Open-source Agent Operating System
This report presents the forensic synthetic code analysis of RightNow-AI/openfang, a Rust project with 18,009 GitHub stars. SynthScan v2.0 examined 264,554 lines of code across 504 source files, recording 1004 pattern matches distributed across 15 syntactic categories. The overall adjusted score of 8.3 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1004 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/openfang-hands/bundled/twitter/HAND.toml | 29 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/twitter/HAND.toml | 176 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/clip/HAND.toml | 57 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/clip/HAND.toml | 124 | # ─── Publishing settings ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/clip/HAND.toml | 184 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/trader/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/trader/HAND.toml | 192 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/trader/HAND.toml | 688 | # ─── Dashboard metrics ──────────────────────────────────────────────────────── | STRING |
| MEDIUM | crates/openfang-hands/bundled/infisical-sync/HAND.toml | 18 | # ─── Requirements ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/infisical-sync/HAND.toml | 41 | # ─── Settings ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/infisical-sync/HAND.toml | 99 | # ─── Agent configuration ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/infisical-sync/HAND.toml | 380 | # ─── Dashboard metrics ──────────────────────────────────────────────────────── | STRING |
| MEDIUM | crates/openfang-hands/bundled/collector/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/collector/HAND.toml | 146 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/browser/HAND.toml | 49 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/browser/HAND.toml | 110 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/lead/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/lead/HAND.toml | 161 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/predictor/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/predictor/HAND.toml | 166 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/researcher/HAND.toml | 8 | # ─── Configurable settings ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/bundled/researcher/HAND.toml | 154 | # ─── Agent configuration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/src/registry.rs | 32 | // ─── Settings availability types ──────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/src/lib.rs | 16 | // ─── Error types ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/src/lib.rs | 38 | // ─── Core types ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-hands/src/lib.rs | 153 | // ─── Hand settings types ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/web_fetch.rs | 495 | // ── SSRF allowlist tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/auth_cooldown.rs | 398 | // ── Auth Profile Rotation (Gap 3) ──────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 127 | // ── Command substitution ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 141 | // ── Command chaining ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 151 | // ── I/O redirection ─────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 158 | // ── Expansion and globbing ──────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 164 | // ── Embedded newlines ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openfang-runtime/src/subprocess_sandbox.rs | 173 | // ── Background execution and logical chaining ────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 744 | // ── Env passthrough merge (issue #1169) ──────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 744 | // ── Env passthrough merge (issue #1169) ──────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 857 | // ── Exec policy tests ────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 960 | // ── Shell metacharacter injection tests ────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 1052 | // ── CJK / multi-byte safety tests (issue #490) ────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 1052 | // ── CJK / multi-byte safety tests (issue #490) ────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 1124 | // ── Shell wrapper bypass tests (issue #794) ──────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/subprocess_sandbox.rs | 1124 | // ── Shell wrapper bypass tests (issue #794) ──────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/provider_health.rs | 45 | // ── Probe cache ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/tool_runner.rs | 4537 | // ─── Canvas / A2UI tests ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/tool_runner.rs | 4625 | // ── Regression: GitHub issue #919 — rm bypass via process_start ────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/tool_runner.rs | 4625 | // ── Regression: GitHub issue #919 — rm bypass via process_start ────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/docker_sandbox.rs | 544 | // ── Container Pool tests ────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/docker_sandbox.rs | 586 | // ── Bind Mount Validation tests ────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 30 | // ── Constants ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 39 | // ── Public types ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 82 | // ── CDP connection ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 224 | // ── Browser session ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 416 | // ── Command implementations ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 621 | // ── Helpers ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 672 | // ── Chromium discovery ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 796 | // ── Browser manager ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 871 | // ── Tool handler functions ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 1121 | // ── Embedded JavaScript ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 1171 | // ── Root detection ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openfang-runtime/src/browser.rs | 1201 | // ── Tests ────────────────────────────────────────────────────────────────── | COMMENT |
| 448 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/openfang-hands/bundled/researcher/HAND.toml | 321 | ## Sources | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 121 | pub check_value: String, | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 281 | #[serde(default = "default_provider")] | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 361 | /// Unique hand identifier (e.g. "clip"). | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 381 | /// Requirements that must be satisfied before activation. | COMMENT |
| LOW | crates/openfang-hands/src/lib.rs | 421 | pub instance_id: Uuid, | COMMENT |
| LOW | crates/openfang-runtime/src/context_budget.rs | 1 | //! Dynamic context budget for tool result truncation. | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 181 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | crates/openfang-runtime/src/agent_loop.rs | 41 | const BASE_RETRY_DELAY_MS: u64 = 1000; | COMMENT |
| LOW | crates/openfang-runtime/src/agent_loop.rs | 141 | /// signatures, Gemini 2.5+ thoughts, OpenAI-compat reasoning_content, | COMMENT |
| LOW | crates/openfang-runtime/src/agent_loop.rs | 2361 | let _ = hook_reg.fire(&ctx); | COMMENT |
| LOW | crates/openfang-runtime/src/auth_cooldown.rs | 1 | //! Provider circuit breaker with exponential cooldown backoff. | COMMENT |
| LOW | crates/openfang-runtime/src/auth_cooldown.rs | 61 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | crates/openfang-runtime/src/think_filter.rs | 1 | //! Streaming think-tag filter. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_driver.rs | 21 | status: u16, | COMMENT |
| LOW | crates/openfang-runtime/src/llm_driver.rs | 181 | /// Base URL override. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_driver.rs | 201 | /// | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 1 | //! Session history validation and repair. | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 21 | /// Number of orphaned ToolResult blocks removed. | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 41 | /// - 2c. Deduplicates ToolResults with the same tool_use_id | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 121 | ..Default::default() | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 361 | }, | COMMENT |
| LOW | crates/openfang-runtime/src/session_repair.rs | 1001 | assert_eq!(result_count, 1, "Should keep only the first ToolResult"); | COMMENT |
| LOW | crates/openfang-runtime/src/apply_patch.rs | 1 | //! Multi-hunk diff-based file patching. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_errors.rs | 1 | //! LLM error classification and sanitization. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_errors.rs | 41 | /// Classified error with metadata. | COMMENT |
| LOW | crates/openfang-runtime/src/llm_errors.rs | 221 | "network error", | COMMENT |
| LOW | crates/openfang-runtime/src/llm_errors.rs | 541 | } | COMMENT |
| LOW | crates/openfang-runtime/src/prompt_builder.rs | 1 | //! Centralized system prompt builder. | COMMENT |
| LOW | crates/openfang-runtime/src/prompt_builder.rs | 61 | pub sender_id: Option<String>, | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 1 | //! A2A (Agent-to-Agent) Protocol — cross-framework agent interoperability. | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 21 | COMMENT | |
| LOW | crates/openfang-runtime/src/a2a.rs | 61 | #[derive(Debug, Clone, Serialize, Deserialize)] | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 81 | /// A2A Task — unit of work exchanged between agents. | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 101 | #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 181 | }, | COMMENT |
| LOW | crates/openfang-runtime/src/a2a.rs | 201 | #[serde(default)] | COMMENT |
| LOW | crates/openfang-runtime/src/graceful_shutdown.rs | 1 | //! Graceful shutdown — ordered subsystem teardown for clean exit. | COMMENT |
| LOW | crates/openfang-runtime/src/compactor.rs | 1 | //! LLM-based session compaction. | COMMENT |
| LOW | crates/openfang-runtime/src/hooks.rs | 1 | //! Plugin lifecycle hooks — intercept points at key moments in agent execution. | COMMENT |
| LOW | crates/openfang-runtime/src/context_overflow.rs | 1 | //! Context overflow recovery pipeline. | COMMENT |
| LOW | crates/openfang-runtime/src/subprocess_sandbox.rs | 1 | //! Subprocess environment sandboxing. | COMMENT |
| LOW | crates/openfang-runtime/src/subprocess_sandbox.rs | 21 | "USERPROFILE", | COMMENT |
| LOW | crates/openfang-runtime/src/subprocess_sandbox.rs | 401 | COMMENT | |
| LOW | crates/openfang-runtime/src/subprocess_sandbox.rs | 1081 | #[test] | COMMENT |
| LOW | crates/openfang-runtime/src/provider_health.rs | 1 | //! Provider health probing — lightweight HTTP checks for local LLM providers. | COMMENT |
| LOW | crates/openfang-runtime/src/reply_directives.rs | 1 | //! Reply directive parsing and streaming accumulation. | COMMENT |
| LOW | crates/openfang-runtime/src/mcp_server.rs | 1 | //! MCP Server — expose OpenFang tools via the Model Context Protocol. | COMMENT |
| LOW | crates/openfang-runtime/src/loop_guard.rs | 1 | //! Tool loop detection for the agent execution loop. | COMMENT |
| LOW | crates/openfang-runtime/src/agent_context.rs | 1 | //! Per-turn agent context loader for external `context.md` files. | COMMENT |
| LOW | crates/openfang-runtime/src/agent_context.rs | 21 | /// Maximum size of `context.md` to inject into the prompt (32 KB). | COMMENT |
| LOW | crates/openfang-runtime/src/command_lane.rs | 1 | //! Command lane system — lane-based command queue with concurrency control. | COMMENT |
| LOW | crates/openfang-runtime/src/tool_policy.rs | 1 | //! Multi-layer tool policy resolution. | COMMENT |
| LOW | crates/openfang-runtime/src/tool_runner.rs | 21 | /// Check if a tool name refers to a shell execution tool. | COMMENT |
| LOW | crates/openfang-runtime/src/tool_runner.rs | 3321 | "container_id": container.container_id, | COMMENT |
| LOW | crates/openfang-runtime/src/tool_runner.rs | 4621 | // Cleanup | COMMENT |
| LOW | crates/openfang-runtime/src/workspace_sandbox.rs | 1 | //! Workspace filesystem sandboxing. | COMMENT |
| LOW | crates/openfang-runtime/src/sandbox.rs | 1 | //! WASM sandbox for secure skill/plugin execution. | COMMENT |
| LOW | crates/openfang-runtime/src/shell_bleed.rs | 1 | //! Shell bleed detection — scan script files for environment variable leaks. | COMMENT |
| LOW | crates/openfang-runtime/src/browser.rs | 1 | //! Native browser automation via Chrome DevTools Protocol (CDP). | COMMENT |
| 217 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | CLAUDE.md | 26 | #### Step 1: Stop any running daemon | COMMENT |
| LOW⚡ | CLAUDE.md | 34 | #### Step 2: Build fresh release binary | COMMENT |
| LOW⚡ | CLAUDE.md | 39 | #### Step 3: Start daemon with required API keys | COMMENT |
| LOW⚡ | CLAUDE.md | 47 | #### Step 4: Test every new endpoint | COMMENT |
| LOW | CLAUDE.md | 62 | #### Step 5: Test real LLM integration | COMMENT |
| LOW⚡ | CLAUDE.md | 73 | #### Step 6: Verify side effects | COMMENT |
| LOW⚡ | CLAUDE.md | 80 | #### Step 7: Verify dashboard HTML | COMMENT |
| LOW⚡ | CLAUDE.md | 87 | #### Step 8: Cleanup | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 369 | ### Step 1: Extract the clip | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 374 | ### Step 2: Crop to vertical (9:16) | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 383 | ### Step 3: Generate SRT captions from transcript | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 454 | ### Step 1: Check settings | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 461 | ### Step 2: Validate credentials | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 516 | ### Step 5: Rate limiting | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 522 | ### Step 6: Publishing summary | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 400 | ### Step 4: Burn captions onto the clip | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 439 | ### Step 5: Generate thumbnail | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 473 | ### Step 3: Publish to Telegram | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 489 | ### Step 4: Publish to WhatsApp | COMMENT |
| LOW | crates/openfang-hands/bundled/trader/HAND.toml | 396 | ### Step 1: Build the BULL Case | COMMENT |
| LOW | crates/openfang-hands/bundled/trader/HAND.toml | 409 | ### Step 2: Build the BEAR Case | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/trader/HAND.toml | 422 | ### Step 3: Cognitive Bias Check | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/trader/HAND.toml | 430 | ### Step 4: Synthesis & Final Signal | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 55 | // Step 1: SSRF protection — BEFORE any network I/O | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 58 | // Step 2: Cache lookup (only for GET) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 67 | // Step 3: Build request with configured method | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 127 | // Step 4: For GET requests, detect HTML and convert to Markdown. | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 143 | // Step 5: Truncate (char-boundary-safe to avoid panics on multi-byte UTF-8) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 154 | // Step 6: Wrap with external content markers | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 160 | // Step 7: Cache (only GET responses) | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 392 | // Step 1: Merge consecutive same-role turns | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 404 | // Step 2: Drop orphaned functionCall parts from model turns. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 443 | // Step 3: Drop orphaned functionResponse parts from user turns. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/gemini.rs | 473 | // Step 4: Remove turns that ended up empty after filtering | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/gemini.rs | 476 | // Step 5: Final merge pass (removing parts may have created new consecutive same-role) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 751 | // Step 1: Request device code. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 754 | // Step 2: Tell the user what to do + try to open browser. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 767 | // Step 3: Poll for authorization. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 770 | // Step 4: Persist. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 561 | // Step 1: remove toolResult blocks whose ID is not in the assistant's toolUse set. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 582 | // Step 2: deduplicate — keep only the first toolResult block per tool_use_id. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 605 | // Step 3: insert a synthetic error result for any toolUse ID with no result. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 626 | // Step 4: if all blocks were removed and nothing was inserted, the message is | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 931 | // Step 1: API delivers a thinking block with signature | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 951 | // Step 2: Verify the signature reached the ContentBlock | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 965 | // Step 3: Now feed the assistant turn back into the driver as if | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 997 | // Step 4: Verify on-the-wire JSON shape (`type=thinking`, `signature` present). | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 1076 | // Step 1: API delivers a response with a redacted_thinking block. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/anthropic.rs | 1095 | // Step 2: The opaque blob must reach the ContentBlock layer. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/anthropic.rs | 1103 | // Step 3: Resubmit the assistant turn as conversation history. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 1128 | // Step 4: On-the-wire JSON shape (`type=redacted_thinking`, `data` present). | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2204 | // Step 1: parse server response shape. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2217 | // Step 2: simulate the driver building blocks (mirrors the live | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2232 | // Step 3: replay through the outbound path. | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6839 | // Step 2: Confirm | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6849 | // Step 3: Stop running daemon | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6864 | // Step 4: Remove auto-start entries | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6868 | // Step 5: Clean PATH from shell configs | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6875 | // Step 6: Remove ~/.openfang/ data | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6888 | // Step 7: Remove cargo bin copy if it exists and is separate from current exe | COMMENT |
| 26 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 369 | ### Step 1: Extract the clip | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 374 | ### Step 2: Crop to vertical (9:16) | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 383 | ### Step 3: Generate SRT captions from transcript | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 454 | ### Step 1: Check settings | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 461 | ### Step 2: Validate credentials | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 516 | ### Step 5: Rate limiting | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/clip/HAND.toml | 522 | ### Step 6: Publishing summary | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 400 | ### Step 4: Burn captions onto the clip | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 439 | ### Step 5: Generate thumbnail | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 473 | ### Step 3: Publish to Telegram | COMMENT |
| LOW | crates/openfang-hands/bundled/clip/HAND.toml | 489 | ### Step 4: Publish to WhatsApp | COMMENT |
| LOW | crates/openfang-hands/bundled/trader/HAND.toml | 396 | ### Step 1: Build the BULL Case | COMMENT |
| LOW | crates/openfang-hands/bundled/trader/HAND.toml | 409 | ### Step 2: Build the BEAR Case | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/trader/HAND.toml | 422 | ### Step 3: Cognitive Bias Check | COMMENT |
| LOW⚡ | crates/openfang-hands/bundled/trader/HAND.toml | 430 | ### Step 4: Synthesis & Final Signal | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 55 | // Step 1: SSRF protection — BEFORE any network I/O | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 58 | // Step 2: Cache lookup (only for GET) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 67 | // Step 3: Build request with configured method | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 127 | // Step 4: For GET requests, detect HTML and convert to Markdown. | COMMENT |
| LOW | crates/openfang-runtime/src/web_fetch.rs | 143 | // Step 5: Truncate (char-boundary-safe to avoid panics on multi-byte UTF-8) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 154 | // Step 6: Wrap with external content markers | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/web_fetch.rs | 160 | // Step 7: Cache (only GET responses) | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 392 | // Step 1: Merge consecutive same-role turns | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 404 | // Step 2: Drop orphaned functionCall parts from model turns. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/gemini.rs | 443 | // Step 3: Drop orphaned functionResponse parts from user turns. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/gemini.rs | 473 | // Step 4: Remove turns that ended up empty after filtering | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/gemini.rs | 476 | // Step 5: Final merge pass (removing parts may have created new consecutive same-role) | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 751 | // Step 1: Request device code. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 754 | // Step 2: Tell the user what to do + try to open browser. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 767 | // Step 3: Poll for authorization. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/copilot.rs | 770 | // Step 4: Persist. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 561 | // Step 1: remove toolResult blocks whose ID is not in the assistant's toolUse set. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 582 | // Step 2: deduplicate — keep only the first toolResult block per tool_use_id. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 605 | // Step 3: insert a synthetic error result for any toolUse ID with no result. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/bedrock.rs | 626 | // Step 4: if all blocks were removed and nothing was inserted, the message is | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 931 | // Step 1: API delivers a thinking block with signature | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 951 | // Step 2: Verify the signature reached the ContentBlock | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 965 | // Step 3: Now feed the assistant turn back into the driver as if | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 997 | // Step 4: Verify on-the-wire JSON shape (`type=thinking`, `signature` present). | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 1076 | // Step 1: API delivers a response with a redacted_thinking block. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/anthropic.rs | 1095 | // Step 2: The opaque blob must reach the ContentBlock layer. | COMMENT |
| LOW⚡ | crates/openfang-runtime/src/drivers/anthropic.rs | 1103 | // Step 3: Resubmit the assistant turn as conversation history. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/anthropic.rs | 1128 | // Step 4: On-the-wire JSON shape (`type=redacted_thinking`, `data` present). | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2204 | // Step 1: parse server response shape. | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2217 | // Step 2: simulate the driver building blocks (mirrors the live | COMMENT |
| LOW | crates/openfang-runtime/src/drivers/openai.rs | 2232 | // Step 3: replay through the outbound path. | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6839 | // Step 2: Confirm | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6849 | // Step 3: Stop running daemon | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6864 | // Step 4: Remove auto-start entries | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6868 | // Step 5: Clean PATH from shell configs | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6875 | // Step 6: Remove ~/.openfang/ data | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6888 | // Step 7: Remove cargo bin copy if it exists and is separate from current exe | COMMENT |
| LOW⚡ | crates/openfang-cli/src/main.rs | 6896 | // Step 8: Remove the binary itself (must be last) | COMMENT |
| LOW | crates/openfang-cli/src/main.rs | 6800 | // Step 1: Show what will be removed | COMMENT |
| LOW | crates/openfang-cli/src/tui/screens/init_wizard.rs | 891 | // Step 1: request device code | COMMENT |
| LOW | crates/openfang-cli/src/tui/screens/init_wizard.rs | 913 | // Step 2: poll for token | COMMENT |
| LOW | crates/openfang-cli/src/tui/screens/init_wizard.rs | 937 | // Step 3: fetch models | COMMENT |
| LOW⚡ | crates/openfang-api/static/js/pages/wizard.js | 21 | // Step 2: Provider setup | COMMENT |
| LOW⚡ | crates/openfang-api/static/js/pages/wizard.js | 30 | // Step 3: Agent creation | COMMENT |
| LOW | crates/openfang-api/static/js/pages/wizard.js | 148 | // Step 3: Category filtering | COMMENT |
| 18 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | crates/openfang-api/tests/api_integration_test.rs | 937 | state.kernel.config.auth.password_hash.clone() | CODE |
| CRITICAL | crates/openfang-api/src/server.rs | 154 | state.kernel.config.auth.password_hash.clone() | CODE |
| CRITICAL | crates/openfang-api/src/routes.rs | 5455 | && !state.kernel.config.network.shared_secret.is_empty(); | CODE |
| CRITICAL | crates/openfang-api/src/routes.rs | 7735 | state.kernel.config.default_model.provider.clone(), | CODE |
| CRITICAL | crates/openfang-api/src/routes.rs | 7736 | state.kernel.config.default_model.api_key_env.clone(), | CODE |
| CRITICAL | crates/openfang-api/src/ws.rs | 332 | state.kernel.config.auth.password_hash.clone() | CODE |
| CRITICAL | crates/openfang-kernel/src/kernel.rs | 2515 | ssrf_allowed_hosts: self.config.web.fetch.ssrf_allowed_hosts.clone(), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/openfang-cli/src/main.rs | 199 | /// What to scaffold. | COMMENT |
| MEDIUM | crates/openfang-cli/src/main.rs | 364 | /// Create a new skill scaffold. | COMMENT |
| MEDIUM | crates/openfang-types/src/agent.rs | 69 | /// Autonomous agent configuration — guardrails for 24/7 agents. | COMMENT |
| MEDIUM | crates/openfang-types/src/agent.rs | 471 | /// Autonomous agent configuration — guardrails for 24/7 agents. | COMMENT |
| MEDIUM | crates/openfang-types/src/agent.rs | 480 | /// agent's working directory and will NOT scaffold private state files | COMMENT |
| MEDIUM | crates/openfang-extensions/src/installer.rs | 221 | /// Generate scaffold files for a new custom integration. | COMMENT |
| MEDIUM | crates/openfang-extensions/src/installer.rs | 263 | /// Generate scaffold files for a new skill. | STRING |
| MEDIUM | crates/openfang-kernel/src/kernel.rs | 9343 | /// existing directory like `~/Documents`, the runtime must NOT scaffold | COMMENT |
| MEDIUM | docs/agent-templates.md | 401 | # "Write a blog post about the benefits of agent-based architectures" | COMMENT |
| MEDIUM | docs/troubleshooting.md | 696 | ### How do I configure the embedding model for memory? | COMMENT |
| MEDIUM | docs/skill-development.md | 487 | # Create a new skill scaffold (interactive) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | crates/openfang-runtime/src/media_understanding.rs | 238 | description: "[Video description would be generated by Gemini]".to_string(), | CODE |
| HIGH | crates/openfang-runtime/src/web_search.rs | 207 | // Include AI-generated answer if available | COMMENT |
| HIGH | crates/openfang-types/src/config.rs | 286 | /// Include AI-generated answer summary. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/openfang-hands/bundled/lead/SKILL.md | 177 | "Jane Smith","VP Engineering","Acme Corp","https://acme.com","https://linkedin.com/in/janesmith","SaaS","SMB (120 employ | CODE |
| LOW | crates/openfang-hands/bundled/lead/SKILL.md | 186 | "company": "Acme Corp", | CODE |
| LOW | crates/openfang-runtime/src/routing.rs | 184 | model: "placeholder".to_string(), | CODE |
| LOW | crates/openfang-memory/src/knowledge.rs | 318 | name: "Acme Corp".to_string(), | CODE |
| LOW | crates/openfang-memory/src/knowledge.rs | 344 | assert_eq!(matches[0].target.name, "Acme Corp"); | CODE |
| LOW | crates/openfang-types/src/approval.rs | 508 | decided_by: Some("admin@example.com".into()), | CODE |
| LOW | crates/openfang-types/src/approval.rs | 514 | assert_eq!(back.decided_by, Some("admin@example.com".into())); | CODE |
| LOW | crates/openfang-api/static/i18n/i18n.js | 99 | if (el.hasAttribute('placeholder')) { | CODE |
| LOW | crates/openfang-api/src/routes.rs | 2412 | "placeholder": f.placeholder, | CODE |
| LOW | crates/openfang-channels/src/xmpp.rs | 231 | platform_id: "user@example.com".to_string(), | CODE |
| LOW | crates/openfang-channels/src/email.rs | 598 | assert_eq!(extract_email_addr("user@example.com"), "user@example.com"); | CODE |
| LOW | crates/openfang-channels/src/linkedin.rs | 440 | "fromName": "Jane Doe", | CODE |
| LOW | crates/openfang-channels/src/linkedin.rs | 449 | assert_eq!(name, "Jane Doe"); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/troubleshooting.md | 434 | curl -H "Authorization: Bearer your-api-key" http://127.0.0.1:4200/api/agents | CODE |
| HIGH | docs/api-reference.md | 39 | Authorization: Bearer <your-api-key> | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test_vertex_e2e.py | 87 | except Exception as e: | CODE |
| LOW | test_vertex_e2e.py | 156 | except Exception as e: | CODE |
| MEDIUM | test_vertex_e2e.py | 12 | def test_vertex_ai(): | CODE |
| LOW | agents/langchain-code-reviewer/server.py | 158 | except Exception as e: | CODE |
| LOW | docs/skill-development.md | 253 | except Exception as e: | CODE |
| LOW | sdk/python/openfang_sdk.py | 120 | except Exception as e: | CODE |
| LOW | sdk/python/openfang_sdk.py | 128 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | sdk/python/openfang_client.py | 10 | # Create an agent | STRING |
| MEDIUM | sdk/python/examples/client_basic.py | 25 | # Create a new agent from the "assistant" template | COMMENT |
| MEDIUM | sdk/python/examples/client_streaming.py | 17 | # Create an agent | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/openfang-hands/bundled/researcher/HAND.toml | 168 | system_prompt = """You are Researcher Hand — an autonomous deep research agent that conducts exhaustive investigations, | CODE |
| MEDIUM | crates/openfang-channels/src/router.rs | 779 | // leverage line in the patch from issue #1127. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test_vertex_e2e.py | 7 | CODE | |
| LOW | agents/langchain-code-reviewer/server.py | 20 | CODE | |
| LOW | agents/langchain-code-reviewer/server.py | 20 | CODE | |
| LOW | sdk/python/openfang_client.py | 31 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test_vertex_e2e.py | 91 | CODE | |
| LOW | sdk/python/openfang_client.py | 82 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/openfang-api/static/js/pages/wizard.js | 5 | function wizardTomlMultilineEscape(s) { | CODE |