OpenShell is the safe, private runtime for autonomous AI agents.
This report presents the forensic synthetic code analysis of NVIDIA/OpenShell, a Rust project with 7,695 GitHub stars. SynthScan v2.0 examined 321,207 lines of code across 763 source files, recording 1264 pattern matches distributed across 16 syntactic categories. The overall adjusted score of 6.8 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1264 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tasks/vm.toml | 15 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tasks/vm.toml | 17 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 51 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 53 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 63 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 65 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 139 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 141 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 146 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/keycloak-k8s-setup.sh | 148 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 18 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 20 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 28 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 30 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 37 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/sandbox.sh | 39 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/sandbox.sh | 59 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/sandbox.sh | 61 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 30 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 73 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 75 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 136 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/docker-publish-multiarch.sh | 138 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 320 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 325 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 334 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 336 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 341 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 349 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 445 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 450 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 459 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/container-engine.sh | 466 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 36 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 38 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 231 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 233 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 248 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 260 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 387 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 394 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 406 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 411 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 427 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 433 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 511 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/container-engine.sh | 516 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 66 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 68 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 106 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 108 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 119 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 121 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 137 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tasks/scripts/package-deb.sh | 139 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/package-deb.sh | 162 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/package-deb.sh | 164 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/package-deb.sh | 170 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tasks/scripts/package-deb.sh | 172 | # --------------------------------------------------------------------------- | COMMENT |
| 279 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .packit.yaml | 21 | # precomputed identity. Local Packit runs fall back to the latest SemVer | COMMENT |
| LOW | tasks/vm.toml | 1 | # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | tasks/scripts/verify-telemetry-compiled-out.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/keycloak-k8s-setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/sandbox.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/container-engine.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/container-engine.sh | 21 | # | COMMENT |
| LOW | tasks/scripts/container-engine.sh | 241 | [[ "${CONTAINER_ENGINE}" == "podman" ]] | COMMENT |
| LOW | tasks/scripts/container-engine.sh | 461 | # | COMMENT |
| LOW | tasks/scripts/package-deb.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/package-deb-install.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/gateway.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/gateway-docker.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/gateway-vm.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/gateway-vm.sh | 21 | # OPENSHELL_SERVER_PORT=18091 mise run gateway:vm | COMMENT |
| LOW | tasks/scripts/helm-k3s-local.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/download-kernel-runtime.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/compress-vm-runtime.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun-macos.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/_lib.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/package-vm-runtime.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/vm-setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/smoke-orphan-cleanup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun.sh | 161 | # base config and runs olddefconfig, then builds the kernel image in one | COMMENT |
| LOW | crates/openshell-ocsf/src/lib.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/builders/mod.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/activity.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/activity.rs | 21 | COMMENT | |
| LOW | crates/openshell-ocsf/src/enums/action.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/security.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/severity.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/auth.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/http_method.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/disposition.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/enums/launch.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/objects/firewall_rule.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-ocsf/src/objects/http.rs | 21 | /// OCSF HTTP Response object. | COMMENT |
| LOW | crates/openshell-ocsf/src/objects/connection.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …ates/openshell-ocsf/src/tracing_layers/event_bridge.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | …ates/openshell-ocsf/src/tracing_layers/event_bridge.rs | 21 | COMMENT | |
| LOW | crates/openshell-server-macros/src/lib.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-vfio/src/pci.rs | 41 | /// IOMMU-group companion BDFs that this guard will restore alongside | COMMENT |
| LOW | crates/openshell-vfio/src/pci.rs | 201 | fs::write(&tmp, &data)?; | COMMENT |
| LOW | crates/openshell-vfio/src/pci.rs | 341 | /// Use this when the binding lifetime is owned by a long-lived component rather | COMMENT |
| LOW | crates/openshell-vfio/src/pci.rs | 421 | } | COMMENT |
| LOW | crates/openshell-vfio/src/lib.rs | 1 | // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | COMMENT |
| LOW | crates/openshell-router/src/backend.rs | 181 | /// It must match the transport the caller intends to use: | COMMENT |
| LOW | crates/openshell-router/src/backend.rs | 261 | let already_sent = headers.iter().any(|(h, _)| h.eq_ignore_ascii_case(name)); | COMMENT |
| LOW | crates/openshell-router/src/backend.rs | 281 | let needs_vertex_anthropic_version = is_vertex_anthropic_rawpredict_route(route); | COMMENT |
| LOW | crates/openshell-router/src/backend.rs | 741 | Ok(StreamingProxyResponse { | COMMENT |
| LOW | crates/openshell-router/src/backend.rs | 841 | /// `aws_bedrock_invoke_stream` is recognized for forward-compatibility | COMMENT |
| LOW | crates/openshell-router/src/backend.rs | 861 | /// the upstream. Returns `None` when the path does not match — the | COMMENT |
| LOW | crates/openshell-router/src/backend.rs | 881 | let model_id = &rest[..slash_at]; | COMMENT |
| LOW | crates/openshell-router/src/backend.rs | 901 | /// different model continue to work, while still guaranteeing the | COMMENT |
| LOW | crates/openshell-router/src/backend.rs | 941 | } | COMMENT |
| LOW | crates/openshell-policy/src/lib.rs | 81 | #[derive(Debug, Serialize, Deserialize)] | COMMENT |
| LOW | crates/openshell-policy/src/lib.rs | 101 | #[serde(default, skip_serializing_if = "is_zero")] | COMMENT |
| LOW | crates/openshell-policy/src/lib.rs | 121 | /// rather than rejected by the L7 path canonicalizer. Required for | COMMENT |
| LOW | crates/openshell-policy/src/lib.rs | 921 | // Sandbox UID/GID constants | COMMENT |
| 395 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .packit.yaml | 27 | # Step 1: Create source tarball from git working tree. | COMMENT |
| LOW⚡ | .packit.yaml | 31 | # Step 2: Create vendored Cargo dependencies tarball for offline RPM build. | COMMENT |
| LOW⚡ | .packit.yaml | 33 | # Step 3: Return the primary archive name. Packit expects create-archive | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 898 | // Step 3: Resolve gateway address (handle loopback override). | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 905 | // Step 4: Build the ProxyCommand using our own binary. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 943 | // Step 6: Cancel log stream and pause event handler before suspending. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 949 | // Step 7: Suspend TUI — leave alternate screen, disable raw mode. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 958 | // Step 8: Spawn SSH as child process and wait. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 771 | // Step 1: Fetch sandbox metadata (providers, sandbox ID). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 795 | // Step 2: Fetch the current live policy (includes updates since creation). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 850 | // Step 1: Get sandbox ID. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 875 | // Step 2: Create SSH session. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 920 | // Step 5: Build the SSH command. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 975 | // Step 9: Resume and draw the TUI before accepting new terminal input. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1005 | // Step 1: Resolve sandbox → SSH session (same as handle_shell_connect). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1052 | // Step 2: Resolve gateway and build ProxyCommand (same as handle_shell_connect). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1074 | // Step 3: Build SSH command — same flags as handle_shell_connect but with | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1104 | // Step 4: Suspend TUI. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1117 | // Step 5: Run command — blocks until user Ctrl-C's or command exits. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1134 | // Step 6: Resume TUI. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 585 | // Step 1: Wait for SupervisorHello. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 611 | // Step 2: Create the outbound channel and register the session. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 628 | // Step 3: Send SessionAccepted. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 666 | // Step 4: Spawn the session loop that reads inbound messages. | COMMENT |
| LOW | crates/openshell-server/src/grpc/policy.rs | 6198 | // Step 1: mechanistic submits a broad L4 grant; the prover flags it | COMMENT |
| LOW | crates/openshell-server/src/grpc/policy.rs | 6259 | // Step 2: the agent refines into a narrow L7 proposal for the SAME | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 35 | ## Step 1: Gather the Problem Statement | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 63 | ## Step 2: Deep Codebase Investigation | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 112 | ## Step 3: Determine Labels | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 127 | ## Step 4: Create the GitHub Issue | COMMENT |
| LOW | .agents/skills/create-spike/SKILL.md | 219 | ## Step 5: Report to User | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 22 | ## Step 1: Identify Relevant Commits | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 45 | ## Step 2: Map Commits to Doc Pages | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 68 | ## Step 3: Read the Commit Details | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 83 | ## Step 4: Read the Current Doc Page | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 93 | ## Step 5: Draft the Update | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 128 | ## Step 6: Present the Results | COMMENT |
| LOW | .agents/skills/update-docs/SKILL.md | 147 | ## Step 7: Build and Verify | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 36 | ### Step 1: Check CLI Reachability | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 49 | ### Step 2: Identify the Compute Platform | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 60 | ### Step 3: Check Docker-Backed Gateways | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 113 | ### Step 4: Check Podman-Backed Gateways | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 129 | ### Step 5: Check Kubernetes Helm Gateways | COMMENT |
| LOW | .agents/skills/debug-openshell-cluster/SKILL.md | 322 | ### Step 6: Check VM-Backed Gateways | COMMENT |
| LOW⚡ | .agents/skills/triage-issue/SKILL.md | 72 | ## Step 1: Fetch the Issue | COMMENT |
| LOW⚡ | .agents/skills/triage-issue/SKILL.md | 82 | ## Step 2: Check for Prior Triage | COMMENT |
| LOW⚡ | .agents/skills/triage-issue/SKILL.md | 90 | ## Step 3: Validate the Agent-First Gate | COMMENT |
| LOW | .agents/skills/triage-issue/SKILL.md | 108 | ## Step 4: Check Reported Version and Known Fixes | COMMENT |
| LOW | .agents/skills/triage-issue/SKILL.md | 124 | ## Step 5: Diagnose and Validate | COMMENT |
| LOW | .agents/skills/triage-issue/SKILL.md | 149 | ## Step 6: Classify | COMMENT |
| LOW | .agents/skills/triage-issue/SKILL.md | 163 | ## Step 7: Post Triage Comment | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 67 | ### Step 0: Check the Active Gateway | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 86 | ### Step 1: Check Whether Managed Inference Is Configured | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 104 | ### Step 2: Inspect the Provider Record | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 129 | ### Step 3: Check Local Host Reachability | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 143 | ### Step 4: Check Request Shape | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 167 | ### Step 5: Probe from a Sandbox | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 182 | ### Step 6: Reapply or Repair the Managed Route | COMMENT |
| LOW | .agents/skills/debug-inference/SKILL.md | 198 | ### Step 7: Diagnose Direct External Inference | COMMENT |
| LOW | .agents/skills/launch-openshell-gator/SKILL.md | 38 | ### Step 1: Confirm Repository Root | COMMENT |
| 92 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | TESTING.md | 56 | def test_exec_python_serializes_callable_payload() -> None: | CODE |
| LOW | tasks/scripts/release.py | 371 | def generate_homebrew_formula( | STRING |
| LOW⚡ | tasks/scripts/sync_docs_website_test.py | 28 | def test_resolve_slug_channels() -> None: | CODE |
| LOW⚡ | tasks/scripts/sync_docs_website_test.py | 34 | def test_resolve_slug_version_requires_slug() -> None: | CODE |
| LOW⚡ | tasks/scripts/sync_docs_website_test.py | 39 | def test_resolve_slug_rejects_unsafe_characters() -> None: | CODE |
| LOW⚡ | tasks/scripts/sync_docs_website_test.py | 47 | def test_resolve_display_name() -> None: | CODE |
| LOW | tasks/scripts/sync_docs_website_test.py | 58 | def test_ordered_entries_pins_latest_then_dev() -> None: | CODE |
| LOW | tasks/scripts/sync_docs_website_test.py | 68 | def test_prefix_navigation_paths() -> None: | CODE |
| LOW | tasks/scripts/sync_docs_website_test.py | 116 | def test_sync_docs_creates_snapshot(tmp_path: Path) -> None: | CODE |
| LOW | tasks/scripts/sync_docs_website_test.py | 148 | def test_remove_docs_drops_snapshot(tmp_path: Path) -> None: | CODE |
| LOW | python/release_tooling_test.py | 25 | def test_exact_tag_versions_are_stable_release_versions() -> None: | CODE |
| LOW | python/release_tooling_test.py | 36 | def test_dev_versions_share_one_build_identity() -> None: | CODE |
| LOW | python/release_tooling_test.py | 47 | def test_semver_tag_parser_excludes_vm_tags() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 283 | def test_load_cluster_bearer_token_returns_none_when_missing( | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 289 | def test_load_cluster_bearer_token_tolerates_unreadable_file( | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 298 | def test_load_cluster_bearer_token_rejects_missing_access_token( | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 439 | def test_tls_config_rejects_partial_client_identity() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 447 | def test_tls_config_allows_empty_for_system_roots() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 458 | def test_cluster_bearer_provider_reloads_on_every_call(tmp_path: Path) -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1116 | def test_mtls_only_from_active_cluster_skips_bearer_interceptor( | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1155 | def test_sandbox_client_close_invokes_bearer_close() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1548 | def test_list_forwards_label_selector() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1558 | def test_list_without_selector_sends_empty_string() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1568 | def test_list_ids_forwards_label_selector() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1579 | def test_sandbox_ref_retains_gateway_labels() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1589 | def test_returned_labels_are_immutable() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1597 | def test_direct_sandbox_ref_construction_defaults_labels() -> None: | CODE |
| LOW⚡ | python/openshell/sandbox_test.py | 1607 | def test_sandbox_ref_stays_hashable_with_labels_excluded_from_identity() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 79 | def test_exec_sends_stdin_payload() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 90 | def test_exec_python_serializes_callable_payload() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 110 | def test_from_active_cluster_reads_gateway_metadata_layout( | CODE |
| LOW | python/openshell/sandbox_test.py | 136 | def test_from_active_cluster_prefers_openshell_gateway_env( | CODE |
| LOW | python/openshell/sandbox_test.py | 196 | def test_normalize_bearer_accepts_str_or_callable() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 215 | def test_bearer_interceptor_attaches_authorization_header() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 235 | def test_bearer_interceptor_handles_empty_metadata() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 248 | def test_bearer_interceptor_calls_token_provider_per_request() -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 266 | def test_load_cluster_bearer_token_reads_oidc_token_json(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 343 | def test_from_active_cluster_loads_bearer_when_auth_mode_is_oidc( | CODE |
| LOW | python/openshell/sandbox_test.py | 361 | def test_from_active_cluster_ignores_stale_token_when_auth_mode_not_oidc( | CODE |
| LOW | python/openshell/sandbox_test.py | 381 | def test_from_active_cluster_https_oidc_without_mtls_uses_tls_with_system_roots( | CODE |
| LOW | python/openshell/sandbox_test.py | 415 | def test_from_active_cluster_https_ca_only_layout( | CODE |
| LOW | python/openshell/sandbox_test.py | 473 | def test_cluster_bearer_provider_raises_on_expired_token(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 489 | def test_cluster_bearer_provider_raises_when_file_missing(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 499 | def test_cluster_bearer_provider_raises_on_missing_access_token( | CODE |
| LOW | python/openshell/sandbox_test.py | 596 | def test_refresher_returns_cached_token_when_fresh(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 610 | def test_refresher_picks_up_disk_rotation_before_refreshing( | CODE |
| LOW | python/openshell/sandbox_test.py | 644 | def test_refresher_adopts_stale_disk_refresh_token_before_refreshing( | CODE |
| LOW | python/openshell/sandbox_test.py | 686 | def test_refresher_resets_token_endpoint_when_disk_issuer_changes( | CODE |
| LOW | python/openshell/sandbox_test.py | 727 | def test_refresher_recovers_from_invalid_grant_after_peer_rotation( | CODE |
| LOW | python/openshell/sandbox_test.py | 775 | def test_refresher_reraises_invalid_grant_without_peer_rotation( | CODE |
| LOW | python/openshell/sandbox_test.py | 808 | def test_refresher_exchanges_refresh_token_when_stale(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 825 | def test_refresher_writes_back_when_enabled(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 850 | def test_refresher_write_back_is_default(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 872 | def test_refresher_honors_refresh_token_rotation(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 896 | def test_refresher_second_process_can_refresh_after_rotation( | CODE |
| LOW | python/openshell/sandbox_test.py | 929 | def test_refresher_concurrent_calls_share_one_refresh(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 982 | def test_refresher_surfaces_idp_failure_as_sandbox_error( | CODE |
| LOW | python/openshell/sandbox_test.py | 1005 | def test_refresher_rejects_issuer_mismatch_in_discovery(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 1026 | def test_refresher_rejects_redirect_during_discovery(tmp_path: Path) -> None: | CODE |
| LOW | python/openshell/sandbox_test.py | 1045 | def test_refresher_insecure_disables_tls_verification() -> None: | CODE |
| 115 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | .packit.yaml | 27 | # Step 1: Create source tarball from git working tree. | COMMENT |
| LOW⚡ | .packit.yaml | 31 | # Step 2: Create vendored Cargo dependencies tarball for offline RPM build. | COMMENT |
| LOW⚡ | .packit.yaml | 33 | # Step 3: Return the primary archive name. Packit expects create-archive | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 898 | // Step 3: Resolve gateway address (handle loopback override). | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 905 | // Step 4: Build the ProxyCommand using our own binary. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 943 | // Step 6: Cancel log stream and pause event handler before suspending. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 949 | // Step 7: Suspend TUI — leave alternate screen, disable raw mode. | COMMENT |
| LOW⚡ | crates/openshell-tui/src/lib.rs | 958 | // Step 8: Spawn SSH as child process and wait. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 771 | // Step 1: Fetch sandbox metadata (providers, sandbox ID). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 795 | // Step 2: Fetch the current live policy (includes updates since creation). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 850 | // Step 1: Get sandbox ID. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 875 | // Step 2: Create SSH session. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 920 | // Step 5: Build the SSH command. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 975 | // Step 9: Resume and draw the TUI before accepting new terminal input. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1005 | // Step 1: Resolve sandbox → SSH session (same as handle_shell_connect). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1052 | // Step 2: Resolve gateway and build ProxyCommand (same as handle_shell_connect). | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1074 | // Step 3: Build SSH command — same flags as handle_shell_connect but with | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1104 | // Step 4: Suspend TUI. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1117 | // Step 5: Run command — blocks until user Ctrl-C's or command exits. | COMMENT |
| LOW | crates/openshell-tui/src/lib.rs | 1134 | // Step 6: Resume TUI. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 585 | // Step 1: Wait for SupervisorHello. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 611 | // Step 2: Create the outbound channel and register the session. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 628 | // Step 3: Send SessionAccepted. | COMMENT |
| LOW | crates/openshell-server/src/supervisor_session.rs | 666 | // Step 4: Spawn the session loop that reads inbound messages. | COMMENT |
| LOW | crates/openshell-server/src/grpc/policy.rs | 6198 | // Step 1: mechanistic submits a broad L4 grant; the prover flags it | COMMENT |
| LOW | crates/openshell-server/src/grpc/policy.rs | 6259 | // Step 2: the agent refines into a narrow L7 proposal for the SAME | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 155 | # Step 1: Remove dangling (untagged) images | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 174 | # Step 2: Remove stale tagged images | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 218 | # Step 3: Remove unused volumes | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 255 | # Step 4: Prune build cache | COMMENT |
| LOW⚡ | scripts/docker-cleanup.sh | 271 | # Step 5: Clean up any newly-dangling images left after tagged image removal | COMMENT |
| LOW⚡ | e2e/rust/tests/custom_image.rs | 44 | // Step 1: Write a temporary Dockerfile. | COMMENT |
| LOW⚡ | e2e/rust/tests/custom_image.rs | 53 | // Step 2: Create a sandbox from the Dockerfile. | COMMENT |
| LOW | e2e/rust/tests/custom_image.rs | 65 | // Step 3: Verify the marker file content appears in the output. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/scripts/sync_docs_website.py | 12 | CODE | |
| LOW | tasks/scripts/release.py | 6 | CODE | |
| LOW | tasks/scripts/sync_docs_website_test.py | 11 | CODE | |
| LOW | python/release_tooling_test.py | 4 | CODE | |
| LOW | python/openshell/sandbox_test.py | 4 | CODE | |
| LOW | python/openshell/__init__.py | 6 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/__init__.py | 8 | CODE | |
| LOW | python/openshell/sandbox.py | 4 | CODE | |
| LOW | python/openshell/release_formula_test.py | 4 | CODE | |
| LOW | deploy/sbom/sbom_to_csv.py | 13 | CODE | |
| LOW | deploy/sbom/resolve_licenses_test.py | 4 | CODE | |
| LOW | deploy/sbom/resolve_licenses.py | 21 | CODE | |
| LOW | examples/policy-advisor/ctf.py | 22 | CODE | |
| LOW | scripts/update_license_headers.py | 19 | CODE | |
| LOW | scripts/baseline_workflow_metrics.py | 23 | CODE | |
| LOW | scripts/generate_third_party_notices.py | 18 | CODE | |
| LOW | e2e/python/test_sandbox_exec_python.py | 4 | CODE | |
| LOW | e2e/python/conftest.py | 4 | CODE | |
| LOW | e2e/python/test_sandbox_providers.py | 12 | CODE | |
| LOW | e2e/python/test_inference_routing.py | 11 | CODE | |
| LOW | e2e/python/test_policy_validation.py | 11 | CODE | |
| LOW | e2e/python/test_security_tls.py | 12 | CODE | |
| LOW | e2e/python/test_sandbox_venv.py | 19 | CODE | |
| LOW | e2e/python/test_sandbox_api.py | 4 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 4 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 9 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 16 | CODE | |
| LOW | e2e/python/test_sandbox_landlock.py | 21 | CODE | |
| LOW | e2e/python/oidc/oidc_auth_test.py | 14 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/sbom.toml | 6 | # Usage: | COMMENT |
| LOW | tasks/notices.toml | 6 | # Usage: | COMMENT |
| LOW | tasks/scripts/keycloak-k8s-setup.sh | 13 | # Usage: | COMMENT |
| LOW | tasks/scripts/package-deb-install.sh | 15 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/download-kernel-runtime.sh | 11 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/compress-vm-runtime.sh | 11 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun-macos.sh | 22 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/package-vm-runtime.sh | 12 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/vm-setup.sh | 13 | # Usage: | COMMENT |
| LOW | tasks/scripts/vm/build-libkrun.sh | 20 | # Usage: | COMMENT |
| LOW | examples/local-inference/routes.yaml | 6 | # Usage: | COMMENT |
| LOW⚡ | scripts/smoke-test-network-policy.sh | 17 | # Usage: | COMMENT |
| LOW | scripts/keycloak-dev.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/docker-cleanup.sh | 15 | # Usage: | COMMENT |
| LOW | scripts/test-release-tag.sh | 8 | # Usage: | COMMENT |
| LOW | e2e/rust/e2e-vm.sh | 22 | # Usage: | COMMENT |
| LOW | e2e/rust/e2e-openshift.sh | 11 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tasks/scripts/vm/build-libkrun-macos.sh | 145 | # Create the unversioned symlink that libkrun links against | COMMENT |
| MEDIUM | deploy/docker/gateway.toml | 6 | # This file is the primary configuration source for docker-compose.yml in this | COMMENT |
| MEDIUM⚡ | scripts/smoke-test-network-policy.sh | 134 | # Create a sandbox with a sleep, wait for Ready (sandboxes are kept by default). | COMMENT |
| MEDIUM⚡ | .github/workflows/release-tag.yml | 859 | # Create a tagged GitHub Release with CLI, gateway, driver, and wheels | COMMENT |
| MEDIUM | e2e/with-kube-gateway.sh | 13 | # Create a local k3d cluster via tasks/scripts/helm-k3s-local.sh, install | COMMENT |
| MEDIUM | e2e/rust/tests/custom_image.rs | 24 | # Create the sandbox user/group so the supervisor can switch to it. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/openshell-providers/src/profiles.rs | 6 | #![allow(deprecated)] // NetworkBinary::harness remains in the public proto for compatibility. | COMMENT |
| MEDIUM | scripts/agents/run.sh | 89 | [[ $# -ge 2 ]] || fail "--harness requires a value" | CODE |
| MEDIUM | scripts/agents/run.sh | 186 | abort "unsupported harness: #{harness} (supported: #{supported.keys.join(', ')})" unless supported.key?(harness) | CODE |
| MEDIUM | scripts/lint-mermaid/package-lock.json | 1711 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| MEDIUM | e2e/with-podman-gateway.sh | 427 | # the harness discovered (e.g. via `podman machine inspect` on macOS) so | COMMENT |
| MEDIUM | e2e/mcp-conformance/client-through-openshell.sh | 9 | # script with that URL. The parent harness creates one reusable conformance | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/scripts/sync_docs_website.py | 354 | except Exception as exc: | CODE |
| MEDIUM | tasks/scripts/sync_docs_website.py | 347 | def main() -> None: | CODE |
| LOW | python/openshell/__init__.py | 26 | except Exception: | CODE |
| LOW | examples/policy-advisor/ctf.py | 213 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | examples/policy-advisor/ctf.py | 258 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/agents/runtime/supervisor.sh | 63 | except Exception: | CODE |
| LOW | e2e/python/test_inference_routing.py | 262 | except Exception as e: | CODE |
| LOW | e2e/python/test_inference_routing.py | 362 | except Exception as exc: | CODE |
| LOW | e2e/python/test_sandbox_policy.py | 1637 | except Exception as e: | CODE |
| LOW | e2e/python/test_sandbox_policy.py | 1647 | except Exception as e: | CODE |
| LOW | e2e/rust/tests/forward_proxy_l7_bypass.rs | 127 | except Exception as e: | CODE |
| LOW | e2e/rust/tests/forward_proxy_l7_bypass.rs | 170 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/scripts/release.py | 167 | CODE | |
| LOW | tasks/scripts/release.py | 455 | CODE | |
| LOW | python/openshell/sandbox.py | 533 | CODE | |
| LOW | python/openshell/sandbox.py | 789 | CODE | |
| LOW | deploy/sbom/resolve_licenses.py | 396 | CODE | |
| LOW | examples/policy-advisor/ctf.py | 388 | CODE | |
| LOW | e2e/python/test_sandbox_providers.py | 199 | CODE | |
| LOW | e2e/python/test_inference_routing.py | 57 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 96 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 201 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 279 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 99 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 209 | CODE | |
| LOW | e2e/python/test_sandbox_policy.py | 282 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/openshell-server/src/inference.rs | 2443 | "dummy-token", | CODE |
| LOW | examples/multi-agent-notepad/runner.sh | 86 | "placeholder", | CODE |
| LOW | …amples/agent-driven-policy-management/sandbox-agent.sh | 44 | "placeholder", | CODE |
| LOW | scripts/agents/runtime/harnesses/codex/exec.sh | 55 | "placeholder", | CODE |
| LOW | e2e/python/test_inference_routing.py | 219 | "Authorization": "Bearer dummy-key", | CODE |
| LOW | e2e/python/test_inference_routing.py | 298 | "x-api-key": "dummy-key", | CODE |
| LOW | e2e/rust/tests/cf_auth_smoke.rs | 302 | "/tmp/fake-key", | CODE |
| LOW | e2e/rust/tests/sync.rs | 207 | .args(["config", "user.email", "test@test.com"]) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tasks/scripts/sync_docs_website.py | 238 | def update_docs_yml(docs_yml: Path, updated: VersionEntry, fern_dir: Path) -> None: | CODE |
| LOW | python/openshell/__init__.py | 29 | __all__ = [ | CODE |
| LOW | deploy/sbom/resolve_licenses.py | 337 | def set_license(comp: dict, license_id: str) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | providers/github.yaml | 19 | # writes require an explicit policy proposal so the agentic loop + | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | e2e/with-kube-gateway.sh | 19 | # Set OPENSHELL_E2E_KUBE_EXTRA_VALUES to one or more colon-separated Helm values | COMMENT |
| LOW | e2e/with-kube-gateway.sh | 38 | # Set OPENSHELL_E2E_KUBE_EXTERNAL_POSTGRES_SECRET to create an ephemeral | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/openshell/sandbox.py | 702 | CODE |