Open-source Agent Operating System
This report summarizes scanner evidence for RightNow-AI/openfang, a Rust project with 18,217 GitHub stars. SynthScan examined 264,554 lines of code across 504 source files, recording 1004 pattern matches distributed across 15 syntactic categories. The legacy adjusted pattern signal is 8.3 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 463 finding(s).
Are imports declared and package/API names verified? 26 finding(s).
Are wrappers, guards, and repeated structures necessary? 516 finding(s).
Which changes need focused human review? 1004 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1004 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/openfang-hands/bundled/twitter/HAND.toml | 29 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/twitter/HAND.toml | 176 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/clip/HAND.toml | 57 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/clip/HAND.toml | 124 | # ─── Publishing settings ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/clip/HAND.toml | 184 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/trader/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/trader/HAND.toml | 192 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/trader/HAND.toml | 688 | # ─── Dashboard metrics ──────────────────────────────────────────────────────── | STRING |
| MEDIUM | crates/openfang-hands/bundled/infisical-sync/HAND.toml | 18 | # ─── Requirements ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/infisical-sync/HAND.toml | 41 | # ─── Settings ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/infisical-sync/HAND.toml | 99 | # ─── Agent configuration ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/infisical-sync/HAND.toml | 380 | # ─── Dashboard metrics ──────────────────────────────────────────────────────── | STRING |
| MEDIUM | crates/openfang-hands/bundled/collector/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/collector/HAND.toml | 146 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/browser/HAND.toml | 49 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/browser/HAND.toml | 110 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/lead/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/lead/HAND.toml | 161 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/predictor/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/predictor/HAND.toml | 166 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/researcher/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/researcher/HAND.toml | 154 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/src/registry.rs | 32 | // ─── Settings availability types ──────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/src/lib.rs | 16 | // ─── Error types ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/src/lib.rs | 38 | // ─── Core types ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/src/lib.rs | 153 | // ─── Hand settings types ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/web_fetch.rs | 495 | // ── SSRF allowlist tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/auth_cooldown.rs | 398 | // ── Auth Profile Rotation (Gap 3) ──────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 127 | // ── Command substitution ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 141 | // ── Command chaining ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 151 | // ── I/O redirection ─────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 158 | // ── Expansion and globbing ──────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 164 | // ── Embedded newlines ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 173 | // ── Background execution and logical chaining ────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 744 | // ── Env passthrough merge (issue #1169) ──────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 744 | // ── Env passthrough merge (issue #1169) ──────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 857 | // ── Exec policy tests ────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 960 | // ── Shell metacharacter injection tests ────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 1052 | // ── CJK / multi-byte safety tests (issue #490) ────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 1052 | // ── CJK / multi-byte safety tests (issue #490) ────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 1124 | // ── Shell wrapper bypass tests (issue #794) ──────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 1124 | // ── Shell wrapper bypass tests (issue #794) ──────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/provider_health.rs | 45 | // ── Probe cache ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/tool_runner.rs | 4537 | // ─── Canvas / A2UI tests ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/tool_runner.rs | 4625 | // ── Regression: GitHub issue #919 — rm bypass via process_start ────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/tool_runner.rs | 4625 | // ── Regression: GitHub issue #919 — rm bypass via process_start ────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/docker_sandbox.rs | 544 | // ── Container Pool tests ────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/docker_sandbox.rs | 586 | // ── Bind Mount Validation tests ────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 30 | // ── Constants ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 39 | // ── Public types ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 82 | // ── CDP connection ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 224 | // ── Browser session ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 416 | // ── Command implementations ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 621 | // ── Helpers ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 672 | // ── Chromium discovery ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 796 | // ── Browser manager ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 871 | // ── Tool handler functions ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 1121 | // ── Embedded JavaScript ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 1171 | // ── Root detection ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 1201 | // ── Tests ────────────────────────────────────────────────────────────────── | COMMENT |
| 448 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/openfang-hands/bundled/researcher/HAND.toml | 321 | ## Sources | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 121 | pub check_value: String, | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 281 | #[serde(default = "default_provider")] | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 361 | /// Unique hand identifier (e.g. "clip"). | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 381 | /// Requirements that must be satisfied before activation. | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 421 | pub instance_id: Uuid, | COMMENT |
| LOW | crates/openfang-runtime/src/context_budget.rs | 1 | //! Dynamic context budget for tool result truncation. | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 181 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | crates/openfang-runtime/src/agent_loop.rs | 41 | const BASE_RETRY_DELAY_MS: u64 = 1000; | COMMENT |
| LOW | crates/openfang-runtime/src/agent_loop.rs | 141 | /// signatures, Gemini 2.5+ thoughts, OpenAI-compat reasoning_content, | COMMENT |
| LOW | crates/openfang-runtime/src/agent_loop.rs | 2361 | let _ = hook_reg.fire(&ctx); | COMMENT |
| LOW | crates/openfang-runtime/src/auth_cooldown.rs | 1 | //! Provider circuit breaker with exponential cooldown backoff. | COMMENT |
| LOW | crates/openfang-runtime/src/auth_cooldown.rs | 61 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | crates/openfang-runtime/src/think_filter.rs | 1 | //! Streaming think-tag filter. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_driver.rs | 21 | status: u16, | COMMENT |
| LOW | crates/openfang-runtime/src/llm_driver.rs | 181 | /// Base URL override. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_driver.rs | 201 | /// | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 1 | //! Session history validation and repair. | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 21 | /// Number of orphaned ToolResult blocks removed. | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 41 | /// - 2c. Deduplicates ToolResults with the same tool_use_id | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 121 | ..Default::default() | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 361 | }, | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 1001 | assert_eq!(result_count, 1, "Should keep only the first ToolResult"); | COMMENT |
| LOW | crates/openfang-runtime/src/apply_patch.rs | 1 | //! Multi-hunk diff-based file patching. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_errors.rs | 1 | //! LLM error classification and sanitization. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_errors.rs | 41 | /// Classified error with metadata. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_errors.rs | 221 | "network error", | COMMENT |
| LOW | crates/openfang-runtime/src/llm_errors.rs | 541 | } | COMMENT |
| LOW | crates/openfang-runtime/src/prompt_builder.rs | 1 | //! Centralized system prompt builder. | COMMENT |
| LOW | crates/openfang-runtime/src/prompt_builder.rs | 61 | pub sender_id: Option<String>, | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 1 | //! A2A (Agent-to-Agent) Protocol — cross-framework agent interoperability. | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 21 | COMMENT | |
| LOW | crates/openfang-runtime/src/a2a.rs | 61 | #[derive(Debug, Clone, Serialize, Deserialize)] | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 81 | /// A2A Task — unit of work exchanged between agents. | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 101 | #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 181 | }, | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 201 | #[serde(default)] | COMMENT |
| LOW | crates/openfang-runtime/src/graceful_shutdown.rs | 1 | //! Graceful shutdown — ordered subsystem teardown for clean exit. | COMMENT |
| LOW | crates/openfang-runtime/src/compactor.rs | 1 | //! LLM-based session compaction. | COMMENT |
| LOW | crates/openfang-runtime/src/hooks.rs | 1 | //! Plugin lifecycle hooks — intercept points at key moments in agent execution. | COMMENT |
| LOW | crates/openfang-runtime/src/context_overflow.rs | 1 | //! Context overflow recovery pipeline. | COMMENT |
| LOW | crates/openfang-runtime/src/subprocess_sandbox.rs | 1 | //! Subprocess environment sandboxing. | COMMENT |
| LOW | crates/openfang-runtime/src/subprocess_sandbox.rs | 21 | "USERPROFILE", | COMMENT |
| LOW | crates/openfang-runtime/src/subprocess_sandbox.rs | 401 | COMMENT | |
| LOW | crates/openfang-runtime/src/subprocess_sandbox.rs | 1081 | #[test] | COMMENT |
| LOW | crates/openfang-runtime/src/provider_health.rs | 1 | //! Provider health probing — lightweight HTTP checks for local LLM providers. | COMMENT |
| LOW | crates/openfang-runtime/src/reply_directives.rs | 1 | //! Reply directive parsing and streaming accumulation. | COMMENT |
| LOW | crates/openfang-runtime/src/mcp_server.rs | 1 | //! MCP Server — expose OpenFang tools via the Model Context Protocol. | COMMENT |
| LOW | crates/openfang-runtime/src/loop_guard.rs | 1 | //! Tool loop detection for the agent execution loop. | COMMENT |
| LOW | crates/openfang-runtime/src/agent_context.rs | 1 | //! Per-turn agent context loader for external `context.md` files. | COMMENT |
| LOW | crates/openfang-runtime/src/agent_context.rs | 21 | /// Maximum size of `context.md` to inject into the prompt (32 KB). | COMMENT |
| LOW | crates/openfang-runtime/src/command_lane.rs | 1 | //! Command lane system — lane-based command queue with concurrency control. | COMMENT |
| LOW | crates/openfang-runtime/src/tool_policy.rs | 1 | //! Multi-layer tool policy resolution. | COMMENT |
| LOW | crates/openfang-runtime/src/tool_runner.rs | 21 | /// Check if a tool name refers to a shell execution tool. | COMMENT |
| LOW | crates/openfang-runtime/src/tool_runner.rs | 3321 | "container_id": container.container_id, | COMMENT |
| LOW | crates/openfang-runtime/src/tool_runner.rs | 4621 | // Cleanup | COMMENT |
| LOW | crates/openfang-runtime/src/workspace_sandbox.rs | 1 | //! Workspace filesystem sandboxing. | COMMENT |
| LOW | crates/openfang-runtime/src/sandbox.rs | 1 | //! WASM sandbox for secure skill/plugin execution. | COMMENT |
| LOW | crates/openfang-runtime/src/shell_bleed.rs | 1 | //! Shell bleed detection — scan script files for environment variable leaks. | COMMENT |
| LOW | crates/openfang-runtime/src/browser.rs | 1 | //! Native browser automation via Chrome DevTools Protocol (CDP). | COMMENT |
| 217 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | CLAUDE.md | 26 | #### Step 1: Stop any running daemon | COMMENT |
| LOW⚡ | CLAUDE.md | 34 | #### Step 2: Build fresh release binary | COMMENT |
| LOW⚡ | CLAUDE.md | 39 | #### Step 3: Start daemon with required API keys | COMMENT |
| LOW⚡ | CLAUDE.md | 47 | #### Step 4: Test every new endpoint | COMMENT |
| LOW | CLAUDE.md | 62 | #### Step 5: Test real LLM integration | COMMENT |
| LOW⚡ | CLAUDE.md | 73 | #### Step 6: Verify side effects | COMMENT |
| LOW⚡ | CLAUDE.md | 80 | #### Step 7: Verify dashboard HTML | COMMENT |
| LOW⚡ | CLAUDE.md | 87 | #### Step 8: Cleanup | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 369 | ### Step 1: Extract the clip | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 374 | ### Step 2: Crop to vertical (9:16) | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 383 | ### Step 3: Generate SRT captions from transcript | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 454 | ### Step 1: Check settings | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 461 | ### Step 2: Validate credentials | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 516 | ### Step 5: Rate limiting | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 522 | ### Step 6: Publishing summary | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 400 | ### Step 4: Burn captions onto the clip | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 439 | ### Step 5: Generate thumbnail | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 473 | ### Step 3: Publish to Telegram | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 489 | ### Step 4: Publish to WhatsApp | COMMENT |
| LOW | crates/openfang-hands/bundled/trader/HAND.toml | 396 | ### Step 1: Build the BULL Case | COMMENT |
| LOW | crates/openfang-hands/bundled/trader/HAND.toml | 409 | ### Step 2: Build the BEAR Case | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/trader/HAND.toml | 422 | ### Step 3: Cognitive Bias Check | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/trader/HAND.toml | 430 | ### Step 4: Synthesis & Final Signal | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 55 | // Step 1: SSRF protection — BEFORE any network I/O | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 58 | // Step 2: Cache lookup (only for GET) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 67 | // Step 3: Build request with configured method | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 127 | // Step 4: For GET requests, detect HTML and convert to Markdown. | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 143 | // Step 5: Truncate (char-boundary-safe to avoid panics on multi-byte UTF-8) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 154 | // Step 6: Wrap with external content markers | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 160 | // Step 7: Cache (only GET responses) | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 392 | // Step 1: Merge consecutive same-role turns | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 404 | // Step 2: Drop orphaned functionCall parts from model turns. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 443 | // Step 3: Drop orphaned functionResponse parts from user turns. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/gemini.rs | 473 | // Step 4: Remove turns that ended up empty after filtering | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/gemini.rs | 476 | // Step 5: Final merge pass (removing parts may have created new consecutive same-role) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 751 | // Step 1: Request device code. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 754 | // Step 2: Tell the user what to do + try to open browser. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 767 | // Step 3: Poll for authorization. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 770 | // Step 4: Persist. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 561 | // Step 1: remove toolResult blocks whose ID is not in the assistant's toolUse set. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 582 | // Step 2: deduplicate — keep only the first toolResult block per tool_use_id. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 605 | // Step 3: insert a synthetic error result for any toolUse ID with no result. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 626 | // Step 4: if all blocks were removed and nothing was inserted, the message is | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 931 | // Step 1: API delivers a thinking block with signature | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 951 | // Step 2: Verify the signature reached the ContentBlock | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 965 | // Step 3: Now feed the assistant turn back into the driver as if | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 997 | // Step 4: Verify on-the-wire JSON shape (`type=thinking`, `signature` present). | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 1076 | // Step 1: API delivers a response with a redacted_thinking block. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/anthropic.rs | 1095 | // Step 2: The opaque blob must reach the ContentBlock layer. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/anthropic.rs | 1103 | // Step 3: Resubmit the assistant turn as conversation history. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 1128 | // Step 4: On-the-wire JSON shape (`type=redacted_thinking`, `data` present). | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2204 | // Step 1: parse server response shape. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2217 | // Step 2: simulate the driver building blocks (mirrors the live | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2232 | // Step 3: replay through the outbound path. | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6839 | // Step 2: Confirm | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6849 | // Step 3: Stop running daemon | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6864 | // Step 4: Remove auto-start entries | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6868 | // Step 5: Clean PATH from shell configs | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6875 | // Step 6: Remove ~/.openfang/ data | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6888 | // Step 7: Remove cargo bin copy if it exists and is separate from current exe | COMMENT |
| 26 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 369 | ### Step 1: Extract the clip | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 374 | ### Step 2: Crop to vertical (9:16) | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 383 | ### Step 3: Generate SRT captions from transcript | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 454 | ### Step 1: Check settings | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 461 | ### Step 2: Validate credentials | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 516 | ### Step 5: Rate limiting | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 522 | ### Step 6: Publishing summary | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 400 | ### Step 4: Burn captions onto the clip | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 439 | ### Step 5: Generate thumbnail | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 473 | ### Step 3: Publish to Telegram | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 489 | ### Step 4: Publish to WhatsApp | COMMENT |
| LOW | crates/openfang-hands/bundled/trader/HAND.toml | 396 | ### Step 1: Build the BULL Case | COMMENT |
| LOW | crates/openfang-hands/bundled/trader/HAND.toml | 409 | ### Step 2: Build the BEAR Case | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/trader/HAND.toml | 422 | ### Step 3: Cognitive Bias Check | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/trader/HAND.toml | 430 | ### Step 4: Synthesis & Final Signal | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 55 | // Step 1: SSRF protection — BEFORE any network I/O | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 58 | // Step 2: Cache lookup (only for GET) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 67 | // Step 3: Build request with configured method | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 127 | // Step 4: For GET requests, detect HTML and convert to Markdown. | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 143 | // Step 5: Truncate (char-boundary-safe to avoid panics on multi-byte UTF-8) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 154 | // Step 6: Wrap with external content markers | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 160 | // Step 7: Cache (only GET responses) | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 392 | // Step 1: Merge consecutive same-role turns | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 404 | // Step 2: Drop orphaned functionCall parts from model turns. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 443 | // Step 3: Drop orphaned functionResponse parts from user turns. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/gemini.rs | 473 | // Step 4: Remove turns that ended up empty after filtering | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/gemini.rs | 476 | // Step 5: Final merge pass (removing parts may have created new consecutive same-role) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 751 | // Step 1: Request device code. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 754 | // Step 2: Tell the user what to do + try to open browser. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 767 | // Step 3: Poll for authorization. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 770 | // Step 4: Persist. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 561 | // Step 1: remove toolResult blocks whose ID is not in the assistant's toolUse set. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 582 | // Step 2: deduplicate — keep only the first toolResult block per tool_use_id. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 605 | // Step 3: insert a synthetic error result for any toolUse ID with no result. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 626 | // Step 4: if all blocks were removed and nothing was inserted, the message is | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 931 | // Step 1: API delivers a thinking block with signature | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 951 | // Step 2: Verify the signature reached the ContentBlock | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 965 | // Step 3: Now feed the assistant turn back into the driver as if | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 997 | // Step 4: Verify on-the-wire JSON shape (`type=thinking`, `signature` present). | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 1076 | // Step 1: API delivers a response with a redacted_thinking block. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/anthropic.rs | 1095 | // Step 2: The opaque blob must reach the ContentBlock layer. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/anthropic.rs | 1103 | // Step 3: Resubmit the assistant turn as conversation history. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 1128 | // Step 4: On-the-wire JSON shape (`type=redacted_thinking`, `data` present). | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2204 | // Step 1: parse server response shape. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2217 | // Step 2: simulate the driver building blocks (mirrors the live | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2232 | // Step 3: replay through the outbound path. | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6839 | // Step 2: Confirm | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6849 | // Step 3: Stop running daemon | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6864 | // Step 4: Remove auto-start entries | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6868 | // Step 5: Clean PATH from shell configs | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6875 | // Step 6: Remove ~/.openfang/ data | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6888 | // Step 7: Remove cargo bin copy if it exists and is separate from current exe | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6896 | // Step 8: Remove the binary itself (must be last) | COMMENT |
| LOW | crates/openfang-cli/src/main.rs | 6800 | // Step 1: Show what will be removed | COMMENT |
| LOW | crates/openfang-cli/src/tui/screens/init_wizard.rs | 891 | // Step 1: request device code | COMMENT |
| LOW | crates/openfang-cli/src/tui/screens/init_wizard.rs | 913 | // Step 2: poll for token | COMMENT |
| LOW | crates/openfang-cli/src/tui/screens/init_wizard.rs | 937 | // Step 3: fetch models | COMMENT |
| LOW⚡ | crates/openfang-api/static/js/pages/wizard.js | 21 | // Step 2: Provider setup | COMMENT |
| LOW⚡ | crates/openfang-api/static/js/pages/wizard.js | 30 | // Step 3: Agent creation | COMMENT |
| LOW | crates/openfang-api/static/js/pages/wizard.js | 148 | // Step 3: Category filtering | COMMENT |
| 18 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | crates/openfang-api/tests/api_integration_test.rs | 937 | state.kernel.config.auth.password_hash.clone() | CODE |
| CRITICAL | crates/openfang-api/src/server.rs | 154 | state.kernel.config.auth.password_hash.clone() | CODE |
| CRITICAL | crates/openfang-api/src/routes.rs | 5455 | && !state.kernel.config.network.shared_secret.is_empty(); | CODE |
| CRITICAL | crates/openfang-api/src/routes.rs | 7735 | state.kernel.config.default_model.provider.clone(), | CODE |
| CRITICAL | crates/openfang-api/src/routes.rs | 7736 | state.kernel.config.default_model.api_key_env.clone(), | CODE |
| CRITICAL | crates/openfang-api/src/ws.rs | 332 | state.kernel.config.auth.password_hash.clone() | CODE |
| CRITICAL | crates/openfang-kernel/src/kernel.rs | 2515 | ssrf_allowed_hosts: self.config.web.fetch.ssrf_allowed_hosts.clone(), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/openfang-cli/src/main.rs | 199 | /// What to scaffold. | COMMENT |
| MEDIUM | crates/openfang-cli/src/main.rs | 364 | /// Create a new skill scaffold. | COMMENT |
| MEDIUM | crates/openfang-types/src/agent.rs | 69 | /// Autonomous agent configuration — guardrails for 24/7 agents. | COMMENT |
| MEDIUM | crates/openfang-types/src/agent.rs | 471 | /// Autonomous agent configuration — guardrails for 24/7 agents. | COMMENT |
| MEDIUM | crates/openfang-types/src/agent.rs | 480 | /// agent's working directory and will NOT scaffold private state files | COMMENT |
| MEDIUM | crates/openfang-extensions/src/installer.rs | 221 | /// Generate scaffold files for a new custom integration. | COMMENT |
| MEDIUM | crates/openfang-extensions/src/installer.rs | 263 | /// Generate scaffold files for a new skill. | STRING |
| MEDIUM | crates/openfang-kernel/src/kernel.rs | 9343 | /// existing directory like `~/Documents`, the runtime must NOT scaffold | COMMENT |
| MEDIUM | docs/agent-templates.md | 401 | # "Write a blog post about the benefits of agent-based architectures" | COMMENT |
| MEDIUM | docs/troubleshooting.md | 696 | ### How do I configure the embedding model for memory? | COMMENT |
| MEDIUM | docs/skill-development.md | 487 | # Create a new skill scaffold (interactive) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | crates/openfang-runtime/src/media_understanding.rs | 238 | description: "[Video description would be generated by Gemini]".to_string(), | CODE |
| HIGH | crates/openfang-runtime/src/web_search.rs | 207 | // Include AI-generated answer if available | COMMENT |
| HIGH | crates/openfang-types/src/config.rs | 286 | /// Include AI-generated answer summary. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/openfang-hands/bundled/lead/SKILL.md | 177 | "Jane Smith","VP Engineering","Acme Corp","https://acme.com","https://linkedin.com/in/janesmith","SaaS","SMB (120 employ | CODE |
| LOW | crates/openfang-hands/bundled/lead/SKILL.md | 186 | "company": "Acme Corp", | CODE |
| LOW | crates/openfang-runtime/src/routing.rs | 184 | model: "placeholder".to_string(), | CODE |
| LOW | crates/openfang-memory/src/knowledge.rs | 318 | name: "Acme Corp".to_string(), | CODE |
| LOW | crates/openfang-memory/src/knowledge.rs | 344 | assert_eq!(matches[0].target.name, "Acme Corp"); | CODE |
| LOW | crates/openfang-types/src/approval.rs | 508 | decided_by: Some("admin@example.com".into()), | CODE |
| LOW | crates/openfang-types/src/approval.rs | 514 | assert_eq!(back.decided_by, Some("admin@example.com".into())); | CODE |
| LOW | crates/openfang-api/static/i18n/i18n.js | 99 | if (el.hasAttribute('placeholder')) { | CODE |
| LOW | crates/openfang-api/src/routes.rs | 2412 | "placeholder": f.placeholder, | CODE |
| LOW | crates/openfang-channels/src/xmpp.rs | 231 | platform_id: "user@example.com".to_string(), | CODE |
| LOW | crates/openfang-channels/src/email.rs | 598 | assert_eq!(extract_email_addr("user@example.com"), "user@example.com"); | CODE |
| LOW | crates/openfang-channels/src/linkedin.rs | 440 | "fromName": "Jane Doe", | CODE |
| LOW | crates/openfang-channels/src/linkedin.rs | 449 | assert_eq!(name, "Jane Doe"); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/troubleshooting.md | 434 | curl -H "Authorization: Bearer your-api-key" http://127.0.0.1:4200/api/agents | CODE |
| HIGH | docs/api-reference.md | 39 | Authorization: Bearer <your-api-key> | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test_vertex_e2e.py | 87 | except Exception as e: | CODE |
| LOW | test_vertex_e2e.py | 156 | except Exception as e: | CODE |
| MEDIUM | test_vertex_e2e.py | 12 | def test_vertex_ai(): | CODE |
| LOW | agents/langchain-code-reviewer/server.py | 158 | except Exception as e: | CODE |
| LOW | docs/skill-development.md | 253 | except Exception as e: | CODE |
| LOW | sdk/python/openfang_sdk.py | 120 | except Exception as e: | CODE |
| LOW | sdk/python/openfang_sdk.py | 128 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | sdk/python/openfang_client.py | 10 | # Create an agent | STRING |
| MEDIUM | sdk/python/examples/client_basic.py | 25 | # Create a new agent from the "assistant" template | COMMENT |
| MEDIUM | sdk/python/examples/client_streaming.py | 17 | # Create an agent | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/openfang-hands/bundled/researcher/HAND.toml | 168 | system_prompt = """You are Researcher Hand — an autonomous deep research agent that conducts exhaustive investigations, | CODE |
| MEDIUM | crates/openfang-channels/src/router.rs | 779 | // leverage line in the patch from issue #1127. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test_vertex_e2e.py | 7 | CODE | |
| LOW | agents/langchain-code-reviewer/server.py | 20 | CODE | |
| LOW | agents/langchain-code-reviewer/server.py | 20 | CODE | |
| LOW | sdk/python/openfang_client.py | 31 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test_vertex_e2e.py | 91 | CODE | |
| LOW | sdk/python/openfang_client.py | 82 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/openfang-api/static/js/pages/wizard.js | 5 | function wizardTomlMultilineEscape(s) { | CODE |