6.9

Adjusted Signal

6.9

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

28.8K

Stars

TypeScript

Language

5.9M

Lines of Code

13.0K

Files

13.1K

Pattern Hits

2026-10-31

Scan Date

0.21

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 8839 finding(s).

Hallucinated Dependency & Supply Chain Risk 21.2/100 · LOW

Are imports declared and package/API names verified? 2997 finding(s).

Agent Over-Engineering Ratio 6.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 6005 finding(s).

PR Review Velocity Impact 28.6/100 · MEDIUM

Which changes need focused human review? 13084 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2624HIGH 74MEDIUM 1300LOW 9086

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 13084 distinct pattern matches across 24 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators2624 hits · 27468 pts

Severity	File	Line	Snippet	Context
CRITICAL	…ema/tests/RuntimeBrokerRetentionLegacyUpgradeTest.java	93	@org.junit.jupiter.params.provider.ValueSource(strings = {"11", "13"})	CODE
CRITICAL	docs/verification/13532-linux-h3/probe-inputs.md	139	Files.createDirectory(temporary.resolve("runtime"), java.nio.file.attribute.PosixFilePermissions.asFileAttribute	CODE
CRITICAL	scripts/tests/codeql-workflow.test.js	27	const java = yml.jobs.codeql.strategy.matrix.include.filter(	CODE
CRITICAL	scripts/tests/managed-harness-kubernetes.test.js	530	spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms.reverse();	CODE
CRITICAL	scripts/tests/managed-harness-kubernetes.test.js	556	fixture.deployment.spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nod	CODE
CRITICAL	scripts/tests/managed-harness-kubernetes.test.js	683	fixture.deployment.spec.template.spec.volumes.push({	CODE
CRITICAL	scripts/tests/audio-prebuilds.test.js	349	f.github.rest.actions.listArtifactsForRepo.mockRejectedValueOnce(	CODE
CRITICAL	scripts/tests/audio-prebuilds.test.js	355	f.github.rest.actions.listArtifactsForRepo.mockResolvedValueOnce({	CODE
CRITICAL	…ipts/tests/managed-harness-kubernetes-launcher.test.js	193	const harness = pool.spec.template.spec.containers.find(	CODE
CRITICAL	…/openaiContentGenerator/openaiContentGenerator.test.ts	103	generatorWithClient.pipeline.client.embeddings.create.mockRejectedValue(	CODE
CRITICAL	…on/src/background/browser-use-bridge.lifecycle.test.ts	378	f.chromeApi.storage.session.set.mockRejectedValueOnce(	CODE
CRITICAL	…on/src/background/browser-use-bridge.lifecycle.test.ts	1020	f.chromeApi.storage.session.set.mockImplementationOnce(block);	CODE
CRITICAL	…on/src/background/browser-use-bridge.lifecycle.test.ts	1201	const methods = f.port.postMessage.mock.calls.map(	CODE
CRITICAL	packages/cli/src/ui/opentui/start-opentui-ui.test.tsx	314	mocks.state.runtime.dualOutputBridge.finalizeAssistantMessage.mockClear();	CODE
CRITICAL	packages/cli/src/ui/opentui/start-opentui-ui.test.tsx	350	const tree = mocks.state.root.render.mock.calls.at(	CODE
CRITICAL	…kages/cli/src/ui/opentui/ExtensionAcquisition.test.tsx	249	const args = f.methods.installExtension.mock.calls.at(-1)!;	CODE
CRITICAL	packages/cli/src/ui/hooks/use-llm-stream.test.tsx	1398	hook.result.current.slash.slashCommands.some(	CODE
CRITICAL	packages/cli/src/commands/batch-workflow.test.ts	468	const deleted = h.api.deleteFile.mock.calls.map(	CODE
CRITICAL	packages/cli/src/commands/batch-workflow.test.ts	529	h.api.deleteFile.mock.calls.map((call: unknown[]) => call[1]),	CODE
CRITICAL	packages/cli/src/serve/hosted-input.test.ts	40	spec.components.schemas.InputImageBlock.properties.mime_type.enum.toSorted(),	CODE
CRITICAL	packages/cli/src/serve/hosted-harness-session.ts	10966	continueAuthorization.authorization.checkpoint.agentWait.runs.filter(	CODE
CRITICAL	packages/cli/src/serve/hosted-harness-session.ts	10985	continueAuthorization.authorization.checkpoint.agentWait.runs.at(	CODE
CRITICAL	…serve/conversations/standalone-session-service.test.ts	4534	h.bridge.killSession.mock.calls.every(([id]) => id === sessionId),	CODE
CRITICAL	…es/cli/src/serve/live/live-session-coordinator.test.ts	1917	harness.realtime.pushAudio.mock.invocationCallOrder.at(-1)!;	CODE
CRITICAL	packages/cli/src/services/mod-session.test.ts	673	loaded.runtime.completeTurn.mock.calls.at(-1)?.[0] as ModTurnComplete;	CODE
CRITICAL	…nts/sidebar/WebShellSidebar.workspace-removal.test.tsx	3566	const handleCallsBefore = workspace.client.workspaceByCwd.mock.calls.filter(	CODE
CRITICAL	…nts/sidebar/WebShellSidebar.workspace-removal.test.tsx	3587	workspace.client.workspaceByCwd.mock.calls.filter(	CODE
CRITICAL	…client/components/managed/ManagedSessionsPage.test.tsx	559	mocks.client.listSessions.mock.calls.map(	CODE
CRITICAL	…client/components/managed/ManagedSessionsPage.test.tsx	944	mocks.client.listSessions.mock.calls.at(-1)?.[0],	CODE
CRITICAL⚡	…client/components/managed/ManagedSessionsPage.test.tsx	2326	const firstReads = mocks.client.getSession.mock.calls.filter(	CODE
CRITICAL⚡	…client/components/managed/ManagedSessionsPage.test.tsx	2334	mocks.client.getSession.mock.calls.filter(([id]) => id === 's1'),	CODE
CRITICAL⚡	…client/components/managed/ManagedSessionsPage.test.tsx	2337	mocks.client.getSession.mock.calls.some(([id]) => id === 's3'),	CODE
CRITICAL	…client/components/managed/ManagedSessionsPage.test.tsx	4715	expect(mocks.client.getTranscript.mock.calls.map(([id]) => id)).toEqual([	CODE
CRITICAL	…l/client/daemon/session/DaemonSessionProvider.test.tsx	3506	sdkMocks.MockDaemonSessionClient.load.mock.calls.some(	CODE
CRITICAL	…l/client/daemon/session/DaemonSessionProvider.test.tsx	15559	sdkMocks.MockDaemonSessionClient.load.mock.calls.map((call) => call[1]),	CODE
CRITICAL	…lient/hooks/useQueuedPrompts.midTurnReconcile.test.tsx	4124	harness.store.appendLocalUserMessage.mock.calls.map((call) => call[2]),	CODE
CRITICAL	…lient/hooks/useQueuedPrompts.midTurnReconcile.test.tsx	4127	harness.store.appendLocalUserMessage.mock.calls.every(	CODE
CRITICAL	…lient/hooks/useQueuedPrompts.midTurnReconcile.test.tsx	4482	sdkMock.actions.getPendingPrompts.mock.calls.filter(	CODE
CRITICAL	…lient/hooks/useQueuedPrompts.midTurnReconcile.test.tsx	15927	harness.store.appendLocalUserMessage.mock.calls.map((call) => [	CODE
CRITICAL	…/src/orchestrator/review-proactive-diagnostics.test.ts	243	const failureLog = observed.log.write.mock.calls.find(	CODE
CRITICAL	…n/code/runtimebroker/service/RuntimeBrokerService.java	773	if (!com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.SSH_PROCESS.equals(binding.getRequest().g	CODE
CRITICAL	…n/code/runtimebroker/service/RuntimeBrokerService.java	786	if (!com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.SSH_PROCESS.equals(binding.getRequest().g	CODE
CRITICAL	…n/code/runtimebroker/service/RuntimeBrokerService.java	814	if (!com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.SSH_PROCESS.equals(binding.getRequest().g	CODE
CRITICAL	…n/code/runtimebroker/service/RuntimeBrokerService.java	847	if (!com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.SSH_PROCESS.equals(binding.getRequest().g	CODE
CRITICAL	…n/code/runtimebroker/service/RuntimeBrokerService.java	4931	if (!com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.SSH_PROCESS.equals(context.bi	CODE
CRITICAL	…/alibaba/qwen/code/runtimebroker/RuntimeAdmission.java	46	\|\| !com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.LOCAL_PROCESS.equals(binding.getRe	CODE
CRITICAL	…/alibaba/qwen/code/runtimebroker/RuntimeAdmission.java	47	&& !com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.SSH_PROCESS.equals(binding	CODE
CRITICAL	…/qwen/code/runtimebroker/CsiNativeActivationProof.java	414	response.put("error", !com.alibaba.qwen.code.runtimebroker.CsiNativeToolContent.trim(output).isEmpty() && !"	CODE
CRITICAL	…/qwen/code/runtimebroker/CsiNativeActivationProof.java	465	String reason = com.alibaba.qwen.code.runtimebroker.CsiNativeToolContent.refusalReason(original, call);	CODE
CRITICAL	…/qwen/code/runtimebroker/CsiNativeActivationProof.java	614	var content = com.alibaba.qwen.code.runtimebroker.CsiNativeToolContent.content(original, batch.batch().calls().g	CODE
CRITICAL	…/qwen/code/runtimebroker/CsiNativeActivationProof.java	924	var input = com.alibaba.qwen.code.runtimebroker.CsiNativeToolContent.qualifyContent(original, batch, ref, te	CODE
CRITICAL	…baba/qwen/code/runtimebroker/RuntimeBindingRecord.java	375	&& (!com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.LOCAL_PROCESS.equals(	CODE
CRITICAL	…/alibaba/qwen/code/runtimebroker/HarnessOwnership.java	18	&& com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.LOCAL_PROCESS.equals(request.getPro	CODE
CRITICAL	…n/code/runtimebroker/transport/ManagedCsiProtocol.java	73	com.alibaba.qwen.code.runtimebroker.protocol.KubernetesNames.dnsLabel(string(storage, "namespace"));	CODE
CRITICAL	…n/code/runtimebroker/transport/ManagedCsiProtocol.java	147	com.alibaba.qwen.code.runtimebroker.protocol.KubernetesNames.dnsSubdomain(string(pod, "nodeName"));	CODE
CRITICAL	…e/runtimebroker/transport/ManagedCsiFilesProtocol.java	36	private static final ObjectMapper JSON = new ObjectMapper(com.fasterxml.jackson.core.JsonFactory.builder()	CODE
CRITICAL	…e/runtimebroker/transport/ManagedCsiFilesProtocol.java	37	.streamReadConstraints(com.fasterxml.jackson.core.StreamReadConstraints.builder()	CODE
CRITICAL⚡	…/code/runtimebroker/protocol/ExternalRuntimeKinds.java	19	return com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.EXTERNAL_SCRATCH.equals(provisionerKind	CODE
CRITICAL⚡	…/code/runtimebroker/protocol/ExternalRuntimeKinds.java	20	\|\| com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.EXTERNAL_WORKSPACE.equals(provision	CODE
CRITICAL⚡	…/code/runtimebroker/protocol/ExternalRuntimeKinds.java	25	return com.alibaba.qwen.code.runtimebroker.protocol.RuntimeProviderKinds.EXTERNAL_WORKSPACE.equals(provisionerKi	CODE
2564 more matches not shown…

Hyper-Verbose Identifiers4757 hits · 4700 pts

Severity	File	Line	Snippet	Context
LOW	…kills/agent-reproduce-feature/scripts/capture_state.py	186	def replace_quoted_key_quoted_value(match: re.Match[str]) -> str:	CODE
LOW	integration-tests/chat-transcript-contract.test.ts	96	function expectManifestToMatchSchema(	CODE
LOW	integration-tests/chat-transcript-contract.test.ts	123	function collectDeclaredSchemaProperties(	CODE
LOW	integration-tests/chat-transcript-document.test.ts	288	async function installNetworkAndCspProbe(page: Page): Promise<{	CODE
LOW	integration-tests/chat-transcript-document.test.ts	333	async function expectConnectSrcCspEnforced(page: Page): Promise<void> {	CODE
LOW	integration-tests/test-helper.ts	40	export function createToolCallErrorMessage(	CODE
LOW	integration-tests/test-helper.ts	158	export function applyContainerSandboxNoProxy(): () => void {	CODE
LOW	integration-tests/test-helper.ts	1036	export async function runForcedToolCallScenario(options: {	CODE
LOW	integration-tests/terminal-bench/qwen_code.py	58	def _install_agent_script_path(self) -> os.PathLike:	CODE
LOW	…-tests/terminal-capture/subagent-flicker-regression.ts	173	function buildSubagentSingleToolCall(	CODE
LOW	…-tests/terminal-capture/subagent-flicker-regression.ts	232	function startSubagentFakeOpenAIServer(	CODE
LOW	…terminal-capture/skill-review-harness/text-capture.tsx	119	async function findGlobalInteractiveChunk(chunksDir: string) {	CODE
LOW	integration-tests/cli/_daemon-harness.ts	239	export function approveWorkspaceMcpServers(	CODE
LOW	…n-tests/cli/qwen-daemon-first-output-benchmark.test.ts	589	async function terminateTrackedProcessGroup(	CODE
LOW	…n-tests/cli/qwen-daemon-first-output-benchmark.test.ts	777	function prepareIsolatedDirectories(sampleId: string): {	CODE
LOW	…n-tests/cli/qwen-daemon-first-output-benchmark.test.ts	1597	function isSuccessfulProcessSample(	CODE
LOW	integration-tests/cli/_daemon-benchmark-helpers.ts	234	export async function measureCliStartupWithProfiler(opts?: {	CODE
LOW	integration-tests/cli/_first-output-benchmark.ts	22	export function parseBenchmarkPostSessionDwell(	CODE
LOW	integration-tests/cli/_first-output-benchmark.ts	34	export function measuredPairCountForDwell(	CODE
LOW	integration-tests/cli/_first-output-benchmark.ts	627	export function pairedCandidateControlStats(	CODE
LOW	integration-tests/cli/_first-output-benchmark.ts	837	export function validateExpectedFinalText(	CODE
LOW	integration-tests/cli/_first-output-benchmark.ts	873	export function evaluateSingleBundlePrototypeGate(	CODE
LOW	integration-tests/cli/_first-output-benchmark.ts	968	export function computeFirstOutputSessionTimings(	CODE
LOW	integration-tests/cli/_first-output-benchmark.ts	1270	export function renderFirstOutputBenchmarkMarkdown(	CODE
LOW	…ration-tests/sdk-typescript/permission-control.test.ts	92	function startFakeToolServerOnMatch(	CODE
LOW	…ration-tests/sdk-typescript/permission-control.test.ts	112	function createStreamingInputWithControlPoint(	CODE
LOW	integration-tests/sdk-typescript/test-helper.ts	737	export function createControlledStreamingInput(	CODE
LOW	integration-tests/sdk-typescript/test-helper.ts	853	export function assertSuccessfulCompletion(messages: SDKMessage[]): void {	CODE
LOW	integration-tests/sdk-typescript/test-helper.ts	992	export function createToolCallErrorMessage(	CODE
LOW	…tests/interactive/context-compress-interactive.test.ts	49	async function runInteractiveWithFakeModel() {	CODE
LOW	…tests/interactive/context-compress-interactive.test.ts	74	function expectSuccessfulCompression() {	CODE
LOW	integration-tests/helpers/chat-transcript-contract.ts	40	export function adaptAcpTranscriptUpdates(	CODE
LOW	integration-tests/helpers/chat-transcript-contract.ts	71	export function projectStableTranscriptBlockIds(	CODE
LOW	…7-14-chat-record-daemon-transcript-block-projection.md	421	export function createTranscriptReplayMachine(	CODE
LOW	…7-14-chat-record-daemon-transcript-block-projection.md	538	export function projectChatRecordsToDaemonTranscript(	CODE
LOW	docs/design/custom-api-key-auth-wizard-prd.md	541	function generateCustomApiKeyEnvKey(protocol: string, baseUrl: string): string {	CODE
LOW	docs/design/2026-08-28-trusted-loopback-full-api.md	280	function requestHasOperatorAuthority(	CODE
LOW	…ign/2026-07-14-web-shell-readonly-daemon-transcript.md	169	export function transcriptBlocksToLocalizedMessages(	CODE
LOW	…s/design/2026-05-27-daemon-workspace-service-design.md	208	export function createDaemonWorkspaceService(	CODE
LOW	docs/design/f2-mcp-transport-pool.md	860	export function isWorkspaceScopedBudgetEvent(	CODE
LOW	docs/design/f2-mcp-transport-pool.md	1226	export function isWorkspaceScopedBudgetEvent(	CODE
LOW	docs/design/telemetry-resource-attributes-design.md	218	function parseOtelResourceAttributes(	CODE
LOW	docs/design/slash-command/phase1-technical-design.md	336	export function getEffectiveSupportedModes(cmd: SlashCommand): ExecutionMode[] {	CODE
LOW	docs/design/slash-command/phase1-technical-design.md	448	function filterCommandsForNonInteractive(	CODE
LOW	docs/design/slash-command/phase3-technical-design.md	117	export function getCommandSubcommandNames(cmd: SlashCommand): string[];	CODE
LOW	docs/design/web-shell/2026-07-19-web-shell-git-log.md	255	export function registerWorkspaceGitLogRoutes(app, deps: {	CODE
LOW	docs/design/web-shell/2026-07-19-web-shell-git-log.md	263	export function registerWorkspaceQualifiedGitLogRoutes(app, deps: {	CODE
LOW	…/design/prompt-cache/global-tool-schema-stable-sort.md	192	function compareToolsByDeclarationName(	CODE
LOW	docs/plans/2026-08-05-feishu-ask-user-question-cards.md	55	export function buildQuestionTerminalCard(	CODE
LOW	docs/plans/2026-05-27-daemon-workspace-service.md	973	export function createDaemonWorkspaceService(	CODE
LOW	docs/plans/2026-05-26-daemon-logger.md	1060	export function createSpawnChannelFactory(	CODE
LOW	integrations/external-context-mem0/src/schemas.test.ts	496	async function writeRuntimeConfiguration(	CODE
LOW	integrations/external-context-mem0/src/schemas.ts	51	export function parseAutoRecallInstanceConfig(	CODE
LOW	integrations/external-context-mem0/src/schemas.ts	89	export function parseDeleteInstanceConfig(	CODE
LOW	…ons/external-context-mem0/src/delete-request-engine.ts	24	export function createDeleteRequestEngine(	CODE
LOW	integrations/external-context-mem0/src/config.ts	36	export async function loadAutoRecallRuntimeConfiguration(	CODE
LOW	integrations/external-context-mem0/src/delete-config.ts	23	export async function loadDeleteRuntimeConfiguration(	CODE
LOW	integrations/external-context-mem0/src/write-config.ts	24	export async function loadWriteRuntimeConfiguration(	CODE
LOW	…s/external-context-mem0/src/auto-recall-config.test.ts	247	async function writeRuntimeConfiguration(	CODE
LOW	…text/examples/provider-extension-local/src/provider.ts	13	export function validateProviderConfiguration(): void {	CODE
4697 more matches not shown…

Decorative Section Separators1149 hits · 3438 pts

Severity	File	Line	Snippet	Context
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	27	// ─────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	29	// ─────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	173	// ─────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	175	// ─────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	200	// ─────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	202	// ─────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	222	// ── Factory ──────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	278	// ── Lifecycle ────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	366	// ── Input ────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	403	// ── Wait ─────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	475	// ── Capture ──────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	641	// ── Output access ────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	697	// ── Cleanup ──────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	719	// ── Internal: flush PTY → xterm.js ──────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	753	// ── Internal: resolve xterm.js path ─────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	767	// ── Internal: build HTML ────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/terminal-capture.ts	876	// ── Internal: utils ─────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/scenario-runner.ts	17	// ─────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/scenario-runner.ts	19	// ─────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/scenario-runner.ts	89	// ─────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/terminal-capture/scenario-runner.ts	91	// ─────────────────────────────────────────────	COMMENT
MEDIUM	…terminal-capture/skill-review-harness/text-capture.tsx	334	// ── BEFORE ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	integration-tests/cli/qwen-serve-client-mcp.test.ts	712	// ── The model→agent dispatch fired ──────────────────────────────────────	COMMENT
MEDIUM	integration-tests/cli/qwen-serve-client-mcp.test.ts	724	// ── SUCCESS PATH (session-scoped runtime MCP — #5626) ───────────────────	COMMENT
MEDIUM	integration-tests/cli/qwen-serve-client-mcp.test.ts	724	// ── SUCCESS PATH (session-scoped runtime MCP — #5626) ───────────────────	COMMENT
MEDIUM	docs/design/slash-command/phase1-technical-design.md	90	// ── 现有字段（保持不变） ──────────────────────────────────────────────	COMMENT
MEDIUM	docs/design/slash-command/phase1-technical-design.md	102	// ── Phase 1 新增：来源与执行类型 ──────────────────────────────────────	COMMENT
MEDIUM	docs/design/slash-command/phase1-technical-design.md	129	// ── Phase 1 新增：模式能力 ──────────────────────────────────────────	COMMENT
MEDIUM	docs/design/slash-command/phase1-technical-design.md	137	// ── Phase 1 新增：可见性 ──────────────────────────────────────────────	COMMENT
MEDIUM	docs/design/slash-command/phase1-technical-design.md	151	// ── Phase 3 预留：体验元数据（Phase 1 仅定义，不使用）──────────────────	COMMENT
MEDIUM	docs/design/slash-command/phase1-technical-design.md	398	// ── 现有方法（保持不变）────────────────────────────────────────────────	COMMENT
MEDIUM	docs/design/slash-command/phase1-technical-design.md	403	// ── Phase 1 新增方法 ──────────────────────────────────────────────────	COMMENT
MEDIUM	docs/design/slash-command/phase1-technical-design.md	538	// ─────────────────────────────────────────	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	2	# =============================================================================	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	20	# =============================================================================	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	40	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	42	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	249	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	251	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	268	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	270	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	313	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	315	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	360	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	362	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	386	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	388	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	416	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	418	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	455	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/test-rewind-e2e.sh	457	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	packages/acp-bridge/src/logRedaction.test.ts	14	// ── Bearer tokens ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/acp-bridge/src/logRedaction.test.ts	36	// ── QQBot tokens ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/acp-bridge/src/logRedaction.test.ts	44	// ── Authorization header catch-all ────────────────────────────────	COMMENT
MEDIUM	packages/acp-bridge/src/logRedaction.test.ts	58	// ── DingTalk access token header ──────────────────────────────────	COMMENT
MEDIUM	packages/acp-bridge/src/logRedaction.test.ts	66	// ── API key prefixes ──────────────────────────────────────────────	COMMENT
MEDIUM	packages/acp-bridge/src/logRedaction.test.ts	121	// ── AWS access key IDs ────────────────────────────────────────────	COMMENT
MEDIUM	packages/acp-bridge/src/logRedaction.test.ts	127	// ── Key=value secret assignments ──────────────────────────────────	COMMENT
MEDIUM	packages/acp-bridge/src/logRedaction.test.ts	175	// ── JSON-quoted secret fields ───────────────────────────────────	COMMENT
MEDIUM	packages/acp-bridge/src/logRedaction.test.ts	195	// ── URL-embedded credentials ──────────────────────────────────────	COMMENT
1089 more matches not shown…

Over-Commented Block3697 hits · 3247 pts

Severity	File	Line	Snippet	Context
LOW	esbuild.config.js	61	// both OTLP protocol chains (~2 MiB) back into the sdk-impl static closure	COMMENT
LOW	esbuild.config.js	221	// Redirect free __dirname/__filename references to the shim so that	COMMENT
LOW	pnpm-workspace.yaml	21	- 'integrations/test-failure-explorer'	COMMENT
LOW	pnpm-workspace.yaml	81	# resolve-peers-from-workspace-root (on by default), every zod peer that a	COMMENT
LOW	.qwen/skills/find-simplifications/SKILL.md	141	### Rotation	COMMENT
LOW	.qwen/skills/find-simplifications/SKILL.md	161	# Delete the directory, never `git worktree remove --force` on the fixed	COMMENT
LOW	docs-site/next-env.d.ts	1	/// <reference types="next" />	COMMENT
LOW	integration-tests/scratch-dir.test.ts	41	);	COMMENT
LOW	integration-tests/globalSetup.ts	41	// settings, saved memories, tool-usage history, and extensions. Inherited	COMMENT
LOW	integration-tests/tsconfig.json	1	{	COMMENT
LOW	integration-tests/tsconfig.json	21	"baseUrl": ".",	COMMENT
LOW	integration-tests/cli/qwen-serve-routes.test.ts	181	'--hostname',	COMMENT
LOW	integration-tests/cli/qwen-serve-routes.test.ts	341	describe('qwen serve — capabilities envelope', () => {	COMMENT
LOW	integration-tests/cli/qwen-serve-routes.test.ts	361	// `git` binary) and is spliced the same way.	COMMENT
LOW	integration-tests/cli/qwen-serve-routes.test.ts	1021	// create-session time, the session stays operational on the	COMMENT
LOW	integration-tests/cli/qwen-serve-baseline.test.ts	441	// workspace-shared MCP transport pool (`QwenAgent.mcpPool`).	COMMENT
LOW	integration-tests/cli/qwen-serve-baseline.test.ts	481	// (`MCP_SERVERS_CONFIGURED` grandchildren — see the	COMMENT
LOW	integration-tests/cli/qwen-serve-baseline.test.ts	521	// doesn't take a sessionId in publish/subscribe — the bus instance	COMMENT
LOW	integration-tests/cli/qwen-serve-client-mcp.test.ts	81	// prompts) and any other turn keep getting a plain assistant reply.	COMMENT
LOW	integration-tests/cli/qwen-serve-client-mcp.test.ts	421	t.serverToolName === 'chrome_read_page' \|\|	COMMENT
LOW	integration-tests/cli/qwen-serve-client-mcp.test.ts	441	// • A session created LATER also inherits the bootstrap Config's runtime MCP	COMMENT
LOW	integration-tests/cli/qwen-serve-streaming.test.ts	81		COMMENT
LOW	integration-tests/cli/qwen-serve-streaming.test.ts	341	'--token',	COMMENT
LOW	integration-tests/cli/acp-integration.test.ts	121	// Use --acp by default, but allow testing with --experimental-acp for backward compatibility	COMMENT
LOW	integration-tests/interactive/interactive-session.ts	181	// of waiting the budget out; only a live-but-slow boot (#13552) pays the	COMMENT
LOW	…egration-tests/interactive/workflow-completion.test.ts	21	InteractiveSession,	COMMENT
LOW	…-tests/helpers/hosted-recovery-blocked-wedge-driver.ts	1121	requestDigest: `sha256:${'c'.repeat(64)}`,	COMMENT
LOW	docs/plans/2026-05-26-daemon-logger.md	1061	options: SpawnChannelFactoryOptions = {},	COMMENT
LOW	docs/users/qwen-serve.md	1061	-d '{"providerId":"qwen-oauth"}'	COMMENT
LOW	docs/users/features/omni-fixed-policies-preset.json	1	// ============================================================================	COMMENT
LOW	docs/developers/daemon/12-auth-security.md	21	- Host the device-flow registry that drives provider OAuth flows visible via SSE events.	COMMENT
LOW	scripts/build_package.js	1	/**	COMMENT
LOW	scripts/run-managed-agent-server-e2e.ts	1041	// predicate must not outlive timeoutMs, and its last error must	COMMENT
LOW	scripts/check-contract-open-prs.js	1	/**	COMMENT
LOW	scripts/build-standalone-release.js	61	// Classic Node.js packaging stays the default. --runtime=bun opts into the	COMMENT
LOW	scripts/sandbox_command.js	1	/**	COMMENT
LOW	scripts/start.js	1	#!/usr/bin/env node	COMMENT
LOW	scripts/esbuild-shims.js	21	import { dirname } from 'node:path';	COMMENT
LOW	scripts/vitest-global-setup.js	21		COMMENT
LOW	scripts/rocketmq-lite-broker.sh	1	#!/usr/bin/env bash	COMMENT
LOW	scripts/rocketmq-lite-broker.sh	21	# consumer group as a LITE group bound to it, because subscribeLite rejects	COMMENT
LOW	scripts/build.js	1	/**	COMMENT
LOW	scripts/test-rewind-e2e.sh	1	#!/usr/bin/env bash	COMMENT
LOW	scripts/check-lockfile.js	81		COMMENT
LOW	scripts/check-lockfile.js	101	// the `playwright` CLIs are.	COMMENT
LOW	scripts/clean.js	1	/**	COMMENT
LOW	scripts/check-failsafe-reports.js	1	/**	COMMENT
LOW	scripts/generate-git-commit-info.js	1	/**	COMMENT
LOW	scripts/build_vscode_companion.js	1	/**	COMMENT
LOW	scripts/check-flyway-open-prs.js	1	/**	COMMENT
LOW	scripts/check-contract-version.js	1	/**	COMMENT
LOW	scripts/build_sandbox.js	1	/**	COMMENT
LOW	scripts/copy_files.js	1	#!/usr/bin/env node	COMMENT
LOW	scripts/sign-release.sh	1	#!/usr/bin/env bash	COMMENT
LOW	scripts/copy_bundle_assets.js	1	/**	COMMENT
LOW	scripts/copy_bundle_assets.js	141	// walk and the measurement is incomplete, where a root that was never there	COMMENT
LOW	scripts/copy_bundle_assets.js	681	console.warn(	COMMENT
LOW	scripts/check-serve-fast-path-bundle.js	141	];	COMMENT
LOW	scripts/build-hosted-installation-assets.js	141	};	COMMENT
LOW	scripts/cli-entry.js	221	// thing that knows its own path, so it publishes it; `getShellContextEnvVars` passes	COMMENT
3637 more matches not shown…

Structural Annotation Overuse142 hits · 234 pts

Severity	File	Line	Snippet	Context
LOW	.qwen/skills/memory-leak-debug/SKILL.md	20	## Step 1: Start the CLI with Snapshot Signal	COMMENT
LOW	.qwen/skills/memory-leak-debug/SKILL.md	62	## Step 2: Exercise the Suspected Leak	COMMENT
LOW	.qwen/skills/memory-leak-debug/SKILL.md	78	## Step 3: Start chrome-devtools Daemon	COMMENT
LOW	.qwen/skills/memory-leak-debug/SKILL.md	87	## Step 4: Identify the Leak	COMMENT
LOW	.qwen/skills/memory-leak-debug/SKILL.md	126	## Step 5: Identify Root Cause	COMMENT
LOW	.qwen/skills/memory-leak-debug/SKILL.md	141	## Step 6: Verify Fix	COMMENT
LOW	.qwen/skills/bugfix/SKILL.md	24	## Step 1: Read The Issue	COMMENT
LOW⚡	.qwen/skills/bugfix/SKILL.md	49	## Step 2: Reproduce	COMMENT
LOW⚡	.qwen/skills/bugfix/SKILL.md	58	## Step 3: Fix	COMMENT
LOW⚡	.qwen/skills/bugfix/SKILL.md	67	## Step 4: Verify	COMMENT
LOW	.qwen/skills/bugfix/SKILL.md	82	## Step 5: Tests	COMMENT
LOW	.qwen/skills/bugfix/SKILL.md	88	## Step 6: Self-Audit and Code Review	COMMENT
LOW⚡	integration-tests/concurrent-runner/runner.py	904	# Step 1: Create worktree	COMMENT
LOW⚡	integration-tests/concurrent-runner/runner.py	911	# Step 2: Run CLI	COMMENT
LOW⚡	integration-tests/concurrent-runner/runner.py	916	# Step 3: Success	COMMENT
LOW⚡	integration-tests/concurrent-runner/runner.py	953	# Step 5: Collect session log (before cleanup)	COMMENT
LOW	integration-tests/concurrent-runner/runner.py	937	# Step 4: Capture git diff (before cleanup)	COMMENT
LOW	integration-tests/concurrent-runner/runner.py	976	# Step 7: Cleanup	COMMENT
LOW	…tion-tests/interactive/file-system-interactive.test.ts	110	// Step 1: Read the file	COMMENT
LOW	…tion-tests/interactive/file-system-interactive.test.ts	139	// Step 2: Write the file	COMMENT
LOW	docs/design/custom-api-key-auth-wizard-prd.md	201	### Step 1: Select Protocol	COMMENT
LOW	docs/design/custom-api-key-auth-wizard-prd.md	227	### Step 2: Enter Base URL	COMMENT
LOW	docs/design/custom-api-key-auth-wizard-prd.md	298	### Step 3: Enter API Key	COMMENT
LOW	docs/design/custom-api-key-auth-wizard-prd.md	325	### Step 4: Enter Model IDs	COMMENT
LOW	docs/design/custom-api-key-auth-wizard-prd.md	366	### Step 5: Review JSON	COMMENT
LOW	docs/design/custom-api-key-auth-wizard-prd.md	447	### Step 6: Save and Authenticate	COMMENT
LOW	docs/plans/2026-05-28-computer-use-built-in.md	1788	// Step 1: install approval gate.	COMMENT
LOW	docs/plans/2026-05-28-computer-use-built-in.md	1804	// Step 2: spawn (idempotent).	COMMENT
LOW	docs/plans/2026-05-28-computer-use-built-in.md	1810	// Step 3: macOS permission probe + guide.	COMMENT
LOW	docs/e2e-tests/worktree-phase-c.md	484	# Step 1: enter worktree	COMMENT
LOW	docs/e2e-tests/worktree-phase-c.md	490	# Step 2: read the absolute worktree path so the model knows where to write	COMMENT
LOW	docs/e2e-tests/worktree-phase-c.md	501	# Step 3: Exit with keep via the tool	COMMENT
LOW	docs/e2e-tests/worktree-phase-c.md	507	# Step 4: Verify worktree still on disk after exit	COMMENT
LOW	docs/users/quickstart.md	15	## Step 1: Install Qwen Code	COMMENT
LOW	docs/users/quickstart.md	55	## Step 2: Set up authentication	COMMENT
LOW	docs/users/quickstart.md	93	## Step 3: Start your first session	COMMENT
LOW	docs/users/configuration/auth.md	324	#### Step 1: Configure models and providers in `~/.qwen/settings.json`	COMMENT
LOW	docs/users/configuration/auth.md	384	#### Step 2: Set environment variables	COMMENT
LOW	docs/users/configuration/auth.md	450	#### Step 3: Switch models with `/model`	COMMENT
LOW	docs/users/extension/getting-started-extensions.md	9	## Step 1: Create a New Extension	COMMENT
LOW	docs/users/extension/getting-started-extensions.md	29	## Step 2: Understand the Extension Files	COMMENT
LOW	docs/users/extension/getting-started-extensions.md	112	## Step 3: Build and Link Your Extension	COMMENT
LOW	docs/users/extension/getting-started-extensions.md	141	## Step 4: Add a Custom Command	COMMENT
LOW	docs/users/extension/getting-started-extensions.md	170	## Step 5: Add Custom Skills and Subagents (Optional)	COMMENT
LOW	docs/users/extension/getting-started-extensions.md	269	## Step 6: Add a Custom `QWEN.md`	COMMENT
LOW	docs/users/extension/getting-started-extensions.md	302	## Step 7: Releasing Your Extension	COMMENT
LOW	scripts/tests/qwen-fleet-shepherd-workflow.test.js	3103	// Step 1: no notice on the PR → the bot posts one keyed by the head,	COMMENT
LOW	scripts/tests/qwen-fleet-shepherd-workflow.test.js	3141	// Step 2: the bot's notice for THIS head is old enough and the head is	COMMENT
LOW	…er/rust/crates/cua-driver/tests/protocol_media_test.rs	284	// Step 1: click with from_zoom=true and NO prior zoom context — expect error.	COMMENT
LOW	…er/rust/crates/cua-driver/tests/protocol_media_test.rs	301	// Step 2: call zoom on that window to store context.	COMMENT
LOW	…er/rust/crates/cua-driver/tests/protocol_media_test.rs	321	// Step 3: click with from_zoom=true — should NOT return the "no zoom context" error.	COMMENT
LOW⚡	…driver/rust/crates/platform-windows/src/tools/impl_.rs	3764	// Step 2: pin overlay to target window, then animate to screen coords.	COMMENT
LOW⚡	…driver/rust/crates/platform-windows/src/tools/impl_.rs	3767	// Step 3: click pulse + actual click.	COMMENT
LOW	…a-driver/rust/crates/platform-macos/src/input/mouse.rs	549	// Step 1: mouseMoved at target (phase=2, clickState=0).	COMMENT
LOW	…a-driver/rust/crates/platform-macos/src/input/mouse.rs	561	// Step 2: off-screen primer click — opens Chromium user-activation gate	COMMENT
LOW	…a-driver/rust/crates/platform-macos/src/input/mouse.rs	586	// Step 3: target click pair(s) with clickState stepped 1→N for double-click	COMMENT
LOW	packages/core/src/core/client.test.ts	11541	// Step 1: a tool call is pending, so the initial context is skipped.	COMMENT
LOW	packages/core/src/core/client.test.ts	11553	// Step 2: the model answered the tool and the user sends a new	COMMENT
LOW	packages/core/src/core/client.test.ts	11576	// Step 0: a regular message on empty history establishes the initial	COMMENT
LOW	packages/core/src/core/client.test.ts	11594	// Step 1: a tool call is pending, so the changed context is skipped.	COMMENT
82 more matches not shown…

AI Slop Vocabulary61 hits · 175 pts

Severity	File	Line	Snippet	Context
MEDIUM	deploy/kubernetes/chart/values.yaml	30	# Empty reuses harness.image; it must include --managed-web-config.	COMMENT
MEDIUM	scripts/tmux-compare.sh	2	# tmux 前后对比 harness：左 pane 跑原版 qwen（ink），右 pane 跑 qwen2（opentui），	COMMENT
MEDIUM	scripts/managed-agent-dev.js	194	'# Generated by scripts/managed-agent-dev.js on launch. The harness token',	CODE
MEDIUM	scripts/managed-agent-dev.js	221	'# Generated by scripts/managed-agent-dev.js on launch. The harness token',	CODE
MEDIUM	scripts/tests/qwen-triage-workflow.test.js	4696	// #7998 "what I did not verify": a blank harness was proved	COMMENT
MEDIUM	scripts/tests/qwen-triage-workflow.test.js	4859	// #8037 "Not verified": the harness replayed the exact wire bytes of	COMMENT
MEDIUM	scripts/tests/qwen-triage-workflow.test.js	4897	// #8261: the re-classifier that demotes a dead harness's findings ran	COMMENT
MEDIUM	scripts/tests/qwen-triage-workflow.test.js	5187	// (#13819 review); it takes a harness slot instead.	COMMENT
MEDIUM	scripts/tests/vitest-global-setup.test.js	375	// Checked as two substrings so the assertion is robust to prettier's	COMMENT
MEDIUM	packages/cua-driver/python/src/cua_driver/wrapper.py	74	# test harness. The Rust binary owns validation, consent, identity, and	COMMENT
LOW	packages/cua-driver/python/src/cua_driver/_native.py	5103	# and just create a new instance with the required handle.	COMMENT
LOW	packages/cua-driver/python/src/cua_driver/_native.py	6097	# and just create a new instance with the required handle.	COMMENT
LOW	packages/cua-driver/python/src/cua_driver/_native.py	6918	# and just create a new instance with the required handle.	COMMENT
LOW	packages/cua-driver/python/src/cua_driver/_native.py	7060	# and just create a new instance with the required handle.	COMMENT
LOW	packages/cua-driver/python/src/cua_driver/_native.py	7274	# and just create a new instance with the required handle.	COMMENT
MEDIUM	packages/cua-driver/rust/crates/cua-driver/Cargo.toml	68	# Shared integration-test harness (MCP/CLI transports, child reaping, paths,	COMMENT
MEDIUM	…river/rust/crates/cua-driver/tests/harness_wpf_test.rs	1503	// coords, so it's the more robust slider integration test.	COMMENT
MEDIUM	…st/crates/cua-driver/tests/desktop_scope_linux_test.rs	17	//! #[ignore] (needs an X11/Xwayland display + AT-SPI + the GTK3 harness). Run:	COMMENT
MEDIUM	…st/crates/cua-driver/tests/desktop_scope_linux_test.rs	101	/// carries that aid and has a frame, so we're robust to the exact field name.	COMMENT
MEDIUM	…s/cua-driver/tests/standalone_browser_behavior_test.rs	76	r#"<main class="harness-grid">"#,	CODE
MEDIUM	…driver/rust/crates/platform-windows/src/tools/impl_.rs	6609	// the string. Documented gap-closer (PR #1699 harness exposed).	COMMENT
MEDIUM	…ust/crates/platform-windows/src/tools/page_bookmark.rs	142	/// is robust against re-renders that change the title mid-flight.	COMMENT
MEDIUM	…a-driver/rust/crates/platform-macos/src/tools/click.rs	456	// screenshot width / logical screen width. This is robust even when	COMMENT
MEDIUM	…es/cua-driver/tests/runners/macos-lume/run-rust-e2e.sh	3	# macOS harness tests use the installed, TCC-authorized cua-driver daemon path.	COMMENT
MEDIUM	packages/cua-driver/tests/runners/macos-lume/run-all.sh	23	# Only the shared web-action lanes honor cell and harness filters, so a targeted	COMMENT
MEDIUM	packages/cua-driver/scripts/_install-common.sh	113	# user's `qwen-cua-driver-foo` test harness or any script	COMMENT
MEDIUM	packages/cua-driver/scripts/_install-common.sh	172	# robust to a missing trailing newline.	COMMENT
MEDIUM	packages/core/src/tools/glob.test.ts	339	path: '../../../../../../../../../../tmp', // Definitely outside	CODE
MEDIUM	packages/core/src/extension/claude-converter.test.ts	948	'skills/best-practices/SKILL.md': '# best practices',	CODE
MEDIUM	packages/core/src/memory/userMemory.test.ts	44	// today, but clearing keeps the suite robust if a future test reuses	COMMENT
MEDIUM	packages/core/src/memory/memoryDiscovery.test.ts	82	// Use maxRetries option for robust cleanup without race conditions	COMMENT
MEDIUM	packages/core/src/utils/gitDiff.ts	1315	// robust split point regardless.	COMMENT
MEDIUM	packages/core/src/utils/pdf.ts	718	// numerically sorting whatever pdftoppm produced is robust to its	COMMENT
MEDIUM	packages/core/src/services/media-memory/service.ts	489	// robust to extension differences.	COMMENT
MEDIUM	packages/cli/src/ui/utils/resumeHistoryUtils.test.ts	290	// record). But convertToHistoryItems must stay robust if a divider ever	COMMENT
MEDIUM	…ui/components/messages/InlineParallelAgentsDisplay.tsx	189	// the component is robust to mixed groups (e.g. a sibling Shell call	COMMENT
MEDIUM	packages/cli/src/ui/hooks/useHistoryManager.ts	310	// and `images` arms keep the guard robust when a tool carries	COMMENT
MEDIUM	packages/cli/src/ui/hooks/use-llm-stream.test.tsx	14880	// handler's guard robust against `addItem` skipping a	COMMENT
MEDIUM	packages/cli/src/ui/hooks/useToolScheduler.test.ts	298	// to find a robust way to test these scenarios.	COMMENT
MEDIUM	packages/cli/src/commands/review/revert-hunk.ts	728	// applied:true would be a false witness. This body marker is the robust	COMMENT
MEDIUM	packages/cli/src/commands/review/pr-context.test.ts	2372	// and a foreign one is a number a stranger chose — with leverage both	COMMENT
MEDIUM	.github/workflows/sdk-java.yml	1268	# Must outlive the hosted-harness-mysql failsafe fork timeout	COMMENT
MEDIUM	.github/workflows/sdk-java.yml	1334	# runs after the fixture. The hosted-harness-gates profile carries a	COMMENT
MEDIUM	.github/workflows/sdk-java.yml	1337	# hosted-harness-mysql verify applies.	COMMENT
MEDIUM⚡	.github/workflows/qwen-triage.yml	4121	# capture harness actually imports. Root `playwright` and Web	COMMENT
MEDIUM⚡	.github/workflows/qwen-triage.yml	4128	# revision. Resolve the CLI from the harness's own directory	COMMENT
MEDIUM⚡	.github/workflows/qwen-triage.yml	4130	# runs the same algorithm as the harness's `from 'playwright'`	COMMENT
MEDIUM	.github/workflows/qwen-triage.yml	3120	# the test harness does not and keeps its stub PATH.	COMMENT
MEDIUM	.github/workflows/qwen-triage.yml	3433	# carries the rationale); the test harness runs non-root, so	COMMENT
MEDIUM	.github/workflows/qwen-triage.yml	3443	# importable; the harness keeps its stubs). The liveness	COMMENT
MEDIUM	.github/workflows/qwen-triage.yml	3507	# harness does not and keeps its stub PATH).	COMMENT
MEDIUM	.github/workflows/qwen-triage.yml	3540	# fails it, while the same code stays runnable under a harness.	COMMENT
MEDIUM	.github/workflows/qwen-triage.yml	4663	# assertions.json, harness scripts, raw logs) into the upload dir.	COMMENT
MEDIUM	.github/workflows/qwen-triage.yml	4778	# importable; the harness keeps its stubs). The liveness	COMMENT
MEDIUM	.github/workflows/qwen-triage.yml	4827	# runs as root; the test harness does not and keeps its stub	COMMENT
MEDIUM	.github/workflows/qwen-triage.yml	6053	# Verdicts come from harness exits: `findings` with no failed	COMMENT
MEDIUM	.github/workflows/web-shell-visuals.yml	187	# (flows.spec.ts) and the animation-harness test (harness.spec.ts) stay	COMMENT
MEDIUM	.github/workflows/web-shell-visuals.yml	264	# Ensure both dirs exist so the counts below are robust even when an	COMMENT
MEDIUM	.github/workflows/qwen-code-pr-review.yml	858	# FREEZE_BIN_SHA256) before pushing — the harness stubs key on these	COMMENT
MEDIUM	.github/workflows/qwen-code-pr-review.yml	948	# Pin-pair self-check: the stub-based harness keys on these	COMMENT
1 more matches not shown…

Modern AI Meta-Vocabulary55 hits · 158 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/design/2026-10-26-mod-terminal-render.md	9	Token Weather, the sample that marks the first milestone in #13749, draws a one-line forecast of the context window dire	CODE
MEDIUM	docs/design/managed-agent-delivery-ledger.md	137	\| [#12797](https://github.com/QwenLM/qwen-code/pull/12797) \| merged (`11938e6aa2`) \| Workspace W0d: authenticated embedd	CODE
MEDIUM	docs/design/managed-agent-delivery-ledger.md	206	\| [#13346](https://github.com/QwenLM/qwen-code/pull/13346) \| merged (`fa3ad5ef4b`) \| [#12692](https://github.com/QwenLM/	CODE
MEDIUM	…026-09-14-acp-bridge-control-plane-harness-boundary.md	195	## Fourth implementation slice: startup orchestration	COMMENT
MEDIUM	docs/design/2026-10-05-session-multi-agent.md	1	# Session multi-agent collaboration	COMMENT
MEDIUM	…ign/web-shell/web-shell-composer-workspace-selector.md	316	### App orchestration	COMMENT
MEDIUM	docs/plans/2026-08-18-peer-session-collaboration.md	173	### Stage 4 — orchestration or push	COMMENT
MEDIUM	docs/e2e-tests/2026-05-19-oom-reproduction-report.md	209	### 为什么 128K context window 更容易触发	COMMENT
MEDIUM	docs/users/configuration/settings.md	208	\| `model.chatCompression.contextPercentageThreshold` \| number \| REMOVED. Replaced by `context.autoCompactThreshold`	CODE
MEDIUM	docs/users/features/multi-agent-coordination.md	21	## Choosing the right multi-agent mode	COMMENT
MEDIUM	docs/users/features/arena.md	196	## Comparison with other multi-agent modes	COMMENT
MEDIUM	docs/users/features/dual-output.md	63	### Multi-agent orchestration	COMMENT
MEDIUM	docs/users/features/approval-mode.md	260	### Safety guardrails	COMMENT
MEDIUM	docs/developers/daemon/09-event-schema.md	101	### MCP guardrails (PR 14b + F2)	COMMENT
MEDIUM	scripts/copy_bundle_assets.js	595	// Copy extension templates so bundled dist/cli.js can scaffold	COMMENT
MEDIUM⚡	packages/cua-driver/python/src/cua_driver/_native.py	477	# Get the scaffolding contract version by calling the into the dylib	COMMENT
MEDIUM⚡	…s/cua-driver/python/src/cua_driver/_native_contract.py	475	# Get the scaffolding contract version by calling the into the dylib	COMMENT
MEDIUM	…river/rust/crates/cua-driver-core/src/text_sanitize.rs	19	//! closing tags before the text leaves the tool layer. Three guardrails	COMMENT
MEDIUM	…river/rust/crates/cua-driver-core/src/text_sanitize.rs	59	/// See module docs for the false-positive guardrails. The function is	COMMENT
MEDIUM	packages/core/src/index.ts	576	// Foundational utilities (paths, storage scaffold, type definitions, constants)	COMMENT
MEDIUM	packages/core/src/tools/priorReadEnforcement.ts	105	* fires identically for both tools. Issue #2499 (model hallucinates	COMMENT
MEDIUM	packages/core/src/tools/mcp-client-manager.test.ts	1682	// Issue #4175 PR 14: MCP client guardrails (counter + slot reservation +	COMMENT
MEDIUM	packages/core/src/tools/mcp-client-manager.test.ts	1682	// Issue #4175 PR 14: MCP client guardrails (counter + slot reservation +	COMMENT
MEDIUM	packages/core/src/core/turn.ts	741	// A turn manages the agentic loop turn within the server context.	COMMENT
MEDIUM	…s/core/src/core/anthropicContentGenerator/converter.ts	1422	// `messages.content`. In agentic loops the last user message after	COMMENT
MEDIUM	…e/src/core/anthropicContentGenerator/converter.test.ts	1825	// Regression: in agentic loops the last user message is usually a	COMMENT
MEDIUM	packages/core/src/memory/extract.ts	161	// Per-project scaffold is required (extraction cursor + metadata live	COMMENT
MEDIUM	packages/core/src/memory/extract.ts	162	// there). User-level scaffold is optional — a brand-new user without	COMMENT
MEDIUM	packages/core/src/memory/extract.ts	243	// cursor. Catch + warn, same shape as the user-level scaffold above.	COMMENT
MEDIUM	packages/core/src/memory/manager.test.ts	4512	// No metadata write: lastDreamAt must still be the scaffold's value,	COMMENT
MEDIUM	packages/core/src/memory/extract.test.ts	851	it('BUG #6311: should NOT advance cursor when agent makes zero tool calls (hallucination)', async () => {	CODE
MEDIUM	packages/core/src/memory/userMemory.test.ts	134	// Unlike per-project scaffold, no meta.json / extract-cursor.json	COMMENT
MEDIUM	packages/core/src/memory/remember.test.ts	383	// Unpinned, that read can be replaced with `null` and the scaffold's	COMMENT
MEDIUM	…es/core/src/skills/bundled/workflow-authoring/SKILL.md	20	## Scout first, then orchestrate	COMMENT
MEDIUM	packages/core/src/skills/bundled/review/SKILL.md	92	The three levels above are the standing effort axis. **`--topology minimal` is a separate axis — a different _shape_ of	CODE
MEDIUM	packages/core/src/skills/bundled/review/SKILL.md	663	This arm exists for one reason: to be run over the same PR set as the full pipeline and compared, per model, so we learn	CODE
MEDIUM	packages/core/src/skills/bundled/review/SKILL.test.ts	1472	// The first three guardrails. The first keeps attribution from becoming a way	COMMENT
MEDIUM	packages/cli/src/ui/voice/voice-keyterms.test.ts	93	'# project terms\n\n Kubernetes # container orchestration \nIssue #42\nPR #5817\nC#\nF#\n # indented comment	CODE
MEDIUM	packages/cli/src/ui/voice/voice-keyterms.test.ts	96	expect(terms).toContain('Kubernetes # container orchestration');	CODE
MEDIUM⚡	packages/cli/src/ui/hooks/use-llm-stream.test.tsx	2485	// In a multi-round agentic task, streamingState never reaches Idle	COMMENT
MEDIUM	packages/cli/src/commands/review/submit.test.ts	2477	// MENTION a scaffold shape mid-text.	COMMENT
MEDIUM	packages/cli/src/commands/review/agent-prompt.test.ts	4221	// floor names the temp-dir scaffold as its one sanctioned exception —	COMMENT
MEDIUM	…/src/commands/review/test-efficacy.integration.test.ts	1909	// Written after the scaffold's commits: a committed hook would be checked	COMMENT
MEDIUM	…ckages/cli/src/commands/review/lib/convergence.test.ts	1941	// The scaffold names the three maintainer dimensions — in BOTH	COMMENT
MEDIUM	…ckages/cli/src/commands/review/lib/convergence.test.ts	1942	// languages. Pinned only in English, a zh scaffold that lost a column	COMMENT
MEDIUM	packages/cli/src/serve/run-qwen-serve.ts	4542	// The MCP client guardrails enforce in the ACP child process (where	COMMENT
MEDIUM	packages/web-shell/client/navigation.test.tsx	62	'https://host/agentic-code/session/a?workspace=w&context=live&instanceId=i&instanceType=dsw#host',	CODE
MEDIUM	packages/web-shell/client/navigation.test.tsx	89	new URL('https://host/agentic-code-other/plugins'),	CODE
MEDIUM	packages/web-shell/client/navigation.test.tsx	95	new URL('https://host/agentic-code/session/%E0'),	CODE
MEDIUM	packages/sdk-typescript/src/daemon/events.ts	2257	// QWEN.md scaffold was performed.	COMMENT
MEDIUM	…qwen/code/managedagent/session/HarnessCoordinator.java	404	// Only a live predecessor's guardrails may stretch past	COMMENT
MEDIUM	.github/workflows/qwen-triage-finalize.yml	149	# else. Bot orchestration runs (pull_request_target / issue_comment	COMMENT
MEDIUM	.github/workflows/qwen-triage-finalize.yml	173	# table renders bot-orchestration plumbing (route, label, precheck)	COMMENT
MEDIUM	.github/scripts/run-autofix-review-verification.sh	670	# comment (any author) must not be able to alter the loop's own guardrails.	COMMENT
MEDIUM	.github/scripts/run-autofix-review-verification.sh	738	# Workspace-root configs are machinery; a scaffold template deep in	COMMENT

Verbosity Indicators86 hits · 146 pts

Severity	File	Line	Snippet	Context
LOW⚡	integration-tests/concurrent-runner/runner.py	904	# Step 1: Create worktree	COMMENT
LOW⚡	integration-tests/concurrent-runner/runner.py	911	# Step 2: Run CLI	COMMENT
LOW⚡	integration-tests/concurrent-runner/runner.py	916	# Step 3: Success	COMMENT
LOW⚡	integration-tests/concurrent-runner/runner.py	953	# Step 5: Collect session log (before cleanup)	COMMENT
LOW	integration-tests/concurrent-runner/runner.py	937	# Step 4: Capture git diff (before cleanup)	COMMENT
LOW	integration-tests/concurrent-runner/runner.py	976	# Step 7: Cleanup	COMMENT
LOW	…tion-tests/interactive/file-system-interactive.test.ts	110	// Step 1: Read the file	COMMENT
LOW	…tion-tests/interactive/file-system-interactive.test.ts	139	// Step 2: Write the file	COMMENT
LOW	scripts/tests/qwen-fleet-shepherd-workflow.test.js	3103	// Step 1: no notice on the PR → the bot posts one keyed by the head,	COMMENT
LOW	scripts/tests/qwen-fleet-shepherd-workflow.test.js	3141	// Step 2: the bot's notice for THIS head is old enough and the head is	COMMENT
LOW	…er/rust/crates/cua-driver/tests/protocol_media_test.rs	284	// Step 1: click with from_zoom=true and NO prior zoom context — expect error.	COMMENT
LOW	…er/rust/crates/cua-driver/tests/protocol_media_test.rs	301	// Step 2: call zoom on that window to store context.	COMMENT
LOW	…er/rust/crates/cua-driver/tests/protocol_media_test.rs	321	// Step 3: click with from_zoom=true — should NOT return the "no zoom context" error.	COMMENT
LOW⚡	…driver/rust/crates/platform-windows/src/tools/impl_.rs	3764	// Step 2: pin overlay to target window, then animate to screen coords.	COMMENT
LOW⚡	…driver/rust/crates/platform-windows/src/tools/impl_.rs	3767	// Step 3: click pulse + actual click.	COMMENT
LOW	…a-driver/rust/crates/platform-macos/src/input/mouse.rs	549	// Step 1: mouseMoved at target (phase=2, clickState=0).	COMMENT
LOW	…a-driver/rust/crates/platform-macos/src/input/mouse.rs	561	// Step 2: off-screen primer click — opens Chromium user-activation gate	COMMENT
LOW	…a-driver/rust/crates/platform-macos/src/input/mouse.rs	586	// Step 3: target click pair(s) with clickState stepped 1→N for double-click	COMMENT
LOW	packages/core/src/core/client.telemetrySwap.test.ts	350	// Step 1: /resume B fails AFTER its forward replay, and the rollback's	COMMENT
LOW	packages/core/src/core/client.telemetrySwap.test.ts	368	// Step 2: /branch — begin captures the outgoing parent, core swaps to	COMMENT
LOW	packages/core/src/core/client.test.ts	11541	// Step 1: a tool call is pending, so the initial context is skipped.	COMMENT
LOW	packages/core/src/core/client.test.ts	11553	// Step 2: the model answered the tool and the user sends a new	COMMENT
LOW	packages/core/src/core/client.test.ts	11576	// Step 0: a regular message on empty history establishes the initial	COMMENT
LOW	packages/core/src/core/client.test.ts	11594	// Step 1: a tool call is pending, so the changed context is skipped.	COMMENT
LOW	packages/core/src/core/client.test.ts	11606	// Step 2: after the tool response a new message carries the latest	COMMENT
LOW	packages/core/src/core/llm-chat.ts	3211	// Step 1: force microcompaction (clear old tool results + media)	COMMENT
LOW	packages/core/src/core/llm-chat.ts	3224	// Step 2: strip thinking parts from model turns	COMMENT
LOW⚡	packages/core/src/extension/marketplace.ts	444	// Step 1: Parse source into repo and optional pluginName	COMMENT
LOW⚡	packages/core/src/extension/marketplace.ts	453	// Step 2: Determine repo type with correct priority order	COMMENT
LOW	packages/core/src/extension/marketplace.ts	551	// Step 3: If marketplace config exists, update type to marketplace	COMMENT
LOW⚡	packages/core/src/extension/gemini-converter.ts	87	// Step 1: Copy all files and directories to temporary directory	COMMENT
LOW⚡	packages/core/src/extension/gemini-converter.ts	90	// Step 2: Convert TOML commands to Markdown in commands folder	COMMENT
LOW⚡	packages/core/src/extension/gemini-converter.ts	96	// Step 3: Create qwen-extension.json with converted config	COMMENT
LOW	packages/core/src/extension/claude-converter.ts	470	// Step 1: Load marketplace.json	COMMENT
LOW	packages/core/src/extension/claude-converter.ts	501	// Step 2: Resolve plugin source directory based on source field	COMMENT
LOW	packages/core/src/extension/claude-converter.ts	520	// Step 3: Load and merge plugin.json if exists (based on strict mode)	COMMENT
LOW	packages/core/src/models/modelsConfig.ts	1072	// Step 1: If modelId exists in registry, always use config from modelRegistry	COMMENT
LOW	packages/core/src/models/modelsConfig.ts	1180	// Step 2: Check if there are existing credentials from other sources (not modelProviders)	COMMENT
LOW⚡	packages/core/src/models/modelsConfig.ts	1220	// Step 3: Fall back to default model for the authType	COMMENT
LOW⚡	packages/core/src/models/modelsConfig.ts	1230	// Step 4: No default available - leave generationConfig incomplete	COMMENT
LOW⚡	packages/core/src/skills/bundled/review/SKILL.test.ts	1696	expect(referenceBody('posting.md')).toContain('# Step 7: Submit PR review');	CODE
LOW⚡	packages/core/src/skills/bundled/review/SKILL.test.ts	1698	'# Step 8: Save review report and cache',	CODE
LOW⚡	packages/core/src/skills/bundled/review/SKILL.test.ts	1811	expect(core).toContain('## Step 7: Submit PR review');	CODE
LOW⚡	packages/core/src/skills/bundled/review/SKILL.test.ts	1812	expect(core).toContain('## Step 8: Save review report and cache');	CODE
LOW	packages/core/src/skills/bundled/review/SKILL.test.ts	1132	body.indexOf('## Step 7: Submit PR review'),	CODE
LOW⚡	packages/core/src/services/usageHistoryService.test.ts	564	// Step 1: open /stats (first time) during the live session.	COMMENT
LOW⚡	packages/core/src/services/usageHistoryService.test.ts	567	// Step 2: /clear or exit.	COMMENT
LOW⚡	packages/core/src/services/usageHistoryService.test.ts	570	// Step 3: re-open /stats.	COMMENT
LOW	packages/core/src/services/media-memory/service.test.ts	606	// Step 1: extract_audio on the video → derived audio version.	COMMENT
LOW	packages/core/src/services/media-memory/service.test.ts	626	// Step 2: transcribe the DERIVED audio — the transcript entry is	COMMENT
LOW	packages/cli/src/ui/utils/customBanner.ts	273	// Step 1: refuse non-regular files BEFORE opening. On POSIX, opening a	COMMENT
LOW	packages/cli/src/ui/utils/customBanner.ts	297	// Step 2: open with O_NOFOLLOW (POSIX only) so a TOCTOU symlink swap	COMMENT
LOW	packages/cli/src/config/environment.ts	755	// Step 1: Load from .env files (higher priority than settings.env)	COMMENT
LOW	packages/cli/src/config/environment.ts	786	// Step 2: settings.env fallback (lowest priority, no-override).	COMMENT
LOW	packages/cli/src/config/migration/versions/v2-to-v3.ts	157	// Step 1: Handle consolidated paths (multiple old paths → single new path)	COMMENT
LOW	packages/cli/src/config/migration/versions/v2-to-v3.ts	191	// Step 2: Handle remaining individual disable* → enable* mappings	COMMENT
LOW	packages/cli/src/config/migration/versions/v2-to-v3.ts	214	// Step 3: Always update version to 3	COMMENT
LOW	packages/cli/src/config/migration/versions/v1-to-v2.ts	137	// Step 1: Map known V1 keys to V2 nested paths	COMMENT
LOW	packages/cli/src/config/migration/versions/v1-to-v2.ts	180	// Step 2: Map V1 disable* keys to V2 nested disable* paths	COMMENT
LOW⚡	packages/cli/src/config/migration/versions/v1-to-v2.ts	198	// Step 3: Preserve mcpServers at the top level	COMMENT
26 more matches not shown…

Cross-Language Confusion26 hits · 140 pts

Severity	File	Line	Snippet	Context
HIGH⚡	packages/sdk-python/tests/unit/test_query_core.py	481	transport.push(	CODE
HIGH⚡	packages/sdk-python/tests/unit/test_query_core.py	491	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	125	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	146	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	181	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	236	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	250	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	271	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	279	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	333	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	347	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	406	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	420	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	569	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	600	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	640	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	667	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	694	transport.push(	CODE
HIGH	packages/sdk-python/tests/unit/test_query_core.py	731	transport.push(	CODE
HIGH⚡	…ges/cua-driver/scripts/tests/test_macos_lume_runner.py	873	"ensure_unrestricted_daemon \|\| status=$?\n"	CODE
HIGH⚡	…ges/cua-driver/scripts/tests/test_macos_lume_runner.py	958	"run_retry_sequence \|\| status=$?\n"	CODE
HIGH	…ges/cua-driver/scripts/tests/test_macos_lume_runner.py	656	"status=0\nretry_result_is_exact \|\| status=$?\n"	CODE
HIGH	…ges/cua-driver/scripts/tests/test_macos_lume_runner.py	673	"status=0\nretry_result_is_exact \|\| status=$?\n"	CODE
HIGH	…ges/cua-driver/scripts/tests/test_macos_lume_runner.py	847	"ensure_unrestricted_daemon \|\| status=$?\n"	CODE
HIGH	…ges/cua-driver/scripts/tests/test_macos_lume_runner.py	910	"run_retry_sequence \|\| status=$?\n"	CODE
HIGH	…ges/cua-driver/scripts/tests/test_macos_lume_runner.py	939	"run_retry_sequence \|\| status=$?\n"	CODE

Fake / Example Data132 hits · 134 pts

Severity	File	Line	Snippet	Context
LOW	integration-tests/qwen-live-harness.ts	707	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/qwen-live-harness.ts	872	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/qwen-live-harness.ts	905	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/test-helper.ts	1057	vi.stubEnv('OPENAI_API_KEY', 'fake-key');	CODE
LOW	integration-tests/test-helper.ts	1080	'fake-key',	CODE
LOW	…capture/table-pending-height-scroll-lock-regression.ts	67	'lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna ali	CODE
LOW	…capture/table-pending-height-scroll-lock-regression.ts	67	'lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna ali	CODE
LOW	integration-tests/cli/daemon-workflow-mode.test.ts	114	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/json-output.test.ts	57	'fake-key',	CODE
LOW	integration-tests/cli/advisor-tool.test.ts	82	vi.stubEnv('OPENAI_API_KEY', 'fake-key');	CODE
LOW	integration-tests/cli/advisor-tool.test.ts	167	'fake-key',	CODE
LOW	integration-tests/cli/advisor-tool.test.ts	301	'fake-key',	CODE
LOW	integration-tests/cli/tool-hook-updated-input.test.ts	124	vi.stubEnv('OPENAI_API_KEY', 'fake-key');	CODE
LOW	integration-tests/cli/daemon-workflow-intent.test.ts	142	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/acp-workflow-mode.test.ts	60	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…n-tests/cli/qwen-daemon-first-output-benchmark.test.ts	770	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…on-tests/cli/qwen-serve-standalone-concurrency.test.ts	43	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…n-tests/cli/external-context-mem0-daemon-write.test.ts	296	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/acp-cron.test.ts	126	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/daemon-invocation-context.test.ts	146	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/workflow-intent.test.ts	59	vi.stubEnv('OPENAI_API_KEY', 'fake-key');	CODE
LOW	…-tests/cli/external-context-mem0-daemon-delete.test.ts	328	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/subagent-hook-owner.test.ts	195	'fake-key',	CODE
LOW	integration-tests/cli/workflow-mode.test.ts	65	vi.stubEnv('OPENAI_API_KEY', 'fake-key');	CODE
LOW	integration-tests/cli/qwen-serve-routes.test.ts	219	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/qwen-serve-session-cd.test.ts	59	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…ation-tests/cli/daemon-workflow-ancestor-trust.test.ts	146	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/headless-workflow-skill.test.ts	107	vi.stubEnv('OPENAI_API_KEY', 'fake-key');	CODE
LOW	integration-tests/cli/headless-workflow-skill.test.ts	124	'fake-key',	CODE
LOW	integration-tests/cli/agent-loop-parity.test.ts	203	'fake-key',	CODE
LOW	integration-tests/cli/acp-agent-loop-parity.test.ts	253	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…tegration-tests/cli/qwen-serve-channel-workers.test.ts	288	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…tegration-tests/cli/qwen-serve-channel-workers.test.ts	500	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…tegration-tests/cli/qwen-serve-channel-workers.test.ts	630	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…tegration-tests/cli/qwen-serve-channel-workers.test.ts	767	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…tegration-tests/cli/qwen-serve-channel-workers.test.ts	892	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…tegration-tests/cli/qwen-serve-channel-workers.test.ts	1001	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/tool-hook-context.test.ts	121	vi.stubEnv('OPENAI_API_KEY', 'fake-key');	CODE
LOW	integration-tests/cli/qwen-serve-client-mcp.test.ts	141	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/gen-ai-telemetry.test.ts	153	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/gen-ai-telemetry.test.ts	493	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/gen-ai-telemetry.test.ts	577	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/qwen-serve-streaming.test.ts	375	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/qwen-config-dir.test.ts	225	'fake-key',	CODE
LOW	…egration-tests/cli/workflow-ancestor-discovery.test.ts	196	'fake-key',	CODE
LOW	integration-tests/cli/acp-integration.test.ts	1036	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/acp-integration.test.ts	1151	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/cli/acp-integration.test.ts	1247	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…ation-tests/sdk-typescript/abort-and-lifecycle.test.ts	46	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/sdk-typescript/system-control.test.ts	39	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…tegration-tests/sdk-typescript/workflow-intent.test.ts	106	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/sdk-typescript/workflow-mode.test.ts	91	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…ration-tests/sdk-typescript/permission-control.test.ts	53	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/sdk-typescript/tool-control.test.ts	59	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/sdk-typescript/sdk-mcp-server.test.ts	58	OPENAI_API_KEY: 'fake-key',	CODE
LOW	integration-tests/sdk-typescript/subagents.test.ts	47	OPENAI_API_KEY: 'fake-key',	CODE
LOW	…tests/interactive/context-compress-interactive.test.ts	66	'fake-key',	CODE
LOW	…-tests/interactive/submitted-prompt-provenance.test.ts	135	'fake-key',	CODE
LOW	…-tests/interactive/external-context-mem0-write.test.ts	244	'fake-key',	CODE
LOW	…on-tests/interactive/protocol-tags-interactive.test.ts	90	'fake-key',	CODE
72 more matches not shown…

Cross-Language Confusion (JS/TS)20 hits · 130 pts

Severity	File	Line	Snippet	Context
HIGH	integration-tests/cli/notebook-edit.test.ts	141	print(result)	CODE
HIGH	scripts/tests/desktop-oss-workflow.test.js	76	elif [ "$1" = '--pattern' ]; then	CODE
HIGH	scripts/tests/desktop-oss-workflow.test.js	104	elif [[ "$1" == https://* ]]; then	CODE
HIGH	scripts/tests/sdk-java-workflow.test.js	2009	elif [[ "$1" == rm ]]; then [[ "$MODE" != removal-fails && ! ( "$MODE" == first-removal-fails && "$3" == *-1 )	CODE
HIGH	scripts/tests/main-ci-failure-issue-workflow.test.js	435	elif [[ "$" == actions/workflows//runs ]]; then	CODE
HIGH⚡	scripts/tests/main-ci-failure-issue-workflow.test.js	904	elif [[ "$" == '--state closed'* ]]; then	CODE
HIGH⚡	scripts/tests/main-ci-failure-issue-workflow.test.js	910	elif [[ "$1" == api ]]; then	CODE
HIGH⚡	scripts/tests/main-ci-failure-issue-workflow.test.js	913	elif [[ "$1 $2" == 'issue reopen' ]]; then	CODE
HIGH⚡	scripts/tests/main-ci-failure-issue-workflow.test.js	919	elif [[ "$1 $2" == 'issue create' ]]; then	CODE
HIGH⚡	scripts/tests/main-ci-failure-issue-workflow.test.js	928	elif [[ "$1 $2" == 'issue view' ]]; then	CODE
HIGH⚡	scripts/tests/main-ci-failure-issue-workflow.test.js	933	elif [[ "$1 $2" == 'issue comment' ]]; then	CODE
HIGH⚡	scripts/tests/main-ci-failure-issue-workflow.test.js	939	elif [[ "$1 $2" == 'issue edit' ]]; then	CODE
HIGH	packages/core/src/services/ssh-workspace-script.ts	226	elif stat.S_ISDIR(info.st_mode):	CODE
HIGH	packages/core/src/services/ssh-workspace-script.ts	254	elif patterns[j] == '**':	CODE
HIGH	packages/core/src/services/ssh-workspace-script.ts	299	print(json.dumps({'stream': key.data, 'data': base64.b64encode(chunk).decode('ascii')}), flush=T	CODE
HIGH⚡	packages/core/src/services/ssh-workspace-script.ts	548	print(json.dumps({'ok': True, 'result': result}, ensure_ascii=False))	CODE
HIGH⚡	packages/core/src/services/ssh-workspace-script.ts	552	elif isinstance(error, OSError):	CODE
HIGH⚡	packages/core/src/services/ssh-workspace-script.ts	555	elif isinstance(error, UnicodeError):	CODE
HIGH⚡	packages/core/src/services/ssh-workspace-script.ts	557	elif isinstance(error, (ValueError, TypeError, KeyError)):	CODE
HIGH⚡	packages/core/src/services/ssh-workspace-script.ts	561	print(json.dumps({'ok': False, 'error': {'code': code, 'message': message}}, ensure_ascii=False))	CODE

Unused Imports186 hits · 126 pts

Severity	File	Line	Context
LOW	…kills/agent-reproduce-feature/scripts/capture_state.py	4	CODE
LOW	…wen/skills/agent-reproduce-feature/scripts/llm_dump.py	7	CODE
LOW	…skills/agent-reproduce-align/scripts/compare_traces.py	4	CODE
LOW	…kills/agent-reproduce-align/scripts/normalize_trace.py	4	CODE
LOW	integration-tests/concurrent-runner/runner.py	9	CODE
LOW	integration-tests/concurrent-runner/runner.py	20	CODE
LOW	integration-tests/concurrent-runner/runner.py	30	CODE
LOW	integration-tests/concurrent-runner/runner.py	30	CODE
LOW	packages/sdk-python/tests/unit/test_validation.py	1	CODE
LOW	packages/sdk-python/tests/unit/test_transport.py	1	CODE
LOW	packages/sdk-python/tests/unit/test_query_core.py	1	CODE
LOW	packages/sdk-python/tests/integration/conftest.py	1	CODE
LOW	…ckages/sdk-python/tests/integration/test_sync_query.py	1	CODE
LOW	…kages/sdk-python/tests/integration/test_async_query.py	1	CODE
LOW	packages/sdk-python/scripts/smoke_real.py	8	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/query.py	3	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/transport.py	3	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	3	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	8	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	8	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	8	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	8	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	8	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	15	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	39	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	39	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	41	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/sync_query.py	3	CODE
126 more matches not shown…

Excessive Try-Catch Wrapping74 hits · 106 pts

Severity	File	Line	Snippet	Context
LOW	…wen/skills/agent-reproduce-feature/scripts/llm_dump.py	142	except Exception as exc:	CODE
MEDIUM	integration-tests/concurrent-runner/runner.py	1065	print(f"Error: Config file not found: {args.config}", file=sys.stderr)	CODE
LOW⚡	integration-tests/concurrent-runner/runner.py	926	except Exception as e:	CODE
LOW⚡	integration-tests/concurrent-runner/runner.py	950	except Exception as e:	CODE
LOW⚡	integration-tests/concurrent-runner/runner.py	963	except Exception as e:	CODE
LOW	integration-tests/concurrent-runner/runner.py	246	except Exception:	CODE
LOW	integration-tests/concurrent-runner/runner.py	346	except Exception as e:	CODE
LOW	integration-tests/concurrent-runner/runner.py	1077	except Exception as e:	CODE
LOW	docs/users/features/hooks.md	234	except Exception as e:	CODE
MEDIUM	docs/users/features/hooks.md	1739	print(f"Error: Invalid JSON input: {e}", file=sys.stderr)	CODE
MEDIUM	docs/developers/sdk-python.md	73	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	docs/developers/sdk-python.md	119	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	docs/developers/sdk-python.md	276	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	docs/developers/sdk-python.md	336	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	docs/developers/sdk-python.md	377	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	docs/developers/sdk-python.md	409	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	docs/developers/sdk-python.md	437	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	docs/developers/sdk-python.md	470	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	packages/sdk-python/README.md	70	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	packages/sdk-python/README.md	114	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	packages/sdk-python/README.md	215	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	packages/sdk-python/README.md	286	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	packages/sdk-python/README.md	364	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	packages/sdk-python/README.md	396	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	packages/sdk-python/README.md	424	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
MEDIUM	packages/sdk-python/README.md	456	print(f"Error: {error.get('message', 'Unknown error')}")	CODE
LOW	packages/sdk-python/scripts/smoke_real.py	365	except Exception as exc:	CODE
MEDIUM	packages/sdk-python/src/qwen_code_sdk/query.py	129	def _initialize(self) -> None:	CODE
MEDIUM	packages/sdk-python/src/qwen_code_sdk/query.py	145	def _send_single_turn_prompt(self) -> None:	CODE
MEDIUM	packages/sdk-python/src/qwen_code_sdk/query.py	169	def _message_router(self) -> None:	CODE
MEDIUM	packages/sdk-python/src/qwen_code_sdk/query.py	231	def runner() -> None:	CODE
LOW⚡	packages/sdk-python/src/qwen_code_sdk/query.py	489	except Exception as exc:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/query.py	142	except Exception as exc:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/query.py	160	except Exception as exc:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/query.py	184	except Exception as exc: # pragma: no cover - critical propagation path	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/query.py	236	except Exception as exc: # pragma: no cover - fatal background path	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/query.py	273	except Exception as exc:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/query.py	318	except Exception as exc:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/transport.py	144	except Exception:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/sync_query.py	53	except Exception:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/sync_query.py	75	except Exception as exc:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/sync_query.py	164	except Exception:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/sync_query.py	174	except Exception:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/sync_query.py	186	except Exception:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/sync_query.py	207	except Exception:	CODE
LOW	packages/cua-driver/python/build_wheel.py	162	except Exception as e:	CODE
LOW	packages/cua-driver/python/build_wheel.py	194	except Exception as e:	CODE
LOW	packages/cua-driver/python/src/cua_driver/wrapper.py	92	except Exception as e:	CODE
MEDIUM	packages/cua-driver/python/src/cua_driver/wrapper.py	93	print(f"Error executing cua-driver: {e}", file=sys.stderr)	CODE
MEDIUM	packages/cua-driver/python/src/cua_driver/_native.py	321	def _uniffi_trait_interface_call(call_status, make_call, write_return_value):	CODE
MEDIUM	packages/cua-driver/python/src/cua_driver/_native.py	328	def _uniffi_trait_interface_call_with_error(call_status, make_call, write_return	CODE
MEDIUM	packages/cua-driver/python/src/cua_driver/_native.py	365	def get(self, handle):	CODE
MEDIUM	packages/cua-driver/python/src/cua_driver/_native.py	413	def check_lower(cls, value):	CODE
LOW⚡	packages/cua-driver/python/src/cua_driver/_native.py	324	except Exception as e:	CODE
LOW⚡	packages/cua-driver/python/src/cua_driver/_native.py	335	except Exception as e:	CODE
LOW	packages/cua-driver/python/src/cua_driver/_native.py	404	except Exception:	CODE
LOW	packages/cua-driver/python/src/cua_driver/_native.py	416	except Exception:	CODE
LOW	packages/cua-driver/python/src/cua_driver/_native.py	2176	except Exception as e:	CODE
LOW	packages/cua-driver/python/src/cua_driver/_native.py	2204	except Exception as e:	CODE
MEDIUM	…s/cua-driver/python/src/cua_driver/_native_contract.py	319	def _uniffi_trait_interface_call(call_status, make_call, write_return_value):	CODE
14 more matches not shown…

Empty Error Handlers14 hits · 70 pts

Severity	File	Line	Snippet	Context
HIGH	integration-tests/concurrent-runner/runner.py	246	except Exception:	CODE
HIGH	integration-tests/concurrent-runner/runner.py	494	except: pass	CODE
HIGH	integration-tests/concurrent-runner/runner.py	681	except:	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/query.py	234	except asyncio.CancelledError:	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/query.py	485	except asyncio.TimeoutError:	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/transport.py	213	except asyncio.TimeoutError:	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/transport.py	263	except asyncio.CancelledError:	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/transport.py	246	except (OSError, subprocess.TimeoutExpired):	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/sync_query.py	209	except AttributeError:	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/sync_query.py	164	except Exception:	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/sync_query.py	174	except Exception:	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/sync_query.py	186	except Exception:	CODE
HIGH	packages/sdk-python/src/qwen_code_sdk/sync_query.py	207	except Exception:	CODE
HIGH	…kages/cua-driver/examples/agent-sdks/fixture_server.py	134	except KeyboardInterrupt:	CODE

Magic Placeholder Names9 hits · 45 pts

Severity	File	Line	Snippet	Context
HIGH	docs/users/qwen-serve-deploy-local.md	147	<string>PASTE-YOUR-TOKEN-HERE</string>	CODE
HIGH	docs/users/configuration/model-providers.md	637	> BAILIAN_CODING_PLAN_API_KEY=your-api-key-here	CODE
HIGH	docs/users/configuration/auth.md	42	export QWENCLOUD_API_KEY="sk-your-api-key"	CODE
HIGH	docs/users/configuration/auth.md	49	export QWENCLOUD_TOKEN_PLAN_API_KEY="sk-sp-your-api-key"	CODE
HIGH	docs/users/configuration/auth.md	72	"QWENCLOUD_API_KEY": "sk-your-api-key"	CODE
HIGH	docs/users/configuration/auth.md	219	export BAILIAN_TOKEN_PLAN_API_KEY="your-api-key"	CODE
HIGH	docs/users/configuration/auth.md	246	"BAILIAN_TOKEN_PLAN_API_KEY": "your-api-key"	CODE
HIGH	docs/developers/tools/web-search.md	267	"TAVILY_API_KEY": "your-api-key-here"	CODE
HIGH	docs/developers/tools/web-search.md	375	"FIRECRAWL_API_KEY": "your-api-key-here"	CODE

Self-Referential Comments8 hits · 27 pts

Severity	File	Line	Snippet	Context
MEDIUM	deploy/k2-resident/application.example.yaml	2	# This file is a template, not an applied deployment or an ACK acceptance result.	COMMENT
MEDIUM	integration-tests/concurrent-runner/runner.py	214	# Create a unique branch for this worktree based on the specified branch	COMMENT
MEDIUM⚡	packages/cua-driver/python/src/cua_driver/_native.py	290	# This function is used for rust calls that return Result<> and therefore can set the CALL_ERROR status code.	COMMENT
MEDIUM⚡	…s/cua-driver/python/src/cua_driver/_native_contract.py	288	# This function is used for rust calls that return Result<> and therefore can set the CALL_ERROR status code.	COMMENT
MEDIUM	.github/workflows/pr-self-report-label.yml	85	# Create the label on first use (idempotent), then apply it.	COMMENT
MEDIUM	.github/workflows/qwen-autofix.yml	4242	# Create the remote-tracking ref so the verification gate's	COMMENT
MEDIUM	.github/workflows/release-sdk.yml	363	# Create a metadata file to record which CLI version was bundled	COMMENT
MEDIUM	…scripts/dsw-swe-verified/dispatch-release-benchmark.sh	26	# This file contains only OPENAI_BASE_URL and OPENAI_MODEL; the API key is	COMMENT

Deep Nesting17 hits · 16 pts

Severity	File	Line	Context
LOW	…kills/agent-reproduce-feature/scripts/capture_state.py	255	CODE
LOW	…kills/agent-reproduce-feature/scripts/capture_state.py	480	CODE
LOW	…kills/agent-reproduce-align/scripts/normalize_trace.py	77	CODE
LOW	integration-tests/concurrent-runner/runner.py	892	CODE
LOW	scripts/harness-kubernetes-preflight.py	12	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/transport.py	130	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/transport.py	216	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/validation.py	87	CODE
LOW	packages/cua-driver/python/build_wheel.py	37	CODE
LOW	packages/cua-driver/python/build_wheel.py	140	CODE
LOW	packages/cua-driver/python/build_wheel.py	166	CODE
LOW	packages/cua-driver/python/build_wheel.py	200	CODE
LOW	packages/cua-driver/python/build_wheel.py	247	CODE
LOW	packages/cua-driver/python/tests/test_uniffi_loader.py	104	CODE
LOW	packages/cua-driver/python/tests/test_uniffi_loader.py	136	CODE
LOW	packages/cua-driver/python/src/cua_driver/_native.py	299	CODE
LOW	…s/cua-driver/python/src/cua_driver/_native_contract.py	297	CODE

Synthetic Comment Markers2 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	packages/cli/src/serve/web-shell-static.ts	44	// (the SPA renders AI-generated markdown) cannot repoint relative URLs to an	COMMENT
HIGH	…mponents/managed/java-managed-agent-event-projector.ts	61	// tool replays as requested, not already running. Once settleTurnItems	COMMENT

Cross-File Repetition3 hits · 15 pts

Severity	File	Snippet	Context
HIGH	…n/code/managedagent/ManagedWorkspaceAdmissionTest.java	{"agent_id":"qwen-code","input":[], "workspace":{"workspace_id":"ws-a"}}	STRING
HIGH	…ibaba/qwen/code/managedagent/ManagedTurnQueryTest.java	{"agent_id":"qwen-code","input":[], "workspace":{"workspace_id":"ws-a"}}	STRING
HIGH	…wen/code/managedagent/ManagedSessionLifecycleTest.java	{"agent_id":"qwen-code","input":[], "workspace":{"workspace_id":"ws-a"}}	STRING

Example Usage Blocks8 hits · 13 pts

Severity	File	Line	Snippet	Context
LOW	scripts/test-rewind-e2e.sh	18	# Usage:	COMMENT
LOW	scripts/sign-release.sh	4	# Usage:	COMMENT
LOW	scripts/installation/install-qwen-with-source.sh	7	# Usage:	COMMENT
LOW	scripts/installation/install-opentui-preview.sh	6	# Usage:	COMMENT
LOW	scripts/installation/install-qwen-standalone.sh	7	# Usage:	COMMENT
LOW⚡	packages/cua-driver/scripts/uninstall.sh	58	# Usage:	COMMENT
LOW	packages/cua-driver/scripts/sync-from-upstream.sh	14	# Usage:	COMMENT
LOW	packages/mobile-mcp/scripts/sync-from-upstream.sh	4	# Usage:	COMMENT

Modern Structural Boilerplate8 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW⚡	packages/sdk-python/src/qwen_code_sdk/query.py	497	async def set_permission_mode(self, mode: str) -> None:	CODE
LOW⚡	packages/sdk-python/src/qwen_code_sdk/query.py	501	async def set_model(self, model: str) -> None:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/__init__.py	67	__all__ = [	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/sync_query.py	117	def set_model(self, model: str) -> None:	CODE
LOW	packages/sdk-python/src/qwen_code_sdk/sync_query.py	123	def set_permission_mode(self, mode: str) -> None:	CODE
LOW	packages/cua-driver/python/src/cua_driver/__init__.py	173	__all__ = [	CODE
LOW	packages/cua-driver/python/src/cua_driver/_native.py	7536	__all__ = [	CODE
LOW	…s/cua-driver/python/src/cua_driver/_native_contract.py	6561	__all__ = [	CODE

Redundant / Tautological Comments3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	…al-bench/ci-tasks/hello-world/tests/setup-uv-pytest.sh	12	# Check if we're in a valid working directory	COMMENT
LOW	scripts/create_alias.sh	24	# Check if the alias already exists	COMMENT
LOW	.github/workflows/live-host-release.yml	401	# Check if the package exists at all — provenance requires an	COMMENT

Overly Generic Function Names2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	.qwen/skills/e2e-testing/scripts/mock-openai-server.js	54	function handleRequest({ body, inputTokens, requestIndex }) {	CODE
LOW	packages/core/src/utils/fileUtils.test.ts	839	const php = '<?php\nfunction handleRequest() {\n return true;\n}\n';	CODE

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	packages/cli/src/serve/hosted-team-session.ts	2095	`Task #${number} is owned by ${task.owner}; you can change only tasks you own or that are unowned.`,	CODE

QwenLM/qwen-code

Open-Source Code Quality, Security and Technical Debt Review