Your Personal AI Assistant; easy to install, deploy on your own machine or on the cloud; supports multiple chat apps with easily extensible capabilities.
This report presents the forensic synthetic code analysis of agentscope-ai/QwenPaw, a Python project with 22,348 GitHub stars. SynthScan v2.0 examined 659,091 lines of code across 2370 source files, recording 14305 pattern matches distributed across 24 syntactic categories. The overall adjusted score of 35.3 places this repository in the Strong AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 14305 distinct pattern matches across 24 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | plugins/bundle/cloudpaw/hooks.py | 21 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/hooks.py | 23 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/hooks.py | 141 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/hooks.py | 143 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 120 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 122 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 197 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 199 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 431 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 433 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 30 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 32 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 47 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 49 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 165 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 167 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 476 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 478 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/routers/a2a.py | 443 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/routers/a2a.py | 445 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 31 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 33 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 85 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 87 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 126 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 128 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 190 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 192 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 578 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 580 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 651 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 653 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 42 | // ── Helpers ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 140 | // ── proposal_choice renderer ───────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 842 | // ── manage_prd renderer ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 1121 | // ── A2A Remote Agent Management Page ────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 1321 | // ── Alias validation ────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 1375 | // ── Alias editing ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 1502 | // ── Batch import handlers ───────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 2351 | // ── a2a_call tool renderer ─────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 2795 | // ── A2A command stream interceptor (control-command path) ────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 3039 | // ── Register plugin ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/ui/src/index.ts | 3057 | // ── Ensure CloudPaw-Master is selected on first install ─────────── | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/ui/src/index.ts | 3061 | // ── Patchable module overrides (QwenPaw ≥ 1.1.4b1) ───────────────── | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/ui/src/index.ts | 3065 | // ── Activate A2A command stream interceptor ──────────────────────── | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/ui/src/index.ts | 3070 | // ── First-install default agent selection ──────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 3165 | // ── Welcome & Theme customisation via configProvider monkey-patch ────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/modules/a2a/client_manager.py | 218 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/modules/a2a/client_manager.py | 220 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/channel/azure_bot/channel.py | 826 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/channel/azure_bot/channel.py | 828 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/channel/azure_bot/channel.py | 1364 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/channel/azure_bot/channel.py | 1366 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 193 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 195 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 332 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 334 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 393 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 395 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 493 | # ------------------------------------------------------------------ | COMMENT |
| 3195 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 255 | def _patch_make_process_factory(patched_fn) -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/router.py | 185 | def _resolved_pet_spritesheet_path(folder: str) -> Path: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/emitter.py | 53 | def _clear_desktop_base_url_cache() -> None: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/emitter.py | 58 | def _reset_desktop_reachability_probe() -> None: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/emitter.py | 63 | def _mark_desktop_unreachable() -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 114 | def _spawn_host_port_from_env() -> tuple[str, int]: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 209 | def _resolved_desktop_base_url() -> str: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 271 | def _clear_desktop_spawn_markers() -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 332 | def _spawn_desktop_background() -> tuple[bool, str | None]: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 350 | def _spawn_desktop_background_impl() -> tuple[bool, str | None]: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 449 | def _stop_desktop_skip_reason(*, force: bool) -> str | None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 599 | def start_desktop_interactive() -> dict[str, Any]: | CODE |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 304 | def _schedule_post_event_timing( | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 147 | def try_acquire_instance_lock() -> bool: | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 245 | def _tasklist_has_no_matching_pid(stdout: str) -> bool: | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 370 | def _terminate_process_tree_unix( # pylint: disable=too-many-return-statements | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/cli.py | 109 | def command_install_default_pet(_args: argparse.Namespace) -> int: | CODE |
| LOW | …undle/qwenpaw-pet/frontend/src/watchConsoleLanguage.ts | 15 | function installLanguageSetItemHook(): void { | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/hooks.py | 428 | def _patched_build_sys_prompt(self): | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 46 | def _check_iac_model_configured() -> bool: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 239 | async def _patched_request_permission( | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 327 | def setup_tool_and_prompt_hooks() -> ( # pylint: disable=too-many-statements | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 620 | def _patch_make_process_factory(patched_fn) -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 704 | def _patch_stream_task_timeout() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 728 | def _patch_mission_master_prompt() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 761 | def _patched_build_master_prompt( | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 146 | def _write_qwenpaw_mode_to_settings() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 273 | def _initialize_agent_workspace( | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 348 | def _uninstall_agent_profiles() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 454 | def _install_workspace_skills( | CODE |
| LOW | plugins/bundle/cloudpaw/injectors.py | 12 | def inject_interaction_module() -> None: | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/plugin.py | 436 | def _patch_plugin_loader_unload() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 373 | def _install_aliyun_cli_blocking() -> bool: | CODE |
| LOW | plugins/bundle/cloudpaw/ui/src/index.ts | 171 | function splitFlatRowsIntoProposals(rows: any[][]): any[][][] { | CODE |
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 91 | def _split_flat_rows_into_proposals( | CODE |
| LOW | plugins/bundle/cloudpaw/tools/a2a_command.py | 96 | def _handle_direct_call_fallback( | CODE |
| LOW⚡ | plugins/channel/azure_bot/channel.py | 830 | def build_agent_request_from_native( | CODE |
| LOW | plugins/channel/azure_bot/channel.py | 970 | async def _resolve_attachment_for_part( | CODE |
| LOW | plugins/channel/azure_bot/channel.py | 1189 | async def _upload_and_get_attachment( | CODE |
| LOW | plugins/channel/azure_bot/channel.py | 1424 | def _store_conversation_reference( | CODE |
| LOW | plugins/tool/qwen-image/qwen_image_tool.py | 173 | def _call_multimodal_conversation( | CODE |
| LOW | website/public/docs/channels.en.md | 1762 | def build_agent_request_from_native(self, native_payload): | CODE |
| LOW | website/public/docs/channels.en.md | 1809 | def build_agent_request_from_native(self, native_payload): | CODE |
| LOW | website/public/docs/channels.zh.md | 1785 | def build_agent_request_from_native(self, native_payload): | CODE |
| LOW | website/public/docs/channels.zh.md | 1832 | def build_agent_request_from_native(self, native_payload): | CODE |
| LOW | website/src/lib/parseBlogMarkdown.ts | 26 | export function compareBlogPostsByDateDesc( | CODE |
| LOW | website/src/lib/parseBlogMarkdown.ts | 43 | export function countDeveloperDaySessions(body: string): number { | CODE |
| LOW | website/src/pages/Downloads/utils.ts | 111 | export function isRecommendedDesktopPlatform( | CODE |
| LOW | website/src/pages/Downloads/utils.ts | 153 | export function getFilesForPluginPlatform( | CODE |
| LOW⚡ | tests/conftest.py | 420 | def pytest_collection_modifyitems( | CODE |
| LOW | tests/conftest.py | 165 | def test_agent_handles_llm_error(mock_llm_provider): | STRING |
| LOW | tests/conftest.py | 206 | def test_agent_sends_formatted_message(mock_channel): | STRING |
| LOW | tests/conftest.py | 219 | def test_router_selects_correct_channel(mock_channel): | STRING |
| LOW | tests/conftest.py | 231 | def test_agent_retries_on_channel_failure(mock_channel): | STRING |
| LOW | tests/unit/routers/test_git.py | 15 | async def test_git_helper_uses_shared_command_runner( | CODE |
| LOW | tests/unit/routers/test_console_placeholder.py | 23 | def test_no_content_parts_returns_new_chat() -> None: | CODE |
| LOW⚡ | tests/unit/routers/test_console_placeholder.py | 47 | def test_dict_without_text_key_is_treated_as_media() -> None: | CODE |
| LOW⚡ | tests/unit/routers/test_console_placeholder.py | 56 | def test_dict_with_non_string_text_is_treated_as_media() -> None: | CODE |
| LOW⚡ | tests/unit/routers/test_console_placeholder.py | 63 | def test_object_with_text_attribute() -> None: | CODE |
| LOW⚡ | tests/unit/routers/test_console_placeholder.py | 70 | def test_object_with_empty_text_attribute_is_media() -> None: | CODE |
| 5338 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 176 | except Exception as exc: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 206 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 260 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 297 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 308 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_approval.py | 61 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_approval.py | 119 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_approval.py | 136 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/pet_paths.py | 23 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/pet_paths.py | 48 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/plugin.py | 64 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/plugin.py | 114 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/plugin.py | 121 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/plugin.py | 135 | except Exception: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/plugin.py | 150 | except Exception: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/plugin.py | 159 | except Exception: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/plugin.py | 165 | except Exception: | CODE |
| MEDIUM | plugins/bundle/qwenpaw-pet/emitter.py | 90 | def _read_token() -> str | None: | CODE |
| MEDIUM | plugins/bundle/qwenpaw-pet/emitter.py | 271 | def _clear_desktop_spawn_markers() -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 191 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 239 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 368 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 590 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 691 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 744 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 778 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 789 | except Exception as exc: | CODE |
| LOW | …/bundle/qwenpaw-pet/qwenpaw_pet_desktop/pet_package.py | 148 | except Exception: | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 37 | except Exception: | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 192 | except Exception: | CODE |
| MEDIUM | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 124 | def clear_spawn_claim() -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/cli.py | 45 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 39 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 47 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 109 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/routers_setup.py | 67 | except Exception as e: | CODE |
| LOW | plugins/bundle/cloudpaw/routers_setup.py | 99 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/routers_setup.py | 111 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/routers_setup.py | 125 | except Exception as e: | CODE |
| MEDIUM | plugins/bundle/cloudpaw/hooks.py | 506 | def _patched_stream_query(self, request, *args, **kwargs): | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/hooks.py | 385 | except Exception as e: | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/hooks.py | 391 | except Exception as e: | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/hooks.py | 394 | except Exception as e: | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/hooks.py | 410 | except Exception as e: | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/hooks.py | 416 | except Exception as e: | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/hooks.py | 419 | except Exception as e: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 56 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 99 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 511 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 569 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 625 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 39 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 89 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 158 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 174 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 321 | except Exception as e: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 377 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 395 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 414 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 426 | except Exception as exc: | CODE |
| 1712 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 17 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/patch_approval.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/pet_paths.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/router.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 4 | CODE | |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/server.py | 4 | CODE | |
| LOW | …/bundle/qwenpaw-pet/qwenpaw_pet_desktop/pet_package.py | 4 | CODE | |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 4 | CODE | |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/cli.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 4 | CODE | |
| LOW | plugins/bundle/cloudpaw/routers/a2a.py | 15 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/a2a_command.py | 2 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/a2a_config_helper.py | 8 | CODE | |
| LOW | plugins/bundle/cloudpaw/prompts/master_prompt.py | 11 | CODE | |
| LOW | …/skills/terraform-cli-setup/scripts/setup_terraform.py | 14 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/gateway_adapter.py | 9 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/call_stream.py | 14 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/client_manager.py | 9 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/auth_interceptor.py | 9 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/auth_interceptor.py | 14 | CODE | |
| LOW | plugins/channel/azure_bot/auth.py | 4 | CODE | |
| LOW | plugins/channel/azure_bot/channel.py | 5 | CODE | |
| LOW | plugins/channel/azure_bot/__init__.py | 4 | CODE | |
| LOW | tests/unit/routers/test_git.py | 3 | CODE | |
| LOW | tests/unit/routers/test_console_placeholder.py | 11 | CODE | |
| LOW | tests/unit/routers/test_settings.py | 4 | CODE | |
| LOW | tests/unit/app/conftest.py | 3 | CODE | |
| LOW | tests/unit/app/test_task_tracker.py | 16 | CODE | |
| LOW | tests/unit/app/test_approval_scope.py | 8 | CODE | |
| LOW | tests/unit/app/test_backup_route_helpers.py | 2 | CODE | |
| LOW | tests/unit/app/test_mcp_background_startup.py | 5 | CODE | |
| LOW | tests/unit/app/routers/conftest.py | 11 | CODE | |
| LOW | tests/unit/app/routers/test_messages_router.py | 11 | CODE | |
| LOW | tests/unit/app/routers/test_config_router.py | 17 | CODE | |
| LOW | tests/unit/app/routers/test_provider_oauth_router.py | 4 | CODE | |
| LOW | tests/unit/app/routers/test_agents_router.py | 13 | CODE | |
| LOW | tests/unit/app/routers/test_healthz.py | 4 | CODE | |
| LOW | tests/unit/app/routers/test_skills_router.py | 17 | CODE | |
| LOW | tests/unit/app/inbox/test_inbox_store.py | 11 | CODE | |
| LOW | tests/unit/app/inbox/test_inbox_trace_store.py | 14 | CODE | |
| LOW | tests/unit/app/auth/test_client_ip.py | 7 | CODE | |
| LOW | tests/unit/app/chats/test_utils.py | 2 | CODE | |
| LOW | tests/unit/app/chats/test_session.py | 13 | CODE | |
| LOW | tests/unit/app/chats/test_repo.py | 3 | CODE | |
| LOW | tests/unit/app/chats/test_models.py | 2 | CODE | |
| LOW | tests/unit/app/chats/test_manager.py | 8 | CODE | |
| LOW | tests/unit/app/crons/test_heartbeat.py | 2 | CODE | |
| LOW | tests/unit/app/crons/test_models.py | 2 | CODE | |
| LOW | tests/unit/app/crons/test_manager.py | 13 | CODE | |
| LOW | tests/unit/app/crons/test_json_repo.py | 3 | CODE | |
| LOW | tests/unit/app/approvals/test_service.py | 13 | CODE | |
| LOW | tests/unit/app/approvals/test_display.py | 12 | CODE | |
| LOW | tests/unit/app/approvals/test_driver_gate.py | 10 | CODE | |
| LOW | tests/unit/app/approvals/test_models.py | 10 | CODE | |
| LOW | tests/unit/app/channels/test_renderer.py | 13 | CODE | |
| LOW | tests/unit/app/channels/test_renderer.py | 18 | CODE | |
| LOW | tests/unit/app/channels/test_renderer.py | 19 | CODE | |
| LOW | tests/unit/app/channels/test_access_control.py | 4 | CODE | |
| LOW | tests/unit/app/channels/test_command_registry.py | 4 | CODE | |
| 1382 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …re-demo/thinking-log-middleware/thinking_log_plugin.py | 0 | always create the middleware (unconditional activation). | STRING |
| HIGH | website/public/docs/plugins.zh.md | 0 | always create the middleware (unconditional activation). | STRING |
| HIGH | website/public/docs/plugins.en.md | 0 | always create the middleware (unconditional activation). | STRING |
| HIGH | …s/middleware-demo/tracing-middleware/tracing_plugin.py | 0 | logs tool call name, input, and execution duration. | STRING |
| HIGH | website/public/docs/plugins.zh.md | 0 | logs tool call name, input, and execution duration. | STRING |
| HIGH | website/public/docs/plugins.en.md | 0 | logs tool call name, input, and execution duration. | STRING |
| HIGH | …s/middleware-demo/tracing-middleware/tracing_plugin.py | 0 | create tracingmiddleware when qwenpaw_trace env var is set. | STRING |
| HIGH | website/public/docs/plugins.zh.md | 0 | create tracingmiddleware when qwenpaw_trace env var is set. | STRING |
| HIGH | website/public/docs/plugins.en.md | 0 | create tracingmiddleware when qwenpaw_trace env var is set. | STRING |
| HIGH | tests/unit/channels/test_voice.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_imessage.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_telegram.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_xiaoyi.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_feishu.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_mqtt.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_qq.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_wecom.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_discord.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_mattermost.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_voice.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_telegram.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_feishu.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_mqtt.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_qq.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_wecom.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_discord.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_mattermost.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_xiaoyi.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_imessage.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_telegram.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_xiaoyi.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_mqtt.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_wecom.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_mattermost.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | tests for dingtalkchannel initialization and factory methods. verifies correct storage of configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_feishu.py | 0 | tests for dingtalkchannel initialization and factory methods. verifies correct storage of configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_qq.py | 0 | tests for dingtalkchannel initialization and factory methods. verifies correct storage of configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | tests for dingtalkchannel initialization and factory methods. verifies correct storage of configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | constructor should store advanced configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_mqtt.py | 0 | constructor should store advanced configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_qq.py | 0 | constructor should store advanced configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_wecom.py | 0 | constructor should store advanced configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | constructor should store advanced configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_mattermost.py | 0 | constructor should store advanced configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | constructor should create required locks for thread safety. | STRING |
| HIGH | tests/unit/channels/test_feishu.py | 0 | constructor should create required locks for thread safety. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | constructor should create required locks for thread safety. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | from_env should read advanced environment variables. | STRING |
| HIGH | tests/unit/channels/test_mqtt.py | 0 | from_env should read advanced environment variables. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | from_env should read advanced environment variables. | STRING |
| HIGH | tests/unit/channels/test_mattermost.py | 0 | from_env should read advanced environment variables. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | starting disabled channel should succeed without action. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | starting disabled channel should succeed without action. | STRING |
| HIGH | tests/unit/channels/test_mattermost.py | 0 | starting disabled channel should succeed without action. | STRING |
| HIGH | tests/integration/test_acp_runner.py | 0 | module-scoped mock openai server with tool_call support. | STRING |
| HIGH | tests/integration/test_cron_execution.py | 0 | module-scoped mock openai server with tool_call support. | STRING |
| 100 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …re-demo/thinking-log-middleware/thinking_log_plugin.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | …s/middleware-demo/tracing-middleware/tracing_plugin.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/server.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 377 | def set_state(self, state: str) -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/cloudpaw/routers_setup.py | 6 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/hooks.py | 18 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 483 | def _setup_a2a_query_rewrite() -> None: # pylint: disable=too-many-statements | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 90 | def _update_pool_manifest(pool_dir: Path) -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/tools/manage_prd.py | 14 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/channel/azure_bot/auth.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/channel/azure_bot/channel.py | 39 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/channel/azure_bot/__init__.py | 6 | __all__ = ["AzureBotChannel"] | CODE |
| LOW | plugins/channel/azure_bot/plugin.py | 8 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/tool/qwen-image/qwen_image_tool.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/tool/qwen-image/qwen_image.py | 10 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/tool/wan27/wan27.py | 10 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/tool/wan27/wan27_tool.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/tool/gpt-image2/gpt_image2_tool.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/tool/gpt-image2/gpt_image2.py | 10 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/unit/app/test_mcp_background_startup.py | 35 | def set_mcp_manager(self, manager) -> None: | CODE |
| LOW | tests/contract/__init__.py | 89 | __all__ = [ | CODE |
| LOW | tests/contract/channels/__init__.py | 322 | __all__ = ["ChannelContractTest"] | CODE |
| LOW | e2e/config/__init__.py | 7 | __all__ = [ | CODE |
| LOW | e2e/tests/test_voice.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_backups.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_cross_module.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_security.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/conftest.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_debug.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_plugins.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_inbox.py | 28 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_login.py | 18 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_agent_stats.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_sessions.py | 30 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_environments.py | 28 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_heartbeat.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_cronjobs.py | 31 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_channels.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_slash_commands.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_files.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_chat.py | 30 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_skills.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_models.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_coding.py | 31 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_memory.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_runtime_config.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_acp.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_tools.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_mcp.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_token_usage.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/tests/test_agents.py | 28 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/tests/test_skill_pool.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/utils/__init__.py | 26 | __all__ = [ | CODE |
| LOW | e2e/utils/report_generator.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | e2e/utils/helpers.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/pages/models_page.py | 16 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/pages/skills_page.py | 16 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/pages/backups_page.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | e2e/pages/base_page.py | 16 | logger = logging.getLogger(__name__) | CODE |
| 525 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 440 | # Step 1: Lock versions initially | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 443 | # Step 2: Update to latest within constraints | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 446 | # Step 3: Review changes | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 449 | # Step 4: Commit lock file | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 483 | # Step 1: Add for_each, keep count commented | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 484 | # Step 2: Add moved blocks for each resource | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 485 | # Step 3: Run terraform plan (should show "moved" not "destroy/create") | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 486 | # Step 4: Apply changes | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 487 | # Step 5: Remove commented count | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 509 | # Step 1: Create secret in AWS Secrets Manager (outside Terraform) | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 512 | # Step 2: Update Terraform to use data sources | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 513 | # Step 3: Use write-only argument (Terraform 1.11+) | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 514 | # Step 4: Remove random_password resource or variable | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 515 | # Step 5: Apply and verify secret not in state | COMMENT |
| LOW | …paw/skills/terraform-skill/references/code-patterns.md | 616 | # Step 1: Lock versions in versions.tf | COMMENT |
| LOW⚡ | …paw/skills/terraform-skill/references/code-patterns.md | 628 | # Step 2: Generate lock file (commit this) | COMMENT |
| LOW⚡ | …paw/skills/terraform-skill/references/code-patterns.md | 632 | # Step 3: Update providers when needed | COMMENT |
| LOW⚡ | …paw/skills/terraform-skill/references/code-patterns.md | 636 | # Step 4: Review and test changes before committing | COMMENT |
| LOW | website/public/docs/cli.en.md | 354 | # Step 1: Query available sessions | COMMENT |
| LOW | website/public/docs/cli.en.md | 357 | # Step 2: Send message using queried parameters | COMMENT |
| LOW | website/public/docs/practice-agent-team.en.md | 94 | ### Step 1: Deploy AgentTeams | COMMENT |
| LOW | website/public/docs/practice-agent-team.en.md | 114 | ### Step 2: Create Agent Team | COMMENT |
| LOW | website/public/docs/practice-agent-team.en.md | 174 | ### Step 3: Assign Tasks and Observe Collaboration | COMMENT |
| LOW | website/public/docs/practice-agent-team.en.md | 192 | ### Step 4: Human-in-the-Loop and Result Retrieval | COMMENT |
| LOW | website/public/docs/channels.en.md | 1323 | ### Step 1: Create an App Registration | COMMENT |
| LOW | website/public/docs/channels.en.md | 1364 | ### Step 2: Create the Azure Bot Resource | COMMENT |
| LOW | website/public/docs/channels.en.md | 1387 | ### Step 3: Expose the Webhook Endpoint | COMMENT |
| LOW | website/public/docs/channels.en.md | 1413 | ### Step 4: Set the Messaging Endpoint | COMMENT |
| LOW | website/public/docs/channels.en.md | 1426 | ### Step 5: Enable Channels (Optional) | COMMENT |
| LOW | website/public/docs/channels.en.md | 1432 | ### Step 6: Connect to QwenPaw | COMMENT |
| LOW | website/public/docs/heartbeat.en.md | 40 | ## Step 1: Write HEARTBEAT.md | COMMENT |
| LOW | website/public/docs/heartbeat.en.md | 70 | ## Step 2: Configure heartbeat | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 40 | ### Step 2: Initialize | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 59 | ### Step 3: Start the server | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 75 | ### Step 1: Install | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 150 | ### Step 2: Initialize | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 169 | ### Step 3: Start the server | COMMENT |
| LOW | tests/integration/test_acp_runner.py | 428 | # Step 1: start | COMMENT |
| LOW | tests/integration/test_acp_runner.py | 470 | # Step 2: close (same chat_id via same target) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 349 | # Step 1: Resolve SID if missing | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 357 | # Step 2: Remove ACL entries | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 367 | # Step 3: Remove the associated junction | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 375 | # Step 4: Delete the AppContainer profile | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 382 | # Step 5: Delete the metadata JSON file (marks this container as done) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 660 | # Step 2: Remove firewall rules | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 668 | # Step 3: Delete the local user account | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 676 | # Step 4: Remove user profile directory | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 687 | # Step 5: Delete the metadata JSON file (marks this sandbox as done) | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 475 | # Step 1: Take ownership of the entire tree (handles TrustedInstaller-owned dirs) | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 486 | # Step 2: Grant Administrators full control recursively | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 504 | # Step 3: Remove the directory tree with a fallback error handler | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 571 | # Step 1: Remove ACL entries with verification and retry | COMMENT |
| LOW | scripts/review-bot/prompts.py | 25 | ## Step 1: Fetch PR Information | COMMENT |
| LOW⚡ | scripts/review-bot/prompts.py | 37 | ## Step 2: Analyze and Review | COMMENT |
| LOW⚡ | scripts/review-bot/prompts.py | 42 | ## Step 3: Output the Review Report | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 23 | # Step 0: Prerequisites | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 79 | # Step 1: Build console static assets | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 93 | # Step 2: Build PyInstaller backend | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 106 | # Step 3: Build Tauri app | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 132 | # Step 4: Collect distribution artifacts | COMMENT |
| 340 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 67 | CODE | |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 238 | CODE | |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 260 | CODE | |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 302 | CODE | |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 348 | CODE | |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 399 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 117 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 198 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/manage_prd.py | 252 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/a2a_call.py | 27 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/a2a_call.py | 353 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/a2a_call.py | 238 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/client_manager.py | 276 | CODE | |
| LOW | plugins/channel/azure_bot/channel.py | 970 | CODE | |
| LOW | plugins/channel/azure_bot/channel.py | 1522 | CODE | |
| LOW | plugins/tool/wan27/wan27_tool.py | 390 | CODE | |
| LOW | plugins/tool/gpt-image2/gpt_image2_tool.py | 22 | CODE | |
| LOW | plugins/tool/gpt-image2/gpt_image2_tool.py | 259 | CODE | |
| LOW | tests/conftest.py | 420 | CODE | |
| LOW | tests/unit/channels/test_base_core.py | 955 | CODE | |
| LOW | tests/integration/conftest.py | 303 | CODE | |
| LOW | tests/integration/test_cross_cutting_defense.py | 35 | CODE | |
| LOW | tests/integration/test_auth_real.py | 67 | CODE | |
| LOW | tests/integration/helpers.py | 394 | CODE | |
| LOW | tests/integration/test_agent_scoped_routing.py | 148 | CODE | |
| LOW | scripts/cleanup_windows_sandbox.py | 531 | CODE | |
| LOW | scripts/cleanup_windows_sandbox.py | 738 | CODE | |
| LOW | scripts/cleanup_windows_sandbox.py | 755 | CODE | |
| LOW | scripts/verify/desktop_verify.py | 784 | CODE | |
| LOW | scripts/verify/desktop_verify.py | 260 | CODE | |
| LOW | scripts/review-bot/review_runner.py | 35 | CODE | |
| LOW | scripts/review-bot/review_runner.py | 57 | CODE | |
| LOW | scripts/review-bot/review_runner.py | 200 | CODE | |
| LOW | scripts/pack/generate_plugin_metadata.py | 290 | CODE | |
| LOW | scripts/startup_profile/tracer.py | 30 | CODE | |
| LOW | scripts/startup_profile/analyze.py | 180 | CODE | |
| LOW | e2e/conftest.py | 166 | CODE | |
| LOW | e2e/conftest.py | 292 | CODE | |
| LOW | e2e/conftest.py | 392 | CODE | |
| LOW | e2e/tests/test_voice.py | 142 | CODE | |
| LOW | e2e/tests/test_backups.py | 245 | CODE | |
| LOW | e2e/tests/test_backups.py | 919 | CODE | |
| LOW | e2e/tests/test_cross_module.py | 84 | CODE | |
| LOW | e2e/tests/test_security.py | 278 | CODE | |
| LOW | e2e/tests/test_security.py | 430 | CODE | |
| LOW | e2e/tests/test_security.py | 629 | CODE | |
| LOW | e2e/tests/test_security.py | 881 | CODE | |
| LOW | e2e/tests/conftest.py | 56 | CODE | |
| LOW | e2e/tests/test_agent_stats.py | 49 | CODE | |
| LOW | e2e/tests/test_agent_stats.py | 580 | CODE | |
| LOW | e2e/tests/test_sessions.py | 586 | CODE | |
| LOW | e2e/tests/test_environments.py | 627 | CODE | |
| LOW | e2e/tests/test_environments.py | 920 | CODE | |
| LOW | e2e/tests/test_environments.py | 1007 | CODE | |
| LOW | e2e/tests/test_cronjobs.py | 59 | CODE | |
| LOW | e2e/tests/test_cronjobs.py | 161 | CODE | |
| LOW | e2e/tests/test_cronjobs.py | 605 | CODE | |
| LOW | e2e/tests/test_channels.py | 545 | CODE | |
| LOW | e2e/tests/test_slash_commands.py | 65 | CODE | |
| LOW | e2e/tests/test_files.py | 326 | CODE | |
| 513 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/integration/test_acp_runner.py | 428 | # Step 1: start | COMMENT |
| LOW | tests/integration/test_acp_runner.py | 470 | # Step 2: close (same chat_id via same target) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 349 | # Step 1: Resolve SID if missing | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 357 | # Step 2: Remove ACL entries | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 367 | # Step 3: Remove the associated junction | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 375 | # Step 4: Delete the AppContainer profile | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 382 | # Step 5: Delete the metadata JSON file (marks this container as done) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 660 | # Step 2: Remove firewall rules | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 668 | # Step 3: Delete the local user account | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 676 | # Step 4: Remove user profile directory | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 687 | # Step 5: Delete the metadata JSON file (marks this sandbox as done) | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 475 | # Step 1: Take ownership of the entire tree (handles TrustedInstaller-owned dirs) | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 486 | # Step 2: Grant Administrators full control recursively | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 504 | # Step 3: Remove the directory tree with a fallback error handler | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 571 | # Step 1: Remove ACL entries with verification and retry | COMMENT |
| LOW | scripts/review-bot/prompts.py | 25 | ## Step 1: Fetch PR Information | COMMENT |
| LOW⚡ | scripts/review-bot/prompts.py | 37 | ## Step 2: Analyze and Review | COMMENT |
| LOW⚡ | scripts/review-bot/prompts.py | 42 | ## Step 3: Output the Review Report | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 23 | # Step 0: Prerequisites | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 79 | # Step 1: Build console static assets | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 93 | # Step 2: Build PyInstaller backend | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 106 | # Step 3: Build Tauri app | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 132 | # Step 4: Collect distribution artifacts | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 60 | # Step 1: Navigate to voice transcription page | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 64 | # Step 2: Verify page loaded (voice page has no breadcrumb) | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 70 | # Step 3: Verify page title | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 76 | # Step 4: Verify and interact with voice service config controls | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 94 | # Step 5: Verify config form | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 100 | # Step 6: Verify controls are clickable/interactable | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 146 | # Step 1: Navigate to voice transcription page | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 150 | # Step 2: Find voice service config control | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 208 | # Step 4: Verify save button enabled and click save | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 218 | # Step 5: Restore original state | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 252 | # Step 4: Verify save | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 256 | # Step 5: Restore original state | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 306 | # Step 1: Navigate to voice transcription page | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 310 | # Step 2: Verify Twilio or voice config area | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 359 | # Step 4: Verify save button exists and is enabled | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 368 | # Step 5: Verify Webhook URL display | COMMENT |
| LOW | e2e/tests/test_voice.py | 111 | # Step 7: Verify save button exists | COMMENT |
| LOW | e2e/tests/test_voice.py | 186 | # Step 3: Switch to another option | COMMENT |
| LOW | e2e/tests/test_voice.py | 241 | # Step 3: Toggle switch | COMMENT |
| LOW | e2e/tests/test_voice.py | 324 | # Step 3: Verify config fields and test input | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 58 | # Step 1: Open the Security page | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 62 | # Step 2: Verify breadcrumb | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 74 | # Step 3: Verify the tabs exist | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 85 | # Step 4: Verify the Tool Guard tab is active by default | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 94 | # Step 5: Verify the Tool Guard enable switch and toggle it | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 116 | # Step 6: Verify the protected-tools dropdown exists | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 122 | # Step 7: Switch to the File Guard tab | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 131 | # Step 8: Verify the File Guard enable switch | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 138 | # Step 9: Verify the File Guard path input | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 171 | # Step 1: Open the Security page | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 175 | # Step 2: Switch to the File Guard tab | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 185 | # Step 3: Verify the add-button initial state (should be disabled on empty input) | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 192 | # Step 4: Type a path and verify the add-button state changes | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 204 | # Step 5: Clear the input | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 212 | # Step 6: Switch back to the Tool Guard tab | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 221 | # Step 7: Click the protected-tools dropdown to expand it | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 282 | # Step 1: Open the Security page | COMMENT |
| 283 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | plugins/tool/qwen-image/qwen_image_tool.py | 66 | Resolve an image path or URL to a usable string. If the input is an HTTP/HTTPS URL, return it as-is. If the inp | STRING |
| HIGH | plugins/tool/qwen-image/qwen_image_tool.py | 142 | Download image from URL and save to local directory. Args: image_url: Public URL of the image. save | STRING |
| HIGH | plugins/tool/wan27/wan27_tool.py | 43 | Resolve an image path or URL to a usable URL. If the input is an HTTP/HTTPS URL, return it as-is. If the input | STRING |
| HIGH | plugins/tool/wan27/wan27_tool.py | 115 | Download video from URL and save to local directory. Args: video_url: Public URL of the video. save | STRING |
| HIGH | plugins/tool/gpt-image2/gpt_image2_tool.py | 558 | Convert image path/URL to API format. Args: image_path: Web URL or local file path Returns: di | STRING |
| HIGH | e2e/utils/helpers.py | 143 | Wait for a condition to be satisfied. Args: condition_func: Condition function; returning a truthy val | STRING |
| HIGH | e2e/utils/helpers.py | 172 | Retry an operation. Args: operation_func: Operation function max_retries: Maximum number of re | STRING |
| HIGH | e2e/pages/chat_page.py | 223 | Send a message (strict-validation version). Strictly isolated from the previous round: 1. Snap | STRING |
| HIGH | src/qwenpaw/drivers/handlers/mcp_stateful_client.py | 373 | Call a tool on the MCP server. Args: name: Tool name arguments: Tool arguments (optiona | STRING |
| HIGH | src/qwenpaw/app/multi_agent_manager.py | 55 | Get agent workspace by ID (lazy loading with dedup). If workspace doesn't exist in memory, it will be created a | STRING |
| HIGH | src/qwenpaw/app/utils.py | 19 | Resolve *user_path* under *root* and reject path-traversal attempts. Uses :py:meth:`Path.is_relative_to` instead of | STRING |
| HIGH | src/qwenpaw/app/utils.py | 49 | Build a project destination directory under *base* from *name*. Validates that *name* is a single path component (n | STRING |
| HIGH | src/qwenpaw/app/agent_context.py | 49 | Get agent workspace for current request. Priority: 1. agent_id parameter (explicit override) 2. request.sta | STRING |
| HIGH | src/qwenpaw/app/routers/plugins.py | 110 | Return the directory that contains plugin.json. Args: base: Root of the extracted archive Returns: | STRING |
| HIGH | src/qwenpaw/app/routers/mcp_oauth.py | 213 | Discover OAuth endpoints via RFC 9728 + RFC 8414 / OIDC discovery. Args: mcp_url: Remote MCP server URL | STRING |
| HIGH | src/qwenpaw/app/routers/tools.py | 272 | Toggle tool enabled status for active agent. Args: tool_name: Tool function name request: FastAPI r | STRING |
| HIGH | src/qwenpaw/app/routers/tools.py | 318 | Update tool async_execution setting for active agent. Args: tool_name: Tool function name async_exe | STRING |
| HIGH | src/qwenpaw/app/routers/tools.py | 424 | Update tool configuration. Args: tool_name: Tool function name body: Configuration update r | STRING |
| HIGH | src/qwenpaw/app/routers/messages.py | 21 | Get MultiAgentManager from app state. Args: request: FastAPI request object Returns: MultiAgen | STRING |
| HIGH | src/qwenpaw/app/routers/messages.py | 85 | Send a text message to a channel. This endpoint allows agents to proactively send messages to users via configu | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 39 | Get the chat manager for the active agent. Args: request: FastAPI request object Returns: Chat | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 57 | Get the session for the active agent. Args: request: FastAPI request object Returns: SafeJSONS | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 239 | Get detailed information about a specific chat by UUID. Args: request: FastAPI request (for agent context) | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 299 | Update an existing chat. Args: chat_id: Chat UUID spec: Partial chat update payload mgr: Ch | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 326 | Delete a chat by UUID. Note: This only deletes the chat spec (UUID mapping). JSONSession state is NOT deleted. | STRING |
| HIGH | src/qwenpaw/app/chats/manager.py | 256 | Archive a single chat. Idempotent: already-archived chats are returned unchanged (archived_at is NOT refreshed). | STRING |
| HIGH | src/qwenpaw/app/approvals/service.py | 401 | Block and wait for approval decision with timeout. Args: request_id: Approval request ID | STRING |
| HIGH | src/qwenpaw/app/channels/command_registry.py | 100 | Register command to priority level. Args: command_prefix: Command prefix (e.g. "/stop") | STRING |
| HIGH | src/qwenpaw/app/channels/command_registry.py | 141 | Check if query is a registered control command. Args: query: User query (e.g. "/stop" or "normal qu | STRING |
| HIGH | src/qwenpaw/app/channels/command_registry.py | 180 | Get priority level for a query. Args: query: User query (e.g. "/stop" or "normal question") | STRING |
| HIGH | src/qwenpaw/app/channels/command_registry.py | 225 | Get priority name from level number. Args: level: Priority level number Returns: | STRING |
| HIGH | src/qwenpaw/app/channels/manager.py | 583 | Get health status for a specific channel. Args: channel_name: Channel identifier (e.g. "dingtalk", | STRING |
| HIGH | src/qwenpaw/app/channels/manager.py | 611 | Restart a single channel by stopping and re-starting it. The channel is stopped, then a fresh instance is creat | STRING |
| HIGH | src/qwenpaw/app/channels/wechat/client.py | 163 | Block until QR code is confirmed or timeout. Args: qrcode: QR code string from get_bot_qrcode(). | STRING |
| HIGH | src/qwenpaw/app/channels/wechat/utils.py | 30 | Decrypt AES-128-ECB encrypted bytes. Args: data: Encrypted bytes (from CDN). key_b64: AES key — acc | STRING |
| HIGH | src/qwenpaw/config/config.py | 2336 | Load agent's complete configuration from workspace/agent.json with mtime-based caching. Uses file modification | STRING |
| HIGH | src/qwenpaw/plugins/loader.py | 175 | Load plugin manifest from JSON file. Args: manifest_path: Path to plugin.json Returns: | STRING |
| HIGH | src/qwenpaw/plugins/loader.py | 520 | Load a single plugin. Args: manifest: Plugin manifest source_path: Path to plugin direc | STRING |
| HIGH | src/qwenpaw/plugins/loader.py | 900 | Copy plugin files, install deps, and load plugin at runtime. The plugin directory is copied into ``install_dir` | STRING |
| HIGH | src/qwenpaw/plugins/architecture.py | 194 | Create a manifest from a ``plugin.json`` dictionary. Thin wrapper around :meth:`model_validate` kept for backwa | STRING |
| HIGH | src/qwenpaw/runtime/commands/control/__init__.py | 208 | Dispatch control command to appropriate handler. Args: query: User query (e.g. "/stop session=123") | STRING |
| HIGH | src/qwenpaw/runtime/commands/control/base.py | 64 | Handle the control command. Args: context: Control command context Returns: Re | STRING |
| HIGH | src/qwenpaw/agents/command_handler.py | 1101 | Process conversation system commands. Args: query: Command string (e.g., "/compact", "/new", "/mess | STRING |
| HIGH | src/qwenpaw/agents/model_factory.py | 259 | Format a video block for OpenAI-compatible API. Local files are converted to base64 data URLs; web URLs are pas | STRING |
| HIGH | src/qwenpaw/agents/memory/base_memory_manager.py | 474 | Return the memory manager class for the given backend name. If the backend is not registered, falls back to the fir | STRING |
| HIGH | src/qwenpaw/agents/utils/file_handling.py | 32 | Read text file with multiple encoding attempts for cross-platform compatibility. This function handles files cr | STRING |
| HIGH | src/qwenpaw/cli/plugin_commands.py | 461 | Download and extract plugin from URL. Args: url: Plugin zip file URL Returns: Tuple of (plugin | STRING |
| HIGH | src/qwenpaw/sandbox/linux_sandbox.py | 133 | Create a Landlock ruleset and return its fd. Args: handled_access_fs: Bitmask of filesystem access rights t | STRING |
| HIGH | src/qwenpaw/sandbox/windows_sandbox.py | 116 | Creates an AppContainer profile and returns its SID string. Calls ``userenv.dll:CreateAppContainerProfile``. If the | STRING |
| HIGH | src/qwenpaw/sandbox/windows_sandbox.py | 227 | Converts a PSID pointer to its string representation. Args: psid: Pointer to a SID structure. advap | STRING |
| HIGH | src/qwenpaw/sandbox/windows_sandbox.py | 261 | Converts a SID string to a PSID pointer. Args: sid_string: SID in string form (e.g. ``S-1-15-2-...``). | STRING |
| HIGH | src/qwenpaw/sandbox/windows_sandbox.py | 735 | Builds SECURITY_CAPABILITIES and proc thread attribute list. Args: kernel32: Pre-loaded kernel32 DLL handle | STRING |
| HIGH | src/qwenpaw/sandbox/windows_sandbox.py | 873 | Launches a process inside the AppContainer via ``CreateProcessW``. Creates stdout/stderr pipes, builds a ``SECURITY | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | tests/unit/sandbox/test_windows_restricted_sandbox.py | 310 | # First character accessible via .value is empty (first null) | COMMENT |
| HIGH | tests/unit/sandbox/test_bubblewrap_sandbox.py | 87 | f"deny_path file not masked with /dev/null, args={args}", | CODE |
| HIGH | scripts/verify/desktop_verify.py | 409 | btnDisabled = disabledByAttr || disabledByCls; | CODE |
| HIGH | scripts/verify/desktop_verify.py | 452 | if (btnRecovered && hasRealText) { | CODE |
| HIGH | e2e/pages/coding_page.py | 268 | # If the project-select modal pops up (project_dir undefined), | COMMENT |
| HIGH | e2e/pages/chat_page.py | 534 | if (btnEnabled && hasRealText) { | STRING |
| HIGH | src/qwenpaw/app/_app.py | 876 | "`npm ci && npm run build` in the `console/` " | CODE |
| HIGH | src/qwenpaw/app/routers/coding_project.py | 129 | Pass ``{"path": null}`` to reset to the default workspace directory. | STRING |
| HIGH | src/qwenpaw/config/config.py | 1361 | "Optional explicit cloud model slot; when null, uses " | CODE |
| HIGH | src/qwenpaw/agents/tools/shell.py | 507 | (`cd /repo && pytest`). | STRING |
| HIGH | …wenpaw/agents/skills/pptx-zh/scripts/office/soffice.py | 151 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-zh/scripts/office/soffice.py | 170 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-zh/scripts/office/soffice.py | 179 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-zh/scripts/office/soffice.py | 193 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-en/scripts/office/soffice.py | 151 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-en/scripts/office/soffice.py | 170 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-en/scripts/office/soffice.py | 179 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-en/scripts/office/soffice.py | 193 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-en/scripts/office/soffice.py | 151 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-en/scripts/office/soffice.py | 170 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-en/scripts/office/soffice.py | 179 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-en/scripts/office/soffice.py | 193 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-zh/scripts/office/soffice.py | 151 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-zh/scripts/office/soffice.py | 170 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-zh/scripts/office/soffice.py | 179 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-zh/scripts/office/soffice.py | 193 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-en/scripts/office/soffice.py | 153 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-en/scripts/office/soffice.py | 172 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-en/scripts/office/soffice.py | 181 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-en/scripts/office/soffice.py | 195 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-zh/scripts/office/soffice.py | 153 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-zh/scripts/office/soffice.py | 172 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-zh/scripts/office/soffice.py | 181 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-zh/scripts/office/soffice.py | 195 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | src/qwenpaw/agents/acp/__init__.py | 47 | # can't follow ``__getattr__`` so it flags them as undefined; runtime is | COMMENT |
| HIGH | src/qwenpaw/cli/doctor_fix_runner.py | 8 | ``rebuild-console-npm`` runs ``npm ci && npm run build`` under ``console/`` | STRING |
| HIGH | src/qwenpaw/cli/doctor_cmd.py | 261 | " Build: `npm ci && npm run build` in the `console/` " | CODE |
| HIGH | src/qwenpaw/sandbox/macos_sandbox.py | 185 | # Always allow /dev/null, /dev/zero, /dev/tty, /tmp | COMMENT |
| HIGH | src/qwenpaw/sandbox/bubblewrap_sandbox.py | 7 | - /dev is a minimal synthetic devtmpfs (null, zero, urandom, tty, etc.) | STRING |
| HIGH | src/qwenpaw/market/providers/clawhub.py | 153 | # /skills carries no owner or logo, so both stay null; the search | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/unit/channels/test_feishu.py | 2892 | mock_client.im.v1.message.areply.assert_called_once() | CODE |
| CRITICAL⚡ | src/qwenpaw/app/channels/feishu/channel.py | 2220 | resp = await self._client.cardkit.v1.card.asettings(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 570 | resp = self._client.contact.v3.user.get(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 874 | resp = await self._client.im.v1.message_reaction.acreate(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 898 | resp = await self._client.im.v1.message_resource.aget(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 939 | resp = await self._client.im.v1.message_resource.aget(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1133 | resp = await self._client.im.v1.message.aget(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1365 | resp = await self._client.im.v1.image.acreate(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1430 | resp = await self._client.im.v1.file.acreate(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1506 | resp = await self._client.im.v1.message.acreate(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1561 | resp = await self._client.im.v1.message.areply(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 2079 | create_resp = await self._client.cardkit.v1.card.acreate( | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 2158 | resp = await self._client.cardkit.v1.card_element.acontent(req) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | plugins/bundle/qwenpaw-pet/emitter.py | 362 | # Create the bridge token *before* spawning so the very first | COMMENT |
| MEDIUM | tests/unit/app/chats/test_session.py | 209 | # Create the file so the empty-key check runs *after* the file-exists | COMMENT |
| MEDIUM⚡ | tests/unit/plugins/test_plugin_api_extensions.py | 276 | # Create a temp plugin with relative import | COMMENT |
| MEDIUM⚡ | tests/unit/plugins/test_plugin_api_extensions.py | 465 | # Create a fake skill | COMMENT |
| MEDIUM | tests/unit/plugins/test_plugin_api_extensions.py | 151 | # Create a fake loaded plugin record | COMMENT |
| MEDIUM | tests/unit/plugins/test_plugin_api_extensions.py | 294 | # Create a helper module | COMMENT |
| MEDIUM | tests/unit/workspace/test_prompt.py | 19 | # Create a simple AGENTS.md | COMMENT |
| MEDIUM | tests/unit/agents/utils/test_audio_transcription.py | 454 | # Create a real audio file so open() doesn't fail | COMMENT |
| MEDIUM | tests/unit/agents/utils/test_file_handling.py | 246 | # Create a file that the mock download would produce | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_telegram.py | 960 | # Create a test file | COMMENT |
| MEDIUM | tests/unit/channels/test_telegram.py | 1010 | # Create a file larger than 50MB | COMMENT |
| MEDIUM | tests/unit/channels/test_xiaoyi.py | 746 | # Create a message larger than TEXT_CHUNK_LIMIT | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 693 | # Create a mock part without url | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 725 | # Create a test file | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 752 | # Create a test file | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 802 | # Create a valid base64 data URL | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 868 | # Create a large base64 data URL | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_feishu.py | 1100 | # Create a file just over the limit | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_dingtalk.py | 3406 | # Create a response without 'data' attribute to avoid triggering | COMMENT |
| MEDIUM | tests/unit/channels/test_dingtalk.py | 1688 | # Create a test file | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_discord.py | 817 | # Create a mock request | COMMENT |
| MEDIUM | tests/unit/channels/test_discord.py | 833 | # Create a message with various content | COMMENT |
| MEDIUM | tests/unit/channels/test_mattermost.py | 1089 | # Create a test image file | COMMENT |
| MEDIUM | tests/unit/channels/test_mattermost.py | 1286 | # Create a typing task | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_base_core.py | 627 | # Create a mock that doesn't auto-create attributes | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_base_core.py | 639 | # Create a mock error with message attribute | COMMENT |
| MEDIUM | e2e/tests/test_channels.py | 392 | # Define the four channels and their expected distinctive field keywords | COMMENT |
| MEDIUM | e2e/tests/test_coding.py | 166 | # Create a project up-front to give us a real existing path. | COMMENT |
| MEDIUM | src/qwenpaw/app/channels/wechat/channel.py | 565 | # Create a per-thread HTTP client | COMMENT |
| MEDIUM | src/qwenpaw/app/channels/wechat/channel.py | 1668 | # Create the background refresh task. | COMMENT |
| MEDIUM⚡ | …wenpaw/security/skill_scanner/data/default_policy.yaml | 3 | # This file defines the built-in security policy. Every setting here can be | COMMENT |
| MEDIUM | src/qwenpaw/agents/model_factory.py | 1241 | # Create the formatter based on the model's native one. In 2.0 every | COMMENT |
| MEDIUM | src/qwenpaw/agents/tools/shell.py | 587 | # Create a copy with resolved shell and timeout to avoid mutating | COMMENT |
| MEDIUM | src/qwenpaw/cli/channels_cmd.py | 887 | # Create a temporary Config object for the interactive configurator | COMMENT |
| MEDIUM | src/qwenpaw/sandbox/windows_restricted_sandbox.py | 2557 | # Create the user profile via the Windows API (userenv.dll CreateProfile). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | website/public/docs/mcp.zh.md | 70 | "API_KEY": "your-api-key" | CODE |
| HIGH | website/public/docs/mcp.en.md | 70 | "API_KEY": "your-api-key" | CODE |
| HIGH | website/public/docs/api-tutorial.zh.md | 68 | -H "Authorization: Bearer <YOUR_TOKEN>" \ | CODE |
| HIGH | website/public/docs/api-tutorial.zh.md | 839 | -H "Authorization: Bearer <YOUR_TOKEN>" \ | CODE |
| HIGH | website/public/docs/api-tutorial.en.md | 68 | -H "Authorization: Bearer <YOUR_TOKEN>" \ | CODE |
| HIGH | website/public/docs/api-tutorial.en.md | 839 | -H "Authorization: Bearer <YOUR_TOKEN>" \ | CODE |
| HIGH | website/public/docs/channels.en.md | 1184 | --api-key <your-api-key> \ | CODE |
| HIGH | website/public/docs/channels.en.md | 1263 | "livekit_api_key": "your-api-key", | CODE |
| HIGH | website/public/docs/channels.zh.md | 1217 | --api-key <your-api-key> \ | CODE |
| HIGH | website/public/docs/channels.zh.md | 1296 | "livekit_api_key": "your-api-key", | CODE |
| HIGH⚡ | …s/unit/security/skill_scanner/test_pattern_analyzer.py | 368 | placeholder_markers={"<YOUR_API_KEY>"}, | CODE |
| HIGH⚡ | …s/unit/security/skill_scanner/test_pattern_analyzer.py | 368 | placeholder_markers={"<YOUR_API_KEY>"}, | CODE |
| HIGH | console/src/pages/Agent/MCP/index.tsx | 97 | "API_KEY": "<YOUR_API_KEY>" | CODE |
| HIGH | console/src/pages/Agent/MCP/index.tsx | 97 | "API_KEY": "<YOUR_API_KEY>" | CODE |
| HIGH | console/src/pages/Agent/MCP/index.tsx | 120 | "API_KEY": "<YOUR_API_KEY>" | CODE |
| HIGH | console/src/pages/Agent/MCP/index.tsx | 120 | "API_KEY": "<YOUR_API_KEY>" | CODE |
| HIGH⚡ | …wenpaw/security/skill_scanner/data/default_policy.yaml | 131 | - "your-api-key" | CODE |
| HIGH⚡ | …wenpaw/security/skill_scanner/data/default_policy.yaml | 132 | - "your_api_key" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 141 | # Check if it's a 2D array (all items are 10-column rows) | COMMENT |
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 161 | # Check if it's a 3D array (multiple proposals) | COMMENT |
| LOW | tests/contract/__init__.py | 81 | # Check if it's a concrete implementation (not abstract) | COMMENT |
| LOW | tests/contract/channels/__init__.py | 121 | # Check if the subclass method is different from BaseChannel's | COMMENT |
| LOW | scripts/run_tests.py | 136 | # Check if there are any Python test files | COMMENT |
| LOW | scripts/run_tests.py | 221 | # Check if pytest is installed | COMMENT |
| LOW | scripts/check-channels.sh | 43 | # Check if we're in a git repo | COMMENT |
| LOW | scripts/check-channels.sh | 61 | # Check if base.py changed | COMMENT |
| LOW | scripts/check-channels.sh | 91 | # Check if dependencies are installed | COMMENT |
| LOW | scripts/install.sh | 286 | # Check if console assets were included in the installed package | COMMENT |
| LOW | e2e/tests/test_skill_pool.py | 628 | # Check if a dialog/drawer opened, or import ran directly | COMMENT |
| LOW | src/qwenpaw/exceptions.py | 643 | # Check if has status_code attribute (typical for API errors) | COMMENT |
| LOW | src/qwenpaw/app/auth.py | 196 | # Check if token is revoked | COMMENT |
| LOW | src/qwenpaw/app/rate_limiter.py | 139 | # Check if IP should be locked based on rate limiting rules | COMMENT |
| LOW | src/qwenpaw/app/agent_context.py | 87 | # Check if agent exists and is enabled | COMMENT |
| LOW⚡ | src/qwenpaw/app/migration.py | 90 | # Check if already migrated | COMMENT |
| LOW | src/qwenpaw/app/migration.py | 483 | # Check if workspace already has skills | COMMENT |
| LOW | src/qwenpaw/app/routers/auth.py | 66 | # Check if user account is locked | COMMENT |
| LOW | src/qwenpaw/app/routers/auth.py | 73 | # Check if IP is locked or rate-limited | COMMENT |
| LOW | src/qwenpaw/app/crons/manager.py | 285 | # Check if dream-based memory optimization is enabled in config | COMMENT |
| LOW | src/qwenpaw/app/channels/unified_queue_manager.py | 175 | # Check if already exists | COMMENT |
| LOW | src/qwenpaw/app/channels/unified_queue_manager.py | 394 | # Check if queue is empty and idle | COMMENT |
| LOW | src/qwenpaw/app/channels/manager.py | 152 | # Check if channel is enabled | COMMENT |
| LOW | src/qwenpaw/app/channels/manager.py | 255 | # Check if payload already has normalized session_id | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 543 | # Check if there's already an active connection for this agent_id | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 1120 | # Check if adding this line would exceed limit | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 1349 | # Check if this is a reasoning/thinking message type | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 1351 | # Check if thinking is filtered | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 1411 | # Check if tool messages should be filtered | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 1560 | # Check if any part exceeds chunk limit | COMMENT |
| LOW | src/qwenpaw/app/channels/wecom/utils.py | 71 | # Check if second row is separator (contains only -, :, |, spaces) | COMMENT |
| LOW | src/qwenpaw/app/channels/wechat/channel.py | 691 | # Check if text looks like a filename (has extension) | COMMENT |
| LOW | src/qwenpaw/app/channels/wechat/channel.py | 1167 | # Check if file exists | COMMENT |
| LOW | src/qwenpaw/app/channels/qq/channel.py | 1267 | # Check if attachment is a voice message and has ASR text. | COMMENT |
| LOW⚡ | src/qwenpaw/config/config.py | 2531 | # Check if already migrated (new structure has only AgentProfileRef) | COMMENT |
| LOW⚡ | src/qwenpaw/config/config.py | 2536 | # Check if default agent config exists | COMMENT |
| LOW | …qwenpaw/security/tool_guard/guardians/rule_guardian.py | 292 | # Check if it's a flag vs an absolute path | COMMENT |
| LOW | src/qwenpaw/providers/provider_manager.py | 2404 | # Check if there's a saved configuration for this plugin provider | COMMENT |
| LOW | src/qwenpaw/runtime/commands/control/__init__.py | 8 | # Check if a query is a control command | STRING |
| LOW | src/qwenpaw/runtime/commands/control/model_handler.py | 204 | # Check if this is the active model | COMMENT |
| LOW | src/qwenpaw/agents/command_handler.py | 986 | # Check if there's a compressed summary | COMMENT |
| LOW | src/qwenpaw/agents/prompt.py | 166 | # Check if markers exist | COMMENT |
| LOW | src/qwenpaw/agents/tools/browser_control.py | 1552 | # Check if sync browser is still connected | COMMENT |
| LOW | src/qwenpaw/agents/tools/browser_control.py | 1580 | # Check if async browser is still connected | COMMENT |
| LOW | …c/qwenpaw/agents/memory/proactive/proactive_trigger.py | 168 | # Check if last message is already proactive | COMMENT |
| LOW⚡ | …qwenpaw/agents/memory/proactive/proactive_responder.py | 333 | # Check if the agent has active tasks (busy with user messages) | COMMENT |
| LOW⚡ | …qwenpaw/agents/memory/proactive/proactive_responder.py | 342 | # Check if any chat was updated since the baseline timestamp | COMMENT |
| LOW | src/qwenpaw/agents/hooks/bootstrap.py | 62 | # Check if bootstrap has already been triggered before | COMMENT |
| LOW | src/qwenpaw/cli/plugin_commands.py | 376 | # Check if tool already exists | COMMENT |
| LOW | src/qwenpaw/cli/plugin_commands.py | 437 | # Check if tool exists | COMMENT |
| LOW | src/qwenpaw/agent_stats/service.py | 305 | # Check if session is in a channel subdirectory | COMMENT |
| LOW | src/qwenpaw/sandbox/windows_restricted_sandbox.py | 1531 | # Check if the group already has an ACE on the Python dir by attempting | COMMENT |
| LOW | src/qwenpaw/sandbox/windows_restricted_sandbox.py | 2780 | # Set PYTHONHOME to the interpreter's prefix so that Python skips | COMMENT |
| LOW | src/qwenpaw/governance/tool_adapter.py | 267 | # Check if execution_level is "off" (dev mode) — allow pass-through | COMMENT |
| LOW | src/qwenpaw/governance/tool_adapter.py | 361 | # Check if sandbox violation was returned (state=DENIED) | COMMENT |
| LOW | src/qwenpaw/governance/detectors.py | 226 | # Check if it's actually a directory on disk | COMMENT |
| LOW | src/qwenpaw/governance/detectors.py | 401 | # Check if rule applies to this tool | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 48 | "placeholder": ("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"), | CODE |
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 55 | "placeholder": "App Password (Client Secret)", | CODE |
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 62 | "placeholder": ("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"), | CODE |
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 69 | "placeholder": "0.0.0.0", | CODE |
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 77 | "placeholder": "3978", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 32 | "placeholder": "sk-...", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 60 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 68 | "placeholder": "120", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 86 | "placeholder": "sk-...", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 115 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 123 | "placeholder": "120", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 32 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 40 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 48 | "placeholder": "600", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 66 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 74 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 82 | "placeholder": "600", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 100 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 108 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 116 | "placeholder": "600", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 33 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 41 | "placeholder": "https://api.openai.com/v1/images/generations", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 49 | "placeholder": "60", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 67 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 75 | "placeholder": "https://api.openai.com/v1/images/edits", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 83 | "placeholder": "60", | CODE |
| LOW | website/public/docs/plugins.zh.md | 1582 | "placeholder": "your-bot-token-here", | CODE |
| LOW | website/public/docs/plugins.en.md | 1599 | "placeholder": "your-bot-token-here", | CODE |
| LOW | tests/integration/test_backup.py | 418 | files={"_": ("placeholder", b"", "text/plain")}, | CODE |
| LOW | console/src/locales/zh.json | 139 | "placeholder": "后端日志会显示在这里。", | CODE |
| LOW | console/src/locales/zh.json | 2130 | "placeholder": "搜索消息...", | CODE |
| LOW | console/src/locales/ja.json | 93 | "placeholder": "バックエンドログがここに表示されます。", | CODE |
| LOW | console/src/locales/ja.json | 1908 | "placeholder": "メッセージを検索...", | CODE |
| LOW | console/src/locales/ru.json | 93 | "placeholder": "Здесь появится вывод backend-логов.", | CODE |
| LOW | console/src/locales/ru.json | 1923 | "placeholder": "Поиск сообщений...", | CODE |
| LOW | console/src/locales/en.json | 139 | "placeholder": "Backend log output will appear here.", | CODE |
| LOW | console/src/locales/en.json | 2271 | "placeholder": "Search messages...", | CODE |
| LOW | console/src/locales/pt-BR.json | 95 | "placeholder": "Backend log output will appear here.", | CODE |
| LOW | console/src/locales/pt-BR.json | 2151 | "placeholder": "Pesquisar messages...", | CODE |
| LOW | console/src/locales/vi.json | 266 | "placeholder": "Nội dung nhật ký sẽ hiển thị ở đây.", | CODE |
| LOW | console/src/locales/vi.json | 621 | "placeholder": "Chọn mô hình", | CODE |
| LOW | console/src/locales/id.json | 228 | "placeholder": "Cari pesan...", | CODE |
| LOW | console/src/locales/id.json | 956 | "placeholder": "Output log backend akan muncul di sini.", | CODE |
| LOW | src/qwenpaw/app/channels/feishu/utils.py | 98 | placeholder = item.get("placeholder") | CODE |
| LOW | …/skill_scanner/rules/signatures/hardcoded_secrets.yaml | 17 | - "placeholder" | CODE |
| LOW | …/skill_scanner/rules/signatures/hardcoded_secrets.yaml | 78 | - "placeholder" | CODE |
| LOW | …/skill_scanner/rules/signatures/hardcoded_secrets.yaml | 112 | - "placeholder" | CODE |
| LOW⚡ | …wenpaw/security/skill_scanner/data/default_policy.yaml | 130 | - "placeholder" | CODE |
| LOW⚡ | …wenpaw/security/skill_scanner/data/default_policy.yaml | 147 | - "placeholder" | CODE |
| LOW | src/qwenpaw/plugins/api.py | 533 | ... "placeholder": "xoxb-...", | STRING |
| LOW⚡ | …/agents/skills/himalaya-zh/references/configuration.md | 9 | email = "user@example.com" | CODE |
| LOW⚡ | …/agents/skills/himalaya-zh/references/configuration.md | 18 | backend.login = "user@example.com" | CODE |
| LOW⚡ | …/agents/skills/himalaya-zh/references/configuration.md | 27 | message.send.backend.login = "user@example.com" | CODE |
| LOW | …/agents/skills/himalaya-zh/references/configuration.md | 143 | email = "user@example.com" | CODE |
| LOW⚡ | …/agents/skills/himalaya-en/references/configuration.md | 9 | email = "user@example.com" | CODE |
| LOW⚡ | …/agents/skills/himalaya-en/references/configuration.md | 18 | backend.login = "user@example.com" | CODE |
| LOW⚡ | …/agents/skills/himalaya-en/references/configuration.md | 27 | message.send.backend.login = "user@example.com" | CODE |
| LOW | …/agents/skills/himalaya-en/references/configuration.md | 143 | email = "user@example.com" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | plugins/bundle/cloudpaw/hooks.py | 401 | # A2A tools: register for orchestration agent | COMMENT |
| MEDIUM | website/public/docs/quickstart.en.md | 425 | #### 👥 Create multi-agent | COMMENT |
| MEDIUM | tests/unit/agents/test_acp_available_commands.py | 712 | # The model context window and the compaction threshold flow through so the | COMMENT |
| MEDIUM⚡ | src/qwenpaw/app/_app.py | 741 | # Stop multi-agent manager (stops all agents and their components) | COMMENT |
| MEDIUM⚡ | src/qwenpaw/app/migration.py | 92 | # 1. Multiple agents already exist (multi-agent config), OR | COMMENT |
| MEDIUM | src/qwenpaw/app/routers/messages.py | 117 | # Get multi-agent manager from app state (via request) | COMMENT |
| MEDIUM⚡ | src/qwenpaw/app/channels/sip/livekit_backend.py | 152 | # Room connection (event-driven) | COMMENT |
| MEDIUM⚡ | src/qwenpaw/modes/mission/prompts.py | 11 | # Master prompt — injected into the *main* agent that orchestrates the loop. | COMMENT |
| MEDIUM | src/qwenpaw/agents/acp/server.py | 1092 | # context window. This is distinct from the cumulative ``tok`` | COMMENT |
| MEDIUM | src/qwenpaw/local_models/manager.py | 240 | # application, you might want to use a dependency injection framework. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/qwenpaw-pet/requirements.txt | 1 | # Keep in sync with plugin.json -> dependencies. | COMMENT |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 21 | logger = logging.getLogger("qwenpaw.pet_desktop") | COMMENT |
| LOW | plugins/bundle/qwenpaw-pet/frontend/src/index.tsx | 1 | // React and antd are injected by the QwenPaw console host at runtime; | COMMENT |
| LOW | plugins/bundle/cloudpaw/hooks.py | 141 | # --------------------------------------------------------------------------- | COMMENT |
| LOW | tests/unit/agents/__init__.py | 1 | # -*- coding: utf-8 -*- | COMMENT |
| LOW | tests/unit/agents/tools/__init__.py | 1 | # -*- coding: utf-8 -*- | COMMENT |
| LOW | tests/unit/channels/test_base_core.py | 1421 | COMMENT | |
| LOW | tests/unit/channels/test_base_core.py | 1441 | # Unit Test Contract Test | COMMENT |
| LOW | tests/contract/channels/test_dingtalk_contract.py | 161 | "_processing_message_ids_lock", | COMMENT |
| LOW | tests/contract/channels/test_dingtalk_contract.py | 181 | # - Dev modifies BaseChannel.send_media() signature | COMMENT |
| LOW | scripts/docker_build.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/check-channels.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/verify/requirements-verify.txt | 1 | # Dependencies for scripts/verify/desktop_verify.py UI drivers. | COMMENT |
| LOW | scripts/verify/desktop_verify.py | 381 | time.sleep(0.5) | COMMENT |
| LOW | .github/workflows/full-tests-nightly.yml | 1 | name: Full Tests Nightly | COMMENT |
| LOW | .github/workflows/pr-preview-tests.yml | 1 | name: PR preview tests | COMMENT |
| LOW | e2e/scripts/start_test_server.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | console/src-tauri/src/backend_download.rs | 321 | COMMENT | |
| LOW | console/src/plugins/types/qwenpaw.d.ts | 281 | renderers: Record<string, React.FC<Record<string, unknown>>>, | COMMENT |
| LOW | console/src/pages/Inbox/hooks/useInboxData.test.ts | 241 | // updater runs after the await resolves, so the synchronous return value | COMMENT |
| LOW | src/qwenpaw/constant.py | 381 | TOOL_GUARD_APPROVAL_HEARTBEAT_INTERVAL = max( | COMMENT |
| LOW | src/qwenpaw/config/utils.py | 801 | COMMENT | |
| LOW | …ecurity/tool_guard/rules/dangerous_shell_commands.yaml | 1 | # Dangerous Shell Command Detection Rules | COMMENT |
| LOW | src/qwenpaw/agents/command_handler.py | 21 | from agentscope.agent import Agent | COMMENT |
| LOW | src/qwenpaw/agents/model_factory.py | 621 | else: | COMMENT |
| LOW | src/qwenpaw/agents/model_factory.py | 1241 | # Create the formatter based on the model's native one. In 2.0 every | COMMENT |
| LOW | src/qwenpaw/agents/tools/utils.py | 301 | # at the cut boundary without raising an exception. | COMMENT |
| LOW | src/qwenpaw/agents/context/scroll/manager.py | 341 | reserve, | COMMENT |
| LOW | src/qwenpaw/agents/context/scroll/manager.py | 381 | ) | COMMENT |
| LOW | src/qwenpaw/agents/utils/message_processing.py | 461 | # already pointing at ``media_dir``. Skip the dict-based | COMMENT |
| LOW | src/qwenpaw/cli/doctor_checks.py | 721 | # Stale *.lock scan disabled — see _STALE_LOCK_SECS comment above. | COMMENT |
| LOW | src/qwenpaw/cli/tui/app.py | 241 | self._inspection_mode = False | COMMENT |
| LOW | src/qwenpaw/cli/tui/widgets/status_bar.py | 41 | COMMENT | |
| LOW | src/qwenpaw/sandbox/windows_restricted_sandbox.py | 3261 | # are cleaned up even if the FastAPI lifespan teardown is bypassed (e.g. | COMMENT |
| LOW | src/qwenpaw/governance/resource_governor.py | 361 | # can write there; the policy ALLOW rule alone is not enough for | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/cloudpaw/tools/manage_prd.py | 252 | CODE | |
| LOW | plugins/channel/azure_bot/channel.py | 95 | CODE | |
| LOW | tests/unit/app/conftest.py | 121 | CODE | |
| LOW | tests/unit/app/approvals/test_service.py | 42 | CODE | |
| LOW | tests/unit/app/approvals/test_driver_gate.py | 49 | CODE | |
| LOW | tests/integration/helpers.py | 225 | CODE | |
| LOW | e2e/pages/inbox_page.py | 167 | CODE | |
| LOW | e2e/pages/cronjobs_page.py | 162 | CODE | |
| LOW | src/qwenpaw/app/routers/agent_scoped.py | 64 | CODE | |
| LOW | src/qwenpaw/app/chats/utils.py | 62 | CODE | |
| LOW | src/qwenpaw/app/channels/base.py | 121 | CODE | |
| LOW | src/qwenpaw/app/channels/dingtalk/channel.py | 126 | CODE | |
| LOW | src/qwenpaw/app/channels/yuanbao/channel.py | 132 | CODE | |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 353 | CODE | |
| LOW | src/qwenpaw/app/channels/feishu/channel.py | 208 | CODE | |
| LOW | src/qwenpaw/app/channels/wecom/channel.py | 135 | CODE | |
| LOW | src/qwenpaw/app/channels/wechat/channel.py | 74 | CODE | |
| LOW | src/qwenpaw/app/channels/telegram/channel.py | 307 | CODE | |
| LOW | src/qwenpaw/app/channels/slack/channel.py | 129 | CODE | |
| LOW | src/qwenpaw/app/channels/mattermost/channel.py | 101 | CODE | |
| LOW | src/qwenpaw/app/channels/onebot/channel.py | 57 | CODE | |
| LOW | src/qwenpaw/app/channels/imessage/channel.py | 42 | CODE | |
| LOW | src/qwenpaw/app/channels/mqtt/channel.py | 36 | CODE | |
| LOW | src/qwenpaw/app/channels/discord_/channel.py | 53 | CODE | |
| LOW | src/qwenpaw/app/channels/matrix/channel.py | 185 | CODE | |
| LOW | src/qwenpaw/app/channels/qq/channel.py | 651 | CODE | |
| LOW | src/qwenpaw/runtime/tool_registry.py | 170 | CODE | |
| LOW | src/qwenpaw/runtime/builder.py | 36 | CODE | |
| LOW | src/qwenpaw/agents/react_agent.py | 59 | CODE | |
| LOW | src/qwenpaw/agents/command_handler.py | 112 | CODE | |
| LOW | src/qwenpaw/agents/middlewares.py | 347 | CODE | |
| LOW | src/qwenpaw/agents/tools/browser_control.py | 2233 | CODE | |
| LOW | src/qwenpaw/agents/tools/browser_control.py | 4853 | CODE | |
| LOW | src/qwenpaw/agents/tools/utils.py | 454 | CODE | |
| LOW | src/qwenpaw/agents/context/scroll/recall_tool.py | 200 | CODE | |
| LOW | src/qwenpaw/governance/audit.py | 245 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/unit/agents/context/test_scroll_manager.py | 856 | # The harness split the span into numbered sections for the model. | COMMENT |
| LOW⚡ | tests/unit/channels/test_dingtalk.py | 874 | # Should not raise, just return | COMMENT |
| MEDIUM | tests/integration/test_console_chat_task.py | 161 | # rather than a specific value to remain robust. | COMMENT |
| MEDIUM | e2e/pages/coding_page.py | 219 | # filtering by visibility is more robust. | COMMENT |
| MEDIUM | console/package-lock.json | 9872 | "resolved": "https://registry.npmmirror.com/robust-predicates/-/robust-predicates-3.0.2.tgz", | CODE |
| LOW | src/qwenpaw/app/routers/config.py | 417 | # For custom channels, just use the dict | COMMENT |
| MEDIUM | …qwenpaw/security/tool_guard/guardians/rule_guardian.py | 197 | # Use a more robust approach to split commands while respecting quotes | COMMENT |
| MEDIUM | src/qwenpaw/providers/openai_chat_model_compat.py | 576 | """OpenAIChatModel with robust parsing for malformed tool-call chunks | STRING |
| MEDIUM | src/qwenpaw/agents/context/scroll/manager.py | 53 | # sections (each a real seq sub-range the harness owns) and have one model call | COMMENT |
| MEDIUM | src/qwenpaw/cli/update_cmd.py | 36 | """Return robust text-decoding settings for subprocess output. | STRING |
| MEDIUM | src/qwenpaw/sandbox/macos_sandbox.py | 41 | # TODO: this remains a heuristic. A robust solution would be to read | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .github/workflows/issue-welcome.yml | 107 | `> Our [contribution policy](https://github.com/${context.repo.owner}/${context.repo.repo}/issues/4333 | CODE |
| HIGH | .github/workflows/pr-welcome.yml | 98 | `> Our [contribution policy](https://github.com/${context.repo.owner}/${context.repo.repo}/issues/4333 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/contract/providers/test_provider_contract.py | 92 | # Example usage: | COMMENT |
| LOW | scripts/check-channels.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/pack-tauri/build_pyinstaller.sh | 5 | # Usage: | COMMENT |
| LOW | e2e/scripts/start_test_server.sh | 4 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/pr-welcome.yml | 320 | comment += `Great job using the PR template! Don't forget to fill in the **Testing** section with how to | CODE |
| LOW | .github/workflows/pr-welcome.yml | 404 | comment += `Great job using the PR template! Don't forget to fill in the **Testing** section with how to | CODE |
| LOW | src/qwenpaw/modes/mission/prompts.py | 531 | - Gotchas encountered (e.g., "don't forget to update Z when changing W") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/unit/channels/test_dingtalk.py | 1470 | CODE |