本地优先的跨平台 Claude Code / AI Agent 桌面工作台：多 Agent 协作、Git Worktree、代码 Diff、技能市场、多模型、Computer Use、桌面宠物；支持微信、飞书、钉钉及 H5 等远程访问。 | Local-first Claude Code / AI Agent desktop workspace: multi-agent teams, Git worktrees, diffs, skills marketplace, multi-model, Computer Use, task-aware desktop pets; remote via WeChat, Feishu, DingTalk, Telegram, WhatsApp & H5.
This report summarizes scanner evidence for NanmiCoder/cc-haha, a TypeScript project with 14,956 GitHub stars. SynthScan examined 1,361,687 lines of code across 4966 source files, recording 4774 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 4.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 4080 finding(s).
Are imports declared and package/API names verified? 87 finding(s).
Are wrappers, guards, and repeated structures necessary? 3999 finding(s).
Which changes need focused human review? 4774 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 4774 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | native/cu-helper/build.test.ts | 26 | function resolveArchitectureSpecificBuildPaths(arch: 'arm64' | 'x86_64') { | CODE |
| LOW | native/cu-helper/build.test.ts | 186 | function resolveIdentityWithOnlyDeveloperId() { | CODE |
| LOW⚡ | runtime/win_helper.py | 1622 | def ensure_target_window_reachable(bundle_id: str | None) -> None: | CODE |
| LOW | runtime/win_helper.py | 50 | def _enable_per_monitor_dpi_awareness() -> None: | CODE |
| LOW | runtime/win_cursor_badge.py | 197 | def _enable_per_monitor_dpi_awareness() -> None: | CODE |
| LOW⚡ | runtime/test_helpers.py | 237 | def test_mutating_command_set_matches_this_test(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 240 | def test_coordinate_commands_are_a_subset(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 249 | def test_pointer_motion_uses_the_animation_gate(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 281 | def test_drag_reuses_the_shared_cursor_motion(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 288 | def test_helper_uses_per_monitor_dpi_coordinates(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 294 | def test_every_mutating_branch_finalizes_the_lease(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 431 | def test_offscreen_point_is_refused(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 436 | def test_unreachable_window_is_refused(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 441 | def test_reachability_check_sees_minimized_windows(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 522 | def test_overlay_draws_a_pointer_instead_of_a_text_banner(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 531 | def test_overlay_uses_the_agent_hotspot_not_a_cursor_offset(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 537 | def test_overlay_is_per_monitor_dpi_aware(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 546 | def test_overlay_renders_a_transparent_pointer_frame(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 580 | def test_overlay_tracks_agent_input_and_not_the_users_pointer(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 588 | def test_overlay_and_helper_share_a_session_input_tag(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 596 | def test_overlay_visibility_is_bound_to_the_controlled_window(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 603 | def test_overlay_activity_does_not_hide_before_animated_motion(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 612 | def test_overlay_readiness_precedes_the_first_action(self): | CODE |
| LOW⚡ | runtime/test_helpers.py | 616 | def test_badge_exits_with_its_parent(self): | CODE |
| LOW | runtime/test_helpers.py | 90 | def test_expected_commands_exist(self): | CODE |
| LOW | runtime/test_helpers.py | 106 | def test_unknown_command_returns_error(self): | CODE |
| LOW | runtime/test_helpers.py | 128 | def test_installed_apps_adds_a_visible_app_missing_from_uninstall_registry(self): | CODE |
| LOW | runtime/test_helpers.py | 141 | def test_running_apps_uses_visible_window_inventory(self): | CODE |
| LOW | runtime/test_helpers.py | 153 | def test_open_app_foregrounds_a_running_app_instead_of_launching_another(self): | CODE |
| LOW | runtime/test_helpers.py | 161 | def test_type_text_paces_long_input_inside_one_helper_call(self): | CODE |
| LOW | runtime/test_helpers.py | 177 | def test_application_frame_window_resolves_to_packaged_child_process(self): | CODE |
| LOW | runtime/test_helpers.py | 267 | def test_spring_cursor_path_starts_smoothly_and_lands_exactly(self): | CODE |
| LOW | runtime/test_helpers.py | 322 | def test_guards_run_before_any_injection(self): | CODE |
| LOW | runtime/test_helpers.py | 334 | def test_uses_injected_flags_to_separate_agent_and_physical_input(self): | CODE |
| LOW | runtime/test_helpers.py | 343 | def test_distinguishes_did_not_run_from_outcome_unknown(self): | CODE |
| LOW | runtime/test_helpers.py | 365 | def test_monitor_failure_refuses_before_injection(self): | CODE |
| LOW | runtime/test_helpers.py | 376 | def test_tagged_keyboard_and_mouse_input_do_not_trip_the_detector(self): | CODE |
| LOW | runtime/test_helpers.py | 407 | def test_foreign_injected_input_is_interference(self): | CODE |
| LOW | runtime/test_helpers.py | 469 | def test_refusals_carry_a_machine_readable_code(self): | CODE |
| LOW | runtime/test_helpers.py | 474 | def test_refusal_says_the_action_was_not_sent(self): | CODE |
| LOW | runtime/test_helpers.py | 491 | def test_badge_is_click_through_and_never_takes_focus(self): | CODE |
| LOW | runtime/test_helpers.py | 568 | def test_overlay_converts_frames_to_premultiplied_bgra(self): | CODE |
| LOW | runtime/test_helpers.py | 686 | def test_check_permissions_always_granted(self): | CODE |
| LOW | runtime/test_helpers.py | 696 | def test_packaged_exe_maps_to_the_host_identity_sent_by_desktop(self): | CODE |
| LOW | runtime/test_helpers.py | 713 | def test_retired_mac_helper_is_not_referenced(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 10 | def test_latest_semver_and_chinese_credits(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 24 | def test_chinese_section_in_either_order_and_without_details(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 34 | def test_incidental_mention_is_not_contributor_credit(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 53 | def test_cannot_credit_unmentioned_account(self): | CODE |
| LOW⚡ | …ls/release-announcement/scripts/test_release_poster.py | 64 | def test_offline_avatar_requires_explicit_test_mode(self): | CODE |
| LOW⚡ | …ls/release-announcement/scripts/test_release_poster.py | 74 | def test_chinese_punctuation_does_not_start_a_wrapped_line(self): | CODE |
| LOW⚡ | …ls/release-announcement/scripts/test_release_poster.py | 82 | def test_overwide_latin_tokens_wrap_without_losing_characters(self): | CODE |
| LOW⚡ | …ls/release-announcement/scripts/test_release_poster.py | 89 | def test_near_full_width_latin_word_with_cjk_brackets(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 132 | def test_render_feature_and_fix_only_variants_without_empty_sections(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 155 | def test_lead_feature_is_readable_on_the_first_phone_screen(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 169 | def test_paragraphs_are_balanced_instead_of_leaving_an_orphan(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 180 | def test_paragraphs_with_a_long_last_line_keep_the_full_measure(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 190 | def test_render_long_content_and_multiple_offline_contributors(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 214 | def test_overheight_render_fails_without_saving_a_clipped_poster(self): | CODE |
| LOW | …ls/release-announcement/scripts/test_release_poster.py | 222 | def test_body_contrast_on_paper_and_highlight_surface(self): | CODE |
| 3332 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | native/cu-helper/build.sh | 63 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | native/cu-helper/build.sh | 67 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | native/cu-helper/build.sh | 72 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | native/cu-helper/build.sh | 74 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 30 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 32 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 96 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 108 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 246 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 253 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 298 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 300 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 352 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 360 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 391 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 396 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 424 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 429 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 531 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/build.sh | 533 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/AXAction.swift | 382 | // ── Right button: secondary menu, nothing else. ─────────────────────── | COMMENT |
| MEDIUM⚡ | native/cu-helper/Sources/cu-helper/AXAction.swift | 405 | // ── ① Native list row → select on the parent AXList. ────────────────── | COMMENT |
| MEDIUM⚡ | native/cu-helper/Sources/cu-helper/AXAction.swift | 413 | // ── ② Primary press on the element: {Press, Confirm, Open} only. ────── | COMMENT |
| MEDIUM⚡ | native/cu-helper/Sources/cu-helper/AXAction.swift | 419 | // ── ③ Scan up to 3 levels of descendants for an actionable node. ────── | COMMENT |
| MEDIUM⚡ | native/cu-helper/Sources/cu-helper/AXAction.swift | 429 | // ── ④ AX hit-test at the element center, then press what's there. ───── | COMMENT |
| MEDIUM⚡ | native/cu-helper/Sources/cu-helper/AXAction.swift | 438 | // ── ⑤ Window-role activation-only (Raise / kAXMain / kAXFocused). ───── | COMMENT |
| MEDIUM⚡ | native/cu-helper/Sources/cu-helper/AXAction.swift | 444 | // ── ⑥ Last resort: synthetic pointer click via postToPid. ───────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/AXAction.swift | 826 | // ── Synthetic wheel at the element center (or point). ───────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/AXAction.swift | 868 | // ── Preferred: replace the live selection and restore the caret. ───── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/AXAction.swift | 921 | // (reliable for native AppKit fields). ─────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/AXAction.swift | 1144 | // ════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/AXAction.swift | 1146 | // ════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/CommandRouter.swift | 132 | // ── No-op preparation verbs (v1 hides nothing) ───────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/CommandRouter.swift | 139 | // ── Displays (TCC-free, CoreGraphics only) ───────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/CommandRouter.swift | 151 | // ── Capture (needs Screen Recording) ─────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/CommandRouter.swift | 161 | // ── Keyboard (needs Accessibility) ───────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/CommandRouter.swift | 181 | // ── Clipboard ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/CommandRouter.swift | 193 | // ── Mouse (legacy coordinate verbs) + virtual cursor ─────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/CommandRouter.swift | 223 | // ── Apps (TCC-free) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/CommandRouter.swift | 254 | // ── Computer-Use contract: AX-tree perception ────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/CommandRouter.swift | 286 | // ── Permissions (onboarding / self-test; both modes) ─────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/Injection.swift | 7 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/Injection.swift | 25 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/KeyMapping.swift | 11 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/KeyMapping.swift | 33 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/KeyMapping.swift | 243 | // ── Editing / whitespace ────────────────────────────────────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/KeyMapping.swift | 252 | // ── Navigation ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | native/cu-helper/Sources/cu-helper/KeyMapping.swift | 263 | // ── Locks / misc ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | native/cu-helper/Sources/cu-helper/KeyMapping.swift | 268 | // ── Function keys (F1–F20) ──────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | native/cu-helper/Sources/cu-helper/KeyMapping.swift | 275 | // ── Keypad (xdotool KP_* spellings + numeric/aliases) ───────────── | COMMENT |
| MEDIUM | native/cu-helper/Sources/cu-helper/KeyMapping.swift | 295 | // ── Punctuation keysyms (xdotool names → ANSI physical keys) ────── | COMMENT |
| MEDIUM⚡ | runtime/win_helper.py | 335 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | runtime/win_helper.py | 337 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | runtime/win_helper.py | 723 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | runtime/win_helper.py | 725 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | runtime/win_helper.py | 95 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | runtime/win_helper.py | 97 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | runtime/win_helper.py | 155 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | runtime/win_helper.py | 157 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | runtime/win_helper.py | 176 | # --------------------------------------------------------------------------- | COMMENT |
| 513 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | native/cu-helper/build.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | native/cu-helper/build.sh | 21 | # requirement" / cdhash lineage). An ad-hoc signature (codesign -s -) or a | COMMENT |
| LOW | native/cu-helper/build.sh | 101 | # b) $CU_HELPER_IDENTITY (legacy helper-only override for direct builds) | COMMENT |
| LOW | native/cu-helper/build.sh | 341 | fi | COMMENT |
| LOW | native/cu-helper/Package.swift | 1 | // swift-tools-version: 6.0 | COMMENT |
| LOW | …per/Tests/CuHelperTests/InjectionPathParityTests.swift | 1 | import XCTest | COMMENT |
| LOW | …-helper/Tests/CuHelperTests/ShellTreeAdviceTests.swift | 1 | import XCTest | COMMENT |
| LOW | …sts/CuHelperTests/PhysicalInputEpochMonitorTests.swift | 1 | import CoreGraphics | COMMENT |
| LOW | native/cu-helper/Sources/CDisclaim/include/cdisclaim.h | 1 | #ifndef CDISCLAIM_H | COMMENT |
| LOW | native/cu-helper/Sources/CDisclaim/include/cdisclaim.h | 21 | // the CLI single-line JSON are a hard contract on fd 1). | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Geometry.swift | 1 | // | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Geometry.swift | 21 | // field the consumer reads. `DisplayGeometry.make(...)` keeps the mirrored | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Geometry.swift | 41 | /// One physical display. Produced by `Displays` (CoreGraphics-only, TCC-free) | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Geometry.swift | 141 | COMMENT | |
| LOW | native/cu-helper/Sources/cu-helper/OverlayPolicy.swift | 21 | } | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/JSONValue.swift | 1 | // | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/JSONValue.swift | 21 | // | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXAction.swift | 1 | // | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXAction.swift | 21 | // • Some controls only yield to an AX hit-test at their center, or (windows) to | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXAction.swift | 301 | /// Zero is not a detail. A move or drag event is not part of a click, | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXAction.swift | 581 | /// | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXAction.swift | 621 | COMMENT | |
| LOW | native/cu-helper/Sources/cu-helper/AXAction.swift | 1241 | var hit: AXUIElement? | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXAction.swift | 1261 | /// and un-burying does not need it. | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXAction.swift | 1401 | /// gesture first, then post the completed burst via `postToPid`. | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/UISettlePolicy.swift | 1 | import Foundation | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/UISettlePolicy.swift | 21 | /// Pure and clock-injected so the decision is testable without sleeping. | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Capture.swift | 1 | // | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Capture.swift | 21 | // showsCursor=false, scalesToFit=true, pixelFormat=32BGRA, sRGB color. | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Capture.swift | 261 | COMMENT | |
| LOW | native/cu-helper/Sources/cu-helper/Capture.swift | 481 | // | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Capture.swift | 501 | // never *blocks* — this @MainActor run loop. On timeout we cancel the SCK task | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Capture.swift | 601 | /// Pick the single best window owned by `pid` via a TCC-free | COMMENT |
| LOW | …/cu-helper/Sources/cu-helper/WindowTargetedEvent.swift | 1 | import AppKit | COMMENT |
| LOW | …/cu-helper/Sources/cu-helper/WindowTargetedEvent.swift | 21 | /// `.cgEvent`. Scroll events use the official private CGEvent field 51 | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Injection.swift | 1 | // | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Injection.swift | 21 | // Mouse events still carry a `mouseCursorPosition` — but that is only the | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Injection.swift | 161 | } | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Injection.swift | 301 | if pid > 0 { | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Injection.swift | 421 | COMMENT | |
| LOW | native/cu-helper/Sources/cu-helper/Injection.swift | 1061 | COMMENT | |
| LOW | native/cu-helper/Sources/cu-helper/AppGuidance.swift | 1 | // AppGuidance.swift — per-app Computer Use guidance for cu-helper. | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AppGuidance.swift | 21 | // interop convention Codex established, but every word below is original to | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AppGuidance.swift | 41 | /// - "medium": browsers and JetBrains-family IDEs expose a real AX tree but | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Permissions.swift | 1 | import ApplicationServices | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Permissions.swift | 21 | /// parent can expose titles even when this helper's own TCC identity cannot | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Permissions.swift | 41 | /// Fails closed: if the trust query itself is unavailable, returns `false`. | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Permissions.swift | 61 | } | COMMENT |
| LOW | …lper/Sources/cu-helper/PhysicalInputEpochMonitor.swift | 21 | } | COMMENT |
| LOW | …lper/Sources/cu-helper/PhysicalInputEpochMonitor.swift | 41 | /// readable from unentitled processes). | COMMENT |
| LOW | …/cu-helper/Sources/cu-helper/WindowCaptureStream.swift | 221 | /// daemon-lifetime consumer while covered; every state read runs an | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Daemon.swift | 21 | return try ResolvedTargetAuthorization.authorize( | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Daemon.swift | 41 | // Transport: a private AF_UNIX SOCK_STREAM socket carrying versioned NDJSON | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/Daemon.swift | 761 | } | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXTree.swift | 1 | // | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXTree.swift | 21 | // `AXManualAccessibility` + `AXEnhancedUserInterface` on the app element so the | COMMENT |
| LOW | native/cu-helper/Sources/cu-helper/AXTree.swift | 221 | let appName = running?.localizedName | COMMENT |
| LOW | …tive/cu-helper/Sources/cu-helper/ShellTreeAdvice.swift | 1 | import Foundation | COMMENT |
| LOW | …e/cu-helper/Sources/cu-helper/VirtualCursorStyle.swift | 1 | import CoreGraphics | COMMENT |
| LOW | …e/cu-helper/Sources/cu-helper/VirtualCursorStyle.swift | 61 | // real task, tool execution was 4% of wall clock and the rest was the model. | COMMENT |
| 500 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | desktop/src/stores/chatStore.ts | 7879 | // Step 1: Collect Agent tool_use blocks → map agent name to toolUseId | COMMENT |
| LOW | desktop/src/stores/chatStore.ts | 7899 | // Step 2: Extract <teammate-message> content by teammate_id | COMMENT |
| LOW | desktop/src/stores/chatStore.ts | 7929 | // Step 3: Correlate and build notifications | COMMENT |
| LOW | src/tasks/LocalShellTask/LocalShellTask.tsx | 294 | // Step 1: Get the task and shell command from current state | COMMENT |
| LOW⚡ | src/tools/BashTool/sedEditParser.ts | 277 | // Step 1: Protect literal backslashes (\\) first - in both BRE and ERE, \\ is literal backslash | COMMENT |
| LOW⚡ | src/tools/BashTool/sedEditParser.ts | 279 | // Step 2: Replace escaped metacharacters with placeholders (these should become unescaped in JS) | COMMENT |
| LOW⚡ | src/tools/BashTool/sedEditParser.ts | 285 | // Step 3: Escape unescaped metacharacters (these are literal in BRE) | COMMENT |
| LOW⚡ | src/tools/BashTool/sedEditParser.ts | 291 | // Step 4: Replace placeholders with their JS equivalents | COMMENT |
| LOW | src/server/api/computer-use.ts | 749 | // Step 1: Check python | COMMENT |
| LOW | src/server/api/computer-use.ts | 779 | // Step 2: Extract runtime files to ~/.claude/.runtime/ | COMMENT |
| LOW | src/server/api/computer-use.ts | 792 | // Step 3: Create venv | COMMENT |
| LOW | src/server/api/computer-use.ts | 832 | // Step 4: Ensure pip | COMMENT |
| LOW | src/server/api/computer-use.ts | 853 | // Step 5: Install requirements | COMMENT |
| LOW | src/server/services/sessionService.ts | 2941 | // Step 1: Try matching the transcript model name directly (current behavior) | COMMENT |
| LOW | src/server/services/sessionService.ts | 2953 | // Step 2: Prefer the model this session actually launched with. Some | COMMENT |
| LOW | src/server/services/sessionService.ts | 2969 | // Step 3: If transcript model name didn't match, try matching with | COMMENT |
| LOW⚡ | src/server/services/sessionService.ts | 3014 | // Step 1: Try matching the transcript model name directly | COMMENT |
| LOW⚡ | src/server/services/sessionService.ts | 3024 | // Step 2: Fallback to provider configured model names. | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 753 | // Step 1: Migrate to single file format (consolidates V1/V2 files, cleans up legacy cache) | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 756 | // Step 2: Sync enabledPlugins from settings.json to installed_plugins.json | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 764 | // Step 3: Initialize in-memory session state | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 1183 | // Step 2: Start with existing data (or start empty if no file exists) | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 1192 | // Step 3: Update V2 scopes based on settings.json (settings is source of truth) | COMMENT |
| LOW | src/utils/plugins/installedPluginsManager.ts | 1148 | // Step 1: Build a map of pluginId -> scope from all settings.json files | COMMENT |
| LOW | src/utils/plugins/installedPluginsManager.ts | 1312 | // Step 4: Save to single file (V2 format) | COMMENT |
| LOW⚡ | src/utils/plugins/pluginLoader.ts | 1360 | // Step 1: Load or create the plugin manifest | COMMENT |
| LOW⚡ | src/utils/plugins/pluginLoader.ts | 1365 | // Step 2: Create the base plugin object | COMMENT |
| LOW | src/utils/plugins/pluginLoader.ts | 1376 | // Step 3: Auto-detect optional directories in parallel | COMMENT |
| LOW | src/utils/plugins/pluginLoader.ts | 1532 | // Step 4: Register agents directory if detected | COMMENT |
| LOW | src/utils/plugins/pluginLoader.ts | 1641 | // Step 5: Load hooks configuration | COMMENT |
| LOW | src/utils/plugins/pluginLoader.ts | 1789 | // Step 6: Load plugin settings | COMMENT |
| LOW | src/utils/permissions/permissionSetup.ts | 993 | // We need to check if base tools were explicitly provided (not just empty default) | COMMENT |
| LOW | src/components/MarkdownTable.tsx | 107 | // Step 1: Get minimum (longest word) and ideal (full content) widths | COMMENT |
| LOW⚡ | src/components/MarkdownTable.tsx | 123 | // Step 2: Calculate available space | COMMENT |
| LOW⚡ | src/components/MarkdownTable.tsx | 130 | // Step 3: Calculate column widths that fit available space | COMMENT |
| LOW | src/components/MarkdownTable.tsx | 158 | // Step 4: Calculate max row lines to determine if vertical format is needed | COMMENT |
| LOW⚡ | src/components/StructuredDiff/Fallback.tsx | 353 | // Step 1: Transform lines to line objects with type information | COMMENT |
| LOW⚡ | src/components/StructuredDiff/Fallback.tsx | 356 | // Step 2: Group adjacent add/remove lines for word-level diffing | COMMENT |
| LOW⚡ | src/components/StructuredDiff/Fallback.tsx | 359 | // Step 3: Number the diff lines | COMMENT |
| LOW⚡ | src/components/StructuredDiff/Fallback.tsx | 368 | // Step 4: Render formatting | COMMENT |
| LOW | src/skills/bundled/skillify.ts | 40 | ### Step 1: Analyze the Session | COMMENT |
| LOW | src/skills/bundled/skillify.ts | 52 | ### Step 2: Interview the User | COMMENT |
| LOW | src/skills/bundled/skillify.ts | 90 | ### Step 3: Write the SKILL.md | COMMENT |
| LOW | src/skills/bundled/skillify.ts | 148 | ### Step 4: Confirm and Save | COMMENT |
| LOW⚡ | src/services/compact/sessionMemoryCompact.ts | 242 | // Step 1: Handle tool_use/tool_result pairs | COMMENT |
| LOW | src/services/compact/sessionMemoryCompact.ts | 288 | // Step 2: Handle thinking blocks that share message.id with kept assistant messages | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | desktop/src/stores/chatStore.ts | 7879 | // Step 1: Collect Agent tool_use blocks → map agent name to toolUseId | COMMENT |
| LOW | desktop/src/stores/chatStore.ts | 7899 | // Step 2: Extract <teammate-message> content by teammate_id | COMMENT |
| LOW | desktop/src/stores/chatStore.ts | 7929 | // Step 3: Correlate and build notifications | COMMENT |
| LOW | src/tasks/LocalShellTask/LocalShellTask.tsx | 294 | // Step 1: Get the task and shell command from current state | COMMENT |
| LOW⚡ | src/tools/BashTool/sedEditParser.ts | 277 | // Step 1: Protect literal backslashes (\\) first - in both BRE and ERE, \\ is literal backslash | COMMENT |
| LOW⚡ | src/tools/BashTool/sedEditParser.ts | 279 | // Step 2: Replace escaped metacharacters with placeholders (these should become unescaped in JS) | COMMENT |
| LOW⚡ | src/tools/BashTool/sedEditParser.ts | 285 | // Step 3: Escape unescaped metacharacters (these are literal in BRE) | COMMENT |
| LOW⚡ | src/tools/BashTool/sedEditParser.ts | 291 | // Step 4: Replace placeholders with their JS equivalents | COMMENT |
| LOW | src/server/api/computer-use.ts | 749 | // Step 1: Check python | COMMENT |
| LOW | src/server/api/computer-use.ts | 779 | // Step 2: Extract runtime files to ~/.claude/.runtime/ | COMMENT |
| LOW | src/server/api/computer-use.ts | 792 | // Step 3: Create venv | COMMENT |
| LOW | src/server/api/computer-use.ts | 832 | // Step 4: Ensure pip | COMMENT |
| LOW | src/server/api/computer-use.ts | 853 | // Step 5: Install requirements | COMMENT |
| LOW | src/server/services/sessionService.ts | 2941 | // Step 1: Try matching the transcript model name directly (current behavior) | COMMENT |
| LOW | src/server/services/sessionService.ts | 2953 | // Step 2: Prefer the model this session actually launched with. Some | COMMENT |
| LOW | src/server/services/sessionService.ts | 2969 | // Step 3: If transcript model name didn't match, try matching with | COMMENT |
| LOW⚡ | src/server/services/sessionService.ts | 3014 | // Step 1: Try matching the transcript model name directly | COMMENT |
| LOW⚡ | src/server/services/sessionService.ts | 3024 | // Step 2: Fallback to provider configured model names. | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 753 | // Step 1: Migrate to single file format (consolidates V1/V2 files, cleans up legacy cache) | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 756 | // Step 2: Sync enabledPlugins from settings.json to installed_plugins.json | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 764 | // Step 3: Initialize in-memory session state | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 1183 | // Step 2: Start with existing data (or start empty if no file exists) | COMMENT |
| LOW⚡ | src/utils/plugins/installedPluginsManager.ts | 1192 | // Step 3: Update V2 scopes based on settings.json (settings is source of truth) | COMMENT |
| LOW | src/utils/plugins/installedPluginsManager.ts | 1148 | // Step 1: Build a map of pluginId -> scope from all settings.json files | COMMENT |
| LOW | src/utils/plugins/installedPluginsManager.ts | 1312 | // Step 4: Save to single file (V2 format) | COMMENT |
| LOW⚡ | src/utils/plugins/pluginLoader.ts | 1360 | // Step 1: Load or create the plugin manifest | COMMENT |
| LOW⚡ | src/utils/plugins/pluginLoader.ts | 1365 | // Step 2: Create the base plugin object | COMMENT |
| LOW | src/utils/plugins/pluginLoader.ts | 1376 | // Step 3: Auto-detect optional directories in parallel | COMMENT |
| LOW | src/utils/plugins/pluginLoader.ts | 1532 | // Step 4: Register agents directory if detected | COMMENT |
| LOW | src/utils/plugins/pluginLoader.ts | 1641 | // Step 5: Load hooks configuration | COMMENT |
| LOW | src/utils/plugins/pluginLoader.ts | 1789 | // Step 6: Load plugin settings | COMMENT |
| LOW | src/components/MarkdownTable.tsx | 107 | // Step 1: Get minimum (longest word) and ideal (full content) widths | COMMENT |
| LOW⚡ | src/components/MarkdownTable.tsx | 123 | // Step 2: Calculate available space | COMMENT |
| LOW⚡ | src/components/MarkdownTable.tsx | 130 | // Step 3: Calculate column widths that fit available space | COMMENT |
| LOW | src/components/MarkdownTable.tsx | 158 | // Step 4: Calculate max row lines to determine if vertical format is needed | COMMENT |
| LOW⚡ | src/components/StructuredDiff/Fallback.tsx | 353 | // Step 1: Transform lines to line objects with type information | COMMENT |
| LOW⚡ | src/components/StructuredDiff/Fallback.tsx | 356 | // Step 2: Group adjacent add/remove lines for word-level diffing | COMMENT |
| LOW⚡ | src/components/StructuredDiff/Fallback.tsx | 359 | // Step 3: Number the diff lines | COMMENT |
| LOW⚡ | src/components/StructuredDiff/Fallback.tsx | 368 | // Step 4: Render formatting | COMMENT |
| LOW | src/skills/bundled/skillify.ts | 40 | ### Step 1: Analyze the Session | COMMENT |
| LOW | src/skills/bundled/skillify.ts | 52 | ### Step 2: Interview the User | COMMENT |
| LOW | src/skills/bundled/skillify.ts | 90 | ### Step 3: Write the SKILL.md | COMMENT |
| LOW | src/skills/bundled/skillify.ts | 148 | ### Step 4: Confirm and Save | COMMENT |
| LOW⚡ | src/services/compact/sessionMemoryCompact.ts | 242 | // Step 1: Handle tool_use/tool_result pairs | COMMENT |
| LOW | src/services/compact/sessionMemoryCompact.ts | 288 | // Step 2: Handle thinking blocks that share message.id with kept assistant messages | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …nts/workspace/surfaces/document/pdfEngine.node.test.ts | 264 | expect(stub.pdfjs.getDocument.mock.calls.map(([params]) => params.worker)).toEqual([ | CODE |
| CRITICAL | desktop/src/pages/TerminalSettings.test.tsx | 157 | act(() => terminalMocks.terminalInstance.onTitleChange.mock.calls.at(-1)?.[0]('project — zsh')) | CODE |
| CRITICAL | adapters/feishu/streaming-card.ts | 220 | this.deps.larkClient.im.message.create({ | CODE |
| CRITICAL | adapters/feishu/streaming-card.ts | 355 | this.deps.larkClient.im.message.patch({ | CODE |
| CRITICAL | adapters/feishu/streaming-card.ts | 369 | this.deps.larkClient.im.message.patch({ | CODE |
| CRITICAL | adapters/feishu/streaming-card.ts | 424 | this.deps.larkClient.im.message.patch({ | CODE |
| CRITICAL | adapters/feishu/streaming-card.ts | 577 | this.deps.larkClient.im.message.patch({ | CODE |
| CRITICAL | src/tools/AgentTool/UI.tsx | 839 | const toolResultBlock = lastToolResult.data.message.message.content.find(c => c.type === 'tool_result'); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ktop/scripts/e2e-deepseek-thinking-ui-agent-browser.sh | 192 | .find((node) => node.getAttribute('placeholder') === placeholder); | CODE |
| LOW | …ktop/scripts/e2e-deepseek-thinking-ui-agent-browser.sh | 279 | .find((node) => node.getAttribute('placeholder') === placeholder); | CODE |
| LOW | …ktop/scripts/e2e-deepseek-thinking-ui-agent-browser.sh | 285 | .filter((node) => node.getAttribute('placeholder') === '与主模型相同'); | CODE |
| LOW | desktop/electron/ipc/capabilities.test.ts | 31 | expect(validateElectronIpcPayload(ELECTRON_IPC_CHANNELS.publicAccessSaveCredential, 'fake-token')).toBe(true) | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 32 | expect(migratePublicAccessSettings({ authtoken: 'fake-token', future: 7 })).toEqual({ version: 1, authtoken: 'fake-t | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 49 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 56 | writeFileSync(file, JSON.stringify({ version: 1, authtoken: 'fake-token', autoStart: true, consentVersion: 1, future | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 71 | writeFileSync(path.join(directory, 'public-access-private.json'), JSON.stringify({ authtoken: 'fake-token', extra: t | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 89 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 97 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 111 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 125 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 136 | await manager.saveCredential('fake-token') | CODE |
| LOW⚡ | desktop/electron/services/publicAccess.test.ts | 150 | await manager.saveCredential('fake-token') | CODE |
| LOW⚡ | desktop/electron/services/publicAccess.test.ts | 151 | forward.mockRejectedValueOnce(new Error('network unavailable fake-token')) | CODE |
| LOW⚡ | desktop/electron/services/publicAccess.test.ts | 157 | forward.mockRejectedValueOnce(new Error('authtoken invalid fake-token')) | CODE |
| LOW⚡ | desktop/electron/services/publicAccess.test.ts | 167 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 182 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 193 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 205 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 224 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 320 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/electron/services/publicAccess.test.ts | 338 | await manager.saveCredential('fake-token') | CODE |
| LOW | desktop/src/stores/hahaOpenAIOAuthStore.test.ts | 60 | email: 'user@example.com', | CODE |
| LOW | desktop/src/stores/hahaOpenAIOAuthStore.test.ts | 73 | email: 'user@example.com', | CODE |
| LOW | desktop/src/stores/hahaOpenAIOAuthStore.test.ts | 85 | email: 'user@example.com', | CODE |
| LOW | desktop/src/stores/chatStore.test.ts | 6530 | toolInput: '{"placeholder":"streamed before permission"', | CODE |
| LOW | desktop/src/stores/chatStore.test.ts | 6539 | partialInput: '{"placeholder":"streamed before permission"', | CODE |
| LOW | desktop/src/components/market/MarketHome.test.tsx | 414 | 'placeholder', | CODE |
| LOW | desktop/src/__tests__/generalSettings.test.tsx | 3193 | expect(fableInput).toHaveAttribute('placeholder', 'Leave blank to let Claude Code choose') | CODE |
| LOW | desktop/src/__tests__/generalSettings.test.tsx | 3195 | .toHaveAttribute('placeholder', 'Same as main') | CODE |
| LOW⚡ | desktop/src/pages/Connectors.test.tsx | 138 | fireEvent.change(screen.getByLabelText('API key'), { target: { value: 'fake-key' } }) | CODE |
| LOW⚡ | desktop/src/pages/Connectors.test.tsx | 144 | expect(screen.getByRole('dialog')).not.toHaveTextContent('fake-key') | CODE |
| LOW⚡ | desktop/src/pages/Connectors.test.tsx | 147 | expect(perform).toHaveBeenCalledWith('remote-search', 'authenticate', { configuration: { apiKey: 'fake-key', workspace | CODE |
| LOW | desktop/src/pages/Connectors.test.tsx | 303 | expect(screen.getByRole('searchbox', { name: 'extensions.searchPlugins' })).toHaveAttribute('placeholder', 'extensions | CODE |
| LOW | …p/src/pages/settings/GeneralSettingsSubagents.test.tsx | 40 | expect(input).toHaveAttribute('placeholder', '不限（默认）') | CODE |
| LOW | scripts/quality-gate/desktop-smoke/deterministic.ts | 99 | apiKey: 'desktop-ui-smoke-fake-key', | CODE |
| LOW | …ripts/quality-gate/desktop-smoke/deterministic.test.ts | 77 | apiKey: 'desktop-ui-smoke-fake-key', | CODE |
| LOW | src/server/proxy/handlerProtocolTrace.test.ts | 31 | presetId: 'custom', name: 'Fixture', baseUrl: 'https://fixture.invalid', apiKey: 'fake-key', apiFormat, | CODE |
| LOW | src/server/proxy/handlerRequestCompatibility.test.ts | 29 | presetId: 'custom', name: 'Fixture', baseUrl: 'https://fixture.invalid', apiKey: 'fake-key', apiFormat, | CODE |
| LOW | src/server/proxy/handlerRequestCompatibility.test.ts | 60 | presetId: 'custom', name: 'Fixture', baseUrl: 'https://fixture.invalid', apiKey: 'fake-key', apiFormat: 'openai_ch | CODE |
| LOW | src/server/__tests__/skills.test.ts | 159 | id, presetId: 'custom', name: id, apiKey: 'fake-key', baseUrl: 'http://127.0.0.1:9/v1', models, ...extra, | CODE |
| LOW | src/server/__tests__/haha-grok-oauth-service.test.ts | 90 | email: 'user@example.com', | CODE |
| LOW | src/server/__tests__/haha-grok-oauth-service.test.ts | 100 | email: 'user@example.com', | CODE |
| LOW | src/server/__tests__/haha-grok-oauth-service.test.ts | 137 | email: 'user@example.com', | CODE |
| LOW | src/server/__tests__/auto-question-answer.test.ts | 278 | presetId: 'custom', name: 'Original', apiKey: 'old-fake-key', | CODE |
| LOW | src/server/__tests__/auto-question-answer.test.ts | 286 | await providers.updateProvider(provider.id, { apiKey: 'new-fake-key', baseUrl: 'https://new.invalid' }) | CODE |
| LOW | src/server/__tests__/haha-grok-oauth-api.test.ts | 41 | email: 'user@example.com', | CODE |
| LOW | src/server/__tests__/haha-grok-oauth-api.test.ts | 49 | expect(statusText).toContain('user@example.com') | CODE |
| LOW | src/server/__tests__/providers.test.ts | 739 | email: 'user@example.com', | CODE |
| LOW | src/server/services/autoQuestionDecisionService.test.ts | 68 | presetId: 'custom', name: 'Fixture', apiKey: 'fake-key', authStrategy: 'api_key', | CODE |
| LOW | src/server/services/autoQuestionDecisionService.test.ts | 87 | expect(headers[0]?.get('x-api-key')).toBe('fake-key') | CODE |
| LOW | src/server/services/autoQuestionDecisionService.test.ts | 105 | presetId: 'custom', name: 'Fixture', apiKey: 'fake-key', authStrategy: 'api_key', | CODE |
| LOW | src/server/services/autoQuestionDecisionService.test.ts | 177 | presetId: 'custom', name: 'Fixture', apiKey: 'fake-key', | CODE |
| LOW | src/server/services/autoQuestionDecisionService.test.ts | 323 | presetId: 'custom', name: 'Fixture', apiKey: 'fake-key', | CODE |
| LOW | src/server/services/diagnosticsShare.test.ts | 81 | email: 'user@example.com', | CODE |
| LOW | src/server/services/diagnosticsShare.test.ts | 105 | 'user@example.com', | CODE |
| LOW | …erver/services/conversationService.teamWorkers.test.ts | 64 | const first = await providers.addProvider({ presetId: 'custom', name: 'A', baseUrl: 'http://127.0.0.1:32111', apiKey: | CODE |
| LOW | …erver/services/conversationService.teamWorkers.test.ts | 65 | const second = await providers.addProvider({ presetId: 'custom', name: 'B', baseUrl: 'http://127.0.0.1:32112', apiKey: | CODE |
| LOW | …erver/services/conversationService.teamWorkers.test.ts | 76 | expect(JSON.stringify(a)).not.toContain('fake-key-b') | CODE |
| 12 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | runtime/win_helper.py | 58 | except (AttributeError, OSError): | CODE |
| HIGH | runtime/win_helper.py | 66 | except (AttributeError, OSError): | CODE |
| HIGH | runtime/win_helper.py | 70 | except (AttributeError, OSError): | CODE |
| HIGH | runtime/win_helper.py | 228 | except Exception: | CODE |
| HIGH | runtime/win_helper.py | 1559 | except Exception: | CODE |
| HIGH | runtime/win_helper.py | 1971 | except (UserInterference, InputMonitorUnavailable): | CODE |
| HIGH | runtime/win_cursor_badge.py | 205 | except (AttributeError, OSError): | CODE |
| HIGH | runtime/win_cursor_badge.py | 213 | except (AttributeError, OSError): | CODE |
| HIGH | runtime/win_cursor_badge.py | 217 | except (AttributeError, OSError): | CODE |
| HIGH | runtime/win_cursor_badge.py | 326 | except (AttributeError, OSError): | CODE |
| HIGH | runtime/win_cursor_badge.py | 362 | except (AttributeError, OSError): | CODE |
| HIGH | runtime/win_cursor_badge.py | 596 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | release-notes/v0.4.3.md | 58 | - #830：尊重自定义 provider context window。 | CODE |
| MEDIUM | src/main.tsx | 3340 | // of a remote assistant session. The agentic loop runs remotely; this | COMMENT |
| MEDIUM | src/query.ts | 202 | // budget for the whole agentic turn; `remaining` is computed per iteration | COMMENT |
| MEDIUM | src/query.ts | 271 | // One object for the whole agentic turn, including tool continuations and | COMMENT |
| MEDIUM | src/tools/AgentTool/loadAgentsDir.ts | 129 | maxTurns?: number // Maximum number of agentic turns before stopping | CODE |
| MEDIUM | src/utils/betas.ts | 448 | // excluded by getAllModelBetas() since non-agentic Haiku calls don't need them. | COMMENT |
| MEDIUM | src/utils/attachments.ts | 1081 | // During proactive agentic loops, task-notification commands would otherwise | COMMENT |
| MEDIUM | src/utils/attachments.ts | 1315 | // long agentic sessions, where this accumulated 60-105× per session. | COMMENT |
| MEDIUM | src/services/openaiAuth/fetch.test.ts | 430 | request.abort() // SDK stream disposal is not the end of the agentic turn. | CODE |
| MEDIUM | src/services/openaiAuth/fetch.ts | 167 | // The server's first successful response pins this agentic turn. Do not | COMMENT |
| MEDIUM | src/services/api/claude.ts | 797 | // (query.ts decrements across the agentic loop). | COMMENT |
| MEDIUM | src/services/api/claude.ts | 1238 | // non-agentic queries (compact, side_question, extract_memories, etc.) | COMMENT |
| MEDIUM | src/services/api/claude.ts | 1576 | // per-call so non-agentic queries keep their own stable header set. | COMMENT |
| MEDIUM | src/services/api/claude.ts | 1610 | // Only latch from agentic queries so a classifier call doesn't flip the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/server/services/sessionService.ts | 2656 | // 3. Look for AI-generated title (written by titleService) | COMMENT |
| HIGH | src/utils/claudeInChrome/setup.ts | 320 | REM Generated by Claude Code - do not edit manually | CODE |
| HIGH | src/utils/claudeInChrome/setup.ts | 325 | # Generated by Claude Code - do not edit manually | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | package-lock.json | 5300 | "resolved": "https://registry.npmmirror.com/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| MEDIUM | site/package-lock.json | 3072 | "resolved": "https://registry.npmmirror.com/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| MEDIUM | src/tools/PowerShellTool/commandSemantics.ts | 71 | // robocopy.exe: Windows native robust file copy | COMMENT |
| MEDIUM | src/utils/swarm/backends/PaneBackendExecutor.ts | 341 | // A more robust check would query the backend for pane existence | COMMENT |
| MEDIUM | src/utils/powershell/parser.ts | 1068 | // and extracting .Redirections) is both simpler and more robust: it catches | COMMENT |
| MEDIUM | src/hooks/useVoiceIntegration.tsx | 176 | // the gap is seamless once transcript text arrives. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | runtime/win_helper.py | 1349 | def _foreground_window_pid() -> int | None: | CODE |
| MEDIUM | runtime/win_helper.py | 1409 | def finalize(self) -> None: | CODE |
| LOW⚡ | runtime/win_helper.py | 331 | except Exception: | CODE |
| LOW⚡ | runtime/win_helper.py | 343 | except Exception: | CODE |
| LOW⚡ | runtime/win_helper.py | 719 | except Exception: | CODE |
| LOW⚡ | runtime/win_helper.py | 731 | except Exception: | CODE |
| LOW⚡ | runtime/win_helper.py | 1612 | except Exception: | CODE |
| LOW⚡ | runtime/win_helper.py | 1617 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 228 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 309 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 583 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 605 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 1358 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 1521 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 1559 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 1565 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 1581 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 1599 | except Exception: | CODE |
| LOW | runtime/win_helper.py | 1964 | except Exception as exc: | CODE |
| LOW | runtime/win_cursor_badge.py | 596 | except Exception: | CODE |
| MEDIUM | runtime/win_cursor_badge.py | 587 | def _read_parent(self) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | desktop/scripts/build-macos-arm64.test.ts | 43 | elif [[ "\${1:-}" == "-m" ]]; then | CODE |
| HIGH | src/tools/TodoWriteTool/prompt.ts | 100 | print("Hello World") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | runtime/win_helper.py | 427 | CODE | |
| LOW | runtime/win_helper.py | 609 | CODE | |
| LOW | runtime/win_helper.py | 653 | CODE | |
| LOW | runtime/win_helper.py | 1570 | CODE | |
| LOW | runtime/win_cursor_badge.py | 505 | CODE | |
| LOW | runtime/win_cursor_badge.py | 543 | CODE | |
| LOW | runtime/win_cursor_badge.py | 561 | CODE | |
| LOW | runtime/win_cursor_badge.py | 587 | CODE | |
| LOW | runtime/test_helpers.py | 45 | CODE | |
| LOW | runtime/test_helpers.py | 223 | CODE | |
| LOW | …/skills/release-announcement/scripts/release_poster.py | 126 | CODE | |
| LOW | desktop/scripts/build-pet-sheet-guide.py | 134 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | runtime/win_helper.py | 27 | CODE | |
| LOW | runtime/win_cursor_badge.py | 21 | CODE | |
| LOW | runtime/test_helpers.py | 18 | CODE | |
| LOW | desktop/scripts/assemble-generated-pet-atlas.py | 4 | CODE | |
| LOW | desktop/scripts/build-pet-sheet-guide.py | 13 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | desktop/scripts/install-macos-unsigned.sh | 15 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/utils/hooks.ts | 1211 | // TODO: Add tests for EPIPE handling. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | runtime/win_cursor_badge.py | 659 | def _update_layered_image(self, image: Image.Image, left: int, top: int) -> None: | CODE |