GitNexus: The Zero-Server Code Intelligence Engine
This report summarizes scanner evidence for abhigyanpatwari/GitNexus, a TypeScript project with 47,825 GitHub stars. SynthScan examined 961,862 lines of code across 2864 source files, recording 5205 pattern matches distributed across 22 syntactic categories. The legacy adjusted pattern signal is 9.5 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3260 finding(s).
Are imports declared and package/API names verified? 187 finding(s).
Are wrappers, guards, and repeated structures necessary? 3747 finding(s).
Which changes need focused human review? 5205 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 5205 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | gitnexus-shared/src/index.ts | 43 | // ─── Scope-based resolution — RFC #909 (Ring 1 #910) ──────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/index.ts | 43 | // ─── Scope-based resolution — RFC #909 (Ring 1 #910) ──────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/graph/types.ts | 232 | // ── Taint/PDG substrate (issue #2080) ──────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/graph/types.ts | 232 | // ── Taint/PDG substrate (issue #2080) ──────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/integrations/circuit-breaker.ts | 250 | // ─── Per-process registry ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …tnexus-shared/src/scope-resolution/resolve-type-ref.ts | 46 | // ─── Public contracts ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …tnexus-shared/src/scope-resolution/resolve-type-ref.ts | 59 | // ─── Strict policy constants ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …tnexus-shared/src/scope-resolution/resolve-type-ref.ts | 101 | // ─── Main entry point ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/module-scope-index.ts | 57 | // ─── Internal ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 31 | // ─── §2.1 Type aliases ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 61 | // ─── Range + Capture (parser-agnostic) ────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 94 | // ─── Hook input/output types (RFC §5.2) ───────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 522 | // ─── §2.4 ImportEdge ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 591 | // ─── §2.3 BindingRef ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 616 | // ─── §2.5 TypeRef ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 677 | // ─── §2.2 Scope ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 771 | // ─── §2.6 Resolution + ResolutionEvidence ─────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 812 | // ─── §2.7 Reference + ReferenceIndex ──────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/types.ts | 862 | // ─── §4.1 LookupParams ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …s-shared/src/scope-resolution/method-dispatch-index.ts | 33 | // ─── Public contracts ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …s-shared/src/scope-resolution/method-dispatch-index.ts | 112 | // ─── Builder ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …s-shared/src/scope-resolution/method-dispatch-index.ts | 164 | // ─── Internal ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …tnexus-shared/src/scope-resolution/evidence-weights.ts | 19 | // ─── Where-found signals (visibility) ───────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …tnexus-shared/src/scope-resolution/evidence-weights.ts | 31 | // ─── Scope-chain deduction (per-hop) ────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …tnexus-shared/src/scope-resolution/evidence-weights.ts | 35 | // ─── Receiver-type-binding signal (decays by MRO depth) ─────────────────── | COMMENT |
| MEDIUM⚡ | …tnexus-shared/src/scope-resolution/evidence-weights.ts | 44 | // ─── Corroborating signals ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …tnexus-shared/src/scope-resolution/evidence-weights.ts | 51 | // ─── Arity compatibility (from `provider.arityCompatibility`) ───────────── | COMMENT |
| MEDIUM⚡ | …tnexus-shared/src/scope-resolution/evidence-weights.ts | 60 | // ─── Global fallback (only when nothing lexically visible) ──────────────── | COMMENT |
| MEDIUM⚡ | …tnexus-shared/src/scope-resolution/evidence-weights.ts | 66 | // ─── Degraded signals ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …tnexus-shared/src/scope-resolution/evidence-weights.ts | 70 | // ─── Unresolved-import cap (multiplicative, applied per-signal) ─────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/position-index.ts | 87 | // ─── Internals ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 38 | // ─── Public contracts ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 258 | // ─── Entry point ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 473 | // ─── Internal: edge drafting (phase 0) ────────────────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 690 | // ─── Internal: per-edge finalization (phase 3) ───────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 778 | // ─── Internal: re-export closure (phase 2.5) ─────────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 1601 | // ─── Internal: wildcard expansion (phase 4) ──────────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 1685 | // ─── Internal: bindings materialization (phase 5) ─────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 1791 | // ─── Internal: Tarjan SCC ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …us-shared/src/scope-resolution/qualified-name-index.ts | 75 | // ─── Internal ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/def-index.ts | 47 | // ─── Internal ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/scope-tree.ts | 31 | // ─── Public contract ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/scope-tree.ts | 50 | // ─── Build errors ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/scope-tree.ts | 73 | // ─── Builder ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/scope-tree.ts | 86 | // ── Pass 1: collect by id + duplicate check ─────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/scope-tree.ts | 97 | // ── Pass 2: validate parent pointers + build children buckets ───────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/scope-tree.ts | 137 | // ── Pass 3: sibling-overlap check ───────────────────────────────────── | COMMENT |
| MEDIUM | gitnexus-shared/src/scope-resolution/scope-tree.ts | 165 | // ─── Internals ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …xus-shared/src/scope-resolution/registries/evidence.ts | 29 | // ── Where-found ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …xus-shared/src/scope-resolution/registries/evidence.ts | 37 | // ── Type-binding path ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …xus-shared/src/scope-resolution/registries/evidence.ts | 41 | // ── Corroborators ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …xus-shared/src/scope-resolution/registries/evidence.ts | 47 | // ── Arity ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …xus-shared/src/scope-resolution/registries/evidence.ts | 50 | // ── Dynamic-unresolved passthrough ───────────────────────────────────── | COMMENT |
| MEDIUM | …xus-shared/src/scope-resolution/registries/evidence.ts | 65 | // ── Where-found visibility ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …xus-shared/src/scope-resolution/registries/evidence.ts | 92 | // ── Type-binding / MRO path ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …xus-shared/src/scope-resolution/registries/evidence.ts | 101 | // ── Owner match (explanatory for debug) ──────────────────────────────── | COMMENT |
| MEDIUM | …xus-shared/src/scope-resolution/registries/evidence.ts | 115 | // ── Arity ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …xus-shared/src/scope-resolution/registries/evidence.ts | 130 | // ── Dynamic-unresolved (degraded signal) ─────────────────────────────── | COMMENT |
| MEDIUM | …xus-shared/src/scope-resolution/registries/evidence.ts | 153 | // ─── Internal ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …exus-shared/src/scope-resolution/registries/context.ts | 24 | // ─── Provider hooks consumed by the registries ───────────────────────────── | COMMENT |
| 1640 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | gitnexus-shared/src/impact-risk.ts | 67 | function countsWithUnmeasuredAxesZeroed( | CODE |
| LOW | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 1182 | function collectAmbiguousWildcards( | CODE |
| LOW | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 1230 | function collectAmbiguousReexports( | CODE |
| LOW | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 1539 | function indexTopLevelExportsByName( | CODE |
| LOW | …s-shared/src/scope-resolution/registries/tie-breaks.ts | 46 | export function compareByConfidenceWithTiebreaks( | CODE |
| LOW | …-shared/src/scope-resolution/registries/lookup-core.ts | 454 | function seedFromOwnerScopedContributor( | CODE |
| LOW | gitnexus/test/unit/ai-context-read-path-must.test.ts | 17 | function assertNoAdvisoryExploreUse(content: string): void { | CODE |
| LOW | gitnexus/test/unit/call-attribution-issue-1166.test.ts | 758 | function definedJsScopeFunctionNames(code: string): string[] { | CODE |
| LOW | gitnexus/test/unit/lbug-adapter-wal-schema.test.ts | 41 | async function mockLbugConfigForStorageVersion(overrides: Record<string, unknown>) { | CODE |
| LOW | gitnexus/test/unit/skip-git-cli.test.ts | 220 | function expectCoolioRegistryEntry() { | CODE |
| LOW | gitnexus/test/unit/shipped-skills-sync.test.ts | 74 | function discoverStandardSkillNames(): string[] { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 123 | async function setupSpringBeanIncrementalRepo() { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 139 | async function setupJavaEnumHeritageIncrementalRepo() { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 157 | async function setupKotlinSpringBeanIncrementalRepo() { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 181 | async function setupSpringAopIncrementalRepo() { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 222 | async function setupSpringBeanFactoryIncrementalRepo() { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 242 | async function setupSpringConfigIncrementalRepo() { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 252 | async function setupKotlinSpringConfigConsumerIncrementalRepo() { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 270 | async function readWildcardServiceAnnotations(repoPath: string): Promise<string[]> { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 288 | async function readSpringConfigPropertyNames(repoPath: string): Promise<string[]> { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 303 | async function readKotlinConfigConsumerState(repoPath: string): Promise<{ | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 329 | async function readActuatorSnapshotLeakRows( | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 351 | async function readRuntimePropertyEvidence(repoPath: string): Promise<{ | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 376 | async function countStatusImplementsNamed(repoPath: string): Promise<number> { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 391 | async function deleteStatusImplementsNamed(repoPath: string): Promise<void> { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 424 | async function countSpringAutoConfigurationDeclarations(repoPath: string): Promise<number> { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 440 | async function countSpringBeanFactoryDeclarations(repoPath: string): Promise<number> { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 455 | async function countSpringAutoConfigurationSyntheticClasses(repoPath: string): Promise<number> { | CODE |
| LOW | gitnexus/test/unit/incremental-orchestration.test.ts | 513 | function assertSpringAopSnapshotShape( | CODE |
| LOW | …exus/test/unit/dockerfile-runtime-asset-parity.test.ts | 44 | function runtimeStageCopiedSources(dockerfile: string): string[] { | CODE |
| LOW | …exus/test/unit/dockerfile-runtime-asset-parity.test.ts | 320 | function shippedAssetRequiredAssets(copiedSources: string[]): { asset: string; source: string }[] { | CODE |
| LOW | gitnexus/test/unit/hooks.test.ts | 132 | function resolveHostGuardForReapingTests(): string | null { | CODE |
| LOW | gitnexus/test/unit/hooks.test.ts | 154 | function writeSelfTestingGuardWithMarkers( | CODE |
| LOW | gitnexus/test/unit/hooks.test.ts | 294 | function findRegisteredRepoForTest(cwd: string) { | CODE |
| LOW | gitnexus/test/unit/eval-server-bind-restriction.test.ts | 11 | function isEvalServerBindRestriction(stderr: string): boolean { | CODE |
| LOW | gitnexus/test/unit/incremental-dirty-recovery.test.ts | 38 | async function parkCrashSidecarsAndRebuild(options?: { alwaysSpill?: boolean }) { | CODE |
| LOW | gitnexus/test/unit/onnxruntime-node-resolver.test.ts | 457 | function loadRedirectActiveResolver(registerHooksSpy: unknown) { | CODE |
| LOW | gitnexus/test/unit/receiver-extraction.test.ts | 52 | function extractExpressRouteReceivers(parser: Parser, code: string) { | CODE |
| LOW | gitnexus/test/unit/cli-index-help.test.ts | 78 | function extractRegisteredHelpDescriptions(): string[] { | CODE |
| LOW | gitnexus/test/unit/objective-c-provider.test.ts | 96 | function legacyResolveObjectiveCImportTarget( | CODE |
| LOW | gitnexus/test/unit/tree-sitter-queries.test.ts | 21 | function capturedDefinitionFunctionNames( | CODE |
| LOW⚡ | gitnexus/test/unit/spring-bean-extractor.test.ts | 100 | function captureKotlinClassAnnotations(code: string): KotlinCaptureSideChannel['classAnnotations'] { | CODE |
| LOW⚡ | gitnexus/test/unit/spring-bean-extractor.test.ts | 106 | function captureKotlinSpringDiFacts( | CODE |
| LOW⚡ | gitnexus/test/unit/spring-bean-extractor.test.ts | 114 | function collectKotlinSpringNonHttpHandlerFactsFromSource( | CODE |
| LOW | gitnexus/test/unit/review-agent-workflow.test.ts | 415 | function reviewTranscriptWithoutTools(): Array<Record<string, unknown>> { | CODE |
| LOW | gitnexus/test/unit/group/http-route-extractor.test.ts | 3002 | def unrelated_scope_collision(): | CODE |
| LOW | gitnexus/test/unit/group/http-route-extractor.test.ts | 3006 | def module_scope_shadow_collision(): | CODE |
| LOW | …tnexus/test/unit/group/sync-partial-extraction.test.ts | 197 | function isStagingBufferDeclaration(node: t.Node): node is t.VariableDeclarator { | CODE |
| LOW | gitnexus/test/unit/call-routing/ruby.test.ts | 55 | function makeRequireCallNodeNoContent(): MockNode { | CODE |
| LOW | …est/unit/import-resolvers/csharp-csproj-parity.test.ts | 84 | function legacyResolveCSharpImportInternal( | CODE |
| LOW⚡ | …it/scope-resolution/import-target-index-parity.test.ts | 79 | function legacyFindRootPackageFiles(allFilePaths: ReadonlySet<string>): string[] { | CODE |
| LOW | …it/scope-resolution/import-target-index-parity.test.ts | 90 | function legacyFindAllFilesInPkgDir(allFilePaths: ReadonlySet<string>, pkgPath: string): string[] { | CODE |
| LOW | …it/scope-resolution/import-target-index-parity.test.ts | 106 | function legacyResolveGoImportTarget( | CODE |
| LOW | …it/scope-resolution/import-target-index-parity.test.ts | 132 | function legacyResolveDartRelative( | CODE |
| LOW | …it/scope-resolution/import-target-index-parity.test.ts | 153 | function legacyResolveDartImportTarget( | CODE |
| LOW | …it/scope-resolution/import-target-index-parity.test.ts | 185 | function legacyResolveRubyRelative( | CODE |
| LOW | …it/scope-resolution/import-target-index-parity.test.ts | 206 | function legacyResolveRubyImportTarget( | CODE |
| LOW | …it/scope-resolution/import-target-index-parity.test.ts | 261 | function legacyResolveByProgressiveStripping( | CODE |
| LOW | …it/scope-resolution/import-target-index-parity.test.ts | 288 | function legacyResolveCsharpNoCsproj( | CODE |
| LOW | …it/scope-resolution/cobol-import-target-parity.test.ts | 62 | function legacyResolveCobolImportTarget( | CODE |
| 1924 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | render.yaml | 1 | # yaml-language-server: $schema=https://render.com/schema/render.yaml.json | COMMENT |
| LOW | render.yaml | 21 | # optional and unset by this Blueprint; the public edge token on the | COMMENT |
| LOW | gitnexus-shared/src/scope-resolution/reference-site.ts | 41 | // An identifier in object-literal property-value position | COMMENT |
| LOW | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 541 | fromScope, | COMMENT |
| LOW | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 1321 | COMMENT | |
| LOW | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 1441 | topLevelOnly: boolean = false, | COMMENT |
| LOW | …exus-shared/src/scope-resolution/finalize-algorithm.ts | 1661 | // here re-reports the pair as an initialization dependency and | COMMENT |
| LOW | …-shared/src/scope-resolution/registries/lookup-core.ts | 101 | ctx: RegistryContext, | COMMENT |
| LOW | gitnexus-claude-plugin/hooks/hook-lock.js | 61 | const now = readMarkerSnapshot(marker); | COMMENT |
| LOW | gitnexus-claude-plugin/hooks/hook-lock.js | 81 | // that has passed to another claimant is left alone; | COMMENT |
| LOW | deploy/kubernetes/cluster-image-policy.yaml | 1 | # Sigstore policy-controller ClusterImagePolicy for GitNexus container images. | COMMENT |
| LOW | deploy/kubernetes/cluster-image-policy.yaml | 21 | # kubectl label namespace <your-ns> policy.sigstore.dev/include=true | COMMENT |
| LOW | deploy/kubernetes/cluster-image-policy.yaml | 41 | # cover every `gitnexus:<tag>`, `gitnexus@sha256:...`, `gitnexus-web:<tag>`, | COMMENT |
| LOW | deploy/kubernetes/cluster-image-policy.yaml | 61 | url: https://fulcio.sigstore.dev | COMMENT |
| LOW | gitnexus-factory-plugin/hooks/hook-lock.js | 61 | const now = readMarkerSnapshot(marker); | COMMENT |
| LOW | gitnexus-factory-plugin/hooks/hook-lock.js | 81 | // that has passed to another claimant is left alone; | COMMENT |
| LOW | .devcontainer/post-create.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .devcontainer/post-create.sh | 21 | # | COMMENT |
| LOW | .devcontainer/post-create.sh | 61 | [ -f /home/node/.claude-mem/.claude-mem-seeded ] || DIRS+=(/home/node/.claude-mem) | COMMENT |
| LOW | .devcontainer/post-create.sh | 101 | # single config files, and single files can't be bind-mounted on Windows | COMMENT |
| LOW | .devcontainer/post-create.sh | 141 | # Seed $HOME/.claude.json from the host, but NOT as a straight copy. That file | COMMENT |
| LOW | .devcontainer/post-create.sh | 161 | # config is copied correctly. If `cursor-agent` reports auth errors after the | COMMENT |
| LOW | .devcontainer/post-create.sh | 181 | sync_from_host /host/.config/gh/config.yml /home/node/.config/gh/config.yml 644 | COMMENT |
| LOW | .devcontainer/post-create.sh | 241 | node "$SCRIPT_DIR/translate-plugin-registries.cjs" "${TRANSLATE_CLIS[@]}" | COMMENT |
| LOW | .devcontainer/post-create.sh | 261 | COMMENT | |
| LOW | .devcontainer/post-create.sh | 281 | # truncated file and treat the store as "already seeded", sticking the container | COMMENT |
| LOW | .devcontainer/install-deps.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .devcontainer/install-deps.sh | 21 | # | COMMENT |
| LOW | .devcontainer/install-deps.sh | 41 | # On Docker Desktop for Windows, the bind-mount permission translation won't let | COMMENT |
| LOW | .devcontainer/devcontainer.json | 1 | // Devcontainer for GitNexus. It pre-installs Claude Code, the OpenAI Codex | COMMENT |
| LOW | .devcontainer/devcontainer.json | 21 | // To bump: pick a tag from github.com/oven-sh/bun/releases and update | COMMENT |
| LOW | .devcontainer/devcontainer.json | 41 | "ghcr.io/devcontainers/features/github-cli:1": {} | COMMENT |
| LOW | .devcontainer/devcontainer.json | 61 | // skill, agent, command, or plugin onto the host for the next host session | COMMENT |
| LOW | .devcontainer/devcontainer.json | 81 | // docker). gh and docker are read-only so a compromised dependency can't | COMMENT |
| LOW | .devcontainer/devcontainer.json | 101 | // That separation is the point: the `docker volume rm <cli>-config-*` | COMMENT |
| LOW | .devcontainer/devcontainer.json | 121 | // mount precedence is: the more specific path wins. | COMMENT |
| LOW | .devcontainer/devcontainer.json | 141 | // claude-mem ran on the host and in the container against the same DB at | COMMENT |
| LOW | .devcontainer/devcontainer.json | 161 | // KEEP IN SYNC: if you add/rename/remove a session sub-path, update all | COMMENT |
| LOW | .devcontainer/devcontainer.json | 181 | // sidecar, so there is no cross-filesystem single-file hazard. projects/ | COMMENT |
| LOW | .devcontainer/devcontainer.json | 201 | // "source=${localEnv:HOME}/.cursor/chats,target=/home/node/.cursor/chats,type=bind", | COMMENT |
| LOW | .devcontainer/devcontainer.json | 221 | COMMENT | |
| LOW | .devcontainer/devcontainer.json | 241 | // container's Linux paths, also seed-once, alongside the cache/ copy so | COMMENT |
| LOW | .devcontainer/devcontainer.json | 261 | "source=${localEnv:HOME}/.config/git,target=/home/node/.config/git,type=bind,readonly", | COMMENT |
| LOW | .devcontainer/devcontainer.json | 281 | "source=${localWorkspaceFolderBasename}-gitnexus-node-modules-${devcontainerId},target=/workspace/gitnexus/node_modu | COMMENT |
| LOW | .devcontainer/devcontainer.json | 301 | // CLAUDE_CONFIG_DIR is left unset on purpose. The Claude default is | COMMENT |
| LOW | .devcontainer/devcontainer.json | 361 | }, | COMMENT |
| LOW | gitnexus/vitest.config.ts | 141 | // Publication reconciliation uses real native COPY/checkpoints. | COMMENT |
| LOW | gitnexus/test/unit/process-processor.test.ts | 661 | // deep branch declared AFTER enough shallow ones is not reached. That is a | COMMENT |
| LOW | …test/unit/incremental-index-extension-dml-gate.test.ts | 541 | ), | COMMENT |
| LOW | gitnexus/test/unit/git-clone.test.ts | 621 | COMMENT | |
| LOW | gitnexus/test/unit/ignore-service.test.ts | 281 | // `.gitignore`-style negation against the hardcoded DEFAULT_IGNORE_LIST. | COMMENT |
| LOW | gitnexus/test/unit/call-attribution-issue-1166.test.ts | 701 | // `Function:found -> predicate` even though `found` is the Array#find | COMMENT |
| LOW | gitnexus/test/unit/spring-destinations-phase.test.ts | 401 | // THE regression. Three sites on one spelling of `orders`: a real Kafka | COMMENT |
| LOW | gitnexus/test/unit/hook-db-lock-probe.test.ts | 141 | }); | COMMENT |
| LOW | gitnexus/test/unit/hook-db-lock-probe.test.ts | 421 | { GITNEXUS_HOOK_PROC_CMDLINE_MAX: '4096' }, | COMMENT |
| LOW | gitnexus/test/unit/hook-db-lock-probe.test.ts | 521 | }); | COMMENT |
| LOW | gitnexus/test/unit/hook-db-lock-probe.test.ts | 581 | // ── D5: GITNEXUS_HOOK_PROC_ROOT is honored ONLY under a test runner (F4) ── | COMMENT |
| LOW | gitnexus/test/unit/hook-db-lock-probe.test.ts | 641 | expect(verdict).toBe('not-owned'); | COMMENT |
| LOW | gitnexus/test/unit/hook-db-lock-probe.test.ts | 881 | COMMENT | |
| LOW | gitnexus/test/unit/ai-context.test.ts | 341 | // template, so a real `gitnexus analyze` silently deleted them on every | COMMENT |
| 953 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | eval/run_eval.py | 177 | patch_output = env.execute({"command": "cd /testbed && git diff"}) | CODE |
| HIGH | eval/tool_registry.py | 30 | fallback='cd /testbed && npx gitnexus query "$query" 2>&1', | CODE |
| HIGH⚡ | eval/tool_registry.py | 41 | fallback='cd /testbed && npx gitnexus context "$name" 2>&1', | CODE |
| HIGH⚡ | eval/tool_registry.py | 50 | fallback='cd /testbed && npx gitnexus impact "$target" --direction "$direction" 2>&1', | CODE |
| HIGH⚡ | eval/tool_registry.py | 59 | fallback='cd /testbed && npx gitnexus cypher "$query" 2>&1', | CODE |
| HIGH⚡ | eval/tool_registry.py | 67 | fallback='cd /testbed && npx gitnexus list 2>&1', | CODE |
| HIGH⚡ | eval/tool_registry.py | 74 | fallback='cd /testbed && npx gitnexus augment "$1" 2>&1 || true', | CODE |
| HIGH⚡ | eval/tool_registry.py | 74 | fallback='cd /testbed && npx gitnexus augment "$1" 2>&1 || true', | CODE |
| HIGH | eval/workflow_bench/evolve.py | 1838 | "`cd gitnexus && npx vitest run test/unit/shipped-skills-sync.test.ts " | CODE |
| HIGH | eval/workflow_bench/provider_usage.py | 104 | """Absent, null, or non-numeric all read as unknown rather than zero.""" | STRING |
| HIGH | eval/environments/gitnexus_docker.py | 114 | check = self.execute({"command": "node --version 2>/dev/null || echo 'NOT_FOUND'"}) | CODE |
| HIGH | eval/environments/gitnexus_docker.py | 134 | check = self.execute({"command": "npx gitnexus --version 2>/dev/null || echo 'NOT_FOUND'"}) | CODE |
| HIGH | eval/environments/gitnexus_docker.py | 158 | "command": f"cd /testbed && npx gitnexus analyze . {skip_flag} 2>&1", | CODE |
| HIGH | eval/environments/gitnexus_docker.py | 193 | "command": f"curl -sf http://{health_host}:{self.eval_server_port}/health 2>/dev/null || echo 'NOT_READY | CODE |
| HIGH | eval/environments/gitnexus_docker.py | 236 | '-H "Content-Type: application/json" -d "$payload" 2>/dev/null)' | CODE |
| HIGH⚡ | eval/environments/gitnexus_docker.py | 278 | "command": "cd /testbed && basename $(git remote get-url origin 2>/dev/null || basename $(pwd)) .git" | CODE |
| HIGH⚡ | eval/environments/gitnexus_docker.py | 278 | "command": "cd /testbed && basename $(git remote get-url origin 2>/dev/null || basename $(pwd)) .git" | CODE |
| HIGH⚡ | eval/environments/gitnexus_docker.py | 280 | commit_result = self.execute({"command": "cd /testbed && git rev-parse HEAD 2>/dev/null || echo unknown"}) | CODE |
| HIGH⚡ | eval/environments/gitnexus_docker.py | 280 | commit_result = self.execute({"command": "cd /testbed && git rev-parse HEAD 2>/dev/null || echo unknown"}) | CODE |
| HIGH | eval/environments/gitnexus_docker.py | 348 | "command": "npx gitnexus list 2>/dev/null | grep -o '/root/.gitnexus/[^ ]*' | head -1 || echo '/root | CODE |
| HIGH | eval/environments/gitnexus_docker.py | 378 | "command": f"curl -sf -X POST http://127.0.0.1:{self.eval_server_port}/shutdown 2>/dev/null || true" | CODE |
| HIGH | eval/tests/test_proposer_sandbox.py | 180 | "process.env.GITNEXUS_BENCH_OPENAI_API_KEY ?? null," | CODE |
| HIGH | eval/tests/test_proposer_sandbox.py | 181 | "onnxInstall:process.env.ONNXRUNTIME_NODE_INSTALL ?? null," | CODE |
| HIGH | eval/tests/test_proposer_sandbox.py | 219 | "- `cd gitnexus && npm test` and `npx tsc --noEmit` verify the change.\n" | CODE |
| HIGH | eval/tests/test_proposer_sandbox.py | 435 | "test ! -e /workspace/.gitnexus/lbug && test ! -e /workspace/.gitnexus/run.cjs && " | CODE |
| HIGH | eval/tests/test_proposer_sandbox.py | 436 | "test ! -e /opt/gitnexus && test ! -e /opt/gitnexus-shared && test ! -e /opt/gitnexus-registry && " | CODE |
| HIGH | eval/tests/test_proposer_sandbox.py | 1237 | result = sandbox.run(["/bin/sh", "-c", "command -v npx && npx --version"], timeout=60) | CODE |
| HIGH | eval/tests/test_proposer_sandbox.py | 2170 | f"(printf x >> {SANDBOX_WORKSPACE}/tracked.txt 2>/dev/null && echo WORKSPACE-WRITABLE || echo workspace-read | CODE |
| HIGH | eval/tests/test_proposer_sandbox.py | 2170 | f"(printf x >> {SANDBOX_WORKSPACE}/tracked.txt 2>/dev/null && echo WORKSPACE-WRITABLE || echo workspace-read | CODE |
| HIGH⚡ | eval/tests/test_oracle_assets.py | 176 | raw = "git apply eval/workflow_bench/review_cases/pr.patch && rm -rf eval/workflow_bench" | CODE |
| HIGH | eval/tests/test_oracle_assets.py | 221 | "git apply eval/workflow_bench/review_cases/case.patch && rm -rf eval/workflow_bench" | CODE |
| HIGH | eval/agents/gitnexus_agent.py | 113 | "command": f'gitnexus-augment "{pattern}" 2>&1 || true', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | gitnexus/bench/import-target/baselines.json | 8 | "_fingerprint_note": "Per-language sha256 over every distinct fromFile|target -> resolved target. A change here is a B | CODE |
| MEDIUM | gitnexus/bench/import-target/baselines.json | 1157 | "_blind_spot": "MEASURED, so nobody has to rediscover it: a full workspace scan reintroduced on 1-in-32 imports passes | CODE |
| MEDIUM | gitnexus/bench/scope-capture/baselines.json | 105 | "_rebaselined_3502_nested_function_fixture": "#3502 adds the php-nested-function fixture used by the resolver regres | CODE |
| MEDIUM | gitnexus/test/unit/git-utils.test.ts | 362 | // the test is robust to platform path-format quirks (Windows 8.3 short | COMMENT |
| MEDIUM | gitnexus/test/unit/cli-commands.test.ts | 123 | // explicit and robust to a future tree-sitter change. | COMMENT |
| MEDIUM | gitnexus/test/unit/parser-loader-skip-optional.test.ts | 70 | // install-state-robust — C's native binding is intentionally fallible, so | COMMENT |
| MEDIUM | gitnexus/test/unit/parser-loader-skip-optional.test.ts | 81 | // Baseline (no skip) so the isolation check is install-state-robust. | COMMENT |
| MEDIUM | …tnexus/test/unit/group/php-guzzle-request-ctor.test.ts | 46 | // this sidesteps that entirely and is robust regardless of how the file | COMMENT |
| MEDIUM | gitnexus/test/unit/group/grpc-extractor.test.ts | 692 | // is robust against client-jar consumers and same-short-name | COMMENT |
| MEDIUM | …tnexus/test/unit/cfg/reaching-defs-equivalence.test.ts | 2 | * #2201 — differential equivalence harness for the reaching-defs solvers. | COMMENT |
| MEDIUM | gitnexus/test/integration/cli-e2e.test.ts | 1820 | // Derive the real uid + filePath from context so the test is robust to the | COMMENT |
| MEDIUM | gitnexus/test/integration/mcp/server-startup.test.ts | 274 | // path containing braces can never truncate the parse (more robust than | COMMENT |
| MEDIUM | gitnexus/src/core/ingestion/cfg/visitors/c-cpp.ts | 722 | // (A bare `try {}` with no catch is ill-formed C++, but stay robust.) | COMMENT |
| MEDIUM | gitnexus/src/core/ingestion/cfg/visitors/swift.ts | 535 | // flow conservatively (Swift forbids fall-through, but stay robust). | COMMENT |
| MEDIUM | gitnexus/src/core/lbug/lbug-config.ts | 608 | // Matching is case-insensitive to remain robust across wrappers/platforms. | COMMENT |
| MEDIUM | gitnexus/src/core/lbug/lbug-adapter.ts | 2206 | // starts), but the lock makes it robust to future reordering — a concurrent | COMMENT |
| MEDIUM | gitnexus/src/mcp/local/local-backend.ts | 2927 | // async `checkStalenessAsync`, robust defense-in-depth otherwise. | COMMENT |
| MEDIUM | .github/workflows/release-evaluation.yml | 2 | # harness. Share the existing evolution runner, protected settings, and power lock. | COMMENT |
| MEDIUM | .github/workflows/release-evaluation.yml | 164 | # runs as the harness, and no release or PR write token is available here. | COMMENT |
| MEDIUM | .github/workflows/impact-pdg-mutation-report.yml | 12 | # The harness shells out to `gitnexus analyze --pdg`, which spawns workers from | COMMENT |
| MEDIUM | .github/workflows/impact-pdg-mutation-report.yml | 46 | # analyze workers the mutation harness spawns. | COMMENT |
| MEDIUM | .github/workflows/codeql.yml | 76 | # retain security analysis of the surrounding benchmark harness. | COMMENT |
| MEDIUM | .github/workflows/gitnexus-skill-evolution.yml | 99 | # Weekly is a deliberate cadence to catch model/harness drift promptly; a | COMMENT |
| MEDIUM | .github/workflows/docker.yml | 284 | # Use `while read` instead of `for $TAGS` to be robust against tags that | COMMENT |
| MEDIUM⚡ | .github/scripts/triage/test_embedding_utils.py | 196 | # 500 samples, 10 dims — well-conditioned for robust covariance | COMMENT |
| MEDIUM | .github/scripts/triage/sweep.py | 40 | # Governs how aggressively the robust covariance downweights extreme points. | COMMENT |
| MEDIUM | …thub/actions/require-agent-release-evidence/action.yml | 14 | # Release evaluation always measures with main's harness. Validate with that | COMMENT |
| MEDIUM | …thub/actions/require-agent-release-evidence/action.yml | 16 | # rejects evidence whose harness differs from it in any evaluation input. | COMMENT |
| MEDIUM | gitnexus-web/package-lock.json | 8161 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.2.tgz", | CODE |
| MEDIUM⚡ | eval/workflow_bench/runner.py | 758 | # Rows where the session (or the harness) died carry no measured evidence and | COMMENT |
| MEDIUM⚡ | eval/workflow_bench/runner.py | 768 | # Health classification. These answer "did the harness work", which is a | COMMENT |
| MEDIUM | eval/workflow_bench/runner.py | 910 | # before the harness bug takes the process down — otherwise a | COMMENT |
| MEDIUM | eval/workflow_bench/runner.py | 1086 | # harness bug takes the process down. Without this, one | COMMENT |
| MEDIUM | eval/workflow_bench/runner.py | 1261 | # still edits the harness (gitignored learnings.jsonl) must | COMMENT |
| MEDIUM | eval/workflow_bench/runner.py | 1271 | # Setup (or its absence) must leave the staged harness copy gone | COMMENT |
| MEDIUM | eval/workflow_bench/runner.py | 1555 | # Admissible means the harness delivered a trustworthy measurement. It says | COMMENT |
| MEDIUM | eval/workflow_bench/mock_provider.py | 62 | # harness exists to catch, so the mock has to be able to script absence. | COMMENT |
| MEDIUM | eval/workflow_bench/comparator_reuse.py | 149 | # Fail closed. A row with no runtime_digest was measured by a harness that | COMMENT |
| MEDIUM | eval/workflow_bench/tasks.scenarios.yaml | 14 | # oracle: harness-owned hidden files + command; oracle success is also | COMMENT |
| MEDIUM | eval/workflow_bench/evolution.py | 498 | # per-skill allowlist. Force-add so a seed or overlay of harness-owned | COMMENT |
| MEDIUM | eval/workflow_bench/runner_artifacts.py | 34 | # pre-existing .git exclusion below, which is the same kind of harness/tool | COMMENT |
| MEDIUM | eval/workflow_bench/sanitized_graph.py | 100 | # Review corpus patches are harness-owned and applied in setup, then | COMMENT |
| MEDIUM | eval/workflow_bench/release_evidence.py | 23 | # Paths whose content defines what an agent evaluation measures: harness, | COMMENT |
| MEDIUM | eval/workflow_bench/release_evidence.py | 88 | # A rename out of a harness path changes the harness too. | COMMENT |
| MEDIUM | eval/workflow_bench/release_evidence.py | 125 | # The tree running this module is that harness's evaluator, so its task | COMMENT |
| MEDIUM | eval/workflow_bench/tasks.review.scenarios.yaml | 1 | # Exact-head historical PR corpus. Hidden labels are captured by the harness | COMMENT |
| MEDIUM | eval/workflow_bench/task_assets.py | 63 | # Review corpus patches are harness-owned. The task repo (`~/GitNexus`) is the | COMMENT |
| MEDIUM⚡ | eval/tests/test_workflow_bench.py | 507 | # expected "bad candidate" outcome and must not read as a broken harness. | COMMENT |
| MEDIUM | eval/tests/test_workflow_bench_sessions.py | 1557 | # The artifact the harness later reads is the one inside that mount. | COMMENT |
| MEDIUM⚡ | eval/tests/test_runner_hardening.py | 591 | # A harness bug recorded as an ordinary infra-error would be averaged into | COMMENT |
| MEDIUM⚡ | eval/tests/test_runner_hardening.py | 888 | # the harness failing; it must reset the streak instead of tripping. | COMMENT |
| MEDIUM⚡ | eval/tests/test_runner_hardening.py | 952 | # the harness bug surfaced. Reading the futures in order and raising on the | COMMENT |
| MEDIUM⚡ | eval/tests/test_release_evidence.py | 212 | # A trusted run's artifact cannot vouch for a report another harness produced. | COMMENT |
| MEDIUM | eval/tests/test_oracle_assets.py | 516 | # through this harness dependency link while candidate-relative imports | COMMENT |
| MEDIUM⚡ | eval/tests/test_comparator_reuse.py | 130 | # A row with no runtime_digest was measured by a harness that recorded none, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | gitnexus/test/unit/spring-config-bindings.test.ts | 237 | @org.springframework.boot.context.properties.ConfigurationProperties("service") | CODE |
| CRITICAL | gitnexus/test/unit/install-duckdb-extension.test.ts | 72 | expect(factory.conn.query.mock.calls.some(([sql]) => String(sql).includes('INSTALL'))).toBe( | CODE |
| CRITICAL | gitnexus/test/unit/spring-interface-inheritance.test.ts | 265 | @org.springframework.web.bind.annotation.RequestMapping("/api") | CODE |
| CRITICAL | gitnexus/test/unit/spring-interface-inheritance.test.ts | 267 | @org.springframework.web.bind.annotation.GetMapping("/list") Object list(); | CODE |
| CRITICAL | …tnexus/test/unit/kotlin-spring-route-ingestion.test.ts | 119 | @org.springframework.web.bind.annotation.GetMapping("/fqn") | CODE |
| CRITICAL | gitnexus/test/unit/java-route-const-resolver.test.ts | 315 | @org.springframework.web.bind.annotation.PostMapping(ApiPathConstants.DIAGNOSIS_SAVE_V1) | CODE |
| CRITICAL | gitnexus/test/unit/java-route-const-resolver.test.ts | 332 | @org.springframework.web.bind.annotation.PostMapping("/literal/path") | CODE |
| CRITICAL | gitnexus/test/unit/group/http-route-extractor.test.ts | 2442 | @org.springframework.web.bind.annotation.RequestMapping("/api") | CODE |
| CRITICAL | gitnexus/test/unit/group/http-route-extractor.test.ts | 2444 | @org.springframework.web.bind.annotation.GetMapping("/users") | CODE |
| CRITICAL | gitnexus/test/unit/group/http-route-extractor.test.ts | 2471 | @org.springframework.web.bind.annotation.GetMapping("/orders/{id}") | CODE |
| CRITICAL | gitnexus/test/unit/group/spring-route-parity.test.ts | 159 | @org.springframework.web.bind.annotation.RequestMapping( | CODE |
| CRITICAL | gitnexus/test/unit/group/grpc-extractor.test.ts | 624 | // `com.acme.auth.proto.AuthServiceGrpc.newBlockingStub(...)`, | COMMENT |
| CRITICAL | gitnexus/test/unit/group/grpc-extractor.test.ts | 640 | this.stub = com.acme.auth.proto.AuthServiceGrpc.newBlockingStub(ch); | CODE |
| CRITICAL | gitnexus/test/unit/group/grpc-extractor.test.ts | 649 | // fully-qualified `com.acme.auth.proto.AuthServiceGrpc.newStub(...)` | COMMENT |
| CRITICAL | gitnexus/test/unit/group/grpc-extractor.test.ts | 716 | this.stub = com.acme.auth.proto.AuthServiceGrpc.newBlockingStub(ch); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .github/scripts/evolution-runner.py | 172 | except RuntimeError: | CODE |
| HIGH | .github/scripts/check-tree-sitter-upgrade-readiness.py | 1062 | except Exception: | CODE |
| HIGH | .github/scripts/check-tree-sitter-upgrade-readiness.py | 372 | except json.JSONDecodeError: | CODE |
| HIGH | .github/scripts/check-tree-sitter-upgrade-readiness.py | 397 | except json.JSONDecodeError: | CODE |
| HIGH | .github/scripts/check-tree-sitter-upgrade-readiness.py | 852 | except json.JSONDecodeError: | CODE |
| HIGH | eval/analysis/analyze_results.py | 71 | except Exception: | CODE |
| HIGH | eval/workflow_bench/proposer_sandbox.py | 1122 | except OSError: | CODE |
| HIGH | eval/workflow_bench/proposer_sandbox.py | 942 | except FileExistsError: | CODE |
| HIGH | eval/workflow_bench/proposer_sandbox.py | 1135 | except OSError: | CODE |
| HIGH | eval/workflow_bench/process_control.py | 455 | except BaseException: | CODE |
| HIGH | eval/workflow_bench/process_control.py | 208 | except (OSError, ValueError): | CODE |
| HIGH | eval/workflow_bench/process_control.py | 466 | except BaseException: | CODE |
| HIGH | eval/workflow_bench/process_control.py | 673 | except ProcessLookupError: | CODE |
| HIGH | eval/workflow_bench/process_control.py | 700 | except ProcessLookupError: | CODE |
| HIGH | eval/workflow_bench/process_control.py | 451 | except BaseException: | CODE |
| HIGH | eval/workflow_bench/process_control.py | 461 | except (OSError, ValueError): | CODE |
| HIGH | eval/workflow_bench/process_control.py | 720 | except OSError: | CODE |
| HIGH | eval/workflow_bench/comparator_reuse.py | 496 | except FileExistsError: | CODE |
| HIGH | eval/workflow_bench/runtime_mounts.py | 266 | except SandboxError: | CODE |
| HIGH | eval/workflow_bench/runtime_mounts.py | 346 | except SandboxError: | CODE |
| HIGH | eval/workflow_bench/evolution.py | 278 | except FileExistsError: | CODE |
| HIGH | eval/workflow_bench/evolution.py | 317 | except OSError: | CODE |
| HIGH | eval/workflow_bench/evolution.py | 332 | except OSError: | CODE |
| HIGH | eval/workflow_bench/model_gateway.py | 495 | except OSError: | CODE |
| HIGH | eval/workflow_bench/litellm_usage_callback.py | 63 | except Exception: | CODE |
| HIGH | eval/bridge/mcp_bridge.py | 168 | except Exception: | CODE |
| HIGH | eval/bridge/mcp_bridge.py | 182 | except Exception: | CODE |
| HIGH | eval/bridge/mcp_bridge.py | 107 | except Exception: | CODE |
| HIGH | eval/environments/gitnexus_docker.py | 381 | except Exception: | CODE |
| HIGH | eval/tests/test_process_control.py | 121 | except ProcessLookupError: | CODE |
| HIGH | eval/tests/test_model_gateway.py | 218 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | gitnexus/test/unit/method-extraction.test.ts | 1696 | print(format: string): void; | CODE |
| HIGH | gitnexus/test/unit/method-extraction.test.ts | 3928 | print(msg); | CODE |
| HIGH | gitnexus/test/unit/method-extraction.test.ts | 3997 | print(msg); | CODE |
| HIGH | gitnexus/test/unit/method-extraction.test.ts | 4024 | print(this); | CODE |
| HIGH | gitnexus/test/unit/ingestion-utils.test.ts | 675 | const code = `def process_data(items: list[int]) -> bool:\n return True`; | CODE |
| HIGH | gitnexus/test/unit/type-env.test.ts | 963 | return True | CODE |
| HIGH | gitnexus/test/unit/type-env.test.ts | 968 | return True | CODE |
| HIGH | gitnexus/test/unit/skill-evolution-workflow.test.ts | 461 | elif [[ "\${run_id}" == '200' ]]; then | CODE |
| HIGH | gitnexus/test/unit/skill-evolution-workflow.test.ts | 501 | elif [[ "\${run_id}" == '200' ]]; then | CODE |
| HIGH | …xus/test/unit/group/python-workspace-extractor.test.ts | 190 | 'def describe():\n """Example:\n from datalib.models import Record\n """\n return None\n', | CODE |
| HIGH | …xus/test/unit/scope-resolution/workspace-index.test.ts | 293 | return True | CODE |
| HIGH | …xus/test/unit/scope-resolution/workspace-index.test.ts | 335 | return True | CODE |
| HIGH | …xus/test/unit/scope-resolution/workspace-index.test.ts | 355 | return True | CODE |
| HIGH | …xus/test/unit/scope-resolution/workspace-index.test.ts | 381 | return True | CODE |
| HIGH | …xus/test/unit/scope-resolution/workspace-index.test.ts | 405 | return True | CODE |
| HIGH | …nit/scope-resolution/python/cached-tree-parity.test.ts | 32 | print(item.upper()) | CODE |
| HIGH | gitnexus/test/integration/skills-e2e.test.ts | 515 | return True | CODE |
| HIGH⚡ | gitnexus/test/integration/skills-e2e.test.ts | 579 | print(f"[INFO] {msg}") | CODE |
| HIGH⚡ | gitnexus/test/integration/skills-e2e.test.ts | 582 | print(f"[ERROR] {msg}") | CODE |
| HIGH⚡ | gitnexus/test/integration/skills-e2e.test.ts | 591 | return True | CODE |
| HIGH | gitnexus/test/integration/skills-e2e.test.ts | 2247 | return True | CODE |
| HIGH | gitnexus/test/integration/has-method.test.ts | 623 | print(format: string): void; | CODE |
| HIGH | …/integration/resolvers/python-module-accessors.test.ts | 114 | return None | CODE |
| HIGH | gitnexus/test/integration/resolvers/python.test.ts | 792 | 'app/services/marker.py': `def _marker(): return True | CODE |
| HIGH | gitnexus/test/integration/resolvers/python.test.ts | 853 | 'app/services/marker.py': `def _marker(): return True | CODE |
| HIGH | gitnexus/test/integration/resolvers/python.test.ts | 927 | 'app/services/marker.py': `def _marker(): return True | CODE |
| HIGH | gitnexus/test/integration/resolvers/python.test.ts | 947 | 'app/services/marker.py': `def _marker(): return True | CODE |
| HIGH | gitnexus/test/integration/resolvers/python.test.ts | 4226 | return True | CODE |
| HIGH | gitnexus/scripts/bench-scope-resolution.ts | 28 | lines.push(` return True`); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1350 | // Step 1: initial index. | COMMENT |
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1353 | // Step 2: comment-only edit, same as the test above. | COMMENT |
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1358 | // Step 3: incremental writeback for the edited file. | COMMENT |
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1369 | // Step 4: force a full rebuild from the SAME on-disk file state. | COMMENT |
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1379 | // Step 5: exact-equality across every stat. `toEqual` would also | COMMENT |
| LOW | gitnexus/test/integration/cli-e2e.test.ts | 509 | // Step 1: analyze repoA with --name shared → registry entry created. | COMMENT |
| LOW | gitnexus/test/integration/cli-e2e.test.ts | 531 | // Step 2: analyze repoB with the SAME --name → collision error. | COMMENT |
| LOW | gitnexus/test/integration/cli-e2e.test.ts | 551 | // Step 3: REGRESSION GUARD for the missing collision-bypass wire | COMMENT |
| LOW | gitnexus/test/integration/cli-e2e.test.ts | 583 | // Step 4: REGRESSION GUARD for the design decision in review | COMMENT |
| LOW⚡ | gitnexus/src/core/augmentation/engine.ts | 131 | // Step 1: BM25 search (fast, no embeddings) | COMMENT |
| LOW⚡ | gitnexus/src/core/augmentation/engine.ts | 134 | // Step 2: Map BM25 file results to symbols | COMMENT |
| LOW | gitnexus/src/core/augmentation/engine.ts | 198 | // Step 3: Batch-fetch callers/callees/processes/cohesion for top matches | COMMENT |
| LOW | gitnexus/src/core/augmentation/engine.ts | 345 | // Step 4: Rank by cohesion (internal signal) and format | COMMENT |
| LOW⚡ | gitnexus/src/core/ingestion/community-processor.ts | 252 | // Step 3: Create community nodes with heuristic labels | COMMENT |
| LOW⚡ | gitnexus/src/core/ingestion/community-processor.ts | 262 | // Step 4: Preserve all assignments for skill generation, but only emit | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 175 | // Step 1: Find entry points (functions that call others but have few callers) | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 188 | // Step 2: Trace processes from each entry point | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 218 | // Step 3: Deduplicate similar traces (subset removal) | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 229 | // Step 4: Limit to max processes — deepest first, but ROUND-ROBIN across | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 343 | // Step 5: Create process nodes | COMMENT |
| LOW | …re/ingestion/route-extractors/kotlin-const-resolver.ts | 685 | // Step 2: the file-name convention, as a tie-break among valid candidates. | COMMENT |
| LOW⚡ | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 134 | // Step 1: run generic MRO (Class-only, EXTENDS-only). | COMMENT |
| LOW⚡ | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 137 | // Step 2: build a graphId → defId map for ALL class-like defs including Traits. | COMMENT |
| LOW | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 156 | // Step 3: collect direct trait-use edges (IMPLEMENTS where target is a Trait). | COMMENT |
| LOW | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 174 | // Step 4: augment every class's MRO by prepending the traits used by | COMMENT |
| LOW | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 203 | // Step 5: also insert Trait-only entries for classes that use traits | COMMENT |
| LOW⚡ | …src/core/ingestion/languages/php/namespace-siblings.ts | 212 | // Step 1: extract namespace structure for each file. Also seed the | COMMENT |
| LOW | …src/core/ingestion/languages/php/namespace-siblings.ts | 225 | // Step 2: group class-like defs and module scopes by namespace. | COMMENT |
| LOW | …src/core/ingestion/languages/php/namespace-siblings.ts | 280 | // Step 3: For each namespace bucket, inject sibling class bindings | COMMENT |
| LOW | …src/core/ingestion/languages/php/namespace-siblings.ts | 339 | // Step 4: Mirror return-type bindings from same-namespace sibling files. | COMMENT |
| LOW | …nexus/src/core/ingestion/languages/cpp/simple-hooks.ts | 63 | // The orchestrator provides the function scope; we need to check if | COMMENT |
| LOW⚡ | …us/src/core/ingestion/languages/ruby/scope-resolver.ts | 166 | // Step 1: EXTENDS chain via the generic MRO builder (direct class inheritance). | COMMENT |
| LOW⚡ | …us/src/core/ingestion/languages/ruby/scope-resolver.ts | 169 | // Step 2: Build defId ↔ graphId bridge for class-like defs. | COMMENT |
| LOW⚡ | …us/src/core/ingestion/languages/ruby/scope-resolver.ts | 179 | // Step 3: Collect IMPLEMENTS edges, partitioned by reason. | COMMENT |
| LOW | …us/src/core/ingestion/languages/ruby/scope-resolver.ts | 206 | // Step 4: Reorder MRO per Ruby semantics. | COMMENT |
| LOW | …exus/src/core/ingestion/scope-resolution/passes/mro.ts | 45 | // Step 1: parentsByGraphId — typed iterator skips the per-edge type | COMMENT |
| LOW | …exus/src/core/ingestion/scope-resolution/passes/mro.ts | 58 | // Step 2: defIdByGraphId — translate graph ids to scope-resolution DefIds. | COMMENT |
| LOW | …exus/src/core/ingestion/scope-resolution/passes/mro.ts | 82 | // Step 3: linearize per class. | COMMENT |
| LOW | …ngestion/scope-resolution/passes/overload-narrowing.ts | 300 | // Step 1: compute per-slot ranks and exclude non-viable candidates. | COMMENT |
| LOW | …ngestion/scope-resolution/passes/overload-narrowing.ts | 334 | // Step 2: pairwise dominance — remove candidates dominated by any other. | COMMENT |
| LOW | gitnexus/src/core/group/extractors/grpc-extractor.ts | 558 | // Step 1: java_package translation. The import-derived package | COMMENT |
| LOW | gitnexus/src/core/group/extractors/grpc-extractor.ts | 579 | // Step 2: proto map cross-check. When this repo also carries a | COMMENT |
| LOW | gitnexus/src/core/group/extractors/grpc-extractor.ts | 630 | // Step 3: import-derived fallback. No `.proto` in this repo | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 3219 | // Step 1: Run hybrid search to get matching symbols. BM25 and vector | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 3292 | // Step 2: For each match with a nodeId, trace to process(es) | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 3695 | // Step 4: Build response | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 5004 | // Step 3: Build full context | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 6796 | // Step 1: Find the target symbol (reuse context's lookup) | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 6927 | // Step 4: Apply or preview. | COMMENT |
| LOW⚡ | gitnexus/src/cli/skill-gen.ts | 125 | // Step 1: Use raw assignments for the fallback when all communities were | COMMENT |
| LOW⚡ | gitnexus/src/cli/skill-gen.ts | 135 | // Step 2: Filter to significant communities | COMMENT |
| LOW⚡ | gitnexus/src/cli/skill-gen.ts | 147 | // Step 3: Build lookup maps | COMMENT |
| LOW⚡ | gitnexus/src/cli/skill-gen.ts | 151 | // Step 4: Ensure the shared project-skill root exists. Never clear it: it | COMMENT |
| LOW | gitnexus/src/cli/skill-gen.ts | 169 | // Step 5: Generate skill files | COMMENT |
| LOW | gitnexus-web/src/core/llm/tools.ts | 81 | // Step 1: Enriched search via backend (connections, cluster, processes pre-joined) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1350 | // Step 1: initial index. | COMMENT |
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1353 | // Step 2: comment-only edit, same as the test above. | COMMENT |
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1358 | // Step 3: incremental writeback for the edited file. | COMMENT |
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1369 | // Step 4: force a full rebuild from the SAME on-disk file state. | COMMENT |
| LOW⚡ | gitnexus/test/unit/incremental-orchestration.test.ts | 1379 | // Step 5: exact-equality across every stat. `toEqual` would also | COMMENT |
| LOW | gitnexus/test/integration/cli-e2e.test.ts | 509 | // Step 1: analyze repoA with --name shared → registry entry created. | COMMENT |
| LOW | gitnexus/test/integration/cli-e2e.test.ts | 531 | // Step 2: analyze repoB with the SAME --name → collision error. | COMMENT |
| LOW | gitnexus/test/integration/cli-e2e.test.ts | 551 | // Step 3: REGRESSION GUARD for the missing collision-bypass wire | COMMENT |
| LOW | gitnexus/test/integration/cli-e2e.test.ts | 583 | // Step 4: REGRESSION GUARD for the design decision in review | COMMENT |
| LOW⚡ | gitnexus/src/core/augmentation/engine.ts | 131 | // Step 1: BM25 search (fast, no embeddings) | COMMENT |
| LOW⚡ | gitnexus/src/core/augmentation/engine.ts | 134 | // Step 2: Map BM25 file results to symbols | COMMENT |
| LOW | gitnexus/src/core/augmentation/engine.ts | 198 | // Step 3: Batch-fetch callers/callees/processes/cohesion for top matches | COMMENT |
| LOW | gitnexus/src/core/augmentation/engine.ts | 345 | // Step 4: Rank by cohesion (internal signal) and format | COMMENT |
| LOW⚡ | gitnexus/src/core/ingestion/community-processor.ts | 252 | // Step 3: Create community nodes with heuristic labels | COMMENT |
| LOW⚡ | gitnexus/src/core/ingestion/community-processor.ts | 262 | // Step 4: Preserve all assignments for skill generation, but only emit | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 175 | // Step 1: Find entry points (functions that call others but have few callers) | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 188 | // Step 2: Trace processes from each entry point | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 218 | // Step 3: Deduplicate similar traces (subset removal) | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 229 | // Step 4: Limit to max processes — deepest first, but ROUND-ROBIN across | COMMENT |
| LOW | gitnexus/src/core/ingestion/process-processor.ts | 343 | // Step 5: Create process nodes | COMMENT |
| LOW | …re/ingestion/route-extractors/kotlin-const-resolver.ts | 685 | // Step 2: the file-name convention, as a tie-break among valid candidates. | COMMENT |
| LOW⚡ | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 134 | // Step 1: run generic MRO (Class-only, EXTENDS-only). | COMMENT |
| LOW⚡ | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 137 | // Step 2: build a graphId → defId map for ALL class-like defs including Traits. | COMMENT |
| LOW | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 156 | // Step 3: collect direct trait-use edges (IMPLEMENTS where target is a Trait). | COMMENT |
| LOW | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 174 | // Step 4: augment every class's MRO by prepending the traits used by | COMMENT |
| LOW | …xus/src/core/ingestion/languages/php/scope-resolver.ts | 203 | // Step 5: also insert Trait-only entries for classes that use traits | COMMENT |
| LOW⚡ | …src/core/ingestion/languages/php/namespace-siblings.ts | 212 | // Step 1: extract namespace structure for each file. Also seed the | COMMENT |
| LOW | …src/core/ingestion/languages/php/namespace-siblings.ts | 225 | // Step 2: group class-like defs and module scopes by namespace. | COMMENT |
| LOW | …src/core/ingestion/languages/php/namespace-siblings.ts | 280 | // Step 3: For each namespace bucket, inject sibling class bindings | COMMENT |
| LOW | …src/core/ingestion/languages/php/namespace-siblings.ts | 339 | // Step 4: Mirror return-type bindings from same-namespace sibling files. | COMMENT |
| LOW⚡ | …us/src/core/ingestion/languages/ruby/scope-resolver.ts | 166 | // Step 1: EXTENDS chain via the generic MRO builder (direct class inheritance). | COMMENT |
| LOW⚡ | …us/src/core/ingestion/languages/ruby/scope-resolver.ts | 169 | // Step 2: Build defId ↔ graphId bridge for class-like defs. | COMMENT |
| LOW⚡ | …us/src/core/ingestion/languages/ruby/scope-resolver.ts | 179 | // Step 3: Collect IMPLEMENTS edges, partitioned by reason. | COMMENT |
| LOW | …us/src/core/ingestion/languages/ruby/scope-resolver.ts | 206 | // Step 4: Reorder MRO per Ruby semantics. | COMMENT |
| LOW | …exus/src/core/ingestion/scope-resolution/passes/mro.ts | 45 | // Step 1: parentsByGraphId — typed iterator skips the per-edge type | COMMENT |
| LOW | …exus/src/core/ingestion/scope-resolution/passes/mro.ts | 58 | // Step 2: defIdByGraphId — translate graph ids to scope-resolution DefIds. | COMMENT |
| LOW | …exus/src/core/ingestion/scope-resolution/passes/mro.ts | 82 | // Step 3: linearize per class. | COMMENT |
| LOW | …ngestion/scope-resolution/passes/overload-narrowing.ts | 300 | // Step 1: compute per-slot ranks and exclude non-viable candidates. | COMMENT |
| LOW | …ngestion/scope-resolution/passes/overload-narrowing.ts | 334 | // Step 2: pairwise dominance — remove candidates dominated by any other. | COMMENT |
| LOW | gitnexus/src/core/group/extractors/grpc-extractor.ts | 558 | // Step 1: java_package translation. The import-derived package | COMMENT |
| LOW | gitnexus/src/core/group/extractors/grpc-extractor.ts | 579 | // Step 2: proto map cross-check. When this repo also carries a | COMMENT |
| LOW | gitnexus/src/core/group/extractors/grpc-extractor.ts | 630 | // Step 3: import-derived fallback. No `.proto` in this repo | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 3219 | // Step 1: Run hybrid search to get matching symbols. BM25 and vector | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 3292 | // Step 2: For each match with a nodeId, trace to process(es) | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 3695 | // Step 4: Build response | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 5004 | // Step 3: Build full context | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 6796 | // Step 1: Find the target symbol (reuse context's lookup) | COMMENT |
| LOW | gitnexus/src/mcp/local/local-backend.ts | 6927 | // Step 4: Apply or preview. | COMMENT |
| LOW⚡ | gitnexus/src/cli/skill-gen.ts | 125 | // Step 1: Use raw assignments for the fallback when all communities were | COMMENT |
| LOW⚡ | gitnexus/src/cli/skill-gen.ts | 135 | // Step 2: Filter to significant communities | COMMENT |
| LOW⚡ | gitnexus/src/cli/skill-gen.ts | 147 | // Step 3: Build lookup maps | COMMENT |
| LOW⚡ | gitnexus/src/cli/skill-gen.ts | 151 | // Step 4: Ensure the shared project-skill root exists. Never clear it: it | COMMENT |
| LOW | gitnexus/src/cli/skill-gen.ts | 169 | // Step 5: Generate skill files | COMMENT |
| LOW | gitnexus-web/src/core/llm/tools.ts | 81 | // Step 1: Enriched search via backend (connections, cluster, processes pre-joined) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/scripts/evolution-runner.py | 8 | CODE | |
| LOW | .github/scripts/check-tree-sitter-upgrade-readiness.py | 17 | CODE | |
| LOW | .github/scripts/evolution-runner-ready.py | 3 | CODE | |
| LOW | …ub/scripts/test_check_tree_sitter_upgrade_readiness.py | 17 | CODE | |
| LOW | .github/scripts/check-workflow-concurrency.py | 30 | CODE | |
| LOW | .github/scripts/triage/test_sweep.py | 2 | CODE | |
| LOW | .github/scripts/triage/test_sweep.py | 21 | CODE | |
| LOW | .github/scripts/triage/test_sweep.py | 21 | CODE | |
| LOW | .github/scripts/triage/test_sweep.py | 458 | CODE | |
| LOW | .github/scripts/triage/test_sweep.py | 460 | CODE | |
| LOW | .github/scripts/triage/embedding_utils.py | 6 | CODE | |
| LOW | .github/scripts/triage/test_embedding_utils.py | 2 | CODE | |
| LOW | .github/scripts/triage/test_embedding_utils.py | 7 | CODE | |
| LOW | .github/scripts/triage/test_embedding_utils.py | 13 | CODE | |
| LOW | .github/scripts/triage/test_embedding_utils.py | 13 | CODE | |
| LOW | .github/scripts/triage/test_embedding_utils.py | 13 | CODE | |
| LOW | .github/scripts/triage/test_embedding_utils.py | 13 | CODE | |
| LOW | .github/scripts/triage/test_embedding_utils.py | 13 | CODE | |
| LOW | .github/scripts/triage/sweep.py | 7 | CODE | |
| LOW | .github/scripts/triage/sweep.py | 17 | CODE | |
| LOW | .github/scripts/triage/sweep.py | 17 | CODE | |
| LOW | .github/scripts/triage/sweep.py | 17 | CODE | |
| LOW | .github/scripts/triage/sweep.py | 17 | CODE | |
| LOW | .github/scripts/triage/sweep.py | 17 | CODE | |
| LOW | eval/tool_registry.py | 1 | CODE | |
| LOW | eval/check_test_execution.py | 3 | CODE | |
| LOW | eval/workflow_bench/proposer_sandbox.py | 3 | CODE | |
| LOW | eval/workflow_bench/process_control.py | 9 | CODE | |
| LOW | eval/workflow_bench/evolve.py | 30 | CODE | |
| LOW | eval/workflow_bench/evolve.py | 74 | CODE | |
| LOW | eval/workflow_bench/runner.py | 35 | CODE | |
| LOW | eval/workflow_bench/runner.py | 110 | CODE | |
| LOW | eval/workflow_bench/runner.py | 110 | CODE | |
| LOW | eval/workflow_bench/runner.py | 110 | CODE | |
| LOW | eval/workflow_bench/runner.py | 130 | CODE | |
| LOW | eval/workflow_bench/runner.py | 130 | CODE | |
| LOW | eval/workflow_bench/runner.py | 130 | CODE | |
| LOW | eval/workflow_bench/runner.py | 130 | CODE | |
| LOW | eval/workflow_bench/runner.py | 130 | CODE | |
| LOW | eval/workflow_bench/runner.py | 155 | CODE | |
| LOW | eval/workflow_bench/runner.py | 155 | CODE | |
| LOW | eval/workflow_bench/runner.py | 155 | CODE | |
| LOW | eval/workflow_bench/runner.py | 155 | CODE | |
| LOW | eval/workflow_bench/runner.py | 155 | CODE | |
| LOW | eval/workflow_bench/runner.py | 169 | CODE | |
| LOW | eval/workflow_bench/mock_provider.py | 31 | CODE | |
| LOW | eval/workflow_bench/release_preflight.py | 3 | CODE | |
| LOW | eval/workflow_bench/comparator_reuse.py | 15 | CODE | |
| LOW | eval/workflow_bench/runtime_mounts.py | 9 | CODE | |
| LOW | eval/workflow_bench/evolution.py | 3 | CODE | |
| LOW | eval/workflow_bench/release_build.py | 3 | CODE | |
| LOW | eval/workflow_bench/review_scoring.py | 3 | CODE | |
| LOW | eval/workflow_bench/model_gateway.py | 11 | CODE | |
| LOW | eval/workflow_bench/baseline_guidance.py | 6 | CODE | |
| LOW | eval/workflow_bench/release_report.py | 3 | CODE | |
| LOW | eval/workflow_bench/runner_artifacts.py | 3 | CODE | |
| LOW | eval/workflow_bench/sanitized_graph.py | 3 | CODE | |
| LOW | eval/workflow_bench/litellm_usage_callback.py | 19 | CODE | |
| LOW | eval/workflow_bench/release_evidence.py | 8 | CODE | |
| LOW | eval/workflow_bench/gateway_supervisor.py | 7 | CODE | |
| 30 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/scripts/evolution-runner.py | 184 | CODE | |
| LOW | .github/scripts/check-tree-sitter-upgrade-readiness.py | 527 | CODE | |
| LOW | .github/scripts/check-tree-sitter-upgrade-readiness.py | 582 | CODE | |
| LOW | .github/scripts/check-tree-sitter-upgrade-readiness.py | 663 | CODE | |
| LOW | .github/scripts/evolution-runner-ready.py | 13 | CODE | |
| LOW | .github/scripts/check-workflow-concurrency.py | 41 | CODE | |
| LOW | .github/scripts/check-workflow-concurrency.py | 99 | CODE | |
| LOW | .github/scripts/triage/sweep.py | 255 | CODE | |
| LOW | eval/run_eval.py | 277 | CODE | |
| LOW | eval/check_test_execution.py | 14 | CODE | |
| LOW | eval/analysis/analyze_results.py | 36 | CODE | |
| LOW | eval/analysis/analyze_results.py | 205 | CODE | |
| LOW | eval/analysis/analyze_results.py | 252 | CODE | |
| LOW | eval/workflow_bench/proposer_sandbox.py | 144 | CODE | |
| LOW | eval/workflow_bench/proposer_sandbox.py | 921 | CODE | |
| LOW | eval/workflow_bench/process_control.py | 159 | CODE | |
| LOW | eval/workflow_bench/process_control.py | 470 | CODE | |
| LOW | eval/workflow_bench/evolve.py | 692 | CODE | |
| LOW | eval/workflow_bench/evolve.py | 1261 | CODE | |
| LOW | eval/workflow_bench/evolve.py | 1600 | CODE | |
| LOW | eval/workflow_bench/runner.py | 448 | CODE | |
| LOW | eval/workflow_bench/runner.py | 862 | CODE | |
| LOW | eval/workflow_bench/runner.py | 964 | CODE | |
| LOW | eval/workflow_bench/runner.py | 1177 | CODE | |
| LOW | eval/workflow_bench/runner.py | 1816 | CODE | |
| LOW | eval/workflow_bench/runner.py | 2417 | CODE | |
| LOW | eval/workflow_bench/runner.py | 1039 | CODE | |
| LOW | eval/workflow_bench/runtime_mounts.py | 239 | CODE | |
| LOW | eval/workflow_bench/evolution.py | 266 | CODE | |
| LOW | eval/workflow_bench/evolution.py | 366 | CODE | |
| LOW | eval/workflow_bench/evolution.py | 560 | CODE | |
| LOW | eval/workflow_bench/evolution.py | 819 | CODE | |
| LOW | eval/workflow_bench/model_gateway.py | 418 | CODE | |
| LOW | eval/workflow_bench/baseline_guidance.py | 53 | CODE | |
| LOW | eval/workflow_bench/release_report.py | 235 | CODE | |
| LOW | eval/workflow_bench/runner_artifacts.py | 148 | CODE | |
| LOW | eval/workflow_bench/sanitized_graph.py | 160 | CODE | |
| LOW | eval/workflow_bench/runner_sessions.py | 568 | CODE | |
| LOW | eval/workflow_bench/runner_sessions.py | 622 | CODE | |
| LOW | eval/workflow_bench/runner_sessions.py | 240 | CODE | |
| LOW | eval/workflow_bench/promotion_apply.py | 50 | CODE | |
| LOW | eval/workflow_bench/promotion_apply.py | 331 | CODE | |
| LOW | eval/workflow_bench/promotion_apply.py | 440 | CODE | |
| LOW | eval/workflow_bench/promotion_apply.py | 618 | CODE | |
| LOW | eval/workflow_bench/task_assets.py | 733 | CODE | |
| LOW | eval/workflow_bench/task_assets.py | 763 | CODE | |
| LOW | eval/workflow_bench/task_assets.py | 840 | CODE | |
| LOW | eval/workflow_bench/task_assets.py | 1027 | CODE | |
| LOW | eval/workflow_bench/task_assets.py | 206 | CODE | |
| LOW | eval/workflow_bench/task_assets.py | 411 | CODE | |
| LOW | eval/workflow_bench/simulate_sweep.py | 293 | CODE | |
| LOW | eval/workflow_bench/simulate_sweep.py | 555 | CODE | |
| LOW | eval/workflow_bench/simulate_sweep.py | 361 | CODE | |
| LOW | eval/workflow_bench/oracle_assets.py | 582 | CODE | |
| LOW | eval/tests/test_promotion_apply.py | 62 | CODE | |
| LOW | eval/tests/test_model_gateway.py | 156 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | gitnexus/bench/parse-throughput.md | 1 | # Parse-throughput benchmark (scaffold) | COMMENT |
| MEDIUM | gitnexus/test/unit/pdg-mode-flip.test.ts | 3 | * (#2099 F1). Sibling of incremental-orchestration.test.ts: real on-disk git | COMMENT |
| MEDIUM | gitnexus/test/unit/parse-impl-heap-guard.test.ts | 28 | describe('#2649 parse-phase heap guardrails', () => { | CODE |
| MEDIUM | …nexus/test/unit/parse-impl-heap-guard-pipeline.test.ts | 2 | * #2649 review — pipeline-level coverage for the parse-phase heap guardrails. | COMMENT |
| MEDIUM | …nexus/test/unit/parse-impl-heap-guard-pipeline.test.ts | 60 | describe('#2649 heap guardrails wired into runChunkedParseAndResolve', () => { | CODE |
| MEDIUM | …xus/src/core/ingestion/taint/summary-harvest-driver.ts | 2 | * Summary-harvest driver (#2084 M4 U1) — the in-phase orchestration that turns | COMMENT |
| MEDIUM | …nexus/src/core/ingestion/pipeline-phases/parse-impl.ts | 653 | // Heap-scale guardrails (#2649), measured on a Linux-kernel analyze | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 26 | # ── Reusable workflow orchestration ───────────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/triage/sweep.py | 62 | # 512-token context window (~4 chars/token). We keep title + body under | COMMENT |
| MEDIUM | .github/scripts/triage/sweep.py | 137 | # Truncate to fit the embedding model's token window. | COMMENT |
| MEDIUM | gitnexus-web/src/core/llm/agent.ts | 239 | // This is critical for agentic workflows with tool calls | COMMENT |
| MEDIUM | eval/workflow_bench/model_gateway.py | 43 | # High reasoning effort on a full context window can leave a request without a | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …t/unit/scope-resolution/python/python-fixtures.test.ts | 172 | except Exception: | CODE |
| LOW | …t/scope-resolution/python/python-local-imports.test.ts | 190 | except Exception as helper: pass | CODE |
| MEDIUM | …t/scope-resolution/python/python-local-imports.test.ts | 44 | def try_named(): | CODE |
| LOW | .github/scripts/check-tree-sitter-upgrade-readiness.py | 1062 | except Exception: | CODE |
| LOW | eval/run_eval.py | 179 | except Exception as patch_err: | CODE |
| LOW | eval/run_eval.py | 246 | except Exception as e: | CODE |
| LOW | eval/run_eval.py | 317 | except Exception as e: | CODE |
| LOW | eval/analysis/analyze_results.py | 71 | except Exception: | CODE |
| LOW | eval/analysis/analyze_results.py | 196 | except Exception as e: | CODE |
| LOW | eval/workflow_bench/process_control.py | 191 | except Exception: | CODE |
| LOW | eval/workflow_bench/litellm_usage_callback.py | 63 | except Exception: | CODE |
| LOW | eval/workflow_bench/litellm_usage_callback.py | 130 | except Exception: | CODE |
| LOW | eval/bridge/mcp_bridge.py | 87 | except Exception as e: | CODE |
| LOW | eval/bridge/mcp_bridge.py | 104 | except Exception: | CODE |
| LOW | eval/bridge/mcp_bridge.py | 107 | except Exception: | CODE |
| LOW | eval/bridge/mcp_bridge.py | 168 | except Exception: | CODE |
| LOW | eval/bridge/mcp_bridge.py | 182 | except Exception: | CODE |
| LOW | eval/bridge/mcp_bridge.py | 222 | except Exception as e: | CODE |
| LOW | eval/bridge/mcp_bridge.py | 243 | except Exception as e: | CODE |
| LOW | eval/bridge/mcp_bridge.py | 316 | except Exception as e: | CODE |
| LOW | eval/environments/gitnexus_docker.py | 86 | except Exception as e: | CODE |
| LOW | eval/environments/gitnexus_docker.py | 321 | except Exception as e: | CODE |
| LOW | eval/environments/gitnexus_docker.py | 363 | except Exception as e: | CODE |
| LOW | eval/environments/gitnexus_docker.py | 381 | except Exception: | CODE |
| LOW⚡ | eval/tests/test_errors.py | 12 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW⚡ | eval/tests/test_errors.py | 24 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | eval/agents/gitnexus_agent.py | 127 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | gitnexus/test/unit/fts-availability-resolve.test.ts | 30 | writeFileSync(artifact, 'placeholder'); | CODE |
| LOW | gitnexus/test/unit/cursor-hook.test.ts | 89 | initGitRepo(tmpDir, { name: 'Test', email: 'test@test.com' }); | CODE |
| LOW | gitnexus/test/unit/cursor-hook.test.ts | 94 | initGitRepo(guardTmpDir, { name: 'Test', email: 'test@test.com' }); | CODE |
| LOW | gitnexus/test/unit/vendored-extension-path.test.ts | 42 | writeFileSync(artifact, 'placeholder'); | CODE |
| LOW | gitnexus/test/unit/vendored-extension-path.test.ts | 57 | writeFileSync(artifact, 'placeholder'); | CODE |
| LOW | gitnexus/test/unit/vendored-extension-path.test.ts | 74 | writeFileSync(evil, 'placeholder'); | CODE |
| LOW | gitnexus/test/unit/hooks.test.ts | 187 | const HOOK_TEST_IDENTITY: GitIdentity = { name: 'Test', email: 'test@test.com' }; | CODE |
| LOW | gitnexus/test/unit/review-agent-workflow.test.ts | 88 | // stub like the literal string "placeholder" can never be published. | COMMENT |
| LOW⚡ | gitnexus/test/unit/review-agent-workflow.test.ts | 2275 | // A production run returned {"body":"placeholder","complete":false}: the | COMMENT |
| LOW⚡ | gitnexus/test/unit/review-agent-workflow.test.ts | 2279 | structuredOutput: JSON.stringify({ body: 'placeholder', complete: false }), | CODE |
| LOW⚡ | gitnexus/test/unit/review-agent-workflow.test.ts | 2285 | expect(stub.artifact.body).not.toContain('placeholder'); | CODE |
| LOW | gitnexus/test/unit/review-agent-workflow.test.ts | 2443 | structuredOutput: JSON.stringify({ body: 'placeholder', complete: false }), | CODE |
| LOW | gitnexus/test/unit/review-agent-workflow.test.ts | 2455 | structuredOutput: JSON.stringify({ body: 'placeholder', complete: false }), | CODE |
| LOW | gitnexus/test/unit/lbug-extension-loader.test.ts | 469 | writeFileSync(artifact, 'placeholder'); | CODE |
| LOW | gitnexus/test/integration/antigravity-hook-e2e.test.ts | 92 | initGitRepo(tmpDir, { name: 'Test', email: 'test@test.com' }); | CODE |
| LOW | gitnexus/test/integration/hooks-e2e.test.ts | 51 | initGitRepo(tmpDir, { name: 'Test', email: 'test@test.com' }); | CODE |
| LOW | .github/workflows/gitnexus-review-agent.yml | 1534 | // the literal string 'placeholder'. | COMMENT |
| LOW | gitnexus-web/src/locales/zh-CN/chat.json | 17 | "placeholder": "询问这个代码库...", | CODE |
| LOW | gitnexus-web/src/locales/zh-CN/settings.json | 11 | "placeholder": "粘贴部署访问令牌", | CODE |
| LOW | gitnexus-web/src/locales/en/chat.json | 17 | "placeholder": "Ask about the codebase...", | CODE |
| LOW | gitnexus-web/src/locales/en/settings.json | 11 | "placeholder": "Paste your deploy access token", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | gitnexus/test/unit/ingestion-utils.test.ts | 675 | const code = `def process_data(items: list[int]) -> bool:\n return True`; | CODE |
| LOW | gitnexus/test/unit/type-env.test.ts | 5725 | const code = `const dbClient: Database = connectDb();\nfunction handleRequest() {\n const localRequest: Request = | CODE |
| LOW | …xus/test/unit/group/python-workspace-extractor.test.ts | 53 | await writeFile('lib/utils/__init__.py', 'def helper(): pass\nclass Config: pass\n'); | CODE |
| LOW | …xus/test/unit/scope-resolution/workspace-index.test.ts | 90 | def helper() -> int: | CODE |
| LOW | …xus/test/unit/scope-resolution/workspace-index.test.ts | 295 | def helper() -> int: | CODE |
| LOW | …xus/test/unit/scope-resolution/workspace-index.test.ts | 435 | def helper() -> int: | CODE |
| LOW⚡ | …t/scope-resolution/python/python-local-imports.test.ts | 21 | 'module_target.py': 'def helper(): return 1\n', | CODE |
| LOW⚡ | …t/scope-resolution/python/python-local-imports.test.ts | 22 | 'closure_target.py': 'def helper(): return 2\n', | CODE |
| LOW⚡ | …t/scope-resolution/python/python-local-imports.test.ts | 23 | 'class_target.py': 'def helper(): return 3\n', | CODE |
| LOW | …st/integration/resolvers/ipynb-python-pipeline.test.ts | 72 | 'lib.py': 'def helper():\n return 1\n', | CODE |
| LOW | …tegration/resolvers/python-namespace-semantics.test.ts | 25 | 'def helper():\n return 1\ndef _hidden():\n return 2\nclass Maker:\n def work(self):\n return 3\ | CODE |
| LOW⚡ | …tegration/resolvers/python-namespace-semantics.test.ts | 45 | 'module_target.py': 'def helper():\n return 8\n', | CODE |
| LOW⚡ | …tegration/resolvers/python-namespace-semantics.test.ts | 46 | 'class_target.py': 'def helper():\n return 9\n', | CODE |
| LOW⚡ | …tegration/resolvers/python-namespace-semantics.test.ts | 47 | 'closure_target.py': 'def helper():\n return 10\n', | CODE |
| LOW | …ation/resolvers/inferred-field-receiver-matrix.test.ts | 1424 | // could not be complete anyway — `def helper(&b) = Foo.class_eval(&b)` | COMMENT |
| LOW | gitnexus/test/integration/resolvers/python.test.ts | 4541 | 'a/__init__.py': `def helper(): | CODE |
| LOW | gitnexus/test/integration/resolvers/python.test.ts | 4547 | 'a/b/c.py': `def helper(): | CODE |
| LOW | gitnexus/src/core/ingestion/languages/ruby/captures.ts | 175 | * def helper(&blk) = Foo.class_eval(&blk) | COMMENT |
| LOW | …s/src/core/ingestion/scope-resolution/scope/walkers.ts | 1995 | // on `class U: def save(self): def helper(): ...` — helper.ownerId will | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | gitnexus-web/src/lib/mermaid-generator.ts | 29 | rawMermaid?: string; // AI-generated mermaid code (sanitized before rendering) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eval/run_eval.py | 349 | CODE | |
| LOW | eval/run_eval.py | 375 | CODE | |
| LOW | eval/workflow_bench/process_control.py | 470 | CODE | |
| LOW | eval/workflow_bench/process_control.py | 761 | CODE | |
| LOW | eval/workflow_bench/runner_sessions.py | 622 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | .github/scripts/triage/test_embedding_utils.py | 160 | # Create a tight cluster with one obvious outlier | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | gitnexus/hooks/claude/pre-tool-use.sh | 48 | # Check if we're in a GitNexus-indexed repo | COMMENT |
| LOW | eval/bridge/mcp_bridge.py | 156 | # Check if npx is available (preferred - uses local install) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eval/workflow_bench/run-evolution.sh | 8 | # Usage: | COMMENT |
| LOW | eval/bridge/gitnexus_tools.sh | 9 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | gitnexus-web/src/core/llm/agent.ts | 99 | - Don't pad with generic "let me know if you need more" — users will ask. | CODE |