Repository Analysis

NVIDIA/OpenShell

OpenShell is the safe, private runtime for autonomous AI agents.

6.8 Low AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of NVIDIA/OpenShell, a Rust project with 7,695 GitHub stars. SynthScan v2.0 examined 321,207 lines of code across 763 source files, recording 1264 pattern matches distributed across 16 syntactic categories. The overall adjusted score of 6.8 places this repository in the Low AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

6.8
Adjusted Score
6.8
Raw Score
100%
Time Factor
2026-07-14
Last Push
7.7K
Stars
Rust
Language
321.2K
Lines of Code
763
Files
1.3K
Pattern Hits
2026-07-14
Scan Date
0.00
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 0MEDIUM 353LOW 911

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 1264 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Decorative Section Separators339 hits · 1152 pts
SeverityFileLineSnippetContext
MEDIUMtasks/vm.toml15# ═══════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMtasks/vm.toml17# ═══════════════════════════════════════════════════════════════════════════COMMENT
MEDIUMtasks/scripts/keycloak-k8s-setup.sh51# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/keycloak-k8s-setup.sh53# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/keycloak-k8s-setup.sh63# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/keycloak-k8s-setup.sh65# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/keycloak-k8s-setup.sh139# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/keycloak-k8s-setup.sh141# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/keycloak-k8s-setup.sh146# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/keycloak-k8s-setup.sh148# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/sandbox.sh18# -------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/sandbox.sh20# -------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/sandbox.sh28# -------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/sandbox.sh30# -------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/sandbox.sh37# -------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/sandbox.sh39# -------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/sandbox.sh59# -------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/sandbox.sh61# -------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/docker-publish-multiarch.sh28# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/docker-publish-multiarch.sh30# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/docker-publish-multiarch.sh73# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/docker-publish-multiarch.sh75# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/docker-publish-multiarch.sh136# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/docker-publish-multiarch.sh138# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh320# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh325# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh334# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh336# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh341# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh349# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh445# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh450# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh459# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh466# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh36# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh38# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh231# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh233# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh248# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh260# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh387# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh394# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh406# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh411# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh427# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh433# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh511# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/container-engine.sh516# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh66# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh68# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh106# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh108# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh119# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh121# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh137# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh139# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh162# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh164# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh170# ---------------------------------------------------------------------------COMMENT
MEDIUMtasks/scripts/package-deb.sh172# ---------------------------------------------------------------------------COMMENT
279 more matches not shown…
Over-Commented Block455 hits · 446 pts
SeverityFileLineSnippetContext
LOW.packit.yaml21 # precomputed identity. Local Packit runs fall back to the latest SemVerCOMMENT
LOWtasks/vm.toml1# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWtasks/scripts/verify-telemetry-compiled-out.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/keycloak-k8s-setup.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/sandbox.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/container-engine.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/container-engine.sh21#COMMENT
LOWtasks/scripts/container-engine.sh241 [[ "${CONTAINER_ENGINE}" == "podman" ]]COMMENT
LOWtasks/scripts/container-engine.sh461#COMMENT
LOWtasks/scripts/package-deb.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/package-deb-install.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/gateway.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/gateway-docker.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/gateway-vm.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/gateway-vm.sh21# OPENSHELL_SERVER_PORT=18091 mise run gateway:vmCOMMENT
LOWtasks/scripts/helm-k3s-local.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/vm/download-kernel-runtime.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/vm/compress-vm-runtime.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/vm/build-libkrun-macos.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/vm/_lib.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/vm/package-vm-runtime.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/vm/vm-setup.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/vm/smoke-orphan-cleanup.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/vm/build-libkrun.sh1#!/usr/bin/env bashCOMMENT
LOWtasks/scripts/vm/build-libkrun.sh161# base config and runs olddefconfig, then builds the kernel image in oneCOMMENT
LOWcrates/openshell-ocsf/src/lib.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/builders/mod.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/enums/activity.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/enums/activity.rs21COMMENT
LOWcrates/openshell-ocsf/src/enums/action.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/enums/security.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/enums/severity.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/enums/auth.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/enums/http_method.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/enums/disposition.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/enums/launch.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/objects/firewall_rule.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-ocsf/src/objects/http.rs21/// OCSF HTTP Response object.COMMENT
LOWcrates/openshell-ocsf/src/objects/connection.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOW…ates/openshell-ocsf/src/tracing_layers/event_bridge.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOW…ates/openshell-ocsf/src/tracing_layers/event_bridge.rs21COMMENT
LOWcrates/openshell-server-macros/src/lib.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-vfio/src/pci.rs41 /// IOMMU-group companion BDFs that this guard will restore alongsideCOMMENT
LOWcrates/openshell-vfio/src/pci.rs201 fs::write(&tmp, &data)?;COMMENT
LOWcrates/openshell-vfio/src/pci.rs341/// Use this when the binding lifetime is owned by a long-lived component ratherCOMMENT
LOWcrates/openshell-vfio/src/pci.rs421}COMMENT
LOWcrates/openshell-vfio/src/lib.rs1// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.COMMENT
LOWcrates/openshell-router/src/backend.rs181/// It must match the transport the caller intends to use:COMMENT
LOWcrates/openshell-router/src/backend.rs261 let already_sent = headers.iter().any(|(h, _)| h.eq_ignore_ascii_case(name));COMMENT
LOWcrates/openshell-router/src/backend.rs281 let needs_vertex_anthropic_version = is_vertex_anthropic_rawpredict_route(route);COMMENT
LOWcrates/openshell-router/src/backend.rs741 Ok(StreamingProxyResponse {COMMENT
LOWcrates/openshell-router/src/backend.rs841/// `aws_bedrock_invoke_stream` is recognized for forward-compatibilityCOMMENT
LOWcrates/openshell-router/src/backend.rs861/// the upstream. Returns `None` when the path does not match — theCOMMENT
LOWcrates/openshell-router/src/backend.rs881 let model_id = &rest[..slash_at];COMMENT
LOWcrates/openshell-router/src/backend.rs901/// different model continue to work, while still guaranteeing theCOMMENT
LOWcrates/openshell-router/src/backend.rs941 }COMMENT
LOWcrates/openshell-policy/src/lib.rs81#[derive(Debug, Serialize, Deserialize)]COMMENT
LOWcrates/openshell-policy/src/lib.rs101 #[serde(default, skip_serializing_if = "is_zero")]COMMENT
LOWcrates/openshell-policy/src/lib.rs121 /// rather than rejected by the L7 path canonicalizer. Required forCOMMENT
LOWcrates/openshell-policy/src/lib.rs921// Sandbox UID/GID constantsCOMMENT
395 more matches not shown…
Structural Annotation Overuse152 hits · 235 pts
SeverityFileLineSnippetContext
LOW.packit.yaml27 # Step 1: Create source tarball from git working tree.COMMENT
LOW.packit.yaml31 # Step 2: Create vendored Cargo dependencies tarball for offline RPM build.COMMENT
LOW.packit.yaml33 # Step 3: Return the primary archive name. Packit expects create-archiveCOMMENT
LOWcrates/openshell-tui/src/lib.rs898 // Step 3: Resolve gateway address (handle loopback override).COMMENT
LOWcrates/openshell-tui/src/lib.rs905 // Step 4: Build the ProxyCommand using our own binary.COMMENT
LOWcrates/openshell-tui/src/lib.rs943 // Step 6: Cancel log stream and pause event handler before suspending.COMMENT
LOWcrates/openshell-tui/src/lib.rs949 // Step 7: Suspend TUI — leave alternate screen, disable raw mode.COMMENT
LOWcrates/openshell-tui/src/lib.rs958 // Step 8: Spawn SSH as child process and wait.COMMENT
LOWcrates/openshell-tui/src/lib.rs771 // Step 1: Fetch sandbox metadata (providers, sandbox ID).COMMENT
LOWcrates/openshell-tui/src/lib.rs795 // Step 2: Fetch the current live policy (includes updates since creation).COMMENT
LOWcrates/openshell-tui/src/lib.rs850 // Step 1: Get sandbox ID.COMMENT
LOWcrates/openshell-tui/src/lib.rs875 // Step 2: Create SSH session.COMMENT
LOWcrates/openshell-tui/src/lib.rs920 // Step 5: Build the SSH command.COMMENT
LOWcrates/openshell-tui/src/lib.rs975 // Step 9: Resume and draw the TUI before accepting new terminal input.COMMENT
LOWcrates/openshell-tui/src/lib.rs1005 // Step 1: Resolve sandbox → SSH session (same as handle_shell_connect).COMMENT
LOWcrates/openshell-tui/src/lib.rs1052 // Step 2: Resolve gateway and build ProxyCommand (same as handle_shell_connect).COMMENT
LOWcrates/openshell-tui/src/lib.rs1074 // Step 3: Build SSH command — same flags as handle_shell_connect but withCOMMENT
LOWcrates/openshell-tui/src/lib.rs1104 // Step 4: Suspend TUI.COMMENT
LOWcrates/openshell-tui/src/lib.rs1117 // Step 5: Run command — blocks until user Ctrl-C's or command exits.COMMENT
LOWcrates/openshell-tui/src/lib.rs1134 // Step 6: Resume TUI.COMMENT
LOWcrates/openshell-server/src/supervisor_session.rs585 // Step 1: Wait for SupervisorHello.COMMENT
LOWcrates/openshell-server/src/supervisor_session.rs611 // Step 2: Create the outbound channel and register the session.COMMENT
LOWcrates/openshell-server/src/supervisor_session.rs628 // Step 3: Send SessionAccepted.COMMENT
LOWcrates/openshell-server/src/supervisor_session.rs666 // Step 4: Spawn the session loop that reads inbound messages.COMMENT
LOWcrates/openshell-server/src/grpc/policy.rs6198 // Step 1: mechanistic submits a broad L4 grant; the prover flags itCOMMENT
LOWcrates/openshell-server/src/grpc/policy.rs6259 // Step 2: the agent refines into a narrow L7 proposal for the SAMECOMMENT
LOW.agents/skills/create-spike/SKILL.md35## Step 1: Gather the Problem StatementCOMMENT
LOW.agents/skills/create-spike/SKILL.md63## Step 2: Deep Codebase InvestigationCOMMENT
LOW.agents/skills/create-spike/SKILL.md112## Step 3: Determine LabelsCOMMENT
LOW.agents/skills/create-spike/SKILL.md127## Step 4: Create the GitHub IssueCOMMENT
LOW.agents/skills/create-spike/SKILL.md219## Step 5: Report to UserCOMMENT
LOW.agents/skills/update-docs/SKILL.md22## Step 1: Identify Relevant CommitsCOMMENT
LOW.agents/skills/update-docs/SKILL.md45## Step 2: Map Commits to Doc PagesCOMMENT
LOW.agents/skills/update-docs/SKILL.md68## Step 3: Read the Commit DetailsCOMMENT
LOW.agents/skills/update-docs/SKILL.md83## Step 4: Read the Current Doc PageCOMMENT
LOW.agents/skills/update-docs/SKILL.md93## Step 5: Draft the UpdateCOMMENT
LOW.agents/skills/update-docs/SKILL.md128## Step 6: Present the ResultsCOMMENT
LOW.agents/skills/update-docs/SKILL.md147## Step 7: Build and VerifyCOMMENT
LOW.agents/skills/debug-openshell-cluster/SKILL.md36### Step 1: Check CLI ReachabilityCOMMENT
LOW.agents/skills/debug-openshell-cluster/SKILL.md49### Step 2: Identify the Compute PlatformCOMMENT
LOW.agents/skills/debug-openshell-cluster/SKILL.md60### Step 3: Check Docker-Backed GatewaysCOMMENT
LOW.agents/skills/debug-openshell-cluster/SKILL.md113### Step 4: Check Podman-Backed GatewaysCOMMENT
LOW.agents/skills/debug-openshell-cluster/SKILL.md129### Step 5: Check Kubernetes Helm GatewaysCOMMENT
LOW.agents/skills/debug-openshell-cluster/SKILL.md322### Step 6: Check VM-Backed GatewaysCOMMENT
LOW.agents/skills/triage-issue/SKILL.md72## Step 1: Fetch the IssueCOMMENT
LOW.agents/skills/triage-issue/SKILL.md82## Step 2: Check for Prior TriageCOMMENT
LOW.agents/skills/triage-issue/SKILL.md90## Step 3: Validate the Agent-First GateCOMMENT
LOW.agents/skills/triage-issue/SKILL.md108## Step 4: Check Reported Version and Known FixesCOMMENT
LOW.agents/skills/triage-issue/SKILL.md124## Step 5: Diagnose and ValidateCOMMENT
LOW.agents/skills/triage-issue/SKILL.md149## Step 6: ClassifyCOMMENT
LOW.agents/skills/triage-issue/SKILL.md163## Step 7: Post Triage CommentCOMMENT
LOW.agents/skills/debug-inference/SKILL.md67### Step 0: Check the Active GatewayCOMMENT
LOW.agents/skills/debug-inference/SKILL.md86### Step 1: Check Whether Managed Inference Is ConfiguredCOMMENT
LOW.agents/skills/debug-inference/SKILL.md104### Step 2: Inspect the Provider RecordCOMMENT
LOW.agents/skills/debug-inference/SKILL.md129### Step 3: Check Local Host ReachabilityCOMMENT
LOW.agents/skills/debug-inference/SKILL.md143### Step 4: Check Request ShapeCOMMENT
LOW.agents/skills/debug-inference/SKILL.md167### Step 5: Probe from a SandboxCOMMENT
LOW.agents/skills/debug-inference/SKILL.md182### Step 6: Reapply or Repair the Managed RouteCOMMENT
LOW.agents/skills/debug-inference/SKILL.md198### Step 7: Diagnose Direct External InferenceCOMMENT
LOW.agents/skills/launch-openshell-gator/SKILL.md38### Step 1: Confirm Repository RootCOMMENT
92 more matches not shown…
Hyper-Verbose Identifiers175 hits · 148 pts
SeverityFileLineSnippetContext
LOWTESTING.md56def test_exec_python_serializes_callable_payload() -> None:CODE
LOWtasks/scripts/release.py371def generate_homebrew_formula(STRING
LOWtasks/scripts/sync_docs_website_test.py28def test_resolve_slug_channels() -> None:CODE
LOWtasks/scripts/sync_docs_website_test.py34def test_resolve_slug_version_requires_slug() -> None:CODE
LOWtasks/scripts/sync_docs_website_test.py39def test_resolve_slug_rejects_unsafe_characters() -> None:CODE
LOWtasks/scripts/sync_docs_website_test.py47def test_resolve_display_name() -> None:CODE
LOWtasks/scripts/sync_docs_website_test.py58def test_ordered_entries_pins_latest_then_dev() -> None:CODE
LOWtasks/scripts/sync_docs_website_test.py68def test_prefix_navigation_paths() -> None:CODE
LOWtasks/scripts/sync_docs_website_test.py116def test_sync_docs_creates_snapshot(tmp_path: Path) -> None:CODE
LOWtasks/scripts/sync_docs_website_test.py148def test_remove_docs_drops_snapshot(tmp_path: Path) -> None:CODE
LOWpython/release_tooling_test.py25def test_exact_tag_versions_are_stable_release_versions() -> None:CODE
LOWpython/release_tooling_test.py36def test_dev_versions_share_one_build_identity() -> None:CODE
LOWpython/release_tooling_test.py47def test_semver_tag_parser_excludes_vm_tags() -> None:CODE
LOWpython/openshell/sandbox_test.py283def test_load_cluster_bearer_token_returns_none_when_missing(CODE
LOWpython/openshell/sandbox_test.py289def test_load_cluster_bearer_token_tolerates_unreadable_file(CODE
LOWpython/openshell/sandbox_test.py298def test_load_cluster_bearer_token_rejects_missing_access_token(CODE
LOWpython/openshell/sandbox_test.py439def test_tls_config_rejects_partial_client_identity() -> None:CODE
LOWpython/openshell/sandbox_test.py447def test_tls_config_allows_empty_for_system_roots() -> None:CODE
LOWpython/openshell/sandbox_test.py458def test_cluster_bearer_provider_reloads_on_every_call(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py1116def test_mtls_only_from_active_cluster_skips_bearer_interceptor(CODE
LOWpython/openshell/sandbox_test.py1155def test_sandbox_client_close_invokes_bearer_close() -> None:CODE
LOWpython/openshell/sandbox_test.py1548def test_list_forwards_label_selector() -> None:CODE
LOWpython/openshell/sandbox_test.py1558def test_list_without_selector_sends_empty_string() -> None:CODE
LOWpython/openshell/sandbox_test.py1568def test_list_ids_forwards_label_selector() -> None:CODE
LOWpython/openshell/sandbox_test.py1579def test_sandbox_ref_retains_gateway_labels() -> None:CODE
LOWpython/openshell/sandbox_test.py1589def test_returned_labels_are_immutable() -> None:CODE
LOWpython/openshell/sandbox_test.py1597def test_direct_sandbox_ref_construction_defaults_labels() -> None:CODE
LOWpython/openshell/sandbox_test.py1607def test_sandbox_ref_stays_hashable_with_labels_excluded_from_identity() -> None:CODE
LOWpython/openshell/sandbox_test.py79def test_exec_sends_stdin_payload() -> None:CODE
LOWpython/openshell/sandbox_test.py90def test_exec_python_serializes_callable_payload() -> None:CODE
LOWpython/openshell/sandbox_test.py110def test_from_active_cluster_reads_gateway_metadata_layout(CODE
LOWpython/openshell/sandbox_test.py136def test_from_active_cluster_prefers_openshell_gateway_env(CODE
LOWpython/openshell/sandbox_test.py196def test_normalize_bearer_accepts_str_or_callable() -> None:CODE
LOWpython/openshell/sandbox_test.py215def test_bearer_interceptor_attaches_authorization_header() -> None:CODE
LOWpython/openshell/sandbox_test.py235def test_bearer_interceptor_handles_empty_metadata() -> None:CODE
LOWpython/openshell/sandbox_test.py248def test_bearer_interceptor_calls_token_provider_per_request() -> None:CODE
LOWpython/openshell/sandbox_test.py266def test_load_cluster_bearer_token_reads_oidc_token_json(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py343def test_from_active_cluster_loads_bearer_when_auth_mode_is_oidc(CODE
LOWpython/openshell/sandbox_test.py361def test_from_active_cluster_ignores_stale_token_when_auth_mode_not_oidc(CODE
LOWpython/openshell/sandbox_test.py381def test_from_active_cluster_https_oidc_without_mtls_uses_tls_with_system_roots(CODE
LOWpython/openshell/sandbox_test.py415def test_from_active_cluster_https_ca_only_layout(CODE
LOWpython/openshell/sandbox_test.py473def test_cluster_bearer_provider_raises_on_expired_token(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py489def test_cluster_bearer_provider_raises_when_file_missing(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py499def test_cluster_bearer_provider_raises_on_missing_access_token(CODE
LOWpython/openshell/sandbox_test.py596def test_refresher_returns_cached_token_when_fresh(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py610def test_refresher_picks_up_disk_rotation_before_refreshing(CODE
LOWpython/openshell/sandbox_test.py644def test_refresher_adopts_stale_disk_refresh_token_before_refreshing(CODE
LOWpython/openshell/sandbox_test.py686def test_refresher_resets_token_endpoint_when_disk_issuer_changes(CODE
LOWpython/openshell/sandbox_test.py727def test_refresher_recovers_from_invalid_grant_after_peer_rotation(CODE
LOWpython/openshell/sandbox_test.py775def test_refresher_reraises_invalid_grant_without_peer_rotation(CODE
LOWpython/openshell/sandbox_test.py808def test_refresher_exchanges_refresh_token_when_stale(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py825def test_refresher_writes_back_when_enabled(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py850def test_refresher_write_back_is_default(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py872def test_refresher_honors_refresh_token_rotation(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py896def test_refresher_second_process_can_refresh_after_rotation(CODE
LOWpython/openshell/sandbox_test.py929def test_refresher_concurrent_calls_share_one_refresh(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py982def test_refresher_surfaces_idp_failure_as_sandbox_error(CODE
LOWpython/openshell/sandbox_test.py1005def test_refresher_rejects_issuer_mismatch_in_discovery(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py1026def test_refresher_rejects_redirect_during_discovery(tmp_path: Path) -> None:CODE
LOWpython/openshell/sandbox_test.py1045def test_refresher_insecure_disables_tls_verification() -> None:CODE
115 more matches not shown…
Verbosity Indicators34 hits · 51 pts
SeverityFileLineSnippetContext
LOW.packit.yaml27 # Step 1: Create source tarball from git working tree.COMMENT
LOW.packit.yaml31 # Step 2: Create vendored Cargo dependencies tarball for offline RPM build.COMMENT
LOW.packit.yaml33 # Step 3: Return the primary archive name. Packit expects create-archiveCOMMENT
LOWcrates/openshell-tui/src/lib.rs898 // Step 3: Resolve gateway address (handle loopback override).COMMENT
LOWcrates/openshell-tui/src/lib.rs905 // Step 4: Build the ProxyCommand using our own binary.COMMENT
LOWcrates/openshell-tui/src/lib.rs943 // Step 6: Cancel log stream and pause event handler before suspending.COMMENT
LOWcrates/openshell-tui/src/lib.rs949 // Step 7: Suspend TUI — leave alternate screen, disable raw mode.COMMENT
LOWcrates/openshell-tui/src/lib.rs958 // Step 8: Spawn SSH as child process and wait.COMMENT
LOWcrates/openshell-tui/src/lib.rs771 // Step 1: Fetch sandbox metadata (providers, sandbox ID).COMMENT
LOWcrates/openshell-tui/src/lib.rs795 // Step 2: Fetch the current live policy (includes updates since creation).COMMENT
LOWcrates/openshell-tui/src/lib.rs850 // Step 1: Get sandbox ID.COMMENT
LOWcrates/openshell-tui/src/lib.rs875 // Step 2: Create SSH session.COMMENT
LOWcrates/openshell-tui/src/lib.rs920 // Step 5: Build the SSH command.COMMENT
LOWcrates/openshell-tui/src/lib.rs975 // Step 9: Resume and draw the TUI before accepting new terminal input.COMMENT
LOWcrates/openshell-tui/src/lib.rs1005 // Step 1: Resolve sandbox → SSH session (same as handle_shell_connect).COMMENT
LOWcrates/openshell-tui/src/lib.rs1052 // Step 2: Resolve gateway and build ProxyCommand (same as handle_shell_connect).COMMENT
LOWcrates/openshell-tui/src/lib.rs1074 // Step 3: Build SSH command — same flags as handle_shell_connect but withCOMMENT
LOWcrates/openshell-tui/src/lib.rs1104 // Step 4: Suspend TUI.COMMENT
LOWcrates/openshell-tui/src/lib.rs1117 // Step 5: Run command — blocks until user Ctrl-C's or command exits.COMMENT
LOWcrates/openshell-tui/src/lib.rs1134 // Step 6: Resume TUI.COMMENT
LOWcrates/openshell-server/src/supervisor_session.rs585 // Step 1: Wait for SupervisorHello.COMMENT
LOWcrates/openshell-server/src/supervisor_session.rs611 // Step 2: Create the outbound channel and register the session.COMMENT
LOWcrates/openshell-server/src/supervisor_session.rs628 // Step 3: Send SessionAccepted.COMMENT
LOWcrates/openshell-server/src/supervisor_session.rs666 // Step 4: Spawn the session loop that reads inbound messages.COMMENT
LOWcrates/openshell-server/src/grpc/policy.rs6198 // Step 1: mechanistic submits a broad L4 grant; the prover flags itCOMMENT
LOWcrates/openshell-server/src/grpc/policy.rs6259 // Step 2: the agent refines into a narrow L7 proposal for the SAMECOMMENT
LOWscripts/docker-cleanup.sh155# Step 1: Remove dangling (untagged) imagesCOMMENT
LOWscripts/docker-cleanup.sh174# Step 2: Remove stale tagged imagesCOMMENT
LOWscripts/docker-cleanup.sh218# Step 3: Remove unused volumesCOMMENT
LOWscripts/docker-cleanup.sh255# Step 4: Prune build cacheCOMMENT
LOWscripts/docker-cleanup.sh271# Step 5: Clean up any newly-dangling images left after tagged image removalCOMMENT
LOWe2e/rust/tests/custom_image.rs44 // Step 1: Write a temporary Dockerfile.COMMENT
LOWe2e/rust/tests/custom_image.rs53 // Step 2: Create a sandbox from the Dockerfile.COMMENT
LOWe2e/rust/tests/custom_image.rs65 // Step 3: Verify the marker file content appears in the output.COMMENT
Unused Imports39 hits · 36 pts
SeverityFileLineSnippetContext
LOWtasks/scripts/sync_docs_website.py12CODE
LOWtasks/scripts/release.py6CODE
LOWtasks/scripts/sync_docs_website_test.py11CODE
LOWpython/release_tooling_test.py4CODE
LOWpython/openshell/sandbox_test.py4CODE
LOWpython/openshell/__init__.py6CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/__init__.py8CODE
LOWpython/openshell/sandbox.py4CODE
LOWpython/openshell/release_formula_test.py4CODE
LOWdeploy/sbom/sbom_to_csv.py13CODE
LOWdeploy/sbom/resolve_licenses_test.py4CODE
LOWdeploy/sbom/resolve_licenses.py21CODE
LOWexamples/policy-advisor/ctf.py22CODE
LOWscripts/update_license_headers.py19CODE
LOWscripts/baseline_workflow_metrics.py23CODE
LOWscripts/generate_third_party_notices.py18CODE
LOWe2e/python/test_sandbox_exec_python.py4CODE
LOWe2e/python/conftest.py4CODE
LOWe2e/python/test_sandbox_providers.py12CODE
LOWe2e/python/test_inference_routing.py11CODE
LOWe2e/python/test_policy_validation.py11CODE
LOWe2e/python/test_security_tls.py12CODE
LOWe2e/python/test_sandbox_venv.py19CODE
LOWe2e/python/test_sandbox_api.py4CODE
LOWe2e/python/test_sandbox_policy.py4CODE
LOWe2e/python/test_sandbox_policy.py9CODE
LOWe2e/python/test_sandbox_policy.py16CODE
LOWe2e/python/test_sandbox_landlock.py21CODE
LOWe2e/python/oidc/oidc_auth_test.py14CODE
Example Usage Blocks17 hits · 24 pts
SeverityFileLineSnippetContext
LOWtasks/sbom.toml6# Usage:COMMENT
LOWtasks/notices.toml6# Usage:COMMENT
LOWtasks/scripts/keycloak-k8s-setup.sh13# Usage:COMMENT
LOWtasks/scripts/package-deb-install.sh15# Usage:COMMENT
LOWtasks/scripts/vm/download-kernel-runtime.sh11# Usage:COMMENT
LOWtasks/scripts/vm/compress-vm-runtime.sh11# Usage:COMMENT
LOWtasks/scripts/vm/build-libkrun-macos.sh22# Usage:COMMENT
LOWtasks/scripts/vm/package-vm-runtime.sh12# Usage:COMMENT
LOWtasks/scripts/vm/vm-setup.sh13# Usage:COMMENT
LOWtasks/scripts/vm/build-libkrun.sh20# Usage:COMMENT
LOWexamples/local-inference/routes.yaml6# Usage:COMMENT
LOWscripts/smoke-test-network-policy.sh17# Usage:COMMENT
LOWscripts/keycloak-dev.sh6# Usage:COMMENT
LOWscripts/docker-cleanup.sh15# Usage:COMMENT
LOWscripts/test-release-tag.sh8# Usage:COMMENT
LOWe2e/rust/e2e-vm.sh22# Usage:COMMENT
LOWe2e/rust/e2e-openshift.sh11# Usage:COMMENT
Self-Referential Comments6 hits · 21 pts
SeverityFileLineSnippetContext
MEDIUMtasks/scripts/vm/build-libkrun-macos.sh145# Create the unversioned symlink that libkrun links againstCOMMENT
MEDIUMdeploy/docker/gateway.toml6# This file is the primary configuration source for docker-compose.yml in thisCOMMENT
MEDIUMscripts/smoke-test-network-policy.sh134# Create a sandbox with a sleep, wait for Ready (sandboxes are kept by default).COMMENT
MEDIUM.github/workflows/release-tag.yml859 # Create a tagged GitHub Release with CLI, gateway, driver, and wheelsCOMMENT
MEDIUMe2e/with-kube-gateway.sh13# Create a local k3d cluster via tasks/scripts/helm-k3s-local.sh, installCOMMENT
MEDIUMe2e/rust/tests/custom_image.rs24# Create the sandbox user/group so the supervisor can switch to it.COMMENT
AI Slop Vocabulary6 hits · 15 pts
SeverityFileLineSnippetContext
MEDIUMcrates/openshell-providers/src/profiles.rs6#![allow(deprecated)] // NetworkBinary::harness remains in the public proto for compatibility.COMMENT
MEDIUMscripts/agents/run.sh89 [[ $# -ge 2 ]] || fail "--harness requires a value"CODE
MEDIUMscripts/agents/run.sh186abort "unsupported harness: #{harness} (supported: #{supported.keys.join(', ')})" unless supported.key?(harness)CODE
MEDIUMscripts/lint-mermaid/package-lock.json1711 "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",CODE
MEDIUMe2e/with-podman-gateway.sh427 # the harness discovered (e.g. via `podman machine inspect` on macOS) soCOMMENT
MEDIUMe2e/mcp-conformance/client-through-openshell.sh9# script with that URL. The parent harness creates one reusable conformanceCOMMENT
Excessive Try-Catch Wrapping12 hits · 12 pts
SeverityFileLineSnippetContext
LOWtasks/scripts/sync_docs_website.py354 except Exception as exc:CODE
MEDIUMtasks/scripts/sync_docs_website.py347def main() -> None:CODE
LOWpython/openshell/__init__.py26except Exception:CODE
LOWexamples/policy-advisor/ctf.py213 except Exception as exc: # noqa: BLE001CODE
LOWexamples/policy-advisor/ctf.py258 except Exception as exc: # noqa: BLE001CODE
LOWscripts/agents/runtime/supervisor.sh63except Exception:CODE
LOWe2e/python/test_inference_routing.py262 except Exception as e:CODE
LOWe2e/python/test_inference_routing.py362 except Exception as exc:CODE
LOWe2e/python/test_sandbox_policy.py1637 except Exception as e:CODE
LOWe2e/python/test_sandbox_policy.py1647 except Exception as e:CODE
LOWe2e/rust/tests/forward_proxy_l7_bypass.rs127 except Exception as e:CODE
LOWe2e/rust/tests/forward_proxy_l7_bypass.rs170except Exception as e:CODE
Deep Nesting14 hits · 10 pts
SeverityFileLineSnippetContext
LOWtasks/scripts/release.py167CODE
LOWtasks/scripts/release.py455CODE
LOWpython/openshell/sandbox.py533CODE
LOWpython/openshell/sandbox.py789CODE
LOWdeploy/sbom/resolve_licenses.py396CODE
LOWexamples/policy-advisor/ctf.py388CODE
LOWe2e/python/test_sandbox_providers.py199CODE
LOWe2e/python/test_inference_routing.py57CODE
LOWe2e/python/test_sandbox_policy.py96CODE
LOWe2e/python/test_sandbox_policy.py201CODE
LOWe2e/python/test_sandbox_policy.py279CODE
LOWe2e/python/test_sandbox_policy.py99CODE
LOWe2e/python/test_sandbox_policy.py209CODE
LOWe2e/python/test_sandbox_policy.py282CODE
Fake / Example Data8 hits · 8 pts
SeverityFileLineSnippetContext
LOWcrates/openshell-server/src/inference.rs2443 "dummy-token",CODE
LOWexamples/multi-agent-notepad/runner.sh86 "placeholder",CODE
LOW…amples/agent-driven-policy-management/sandbox-agent.sh44 "placeholder",CODE
LOWscripts/agents/runtime/harnesses/codex/exec.sh55 "placeholder",CODE
LOWe2e/python/test_inference_routing.py219 "Authorization": "Bearer dummy-key",CODE
LOWe2e/python/test_inference_routing.py298 "x-api-key": "dummy-key",CODE
LOWe2e/rust/tests/cf_auth_smoke.rs302 "/tmp/fake-key",CODE
LOWe2e/rust/tests/sync.rs207 .args(["config", "user.email", "test@test.com"])CODE
Modern Structural Boilerplate3 hits · 3 pts
SeverityFileLineSnippetContext
LOWtasks/scripts/sync_docs_website.py238def update_docs_yml(docs_yml: Path, updated: VersionEntry, fern_dir: Path) -> None:CODE
LOWpython/openshell/__init__.py29__all__ = [CODE
LOWdeploy/sbom/resolve_licenses.py337def set_license(comp: dict, license_id: str) -> None:CODE
Modern AI Meta-Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMproviders/github.yaml19 # writes require an explicit policy proposal so the agentic loop +COMMENT
Redundant / Tautological Comments2 hits · 3 pts
SeverityFileLineSnippetContext
LOWe2e/with-kube-gateway.sh19# Set OPENSHELL_E2E_KUBE_EXTRA_VALUES to one or more colon-separated Helm valuesCOMMENT
LOWe2e/with-kube-gateway.sh38# Set OPENSHELL_E2E_KUBE_EXTERNAL_POSTGRES_SECRET to create an ephemeralCOMMENT
AI Structural Patterns1 hit · 1 pts
SeverityFileLineSnippetContext
LOWpython/openshell/sandbox.py702CODE