OpenShell is the safe, private runtime for autonomous AI agents.
This report presents the forensic synthetic code analysis of NVIDIA/OpenShell, a Rust project with 8,406 GitHub stars. SynthScan v2.0 examined 576,684 lines of code across 1329 source files, recording 1611 pattern matches distributed across 17 syntactic categories. The overall adjusted score of 4.5 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1611 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tasks/vm.toml | 15 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tasks/vm.toml | 17 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 51 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 53 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 63 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 65 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 139 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 141 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 146 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 148 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 18 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 20 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 28 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 30 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 37 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 39 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/sandbox.sh | 59 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/sandbox.sh | 61 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 30 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 73 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 75 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 136 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 138 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 320 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 325 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 334 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 336 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 341 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 349 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 445 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 450 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 459 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 466 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 36 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 38 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 231 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 233 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 248 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 260 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 387 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 394 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 406 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 411 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 427 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 433 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 511 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 516 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 66 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 68 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 106 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 108 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 119 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 121 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 137 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 139 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 162 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 164 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/vm/download-kernel-runtime.sh | 33 | # ── Auto-detect platform (detect_platform from _lib.sh) ───────────────── | COMMENT |
| MEDIUM | tasks/scripts/vm/download-kernel-runtime.sh | 72 | # ── Check for gh CLI ──────────────────────────────────────────────────── | COMMENT |
| 319 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | buf.yaml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | .packit.yaml | 21 | # precomputed identity. Local Packit runs fall back to the latest SemVer | COMMENT |
| LOW | tasks/typescript.toml | 61 | depends = [ | COMMENT |
| LOW | tasks/vm.toml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tasks/scripts/verify-static-binary.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/verify-static-binary.sh | 21 | # dependencies". The checks below therefore require, for each binary: | COMMENT |
| LOW | tasks/scripts/verify-telemetry-compiled-out.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/keycloak-k8s-setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/sandbox.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/container-engine.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/container-engine.sh | 21 | # | COMMENT |
| LOW | tasks/scripts/container-engine.sh | 241 | [[ "${CONTAINER_ENGINE}" == "podman" ]] | COMMENT |
| LOW | tasks/scripts/container-engine.sh | 461 | # | COMMENT |
| LOW | tasks/scripts/package-deb.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/package-deb-install.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/gateway.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/gateway-docker.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/gateway-podman.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/gateway-vm.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/gateway-vm.sh | 21 | # OPENSHELL_SERVER_PORT=18091 mise run gateway:vm | COMMENT |
| LOW | tasks/scripts/helm-k3s-local.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/build-env.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/download-kernel-runtime.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/compress-vm-runtime.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun-macos.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/_lib.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/package-vm-runtime.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/vm-setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/smoke-orphan-cleanup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun.sh | 161 | # base config and runs olddefconfig, then builds the kernel image in one | COMMENT |
| LOW | …s/openshell-driver-mxc/tests/policy_mapper_examples.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-driver-mxc/tests/wxc_exec_real.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-driver-mxc/tests/wxc_exec_real.rs | 21 | //! | COMMENT |
| LOW | …tes/openshell-driver-mxc/tests/policy_mapper_matrix.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …tes/openshell-driver-mxc/tests/policy_mapper_matrix.rs | 1041 | COMMENT | |
| LOW | …tes/openshell-driver-mxc/tests/policy_mapper_matrix.rs | 1061 | "network_policies", | COMMENT |
| LOW | crates/openshell-driver-mxc/examples/demo.yaml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-driver-mxc/examples/demo.yaml | 21 | COMMENT | |
| LOW | crates/openshell-driver-mxc/examples/mxc-gateway.toml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …enshell-driver-mxc/examples/e2e-policies/fs-empty.yaml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …l-driver-mxc/examples/e2e-policies/network-reject.yaml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-driver-mxc/src/policy.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-driver-mxc/src/policy.rs | 21 | COMMENT | |
| LOW | crates/openshell-driver-mxc/src/lib.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-driver-mxc/src/lib.rs | 21 | mod grpc; | COMMENT |
| LOW | crates/openshell-driver-mxc/src/mxc.rs | 41 | } | COMMENT |
| LOW | crates/openshell-driver-mxc/src/driver.rs | 41 | /// write to any ungranted path is denied by the OS. No persistent session. | COMMENT |
| LOW | crates/openshell-driver-mxc/src/policy_map/mod.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-driver-mxc/src/policy_map/mod.rs | 21 | //! - [`split_policy`] — the *lossless* split for the Windows MXC compute | COMMENT |
| LOW | crates/openshell-driver-mxc/src/policy_map/map.rs | 61 | } | COMMENT |
| LOW | crates/openshell-ocsf/src/lib.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/builders/mod.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/activity.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/activity.rs | 21 | COMMENT | |
| LOW | crates/openshell-ocsf/src/enums/action.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/security.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/severity.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/auth.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/http_method.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| 575 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .packit.yaml | 27 | # Step 1: Create source tarball from git working tree. | COMMENT |
| LOW⚡ | .packit.yaml | 31 | # Step 2: Create vendored Cargo dependencies tarball for offline RPM build. | COMMENT |
| LOW⚡ | .packit.yaml | 33 | # Step 3: Return the primary archive name. Packit expects create-archive | COMMENT |
| LOW | crates/openshell-cli/src/oidc_auth.rs | 329 | // Step 1: Request device and user codes | COMMENT |
| LOW | crates/openshell-cli/src/oidc_auth.rs | 366 | // Step 2: Display instructions to the user | COMMENT |
| LOW | crates/openshell-cli/src/oidc_auth.rs | 380 | // Step 3: Poll the token endpoint | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 921 | // Step 3: Resolve gateway address (handle loopback override). | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 928 | // Step 4: Build the ProxyCommand using our own binary. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 966 | // Step 6: Cancel log stream and pause event handler before suspending. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 972 | // Step 7: Suspend TUI — leave alternate screen, disable raw mode. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 981 | // Step 8: Spawn SSH as child process and wait. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 793 | // Step 1: Fetch sandbox metadata (providers, sandbox ID). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 817 | // Step 2: Fetch the current live policy (includes updates since creation). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 872 | // Step 1: Get sandbox ID. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 898 | // Step 2: Create SSH session. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 943 | // Step 5: Build the SSH command. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 998 | // Step 9: Resume and draw the TUI before accepting new terminal input. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1029 | // Step 1: Resolve sandbox → SSH session (same as handle_shell_connect). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1077 | // Step 2: Resolve gateway and build ProxyCommand (same as handle_shell_connect). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1099 | // Step 3: Build SSH command — same flags as handle_shell_connect but with | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1129 | // Step 4: Suspend TUI. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1142 | // Step 5: Run command — blocks until user Ctrl-C's or command exits. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1159 | // Step 6: Resume TUI. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 729 | // Step 1: Wait for SupervisorHello. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 755 | // Step 2: Create and register the outbound channel. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 772 | // Step 3: Send SessionAccepted. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 810 | // Step 4: Spawn the session loop that reads inbound messages. | COMMENT |
| LOW | crates/openshell-server/src/grpc/policy.rs | 12604 | // Step 1: mechanistic submits a broad L4 grant; the prover flags it | COMMENT |
| LOW | crates/openshell-server/src/grpc/policy.rs | 12667 | // Step 2: the agent refines into a narrow L7 proposal for the SAME | COMMENT |
| LOW | deploy/helm/openshell/values.yaml | 319 | # WARNING: The RBAC Role grants read/write access to ALL Secrets in the | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 35 | ## Step 1: Gather the Problem Statement | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 63 | ## Step 2: Deep Codebase Investigation | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 112 | ## Step 3: Determine Labels | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 129 | ## Step 4: Create the GitHub Issue | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 227 | ## Step 5: Report to User | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 22 | ## Step 1: Identify Relevant Commits | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 45 | ## Step 2: Map Commits to Doc Pages | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 68 | ## Step 3: Read the Commit Details | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 83 | ## Step 4: Read the Current Doc Page | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 93 | ## Step 5: Draft the Update | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 128 | ## Step 6: Present the Results | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 147 | ## Step 7: Build and Verify | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 43 | ### Step 1: Check CLI Reachability | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 65 | ### Step 2: Identify the Compute Platform | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 77 | ### Step 3: Check Gateway Startup Dependencies | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 140 | ### Step 4: Check Docker-Backed Gateways | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 214 | ### Step 5: Check Podman-Backed Gateways | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 266 | ### Step 6: Check Kubernetes Helm Gateways | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 582 | ### Step 7: Check VM-Backed Gateways | COMMENT |
| LOW⚡ | .agents/skills/triage-issue/SKILL.md | 85 | ## Step 1: Fetch the Issue | COMMENT |
| LOW⚡ | .agents/skills/triage-issue/SKILL.md | 95 | ## Step 2: Check for Prior Triage | COMMENT |
| LOW⚡ | .agents/skills/triage-issue/SKILL.md | 104 | ## Step 3: Check Report Completeness | COMMENT |
| LOW | .agents/skills/triage-issue/SKILL.md | 116 | ## Step 4: Check Reported Version and Known Fixes | COMMENT |
| LOW | .agents/skills/triage-issue/SKILL.md | 132 | ## Step 5: Diagnose and Validate | COMMENT |
| LOW | .agents/skills/triage-issue/SKILL.md | 162 | ## Step 6: Classify | COMMENT |
| LOW | .agents/skills/triage-issue/SKILL.md | 182 | ## Step 7: Post Triage Comment | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 74 | ### Step 0: Check the Active Gateway | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 93 | ### Step 1: Check Whether the Relevant Route Is Configured | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 119 | ### Step 2: Inspect the Provider Record | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 149 | ### Step 3: Check Local Host Reachability | COMMENT |
| 88 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | TESTING.md | 56 | def test_exec_python_serializes_callable_payload() -> None: | CODE |
| LOW | tasks/scripts/release.py | 406 | def generate_homebrew_formula( | STRING |
| LOW⚡ | tasks/scripts/sync_docs_website_test.py | 28 | def test_resolve_slug_channels() -> None: | CODE |
| LOW⚡ | tasks/scripts/sync_docs_website_test.py | 34 | def test_resolve_slug_version_requires_slug() -> None: | CODE |
| LOW⚡ | tasks/scripts/sync_docs_website_test.py | 39 | def test_resolve_slug_rejects_unsafe_characters() -> None: | CODE |
| LOW⚡ | tasks/scripts/sync_docs_website_test.py | 47 | def test_resolve_display_name() -> None: | CODE |
| LOW | tasks/scripts/sync_docs_website_test.py | 58 | def test_ordered_entries_pins_latest_then_dev() -> None: | CODE |
| LOW | tasks/scripts/sync_docs_website_test.py | 68 | def test_prefix_navigation_paths() -> None: | CODE |
| LOW | tasks/scripts/sync_docs_website_test.py | 116 | def test_sync_docs_creates_snapshot(tmp_path: Path) -> None: | CODE |
| LOW | tasks/scripts/sync_docs_website_test.py | 148 | def test_remove_docs_drops_snapshot(tmp_path: Path) -> None: | CODE |
| LOW | python/release_tooling_test.py | 25 | def test_exact_tag_versions_are_stable_release_versions() -> None: | CODE |
| LOW | python/release_tooling_test.py | 36 | def test_dev_versions_share_one_build_identity() -> None: | CODE |
| LOW | python/release_tooling_test.py | 47 | def test_semver_tag_parser_excludes_vm_tags() -> None: | CODE |
| LOW⚡ | python/wheel_verifier_test.py | 68 | def test_accepts_pure_python_sdk_wheel(tmp_path: Path) -> None: | CODE |
| LOW⚡ | python/wheel_verifier_test.py | 74 | def test_requires_exactly_one_wheel_in_directory(tmp_path: Path) -> None: | CODE |
| LOW⚡ | python/wheel_verifier_test.py | 82 | def test_rejects_missing_generated_proto(tmp_path: Path) -> None: | CODE |
| LOW⚡ | python/wheel_verifier_test.py | 98 | def test_rejects_bundled_windows_cli(tmp_path: Path) -> None: | CODE |
| LOW⚡ | python/wheel_verifier_test.py | 106 | def test_rejects_openshell_console_script(tmp_path: Path) -> None: | CODE |
| LOW⚡ | python/wheel_verifier_test.py | 116 | def test_rejects_native_extension(tmp_path: Path) -> None: | CODE |
| LOW | python/wheel_verifier_test.py | 132 | def test_rejects_platform_wheel(tmp_path: Path) -> None: | CODE |
| LOW | python/wheel_verifier_test.py | 139 | def test_rejects_unexpected_version(tmp_path: Path) -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 45 | def _client_credentials_fixture() -> dict[str, Any]: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 53 | def test_oauth_client_credentials_conformance_fixture() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 63 | def test_client_credentials_auth_exact_form_cache_and_redaction() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 644 | def test_load_cluster_bearer_token_returns_none_when_missing( | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 650 | def test_load_cluster_bearer_token_tolerates_unreadable_file( | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 659 | def test_load_cluster_bearer_token_rejects_missing_access_token( | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 800 | def test_tls_config_rejects_partial_client_identity() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 808 | def test_tls_config_allows_empty_for_system_roots() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 819 | def test_cluster_bearer_provider_reloads_on_every_call(tmp_path: Path) -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1477 | def test_mtls_only_from_active_cluster_skips_bearer_interceptor( | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1516 | def test_sandbox_client_close_invokes_bearer_close() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 2254 | def test_sandbox_ref_retains_gateway_labels() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 2264 | def test_sandbox_ref_includes_main_process_result() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 2273 | def test_returned_labels_are_immutable() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 2281 | def test_direct_sandbox_ref_construction_defaults_labels() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 2393 | def test_create_passes_workspace_to_proto() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 114 | def test_client_credentials_auth_preserves_explicit_empty_scopes() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 150 | def test_client_credentials_auth_rejects_invalid_expiry(expires_in: object) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 181 | def test_client_credentials_auth_refuses_discovery_redirect(status: int) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 208 | def test_client_credentials_auth_refuses_token_redirect(status: int) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 242 | def test_client_credentials_auth_rejects_discovery_issuer_mismatch() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 264 | def test_client_credentials_auth_rejects_oversized_response() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 282 | def test_client_credentials_auth_single_flight_and_retry() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 323 | def test_client_credentials_auth_fails_closed_and_redacts_errors() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 354 | def test_client_credentials_auth_does_not_use_stale_token_after_renewal_failure() -> ( | CODE |
| LOW | python/openshell/sandbox_test.py | 440 | def test_exec_sends_stdin_payload() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 451 | def test_exec_python_serializes_callable_payload() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 471 | def test_from_active_cluster_reads_gateway_metadata_layout( | CODE |
| LOW | python/openshell/sandbox_test.py | 497 | def test_from_active_cluster_prefers_openshell_gateway_env( | CODE |
| LOW | python/openshell/sandbox_test.py | 557 | def test_normalize_bearer_accepts_str_or_callable() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 576 | def test_bearer_interceptor_attaches_authorization_header() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 596 | def test_bearer_interceptor_handles_empty_metadata() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 609 | def test_bearer_interceptor_calls_token_provider_per_request() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 627 | def test_load_cluster_bearer_token_reads_oidc_token_json(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 704 | def test_from_active_cluster_loads_bearer_when_auth_mode_is_oidc( | CODE |
| LOW | python/openshell/sandbox_test.py | 722 | def test_from_active_cluster_ignores_stale_token_when_auth_mode_not_oidc( | CODE |
| LOW | python/openshell/sandbox_test.py | 742 | def test_from_active_cluster_https_oidc_without_mtls_uses_tls_with_system_roots( | CODE |
| LOW | python/openshell/sandbox_test.py | 776 | def test_from_active_cluster_https_ca_only_layout( | CODE |
| LOW | python/openshell/sandbox_test.py | 834 | def test_cluster_bearer_provider_raises_on_expired_token(tmp_path: Path) -> None: | CODE |
| 191 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .packit.yaml | 27 | # Step 1: Create source tarball from git working tree. | COMMENT |
| LOW⚡ | .packit.yaml | 31 | # Step 2: Create vendored Cargo dependencies tarball for offline RPM build. | COMMENT |
| LOW⚡ | .packit.yaml | 33 | # Step 3: Return the primary archive name. Packit expects create-archive | COMMENT |
| LOW | crates/openshell-cli/src/oidc_auth.rs | 329 | // Step 1: Request device and user codes | COMMENT |
| LOW | crates/openshell-cli/src/oidc_auth.rs | 366 | // Step 2: Display instructions to the user | COMMENT |
| LOW | crates/openshell-cli/src/oidc_auth.rs | 380 | // Step 3: Poll the token endpoint | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 921 | // Step 3: Resolve gateway address (handle loopback override). | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 928 | // Step 4: Build the ProxyCommand using our own binary. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 966 | // Step 6: Cancel log stream and pause event handler before suspending. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 972 | // Step 7: Suspend TUI — leave alternate screen, disable raw mode. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 981 | // Step 8: Spawn SSH as child process and wait. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 793 | // Step 1: Fetch sandbox metadata (providers, sandbox ID). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 817 | // Step 2: Fetch the current live policy (includes updates since creation). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 872 | // Step 1: Get sandbox ID. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 898 | // Step 2: Create SSH session. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 943 | // Step 5: Build the SSH command. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 998 | // Step 9: Resume and draw the TUI before accepting new terminal input. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1029 | // Step 1: Resolve sandbox → SSH session (same as handle_shell_connect). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1077 | // Step 2: Resolve gateway and build ProxyCommand (same as handle_shell_connect). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1099 | // Step 3: Build SSH command — same flags as handle_shell_connect but with | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1129 | // Step 4: Suspend TUI. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1142 | // Step 5: Run command — blocks until user Ctrl-C's or command exits. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1159 | // Step 6: Resume TUI. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 729 | // Step 1: Wait for SupervisorHello. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 755 | // Step 2: Create and register the outbound channel. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 772 | // Step 3: Send SessionAccepted. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 810 | // Step 4: Spawn the session loop that reads inbound messages. | COMMENT |
| LOW | crates/openshell-server/src/grpc/policy.rs | 12604 | // Step 1: mechanistic submits a broad L4 grant; the prover flags it | COMMENT |
| LOW | crates/openshell-server/src/grpc/policy.rs | 12667 | // Step 2: the agent refines into a narrow L7 proposal for the SAME | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 155 | # Step 1: Remove dangling (untagged) images | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 174 | # Step 2: Remove stale tagged images | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 218 | # Step 3: Remove unused volumes | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 255 | # Step 4: Prune build cache | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 271 | # Step 5: Clean up any newly-dangling images left after tagged image removal | COMMENT |
| LOW⚡ | e2e/rust/tests/custom_image.rs | 70 | // Step 1: Write a temporary Dockerfile. | COMMENT |
| LOW⚡ | e2e/rust/tests/custom_image.rs | 79 | // Step 2: Create a sandbox from the Dockerfile. | COMMENT |
| LOW | e2e/rust/tests/custom_image.rs | 97 | // Step 3: Verify the marker file content appears in the output. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/openshell-server/src/inference.rs | 2952 | "dummy-token", | CODE |
| LOW | crates/openshell-server/src/grpc/provider.rs | 11221 | "placeholder".to_string(), | CODE |
| LOW | crates/openshell-server/src/grpc/provider.rs | 11293 | "placeholder".to_string(), | CODE |
| LOW | crates/openshell-server/src/grpc/provider.rs | 11791 | "placeholder".to_string(), | CODE |
| LOW | crates/openshell-server/src/grpc/provider.rs | 12140 | "placeholder".to_string(), | CODE |
| LOW | crates/openshell-supervisor-network/src/l7/relay.rs | 4692 | .expect("placeholder") | CODE |
| LOW | crates/openshell-supervisor-network/src/l7/relay.rs | 4796 | .expect("placeholder") | CODE |
| LOW | crates/openshell-supervisor-network/src/l7/relay.rs | 7905 | .expect("placeholder") | CODE |
| LOW | sdk/go/openshell/v1/workspace_test.go | 302 | PrincipalSubject: "user@example.com", | CODE |
| LOW⚡ | sdk/go/openshell/v1/workspace_test.go | 315 | m, err := wc.AddMember(context.Background(), "test-ws", "user@example.com", WorkspaceRoleAdmin) | CODE |
| LOW⚡ | sdk/go/openshell/v1/workspace_test.go | 319 | assert.Equal(t, "user@example.com", m.PrincipalSubject) | CODE |
| LOW⚡ | sdk/go/openshell/v1/workspace_test.go | 322 | assert.Equal(t, "user@example.com", mock.lastAddMemberReq.GetPrincipalSubject()) | CODE |
| LOW⚡ | sdk/go/openshell/v1/workspace_test.go | 331 | _, err := wc.AddMember(context.Background(), "", "user@example.com", WorkspaceRoleAdmin) | CODE |
| LOW | sdk/go/openshell/v1/workspace_test.go | 355 | _, err := wc.AddMember(context.Background(), "test-ws", "user@example.com", WorkspaceRole("invalid")) | CODE |
| LOW | sdk/go/openshell/v1/workspace_test.go | 369 | _, err := wc.AddMember(context.Background(), "test-ws", "user@example.com", WorkspaceRoleUser) | CODE |
| LOW | sdk/go/openshell/v1/workspace_test.go | 383 | err := wc.RemoveMember(context.Background(), "test-ws", "user@example.com") | CODE |
| LOW | sdk/go/openshell/v1/workspace_test.go | 394 | err := wc.RemoveMember(context.Background(), "", "user@example.com") | CODE |
| LOW | sdk/go/openshell/v1/workspace_test.go | 440 | assert.Equal(t, "user@example.com", members[0].PrincipalSubject) | CODE |
| LOW | …k/go/openshell/v1/internal/converter/workspace_test.go | 122 | PrincipalSubject: "user@example.com", | CODE |
| LOW | …k/go/openshell/v1/internal/converter/workspace_test.go | 134 | assert.Equal(t, "user@example.com", m.PrincipalSubject) | CODE |
| LOW⚡ | sdk/go/openshell/v1/fake/workspace_test.go | 145 | m, err := fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRoleAdmin) | CODE |
| LOW⚡ | sdk/go/openshell/v1/fake/workspace_test.go | 149 | assert.Equal(t, "user@example.com", m.PrincipalSubject) | CODE |
| LOW⚡ | sdk/go/openshell/v1/fake/workspace_test.go | 155 | _, err := fc.Workspaces().AddMember(context.Background(), "", "user@example.com", types.WorkspaceRoleAdmin) | CODE |
| LOW⚡ | sdk/go/openshell/v1/fake/workspace_test.go | 171 | _, err := fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRole("invalid")) | CODE |
| LOW⚡ | sdk/go/openshell/v1/fake/workspace_test.go | 179 | _, err := fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRoleAdmin) | CODE |
| LOW⚡ | sdk/go/openshell/v1/fake/workspace_test.go | 182 | _, err = fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRoleUser) | CODE |
| LOW⚡ | sdk/go/openshell/v1/fake/workspace_test.go | 189 | _, _ = fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRoleAdmin) | CODE |
| LOW⚡ | sdk/go/openshell/v1/fake/workspace_test.go | 191 | err := fc.Workspaces().RemoveMember(context.Background(), "ws", "user@example.com") | CODE |
| LOW⚡ | sdk/go/openshell/v1/fake/workspace_test.go | 201 | err := fc.Workspaces().RemoveMember(context.Background(), "", "user@example.com") | CODE |
| LOW | sdk/go/openshell/v1/fake/workspace_test.go | 243 | _, _ = fc.Workspaces().AddMember(context.Background(), "ws-a", "user@example.com", types.WorkspaceRoleAdmin) | CODE |
| LOW | sdk/go/openshell/v1/fake/workspace_test.go | 249 | assert.Equal(t, "user@example.com", membersA[0].PrincipalSubject) | CODE |
| LOW | sdk/go/openshell/v1/fake/health.go | 78 | Subject: "fake-user", | CODE |
| LOW | sdk/go/openshell/v1/fake/health_test.go | 102 | assert.Equal(t, "fake-user", user.Subject) | CODE |
| LOW | examples/multi-agent-notepad/runner.sh | 86 | "placeholder", | CODE |
| LOW | …amples/agent-driven-policy-management/sandbox-agent.sh | 44 | "placeholder", | CODE |
| LOW | scripts/agents/runtime/harnesses/codex/exec.sh | 51 | "placeholder", | CODE |
| LOW | e2e/python/test_inference_routing.py | 225 | "Authorization": "Bearer dummy-key", | CODE |
| LOW | e2e/python/test_inference_routing.py | 304 | "x-api-key": "dummy-key", | CODE |
| LOW | e2e/rust/tests/cf_auth_smoke.rs | 294 | "/tmp/fake-key", | CODE |
| LOW | e2e/rust/tests/sync.rs | 207 | .args(["config", "user.email", "test@test.com"]) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/scripts/sync_docs_website.py | 12 | CODE | |
| LOW | tasks/scripts/release.py | 6 | CODE | |
| LOW | tasks/scripts/verify-python-wheel.py | 6 | CODE | |
| LOW | tasks/scripts/sync_docs_website_test.py | 11 | CODE | |
| LOW | python/release_tooling_test.py | 4 | CODE | |
| LOW | python/wheel_verifier_test.py | 4 | CODE | |
| LOW | python/openshell/sandbox_test.py | 4 | CODE | |
| LOW | python/openshell/__init__.py | 6 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/sandbox.py | 4 | CODE | |
| LOW | python/openshell/release_formula_test.py | 4 | CODE | |
| LOW | deploy/sbom/sbom_to_csv.py | 13 | CODE | |
| LOW | deploy/sbom/resolve_licenses_test.py | 4 | CODE | |
| LOW | deploy/sbom/resolve_licenses.py | 21 | CODE | |
| LOW | examples/policy-advisor/ctf.py | 22 | CODE | |
| LOW | examples/transparent-tcp-redis/redis_client.py | 6 | CODE | |
| LOW | scripts/update_license_headers.py | 19 | CODE | |
| LOW | scripts/baseline_workflow_metrics.py | 23 | CODE | |
| LOW | scripts/generate_third_party_notices.py | 18 | CODE | |
| LOW | e2e/python/test_sandbox_exec_python.py | 4 | CODE | |
| LOW | e2e/python/conftest.py | 4 | CODE | |
| LOW | e2e/python/test_sandbox_providers.py | 12 | CODE | |
| LOW | e2e/python/test_sandbox_providers.py | 26 | CODE | |
| LOW | e2e/python/test_workspace_api.py | 4 | CODE | |
| LOW | e2e/python/test_inference_routing.py | 11 | CODE | |
| LOW | e2e/python/test_policy_validation.py | 11 | CODE | |
| LOW | e2e/python/test_security_tls.py | 12 | CODE | |
| LOW | e2e/python/test_sandbox_venv.py | 19 | CODE | |
| LOW | e2e/python/test_sandbox_api.py | 4 | CODE | |
| LOW | e2e/python/test_sandbox_api.py | 14 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 4 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 17 | CODE | |
| LOW | e2e/python/test_sandbox_landlock.py | 21 | CODE | |
| LOW | e2e/python/oidc/oidc_auth_test.py | 14 | CODE | |
| LOW | e2e/python/oidc/helpers.py | 9 | CODE | |
| LOW | e2e/python/oidc/workspace_authz_test.py | 15 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/sbom.toml | 6 | # Usage: | COMMENT |
| LOW | tasks/notices.toml | 6 | # Usage: | COMMENT |
| LOW | tasks/scripts/keycloak-k8s-setup.sh | 13 | # Usage: | COMMENT |
| LOW | tasks/scripts/package-deb-install.sh | 15 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/download-kernel-runtime.sh | 11 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/compress-vm-runtime.sh | 11 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun-macos.sh | 22 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/package-vm-runtime.sh | 12 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/vm-setup.sh | 13 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun.sh | 20 | # Usage: | COMMENT |
| LOW | examples/local-inference/routes.yaml | 6 | # Usage: | COMMENT |
| LOW⚡ | scripts/smoke-test-network-policy.sh | 17 | # Usage: | COMMENT |
| LOW | scripts/keycloak-dev.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/docker-cleanup.sh | 15 | # Usage: | COMMENT |
| LOW | scripts/test-release-tag.sh | 8 | # Usage: | COMMENT |
| LOW | e2e/rust/e2e-vm.sh | 22 | # Usage: | COMMENT |
| LOW | e2e/rust/e2e-openshift.sh | 11 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | e2e/python/test_sandbox_api.py | 81 | "[ -t 0 ] && printf T || printf N; " | CODE |
| HIGH⚡ | e2e/python/test_sandbox_api.py | 82 | "[ -t 1 ] && printf T || printf N; " | CODE |
| HIGH⚡ | e2e/python/test_sandbox_api.py | 83 | "[ -t 2 ] && printf T || printf N; printf '\\n'; " | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tasks/scripts/vm/build-libkrun-macos.sh | 145 | # Create the unversioned symlink that libkrun links against | COMMENT |
| MEDIUM | deploy/docker/gateway.toml | 6 | # This file is the primary configuration source for docker-compose.yml in this | COMMENT |
| MEDIUM⚡ | scripts/smoke-test-network-policy.sh | 134 | # Create a sandbox with a sleep, wait for Ready (sandboxes are kept by default). | COMMENT |
| MEDIUM⚡ | .github/workflows/release-tag.yml | 419 | # Create a tagged GitHub Release with CLI, gateway, driver, and wheels | COMMENT |
| MEDIUM | e2e/with-kube-gateway.sh | 13 | # Create a local k3d cluster via tasks/scripts/helm-k3s-local.sh, install | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/openshell-providers/src/profiles.rs | 6 | #![allow(deprecated)] // NetworkBinary::harness remains in the public proto for compatibility. | COMMENT |
| MEDIUM | scripts/agents/run.sh | 89 | [[ $# -ge 2 ]] || fail "--harness requires a value" | CODE |
| MEDIUM | scripts/agents/run.sh | 186 | abort "unsupported harness: #{harness} (supported: #{supported.keys.join(', ')})" unless supported.key?(harness) | CODE |
| MEDIUM | scripts/lint-mermaid/package-lock.json | 1633 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| MEDIUM | e2e/with-podman-gateway.sh | 18 | # Podman sandbox stop timeout. The harness default is intentionally shorter | COMMENT |
| MEDIUM | e2e/with-podman-gateway.sh | 492 | # the harness discovered (e.g. via `podman machine inspect` on macOS) so | COMMENT |
| MEDIUM | e2e/mcp-conformance/client-through-openshell.sh | 9 | # script with that URL. The parent harness creates one reusable conformance | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/scripts/release.py | 176 | CODE | |
| LOW | tasks/scripts/release.py | 493 | CODE | |
| LOW | python/openshell/sandbox.py | 1413 | CODE | |
| LOW | python/openshell/sandbox.py | 274 | CODE | |
| LOW | python/openshell/sandbox.py | 909 | CODE | |
| LOW | python/openshell/sandbox.py | 1270 | CODE | |
| LOW | deploy/sbom/resolve_licenses.py | 400 | CODE | |
| LOW | examples/policy-advisor/ctf.py | 388 | CODE | |
| LOW | e2e/python/test_sandbox_providers.py | 334 | CODE | |
| LOW | e2e/python/test_inference_routing.py | 57 | CODE | |
| LOW | e2e/python/test_sandbox_api.py | 66 | CODE | |
| LOW | e2e/python/test_sandbox_api.py | 74 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 97 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 202 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 280 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 100 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 210 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 283 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/scripts/sync_docs_website.py | 354 | except Exception as exc: | CODE |
| MEDIUM | tasks/scripts/sync_docs_website.py | 347 | def main() -> None: | CODE |
| LOW | python/openshell/__init__.py | 29 | except Exception: | CODE |
| LOW | python/openshell/sandbox.py | 358 | except Exception: | CODE |
| LOW | examples/policy-advisor/ctf.py | 213 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | examples/policy-advisor/ctf.py | 258 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/agents/runtime/supervisor.sh | 63 | except Exception: | CODE |
| LOW | e2e/python/test_inference_routing.py | 268 | except Exception as e: | CODE |
| LOW | e2e/python/test_inference_routing.py | 368 | except Exception as exc: | CODE |
| LOW | e2e/python/test_sandbox_policy.py | 1642 | except Exception as e: | CODE |
| LOW | e2e/python/test_sandbox_policy.py | 1652 | except Exception as e: | CODE |
| LOW | e2e/rust/tests/podman_corporate_proxy.rs | 346 | except Exception as err: | CODE |
| LOW | e2e/rust/tests/forward_proxy_l7_bypass.rs | 127 | except Exception as e: | CODE |
| LOW | e2e/rust/tests/forward_proxy_l7_bypass.rs | 170 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | e2e/with-podman-gateway.sh | 17 | # Set OPENSHELL_E2E_PODMAN_STOP_TIMEOUT_SECS to override the managed gateway's | COMMENT |
| LOW | e2e/with-kube-gateway.sh | 19 | # Set OPENSHELL_E2E_KUBE_EXTRA_VALUES to one or more colon-separated Helm values | COMMENT |
| LOW | e2e/with-kube-gateway.sh | 38 | # Set OPENSHELL_E2E_KUBE_EXTERNAL_POSTGRES_SECRET to create an ephemeral | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/scripts/sync_docs_website.py | 238 | def update_docs_yml(docs_yml: Path, updated: VersionEntry, fern_dir: Path) -> None: | CODE |
| LOW | python/openshell/__init__.py | 32 | __all__ = [ | CODE |
| LOW | deploy/sbom/resolve_licenses.py | 337 | def set_license(comp: dict, license_id: str) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | providers/github.yaml | 19 | # writes require an explicit policy proposal so the agentic loop + | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/openshell/sandbox.py | 1169 | CODE |