _restart_server_for_agent_swap(self, agent_name): | CODE |
| LOW | …in-deepagents-code-progressive-tool-disclosure.test.ts | 157 | def build_model_identity_section(name, provider=None, context_limit=None, unsupported_modalities=frozenset()): return na | CODE |
| LOW | test/repro-2681-group-writable.test.ts | 43 | function extractShellFunctionFromSource(src: string, name: string): string { | CODE |
| LOW | test/repro-2681-group-writable.test.ts | 57 | function normalizeMutableConfigPermsFor(configDir: string): string { | CODE |
| LOW | test/repro-2681-group-writable.test.ts | 85 | function runMutableConfigNormalizer(configDir: string, ownedPaths: string[]) { | CODE |
| LOW | test/local-credential-helper-suite.ts | 201 | export function registerLocalCredentialHelperTests(group: LocalCredentialHelperTestGroup): void { | CODE |
| LOW | test/local-credential-helper-suite.ts | 502 | async function expectSuccessfulCompletion( | CODE |
| LOW | test/onboard-ollama-autostart.test.ts | 65 | function runOllamaAutostartScenario(opts: ScenarioOptions): WizardResult { | CODE |
| LOW | test/install-agent-alias-parity.test.ts | 30 | function installerCanonicalAgentName(input: string): string { | CODE |
| LOW | …/langchain-deepagents-code-direct-module-patch.test.ts | 129 | ["def managed_auto_approval_enabled() -> bool:"], | CODE |
| LOW | …/langchain-deepagents-code-direct-module-patch.test.ts | 1429 | .replace("def _fetch_with_redirects(", "def _renamed_fetch_with_redirects("), | CODE |
| LOW | test/hermes-share-mount-deps.test.ts | 21 | function extractHermesInstallCommand(dockerfile: string): string { | CODE |
| LOW | test/pr-e2e-gate-lifecycle.test.ts | 51 | function emptyPrGateCheckRunsRoute() { | CODE |
| LOW | test/pr-e2e-gate-lifecycle.test.ts | 71 | function existingPrGateCheckRunsRoute(overrides: Record<string, unknown> = {}) { | CODE |
| LOW | test/pr-e2e-gate-lifecycle.test.ts | 196 | async function expectHandledFinalization( | CODE |
| LOW | test/pr-e2e-gate-lifecycle.test.ts | 203 | async function expectControllerFailureFinalization( | CODE |
| LOW | test/pr-e2e-gate-lifecycle.test.ts | 216 | function expectControllerDetailsLink(body: unknown): void { | CODE |
| LOW | test/cli-coverage-sequencer.test.ts | 47 | function representativeCliCoverageEntries(): WeightedShardEntry<string>[] { | CODE |
| LOW | test/onboard-terminal-dashboard.test.ts | 32 | function runTerminalDashboardScenario(scenario: "create" | "reuse") { | CODE |
| LOW | test/nemoclaw-start-guard-recovery.test.ts | 22 | function extractGatewayLogAppendFunction( | CODE |
| LOW | test/install-openshell-upgrade-prompt.test.ts | 17 | function runPreinstallUpgradeGuard( | CODE |
| LOW | test/onboard-rollback.test.ts | 20 | function isOnboardRollbackInternals(value: object | null): value is OnboardRollbackInternals { | CODE |
| LOW | …angchain-deepagents-code-managed-mcp-hardening.test.ts | 262 | def tracked_anonymous_snapshot(snapshot_payload): | STRING |
| LOW | test/wsl2-probe-timeout.test.ts | 18 | function isOnboardValidationInternals( | CODE |
| LOW | test/wsl2-probe-timeout.test.ts | 184 | function runCalibratedProbeWithResults(results: ProbeResultFixture[], clock: number[]) { | CODE |
| LOW | test/openclaw-tool-search-runtime-validator.test.ts | 73 | function createOpenClawCodingTools(options) { | CODE |
| LOW | test/openclaw-tool-search-runtime-validator.test.ts | 250 | "function renamedApplyToolSearchCatalog(params)", | CODE |
| 3638 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/hermes-mcp-integrity-state.test.ts | 95 | print(guard._canonical_mcp_servers_digest(open(sys.argv[2], encoding="utf-8").read())) | CODE |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 146 | print(json.dumps({ | CODE |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 217 | print(json.dumps({"current": current, "pending": pending, "misuse": misuse})) | CODE |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 273 | print(json.dumps({ | CODE |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 413 | print(json.dumps(rejected)) | CODE |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 462 | print(json.dumps(outcomes)) | CODE |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 537 | print(json.dumps({"diverged": diverged, "raced": raced})) | CODE |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 582 | print(json.dumps({"state": state, "config_reads": config_reads})) | CODE |
| HIGH⚡ | test/hermes-mcp-integrity-state.test.ts | 786 | print(json.dumps({"errors": errors, "hash_unchanged": open(strict, encoding="utf-8").read() == pending_hash})) | STRING |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 678 | print(json.dumps({"states": states, "hash": hash_text})) | STRING |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 729 | print(json.dumps({ | STRING |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 838 | print(json.dumps({ | STRING |
| HIGH | test/hermes-mcp-integrity-state.test.ts | 898 | print(json.dumps({"errors": errors, "hash_exists": os.path.exists(strict)})) | STRING |
| HIGH⚡ | test/hermes-mcp-config-transaction.test.ts | 582 | return True, type(error).__name__ | CODE |
| HIGH⚡ | test/hermes-mcp-config-transaction.test.ts | 583 | return False, "none" | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 49 | print(json.dumps(errors)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 125 | print(json.dumps(results)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 154 | print(json.dumps(errors)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 181 | print(json.dumps({"ok": True})) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 225 | print(json.dumps({ | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 287 | print(json.dumps(accepted)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 347 | print(json.dumps({"exit_code": module.main()})) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 411 | print(json.dumps({"results": results, "null_result": null_result})) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 454 | print(json.dumps({"exit_code": module.main()})) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 486 | print(json.dumps([ | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 517 | print(str(error)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 720 | print(json.dumps(results, sort_keys=True)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 799 | print(json.dumps(errors)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 826 | print(str(error)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 850 | print(str(error)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 880 | print(str(error)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 890 | print(str(error)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 946 | print(json.dumps({ | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 988 | print(str(error)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1055 | print(json.dumps({ | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1095 | print(json.dumps({str(pid): module._is_trusted_gateway_process(pid) for pid in arguments})) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1141 | return True | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1159 | return True | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1170 | return True, "waiting-for-stable-replacement-identity" | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1182 | print(json.dumps(observed, sort_keys=True)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1260 | print(json.dumps({"changed": changed})) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1302 | print(json.dumps(errors)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1336 | print(json.dumps(errors)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1356 | print(json.dumps({str(pid): module._is_service_manager_process(pid) for pid in arguments})) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1387 | print(json.dumps(result, sort_keys=True)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1409 | print(json.dumps(module.probe(), sort_keys=True)) | CODE |
| HIGH | test/hermes-mcp-config-transaction.test.ts | 1471 | print(json.dumps({"error": str(error), "signals": signals})) | CODE |
| HIGH | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 270 | "deepagents_code/agent.py": "def create_cli_agent(*args, **kwargs): return None\n", | CODE |
| HIGH | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 436 | elif state == "partial": | CODE |
| HIGH | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 438 | elif state == "conflict": | CODE |
| HIGH | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 570 | print(json.dumps({ | CODE |
| HIGH | …in-deepagents-code-progressive-tool-disclosure.test.ts | 89 | def _load_dotenv(*, start_path=None, refresh_loaded=False): return False | CODE |
| HIGH | …in-deepagents-code-progressive-tool-disclosure.test.ts | 92 | def _tracing_enabled(): return False | CODE |
| HIGH | …in-deepagents-code-progressive-tool-disclosure.test.ts | 110 | def get_class_path(self, provider_name): return None | CODE |
| HIGH | …in-deepagents-code-progressive-tool-disclosure.test.ts | 136 | elif isinstance(existing_callbacks, list): | CODE |
| HIGH | …in-deepagents-code-progressive-tool-disclosure.test.ts | 155 | def _resolve_ptc_option(*args, **kwargs): return None | CODE |
| HIGH | …in-deepagents-code-progressive-tool-disclosure.test.ts | 176 | async def _run_install_subprocess(*args, **kwargs): return True, "spawned" | CODE |
| HIGH | …in-deepagents-code-progressive-tool-disclosure.test.ts | 235 | def should_run_onboarding(state_dir=None): return True | CODE |
| HIGH | …in-deepagents-code-progressive-tool-disclosure.test.ts | 262 | return None | CODE |
| HIGH | …in-deepagents-code-progressive-tool-disclosure.test.ts | 282 | def _run_single_hook(command, event, payload_bytes): return None | CODE |
| 312 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .pre-commit-config.yaml | 45 | # ── Priority 0: general file fixers ─────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 62 | # ── Priority 0: reject force-added ignored files ─────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 87 | # ── Priority 3: sync generated docs before read-only validation ─────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 98 | # ── Priority 5: formatters ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 122 | # ── Priority 6: auto-fix after formatting ───────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 133 | # ── Priority 10: linters and validation ───────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 218 | # ── commit-msg hooks ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 227 | # ── pre-push hooks ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 266 | # ── post-merge / post-checkout: warn about stale compiled dist/ ─────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 282 | # ── Priority 20: project-level checks (full coverage is manual) ──────────── | COMMENT |
| MEDIUM | test/gateway-state-reconcile-2276.test.ts | 288 | // ─── Scenario 14 (#4497) ─── connect preserves enough state for rebuild ───── | COMMENT |
| MEDIUM | test/gateway-state-reconcile-2276.test.ts | 288 | // ─── Scenario 14 (#4497) ─── connect preserves enough state for rebuild ───── | COMMENT |
| MEDIUM | test/validate-config-schemas.test.ts | 236 | // ── Validation target discovery ───────────────────────────────────────────── | COMMENT |
| MEDIUM | test/validate-config-schemas.test.ts | 282 | // ── Blueprint ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/validate-config-schemas.test.ts | 387 | // ── Model Router pool config ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/validate-config-schemas.test.ts | 440 | // ── Base sandbox policy ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/validate-config-schemas.test.ts | 839 | // ── Policy presets ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/validate-config-schemas.test.ts | 1247 | // ── OpenClaw plugin manifest ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/validate-config-schemas.test.ts | 1295 | // ── Model-Specific Setup ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/e2e-non-root-smoke.sh | 93 | # ── Summary ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/security-sandbox-tar-traversal.test.ts | 20 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security-sandbox-tar-traversal.test.ts | 22 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/security-sandbox-tar-traversal.test.ts | 149 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/security-sandbox-tar-traversal.test.ts | 151 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/security-sandbox-tar-traversal.test.ts | 157 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security-sandbox-tar-traversal.test.ts | 188 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security-sandbox-tar-traversal.test.ts | 190 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security-c4-manifest-traversal.test.ts | 17 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security-c4-manifest-traversal.test.ts | 19 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security-c4-manifest-traversal.test.ts | 193 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security-c4-manifest-traversal.test.ts | 195 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security-c4-manifest-traversal.test.ts | 258 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/security-c4-manifest-traversal.test.ts | 260 | // ═══════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | test/repro-2201.test.ts | 129 | // ── Registry — both sandboxes exist ─────────────────────────── | COMMENT |
| MEDIUM | test/repro-2201.test.ts | 214 | // ── Dummy workspace dir for the fake ssh tar call ───────────── | COMMENT |
| MEDIUM | test/repro-2201.test.ts | 219 | // ── Fake openshell ──────────────────────────────────────────── | COMMENT |
| MEDIUM | test/repro-2201.test.ts | 258 | // ── Fake docker ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/repro-2201.test.ts | 294 | // ── Fake ssh ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/ollama-tools-capability.test.ts | 218 | // ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/ollama-tools-capability.test.ts | 230 | // ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/ollama-tools-capability.test.ts | 533 | // ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/ollama-tools-capability.test.ts | 541 | // ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/ollama-tools-capability.test.ts | 660 | // ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/ollama-tools-capability.test.ts | 666 | // ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/agents-manifest-policy-conformance.test.ts | 95 | // ─── OpenClaw policy mirror ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 89 | # ── Test 1: Default port works through real entrypoint ────────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 99 | # ── Test 2: Valid port override accepted by real entrypoint ───── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 109 | # ── Test 3: Non-numeric port rejected by real entrypoint ──────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 114 | # ── Test 4: Privileged port rejected by real entrypoint ───────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 119 | # ── Test 5: Port above 65535 rejected by real entrypoint ──────── | COMMENT |
| MEDIUM⚡ | test/e2e-port-overrides.sh | 124 | # ── Test 6: Pattern injection rejected by real entrypoint ─────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 148 | # ── Test 8: Node.js ports module rejects invalid port ─────────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 160 | # ── Test 9: Boundary port 1024 accepted by real entrypoint ────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 180 | # ── Test 11: NIM maps host port to fixed internal 8000 ────────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 198 | # ── Test 12: docker port queries container internal 8000 ──────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 216 | # ── Test 13: Entrypoint has fail-fast validation block ────────── | COMMENT |
| MEDIUM | test/e2e-port-overrides.sh | 229 | # ── Summary ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/generate-openclaw-config.test.ts | 844 | // ─── agents.list bake ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/generate-openclaw-config.test.ts | 1156 | // ─── agents-manifest extensions ─────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | test/e2e-gateway-isolation.sh | 328 | # ── Test 14b: Sandbox user cannot modify blueprints ────────────── | COMMENT |
| 385 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .markdownlint-cli2.yaml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | .pre-commit-config.yaml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | vitest.config.ts | 181 | alias: canonicalOpenShellPolicyAlias, | COMMENT |
| LOW | vitest.config.ts | 201 | // Live E2E tests are opt-in because they install, onboard, and | COMMENT |
| LOW | test/nemoclaw-start-gateway-marker.test.ts | 61 | // 0.0.44 does not export OPENSHELL_DRIVERS into the sandbox container env, so | COMMENT |
| LOW | test/gateway-state-reconcile-2276.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | test/gateway-state-reconcile-2276.test.ts | 281 | ); | COMMENT |
| LOW | test/destroy-wipe-sandbox-state.test.ts | 281 | }); | COMMENT |
| LOW | test/uninstall-prompt-pty.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/generate-openclaw-config-slack-allowlist.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | test/repro-5445-docs-published-route.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/e2e-non-root-smoke.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | test/e2e-non-root-smoke.sh | 21 | # CAVEAT: no-new-privileges ≠ Landlock. We catch #2472-class bugs only | COMMENT |
| LOW | test/openclaw-tui-chat-correlation.test.ts | 621 | analysis.conflictingSessionRunEvents.length === 0 && | COMMENT |
| LOW | test/onboard-anthropic-compatible-openai-agent.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/onboard-ollama-autostart.test.ts | 21 | ollamaRunning: boolean; | COMMENT |
| LOW | test/onboard-ollama-autostart.test.ts | 81 | path.join(repoRoot, "src", "lib", "inference", "ollama", "proxy.ts"), | COMMENT |
| LOW | test/channels-remove-full-teardown.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/reboot-identity-drift.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/host-proxy-inference-local-e2e.test.ts | 41 | const curlOk = curlAvailable(); | COMMENT |
| LOW | test/security-sandbox-tar-traversal.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/seed-hermes-dashboard-config.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …st/nemoclaw-start-extra-placeholder-breadcrumb.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …st/nemoclaw-start-extra-placeholder-breadcrumb.test.ts | 21 | // X5 — the startup breadcrumb "[config] NEMOCLAW_EXTRA_PLACEHOLDER_KEYS | COMMENT |
| LOW | test/policy-tiers.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/exit-code-user-error-surfaces.test.ts | 201 | } | COMMENT |
| LOW | test/security-c4-manifest-traversal.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/ollama-tools-capability.test.ts | 521 | rawError: "connection refused", | COMMENT |
| LOW | test/nemoclaw-start-gateway-health.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/policy-add-remove-session-sync.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/dcode-wrapper-empty-prompt.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/wechat-diagnostics.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | test/corporate-ca-tls-e2e.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/install-preflight.test.ts | 3081 | // no controlling terminal so /dev/tty becomes unopenable. | COMMENT |
| LOW | test/hermes-wrapper-oneshot-routing.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/generate-openclaw-config-agents-manifest.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | test/snapshot-restore-existing-dest.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/strict-tool-call-probe.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/agents-manifest-policy-conformance.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | test/dcode-start-keepalive.test.ts | 101 | // source-shape-contract: compatibility -- Executes the shipped entrypoint to protect no-command sandbox liveness | COMMENT |
| LOW | test/snapshot.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/e2e-port-overrides.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | test/ollama-auth-proxy-handler.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/fixture-umask-normalization.test.ts | 21 | const FIXTURE_UMASK_SETUP = "test/helpers/normalize-fixture-umask.ts"; | COMMENT |
| LOW | test/e2e-gateway-isolation.sh | 241 | && ! echo "$SANDBOX_CONTROL_OUT" | grep -q PRIVILEGED_CONTROL_UNAVAILABLE; then | COMMENT |
| LOW | test/e2e-gateway-isolation.sh | 261 | # #3280 condition (permissive OpenShell runtime). We --cap-add those two | COMMENT |
| LOW | test/sandbox-init.test.ts | 441 | COMMENT | |
| LOW | test/http-proxy-fix-e2e.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/http-proxy-fix-rewrite.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/channels-add-deepagents-rejection.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/gateway-http-reuse-wait.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/repro-5978-policy-denial-hint.test.ts | 41 | // sandbox base image — the image's own /etc/profile.d + /etc/bash.bashrc hooks | COMMENT |
| LOW | test/repro-5978-policy-denial-hint.test.ts | 81 | // Run a snippet under a pseudo-terminal so `[ -t 2 ]` is true and the shell is | COMMENT |
| LOW | test/repro-5978-policy-denial-hint.test.ts | 421 | // …exactly once across the whole run: both /etc/profile.d and | COMMENT |
| LOW | test/local-slack-auth-test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | test/tunnel-gateway-port-release-runtime.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | test/repro-2666-silent-list-status.test.ts | 141 | // Fallback synthesizes recovery flags so downstream rendering treats the | COMMENT |
| LOW | test/generate-openclaw-config-reload.test.ts | 1 | // @ts-nocheck | COMMENT |
| LOW | test/whatsapp-qr-compact.test.ts | 21 | "whatsapp-qr-compact.ts", | COMMENT |
| LOW | test/hermes-gateway-wrapper.test.ts | 1 | // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| 354 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/gateway-state-reconcile-2276.test.ts | 313 | // Step 3: routine connect must preserve the registry entry. | COMMENT |
| LOW | test/gateway-state-reconcile-2276.test.ts | 324 | // Step 4: the previously-suggested rebuild must RECOVER the stale sandbox. | COMMENT |
| LOW | .agents/skills/nemoclaw-contributor-create-pr/SKILL.md | 21 | ## Step 1: Verify Branch State | COMMENT |
| LOW | .agents/skills/nemoclaw-contributor-create-pr/SKILL.md | 49 | ## Step 2: Choose Efficient Pre-PR Checks | COMMENT |
| LOW | .agents/skills/nemoclaw-contributor-create-pr/SKILL.md | 95 | ## Step 3: Push the Branch | COMMENT |
| LOW | .agents/skills/nemoclaw-contributor-create-pr/SKILL.md | 105 | ## Step 4: Prepare DCO Declaration and Verify GitHub Commits | COMMENT |
| LOW | .agents/skills/nemoclaw-contributor-create-pr/SKILL.md | 132 | ## Step 5: Determine PR Metadata | COMMENT |
| LOW | .agents/skills/nemoclaw-contributor-create-pr/SKILL.md | 175 | ## Step 6: Compose the PR Body | COMMENT |
| LOW | .agents/skills/nemoclaw-contributor-create-pr/SKILL.md | 209 | ## Step 7: Create the PR | COMMENT |
| LOW | .agents/skills/nemoclaw-contributor-create-pr/SKILL.md | 238 | ## Step 8: Monitor CI and Review Feedback | COMMENT |
| LOW | .agents/skills/nemoclaw-contributor-create-pr/SKILL.md | 242 | ## Step 9: Report the Result | COMMENT |
| LOW | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 17 | ## Step 1: Fetch candidate PRs | COMMENT |
| LOW | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 34 | ## Step 2: Extract linked issues | COMMENT |
| LOW⚡ | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 47 | ## Step 3: Detect duplicates | COMMENT |
| LOW⚡ | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 57 | ## Step 4: Check for superseded PRs | COMMENT |
| LOW⚡ | …nts/skills/nemoclaw-maintainer-find-review-pr/SKILL.md | 65 | ## Step 5: Present results | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-refactor-docs/SKILL.md | 33 | ## Step 1: Inventory Before Editing | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-refactor-docs/SKILL.md | 58 | ## Step 2: Design Around the User Journey | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-refactor-docs/SKILL.md | 83 | ## Step 3: Establish Canonical Ownership | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-refactor-docs/SKILL.md | 102 | ## Step 4: Define the URL Migration Contract | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-refactor-docs/SKILL.md | 133 | ## Step 5: Implement in a Content-Safe Order | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-refactor-docs/SKILL.md | 153 | ## Step 6: Run a Readability Pass | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-refactor-docs/SKILL.md | 171 | ## Step 7: Validate the Refactor | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-refactor-docs/SKILL.md | 203 | ## Step 8: Run an Independent Docs Review | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 23 | ## Step 1: Parse the GitHub URL | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 32 | ## Step 2: Check Out the Code | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 49 | ## Step 3: Identify Changed Files | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 63 | ## Step 4: Read Every Changed File and Diff | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 79 | ## Step 5: Analyze Against the Security Checklist | COMMENT |
| LOW | …ills/nemoclaw-maintainer-security-code-review/SKILL.md | 145 | ## Step 6: Produce the Report | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-evening/SKILL.md | 13 | ## Step 1: Check Progress | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-evening/SKILL.md | 22 | ## Step 2: Review Post-Tag Stragglers | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-evening/SKILL.md | 35 | ## Step 3: Generate Handoff Summary | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-evening/SKILL.md | 49 | ## Step 4: Cut the Tag and Publish Release Notes | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-evening/SKILL.md | 53 | ## Step 5: Confirm and Share | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-evening/SKILL.md | 66 | ## Step 6: Update State | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 37 | ### Step 1: Parse issue | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 47 | ### Step 2: Discover candidate PRs | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 55 | ### Step 3: Detect supersession | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 63 | ### Step 4: Tier 0 gates | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 73 | ### Step 5: Tier 1 correctness | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 77 | ### Step 6: Tier 2 quality | COMMENT |
| LOW⚡ | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 81 | ### Step 7: Weighted score | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 92 | ### Step 8: Tier 3 ranking | COMMENT |
| LOW | …ents/skills/nemoclaw-maintainer-pr-comparator/SKILL.md | 96 | ### Step 9: Emit verdict | COMMENT |
| LOW⚡ | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 35 | # Step 1: PRs that explicitly link the issue. | COMMENT |
| LOW⚡ | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 43 | # Step 2: Expand by files mentioned in issue body. | COMMENT |
| LOW | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 56 | # Step 3: Expand by title-token Jaccard. | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-morning/SKILL.md | 13 | ## Step 1: Determine Target Version and Stragglers | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-morning/SKILL.md | 21 | ## Step 2: Triage | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-morning/SKILL.md | 33 | ## Step 3: Label Version Targets | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-morning/SKILL.md | 43 | ## Step 4: Save State and Output the Plan | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 14 | ## Step 1: Load Canonical Policy | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 25 | ## Step 2: Determine Mode | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 47 | ## Step 3: Present the Dry Run | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 62 | ## Step 4: Apply Only the Accepted Write Set | COMMENT |
| LOW | .agents/skills/nemoclaw-maintainer-triage/SKILL.md | 75 | ## Step 5: Report | COMMENT |
| LOW | …ts/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md | 56 | ### Step 1: Generate Release Plan | COMMENT |
| LOW | …ts/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md | 77 | ### Step 2: Show Plan, E2E Evidence, and Ask for Exact Confirmation | COMMENT |
| LOW | …ts/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md | 108 | ### Step 3: Cut the Semver Tag | COMMENT |
| 92 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | test/channels-remove-full-teardown.test.ts | 573 | messagingPlanUpdate.updates.messaging.plan.channels.map( | CODE |
| CRITICAL | src/lib/actions/inference-set-provider-alias.test.ts | 125 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL | src/lib/actions/inference-set-hermes-run.test.ts | 170 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL | …/lib/actions/inference-set-compatible-provider.test.ts | 45 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL | …/lib/actions/inference-set-compatible-provider.test.ts | 123 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL | …/lib/actions/inference-set-compatible-provider.test.ts | 221 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL | …/lib/actions/inference-set-compatible-provider.test.ts | 274 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL | …actions/inference-set-openclaw-gateway-restart.test.ts | 71 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL | …actions/inference-set-openclaw-gateway-restart.test.ts | 92 | const auditReasons = deps.calls.appendAuditEntry.mock.calls.map(([entry]) => | CODE |
| CRITICAL⚡ | …actions/inference-set-openclaw-gateway-restart.test.ts | 190 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL⚡ | …actions/inference-set-openclaw-gateway-restart.test.ts | 198 | const auditReasons = deps.calls.appendAuditEntry.mock.calls.map(([entry]) => | CODE |
| CRITICAL⚡ | …actions/inference-set-openclaw-gateway-restart.test.ts | 208 | expect(deps.calls.log.mock.calls.map(([line]) => String(line)).join("\n")).not.toContain( | CODE |
| CRITICAL | …actions/inference-set-openclaw-gateway-restart.test.ts | 257 | const auditReasons = deps.calls.appendAuditEntry.mock.calls.map(([entry]) => | CODE |
| CRITICAL | …actions/inference-set-openclaw-gateway-restart.test.ts | 264 | expect(deps.calls.log.mock.calls.map(([line]) => String(line)).join("\n")).not.toContain( | CODE |
| CRITICAL | src/lib/actions/inference-set-openclaw-run.test.ts | 59 | expect(deps.calls.updateSandbox.mock.calls.at(-1)).toEqual([ | CODE |
| CRITICAL | src/lib/actions/inference-set-degraded-state.test.ts | 75 | const logged = deps.calls.log.mock.calls.map((args) => String(args[0])).join("\n"); | CODE |
| CRITICAL | src/lib/actions/inference-set-degraded-state.test.ts | 116 | const logged = deps.calls.log.mock.calls.map((args) => String(args[0])).join("\n"); | CODE |
| CRITICAL | src/lib/actions/inference-set-local-provider.test.ts | 50 | const logged = deps.calls.log.mock.calls.map((a) => String(a[0])).join("\n"); | CODE |
| CRITICAL | …ctions/inference-set-gateway-route-containment.test.ts | 495 | deps.calls.captureOpenshell.mock.calls.filter( | CODE |
| CRITICAL | src/lib/actions/inference-set-context-window.test.ts | 38 | const logged = deps.calls.log.mock.calls.map((a) => String(a[0])).join("\n"); | CODE |
| CRITICAL | src/lib/actions/inference-set-context-window.test.ts | 49 | const logged = deps.calls.log.mock.calls.map((a) => String(a[0])).join("\n"); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/hermes-mcp-integrity-state.test.ts | 519 | except Exception as error: | CODE |
| LOW | test/hermes-mcp-integrity-state.test.ts | 535 | except Exception as error: | CODE |
| LOW⚡ | test/hermes-mcp-integrity-state.test.ts | 778 | except Exception as error: | STRING |
| LOW⚡ | test/hermes-mcp-integrity-state.test.ts | 784 | except Exception as error: | STRING |
| LOW | test/hermes-mcp-integrity-state.test.ts | 725 | except Exception as error: | STRING |
| LOW | test/hermes-mcp-integrity-state.test.ts | 836 | except Exception as caught: | STRING |
| LOW | test/hermes-mcp-integrity-state.test.ts | 896 | except Exception as error: | STRING |
| MEDIUM | test/hermes-mcp-config-transaction.test.ts | 578 | def blocked(operation): | CODE |
| LOW⚡ | test/hermes-mcp-config-transaction.test.ts | 581 | except Exception as error: | CODE |
| LOW | …gchain-deepagents-code-nemotron-profile-plugin.test.ts | 461 | except Exception as exc: | CODE |
| LOW | test/hermes-mcp-rollback-pending.test.ts | 86 | except Exception as caught: | CODE |
| LOW | test/hermes-mcp-credential-boundary-manifest.test.ts | 47 | except Exception as error: | CODE |
| LOW | …xperimental/checks/09-deepagents-code-tavily-opt-in.sh | 101 | except Exception: | CODE |
| LOW | …xperimental/checks/09-deepagents-code-tavily-opt-in.sh | 120 | except Exception as exc: | CODE |
| LOW | …xperimental/checks/06-deepagents-code-python-egress.sh | 71 | except Exception: | CODE |
| LOW | …xperimental/checks/06-deepagents-code-python-egress.sh | 90 | except Exception as exc: | CODE |
| LOW | …xperimental/checks/11-deepagents-code-observability.sh | 183 | except Exception as error: | CODE |
| MEDIUM | test/e2e/live/issue-4462-scope-upgrade-approval.test.ts | 133 | def load(name): | CODE |
| LOW | test/e2e/live/issue-4462-scope-upgrade-approval.test.ts | 190 | except Exception: return '' | CODE |
| LOW | test/e2e/live/issue-4462-scope-upgrade-approval.test.ts | 198 | except Exception: raise SystemExit(1) | CODE |
| LOW | test/e2e/live/issue-4462-scope-upgrade-approval.test.ts | 304 | except Exception: | CODE |
| LOW | test/e2e/live/issue-4462-scope-upgrade-approval.test.ts | 332 | except Exception: return '' | CODE |
| LOW | test/e2e/live/issue-4462-scope-upgrade-approval.test.ts | 374 | except Exception: raise SystemExit('rotated device identity key is malformed') | CODE |
| LOW | test/e2e/live/issue-4462-scope-upgrade-approval.test.ts | 566 | except Exception: return '' | CODE |
| LOW | test/e2e/live/issue-4462-scope-upgrade-approval.test.ts | 571 | except Exception: return '' | CODE |
| LOW | test/e2e/live/hermes-discord.test.ts | 195 | except Exception as exc: | CODE |
| LOW⚡ | test/e2e/live/hermes-discord.test.ts | 299 | except Exception as exc: | CODE |
| LOW | test/e2e/live/rebuild-openclaw.test.ts | 582 | except Exception: | CODE |
| LOW⚡ | test/e2e/live/hermes-slack-e2e-helpers.ts | 566 | except Exception: | CODE |
| LOW⚡ | test/e2e/live/hermes-slack-e2e-helpers.ts | 672 | except Exception as exc: | CODE |
| LOW⚡ | test/e2e/live/hermes-slack-e2e-helpers.ts | 683 | except Exception as exc: | CODE |
| LOW | test/e2e/live/hermes-slack-e2e-helpers.ts | 379 | except Exception as exc: | CODE |
| LOW | test/e2e/lib/discord-gateway-proof.sh | 343 | except Exception as exc: | CODE |
| LOW | test/e2e/lib/discord-gateway-proof.sh | 447 | except Exception as exc: | CODE |
| LOW | test/e2e/lib/anthropic-switch-provider.sh | 23 | except Exception as e: | CODE |
| LOW | test/e2e/lib/anthropic-switch-provider.sh | 82 | except Exception: | CODE |
| MEDIUM | agents/hermes/runtime-config-guard.py | 732 | def _startup_ready_marker_absent() -> bool: | CODE |
| LOW⚡ | agents/hermes/runtime-config-guard.py | 3556 | except Exception: | CODE |
| LOW⚡ | agents/hermes/runtime-config-guard.py | 3559 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 955 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 1035 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 1089 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 1093 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2056 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2227 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2614 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2781 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2785 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 2873 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 3045 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 4350 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 4355 | except Exception: | CODE |
| LOW | agents/hermes/runtime-config-guard.py | 4531 | except Exception as exc: | CODE |
| LOW | agents/hermes/seed-dashboard-config.py | 187 | except Exception as exc: | CODE |
| LOW | agents/hermes/seed-dashboard-config.py | 453 | except Exception as exc: # pragma: no cover - PyYAML ships in the Hermes venv | CODE |
| LOW | agents/hermes/seed-dashboard-config.py | 467 | except Exception as exc: | CODE |
| LOW | agents/hermes/seed-dashboard-config.py | 484 | except Exception as exc: | CODE |
| LOW | agents/hermes/mcp-config-transaction.py | 608 | except Exception as hash_error: | CODE |
| LOW | agents/hermes/mcp-config-transaction.py | 611 | except Exception as rollback_error: | CODE |
| LOW | agents/hermes/mcp-config-transaction.py | 630 | except Exception as mutation_error: | CODE |
| 133 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …-update-dependencies/scripts/collect-release-ledger.py | 265 | CODE | |
| LOW | …-update-dependencies/scripts/collect-release-ledger.py | 1506 | CODE | |
| LOW | agents/hermes/validate-env-secret-boundary.py | 156 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 341 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 475 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 662 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 1068 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 1338 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 2005 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 2450 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 2589 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 3227 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 3596 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 3718 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 3989 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 4725 | CODE | |
| LOW | agents/hermes/seed-dashboard-config.py | 234 | CODE | |
| LOW | agents/hermes/seed-dashboard-config.py | 258 | CODE | |
| LOW | agents/hermes/seed-dashboard-config.py | 281 | CODE | |
| LOW | agents/hermes/seed-dashboard-config.py | 304 | CODE | |
| LOW | agents/hermes/hermes-wrapper.py | 177 | CODE | |
| LOW | agents/hermes/hermes-wrapper.py | 314 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 649 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 744 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 950 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 1088 | CODE | |
| LOW | agents/hermes/plugin/__init__.py | 132 | CODE | |
| LOW | agents/hermes/plugin/__init__.py | 1020 | CODE | |
| LOW | …nts/langchain-deepagents-code/managed-dcode-runtime.py | 1132 | CODE | |
| LOW | …ts/langchain-deepagents-code/validate-observability.py | 776 | CODE | |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 1240 | CODE | |
| LOW | …chain-deepagents-code/patch-managed-deepagents-code.py | 1165 | CODE | |
| LOW | …/langchain-deepagents-code/dcode-session-supervisor.py | 31 | CODE | |
| LOW | …/langchain-deepagents-code/dcode-session-supervisor.py | 123 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 660 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 777 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 989 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 1829 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 2078 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 2670 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 3165 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 3267 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 3317 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 4008 | CODE | |
| LOW | scripts/state-dir-guard.py | 577 | CODE | |
| LOW | scripts/state-dir-guard.py | 745 | CODE | |
| LOW | scripts/state-dir-guard.py | 934 | CODE | |
| LOW | scripts/state-dir-guard.py | 979 | CODE | |
| LOW | scripts/state-dir-guard.py | 1224 | CODE | |
| LOW | scripts/state-dir-guard.py | 1477 | CODE | |
| LOW | scripts/state-dir-guard.py | 1615 | CODE | |
| LOW | scripts/state-dir-guard.py | 1861 | CODE | |
| LOW | scripts/managed-gateway-control.py | 941 | CODE | |
| LOW | scripts/managed-gateway-control.py | 977 | CODE | |
| LOW | scripts/managed-gateway-control.py | 1303 | CODE | |
| LOW | scripts/lib/clean_runtime_shell_env_shim.py | 94 | CODE | |
| LOW | scripts/lib/normalize_mutable_config_perms.py | 122 | CODE | |
| LOW | scripts/lib/normalize_mutable_config_perms.py | 215 | CODE | |
| LOW | scripts/lib/normalize_mutable_config_perms.py | 566 | CODE | |
| LOW | scripts/lib/normalize_mutable_config_perms.py | 736 | CODE | |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/e2e/registry/definitions/baseline.ts | 161 | // Failing-test-first regression scaffold for #4423. After | COMMENT |
| MEDIUM | test/e2e/registry/definitions/baseline.ts | 184 | // helper (parts 2 & 3 of ericksoa's plan) extends this scaffold, | COMMENT |
| MEDIUM | …iner-cross-issue-sweep/checks/relationship-judgment.md | 64 | ## Evidence requirement (anti-hallucination) | COMMENT |
| MEDIUM | agents/openclaw/manifest.yaml | 7 | # level for backward compatibility. Phase 3 of the multi-agent plan will | COMMENT |
| MEDIUM | …ts/langchain-deepagents-code/nemoclaw_observability.py | 394 | # base64 pickle or attacker-controlled string output before guardrails | COMMENT |
| MEDIUM | nemoclaw-blueprint/policies/openclaw-sandbox.yaml | 123 | # frame)` and multi-agent delegation is unusable. | COMMENT |
| MEDIUM | scripts/nemoclaw-start.sh | 25 | # NEMOCLAW_CONTEXT_WINDOW Override the model's context window size (e.g., "32768"). | COMMENT |
| MEDIUM | scripts/nemoclaw-start.sh | 5584 | # Provision per-agent workspaces for multi-agent OpenClaw deployments. | COMMENT |
| MEDIUM | .github/workflows/sandbox-images-and-e2e.yaml | 133 | # and 45-minute root-entrypoint budgets, plus orchestration/cleanup time. | COMMENT |
| MEDIUM | src/lib/onboard/finalization-deps.ts | 6 | // entrypoint stays lean (codebase-growth-guardrails). The lazy `require` calls | COMMENT |
| MEDIUM | src/lib/onboard/host-proxy-env.ts | 61 | // entrypoint is line-budget-constrained per codebase-growth-guardrails. | COMMENT |
| MEDIUM | src/lib/actions/README.md | 18 | dns/index.ts # internal dns fix-coredns/setup-proxy orchestration | CODE |
| MEDIUM | src/lib/actions/README.md | 19 | dev/npm-link-or-shim.ts # prepare-time dev shim orchestration | CODE |
| MEDIUM | src/lib/inference/onboard-probes-curl-harness.ts | 11 | // codebase-growth-guardrails "if count" for *.test.ts stays flat; see PR | COMMENT |
| MEDIUM | src/lib/policy/index.ts | 908 | // fresh sandbox whose unknown policy may be replaced with a scaffold. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …al/checks/03-deepagents-code-nemotron-ultra-profile.sh | 6 | # harness profile before later checks intentionally re-onboard to another model. | COMMENT |
| MEDIUM | agents/langchain-deepagents-code/policy-additions.yaml | 5 | # default, allow the terminal harness, managed inference, and normal code-hosting | COMMENT |
| MEDIUM | agents/langchain-deepagents-code/policy-additions.yaml | 30 | # Deep Agents Code is a terminal coding harness, so filesystem policy must | COMMENT |
| MEDIUM | agents/langchain-deepagents-code/manifest.yaml | 5 | # This is a terminal-oriented harness: there is no long-running gateway or | COMMENT |
| MEDIUM | agents/langchain-deepagents-code/dcode-wrapper.sh | 653 | # state and therefore invalid in the managed harness. | COMMENT |
| MEDIUM | scripts/openclaw-config-guard.py | 1344 | # harness, retain their explicit compatibility path. Current images | COMMENT |
| MEDIUM | scripts/nemoclaw-start.sh | 2640 | # exit, timeout reduction, and token cleanup for a more comprehensive fix. | COMMENT |
| MEDIUM | scripts/nemoclaw-start.sh | 2995 | # but kept robust) can bump again. The set is otherwise small and | COMMENT |
| MEDIUM | scripts/nemoclaw-start.sh | 4401 | # is robust to every here-doc shape, not only the | COMMENT |
| MEDIUM | src/lib/actions/sandbox/policy-list-render.test.ts | 60 | // description, so keying off the marker+name is robust to that suffix. | COMMENT |
| MEDIUM | …c/lib/actions/sandbox/sessions/gateway-rpc-envelope.ts | 35 | // 1. Single-line JSON candidates in reverse order — robust to log noise | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-config.yaml | 12 | # Usage: | COMMENT |
| LOW | …/e2e/e2e-cloud-experimental/openclaw-tui-in-sandbox.sh | 13 | # Usage: | COMMENT |
| LOW | test/e2e/e2e-cloud-experimental/cleanup.sh | 9 | # Usage: | COMMENT |
| LOW | …features/skill/lib/validate_sandbox_openclaw_skills.sh | 9 | # Usage: | COMMENT |
| LOW | test/e2e/lib/install-path-refresh.sh | 14 | # Usage: | COMMENT |
| LOW | …r-cross-issue-sweep/scripts/search-candidate-issues.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/check-spdx-headers.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/debug.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/check-installer-hash.sh | 12 | # Usage: | COMMENT |
| LOW | scripts/start-services.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/update-hermes-agent.sh | 34 | # Usage: | COMMENT |
| LOW | scripts/update-docker-pin.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/walkthrough.sh | 30 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 106 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 193 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 263 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 509 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 598 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 649 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 689 | # Usage: | COMMENT |
| LOW | scripts/lib/sandbox-init.sh | 716 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/e2e/lib/openclaw-agent-json.py | 19 | CODE | |
| LOW | …law-maintainer-pr-comparator/scripts/render-verdict.py | 38 | CODE | |
| LOW | …-maintainer-cross-issue-sweep/scripts/render-report.py | 36 | CODE | |
| LOW | …-update-dependencies/scripts/collect-release-ledger.py | 7 | CODE | |
| LOW | agents/hermes/validate-env-secret-boundary.py | 17 | CODE | |
| LOW | agents/hermes/build-mcp-digest.py | 6 | CODE | |
| LOW | agents/hermes/runtime-config-guard.py | 7 | CODE | |
| LOW | agents/hermes/finalize-tirith-marker.py | 5 | CODE | |
| LOW | agents/hermes/seed-dashboard-config.py | 48 | CODE | |
| LOW | agents/hermes/patch-session-list-preview.py | 25 | CODE | |
| LOW | agents/hermes/mcp-config-transaction.py | 25 | CODE | |
| LOW | …ain-deepagents-code/validate-nemotron-ultra-profile.py | 5 | CODE | |
| LOW | …nts/langchain-deepagents-code/managed-dcode-runtime.py | 6 | CODE | |
| LOW | …ts/langchain-deepagents-code/validate-observability.py | 5 | CODE | |
| LOW | …eepagents-code/validate-progressive-tool-disclosure.py | 5 | CODE | |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 5 | CODE | |
| LOW | …chain-deepagents-code/patch-managed-deepagents-code.py | 22 | CODE | |
| LOW | …/langchain-deepagents-code/dcode-session-supervisor.py | 5 | CODE | |
| LOW | …ile-plugin/src/nemoclaw_deepagents_profile/__init__.py | 5 | CODE | |
| LOW | scripts/openclaw-config-guard.py | 18 | CODE | |
| LOW | scripts/state-dir-guard.py | 17 | CODE | |
| LOW | scripts/generate-platform-docs.py | 19 | CODE | |
| LOW | scripts/managed-gateway-control.py | 44 | CODE | |
| LOW | scripts/lib/normalize_mutable_config_perms.py | 7 | CODE | |
| LOW | scripts/e2e/sanitize-trace-timing.py | 19 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/onboard-selection.test.ts | 3672 | retryAnswer: "nvapi-fake-key-value", | CODE |
| LOW | test/e2e/live/inference-routing.test.ts | 95 | const compatibleKey = "fake-key-for-unreachable-test"; | CODE |
| LOW | test/e2e/live/inference-routing.test.ts | 188 | E2E_API_KEY: "e2e-fake-key", | CODE |
| LOW | test/e2e/live/inference-routing.test.ts | 190 | redactionValues: ["e2e-fake-key"], | CODE |
| LOW | test/e2e/live/token-rotation.test.ts | 41 | telegram: process.env.TELEGRAM_BOT_TOKEN_A ?? "test-fake-token-A-rotation-e2e", | CODE |
| LOW | test/e2e/live/token-rotation.test.ts | 48 | telegram: process.env.TELEGRAM_BOT_TOKEN_B ?? "test-fake-token-B-rotation-e2e", | CODE |
| LOW | test/e2e/live/openclaw-plugin-runtime-exdev.test.ts | 1019 | COMPATIBLE_API_KEY: "nemoclaw-exdev-dummy-key", | CODE |
| LOW | test/e2e/live/openclaw-plugin-runtime-exdev.test.ts | 1022 | NEMOCLAW_PROVIDER_KEY: "nemoclaw-exdev-dummy-key", | CODE |
| LOW⚡ | test/e2e/lib/hermetic-compatible-inference.sh | 14 | local fake_key | CODE |
| LOW⚡ | test/e2e/lib/hermetic-compatible-inference.sh | 15 | fake_key="${NEMOCLAW_E2E_COMPATIBLE_API_KEY:-e2e-compatible-key}" | CODE |
| LOW⚡ | test/e2e/lib/hermetic-compatible-inference.sh | 24 | export FAKE_OPENAI_API_KEY="$fake_key" | CODE |
| LOW | test/e2e/lib/hermetic-compatible-inference.sh | 38 | export COMPATIBLE_API_KEY="$fake_key" | CODE |
| LOW | .github/workflows/e2e.yaml | 3491 | TELEGRAM_BOT_TOKEN_A: "test-fake-token-A-rotation-e2e" | CODE |
| LOW | .github/workflows/e2e.yaml | 3492 | TELEGRAM_BOT_TOKEN_B: "test-fake-token-B-rotation-e2e" | CODE |
| LOW | .github/workflows/e2e.yaml | 3664 | # the legacy fake-token defaults, optional _REAL secret overrides, | COMMENT |
| LOW | src/lib/messaging/persistence.ts | 73 | "credentialId" | "sourceInput" | "providerName" | "placeholder" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …law-maintainer-pr-comparator/scripts/render-verdict.py | 29 | "closest_to_ready": null, | STRING |
| HIGH | …ts/langchain-deepagents-code/nemoclaw_observability.py | 676 | handle = nemo_relay.scope.push( | CODE |
| HIGH | scripts/openclaw-config-guard.py | 2321 | "if (!value || typeof value!=='object' || Array.isArray(value)) process.exit(4);" | CODE |
| HIGH | scripts/lib/normalize_mutable_config_perms.py | 41 | if (!JSON5 || typeof JSON5.parse !== "function") process.exit(2); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/gateway-state-reconcile-2276.test.ts | 313 | // Step 3: routine connect must preserve the registry entry. | COMMENT |
| LOW | test/gateway-state-reconcile-2276.test.ts | 324 | // Step 4: the previously-suggested rebuild must RECOVER the stale sandbox. | COMMENT |
| LOW⚡ | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 35 | # Step 1: PRs that explicitly link the issue. | COMMENT |
| LOW⚡ | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 43 | # Step 2: Expand by files mentioned in issue body. | COMMENT |
| LOW | …aw-maintainer-pr-comparator/scripts/find-candidates.sh | 56 | # Step 3: Expand by title-token Jaccard. | COMMENT |
| LOW⚡ | scripts/update-docker-pin.sh | 35 | # Step 1: get an auth token for the Docker Hub library repo | COMMENT |
| LOW | scripts/update-docker-pin.sh | 46 | # Step 2: fetch the tag headers and use Docker-Content-Digest for the index. | COMMENT |
| LOW | src/lib/adapters/openshell/resolve.ts | 42 | // Step 1: command -v | COMMENT |
| LOW | src/lib/adapters/openshell/resolve.ts | 57 | // Step 2: fallback candidates | COMMENT |
| LOW | src/lib/actions/sandbox/rebuild-destroy-phase.ts | 60 | // Step 3: Delete sandbox without tearing down gateway or session. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | agents/hermes/start.sh | 2338 | # This function is called from an `if ! ...` recovery branch, where Bash | COMMENT |
| MEDIUM | …ts/langchain-deepagents-code/nemoclaw_observability.py | 903 | # This method is called only after leaving the handler's ``except`` | COMMENT |
| MEDIUM | scripts/nemoclaw-start.sh | 4568 | # Create the log through a same-directory temp file and rename it into place. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | agents/hermes/runtime-config-guard.py | 1545 | def _set_inode_flags(fd: int, flags: int) -> None: | CODE |
| LOW | …ngchain-deepagents-code/progressive_tool_disclosure.py | 607 | __all__ = [ | CODE |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 76 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 833 | def set_handler(self, _handler: Any, inherit: bool = True) -> None: | CODE |
| LOW | …ts/langchain-deepagents-code/nemoclaw_observability.py | 836 | def set_handlers(self, _handlers: list[Any], inherit: bool = True) -> None: | CODE |
| LOW | …chain-deepagents-code/patch-managed-deepagents-code.py | 989 | def set_auto_update(enabled: bool) -> None: | CODE |
| LOW | …ile-plugin/src/nemoclaw_deepagents_profile/__init__.py | 273 | __all__ = ["register"] | CODE |
| LOW | scripts/openclaw-config-guard.py | 2073 | def _set_inode_flags(fd: int, flags: int | None) -> None: | CODE |
| LOW | scripts/openclaw-config-guard.py | 2831 | def _set_dir(fd: int, uid: int, gid: int, mode: int, freeze_mode: int) -> None: | CODE |
| LOW | scripts/state-dir-guard.py | 273 | def _set_inode_flags(fd: int, flags: int | None) -> None: | CODE |
| LOW | scripts/lib/normalize_mutable_config_perms.py | 114 | def set_mode(child_fd: int, mode: int, *, required: bool = False) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/lib/state/config-io.ts | 74 | " # If you can use sudo, repair the existing config directory:", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/nemoclaw-start.sh | 4196 | # Check if shields were previously active (config dir is root-owned). | COMMENT |