Your Personal AI Assistant; easy to install, deploy on your own machine or on the cloud; supports multiple chat apps with easily extensible capabilities.
This report presents the forensic synthetic code analysis of agentscope-ai/QwenPaw, a Python project with 34,611 GitHub stars. SynthScan v2.0 examined 1,295,254 lines of code across 4211 source files, recording 24802 pattern matches distributed across 24 syntactic categories. The overall adjusted score of 27.3 places this repository in the Moderate AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 24802 distinct pattern matches across 24 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | plugins/bundle/cloudpaw/hooks.py | 22 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/hooks.py | 24 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/hooks.py | 142 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/hooks.py | 144 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 121 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 123 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 186 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 188 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 420 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/plugin.py | 422 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 31 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 33 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 48 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 50 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 166 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 168 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 471 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/plugin.py | 473 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/routers/a2a.py | 443 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/routers/a2a.py | 445 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 31 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 33 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 85 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 87 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 126 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 128 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 190 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 192 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 578 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 580 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 651 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/routers/a2a.py | 653 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 42 | // ── Helpers ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 146 | // ── proposal_choice renderer ───────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 848 | // ── manage_prd renderer ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 1133 | // ── A2A Remote Agent Management Page ────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 1333 | // ── Alias validation ────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 1387 | // ── Alias editing ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 1514 | // ── Batch import handlers ───────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 2363 | // ── a2a_call tool renderer ─────────────────────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 2834 | // ── A2A command stream interceptor (control-command path) ────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 3078 | // ── Register plugin ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/ui/src/index.ts | 3096 | // ── Ensure CloudPaw-Master is selected on first install ─────────── | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/ui/src/index.ts | 3100 | // ── Patchable module overrides (QwenPaw ≥ 1.1.4b1) ───────────────── | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/ui/src/index.ts | 3104 | // ── Activate A2A command stream interceptor ──────────────────────── | COMMENT |
| MEDIUM⚡ | plugins/bundle/cloudpaw/ui/src/index.ts | 3109 | // ── First-install default agent selection ──────────────────────────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/ui/src/index.ts | 3204 | // ── Welcome & Theme customisation via configProvider monkey-patch ────── | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/modules/a2a/client_manager.py | 218 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/cloudpaw/modules/a2a/client_manager.py | 220 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/bundle/omp_workflows/shared/constants.py | 6 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | plugins/bundle/omp_workflows/shared/constants.py | 9 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/channel/azure_bot/channel.py | 820 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/channel/azure_bot/channel.py | 822 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/channel/azure_bot/channel.py | 1358 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | plugins/channel/azure_bot/channel.py | 1360 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 190 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 192 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 326 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 328 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | plugins/channel/azure_bot/channel.py | 387 | # ------------------------------------------------------------------ | COMMENT |
| 4046 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 255 | def _patch_make_process_factory(patched_fn) -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/router.py | 185 | def _resolved_pet_spritesheet_path(folder: str) -> Path: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/emitter.py | 53 | def _clear_desktop_base_url_cache() -> None: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/emitter.py | 58 | def _reset_desktop_reachability_probe() -> None: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/emitter.py | 63 | def _mark_desktop_unreachable() -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 114 | def _spawn_host_port_from_env() -> tuple[str, int]: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 209 | def _resolved_desktop_base_url() -> str: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 271 | def _clear_desktop_spawn_markers() -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 332 | def _spawn_desktop_background() -> tuple[bool, str | None]: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 350 | def _spawn_desktop_background_impl() -> tuple[bool, str | None]: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 449 | def _stop_desktop_skip_reason(*, force: bool) -> str | None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 599 | def start_desktop_interactive() -> dict[str, Any]: | CODE |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 304 | def _schedule_post_event_timing( | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 147 | def try_acquire_instance_lock() -> bool: | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 245 | def _tasklist_has_no_matching_pid(stdout: str) -> bool: | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 370 | def _terminate_process_tree_unix( # pylint: disable=too-many-return-statements | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/cli.py | 109 | def command_install_default_pet(_args: argparse.Namespace) -> int: | CODE |
| LOW | …undle/qwenpaw-pet/frontend/src/watchConsoleLanguage.ts | 15 | function installLanguageSetItemHook(): void { | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 47 | def _check_iac_model_configured() -> bool: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 251 | async def _patched_request_permission( | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 543 | def setup_tool_and_prompt_hooks() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 577 | def _patch_mission_master_prompt() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 618 | def _patched_build_master_prompt( | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 146 | def _write_qwenpaw_mode_to_settings() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 274 | def _initialize_agent_workspace( | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 349 | def _uninstall_agent_profiles() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 455 | def _install_workspace_skills( | CODE |
| LOW | plugins/bundle/cloudpaw/injectors.py | 12 | def inject_interaction_module() -> None: | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/plugin.py | 425 | def _patch_plugin_loader_unload() -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 362 | def _install_aliyun_cli_blocking() -> bool: | CODE |
| LOW | plugins/bundle/cloudpaw/ui/src/index.ts | 177 | function splitFlatRowsIntoProposals(rows: any[][]): any[][][] { | CODE |
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 91 | def _split_flat_rows_into_proposals( | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 106 | def _packaged_build_fingerprint() -> dict[str, str | None]: | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 172 | def _native_host_support_paths() -> list[Path]: | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 189 | def _resolve_host_interpreter() -> str: | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 204 | def _windows_batch_path_literal(value: str) -> str: | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 214 | def native_host_launcher_path( | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 226 | def recover_windows_native_host_launcher( | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 356 | def _write_local_extension_config( | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 397 | def _write_install_mode_state( | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 409 | def _read_install_mode_state_data( | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 429 | def _check_native_host_runtime( | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 497 | def _native_host_repair_instruction(probe: dict[str, object]) -> str: | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 829 | def _find_windows_chrome_executable() -> Path | None: | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 873 | def open_chrome_extensions_page( | CODE |
| LOW | plugins/bundle/chrome/transport/state.py | 22 | def get_nm_bridge_route_state() -> NMBridgeRouteState: | CODE |
| LOW | plugins/bundle/chrome/api/routes.py | 61 | def _write_private_bridge_config( | CODE |
| LOW | plugins/bundle/chrome/api/routes.py | 103 | def _setup_extension_files_serially( | CODE |
| LOW | plugins/bundle/chrome/api/routes.py | 171 | async def open_local_extension_folder() -> dict[str, str | bool | None]: | CODE |
| LOW | …ndle/chrome/assets/extensions/chrome/service_worker.js | 198 | async function removeTabProtocolMetadata(tabId) { | CODE |
| LOW | …ndle/chrome/assets/extensions/chrome/service_worker.js | 1191 | function isLocalQwenPawExternalOrigin(origin) { | CODE |
| LOW | plugins/bundle/chrome/assets/scripts/nm_host.py | 260 | async def connect_websocket_with_retry( | CODE |
| LOW | plugins/bundle/chrome/assets/scripts/nm_host.py | 372 | async def _run_single_backend_bridge( | CODE |
| LOW | plugins/bundle/omp_workflows/shared/fork_guard.py | 64 | def merge_blocked_continuation(protocol: str) -> str: | STRING |
| LOW | plugins/bundle/computer-use/plugin.py | 80 | def _seed_tool_for_existing_agents() -> None: | CODE |
| LOW | plugins/bundle/computer-use/computer_use/client.py | 616 | async def stop_computer_use_session(session_id: str) -> bool: | CODE |
| LOW | plugins/bundle/computer-use/computer_use/client.py | 635 | def known_computer_use_sessions() -> list[str]: | CODE |
| LOW | plugins/bundle/computer-use/computer_use/client.py | 647 | async def stop_all_computer_use_turns() -> int: | CODE |
| LOW | plugins/bundle/computer-use/computer_use/access.py | 186 | def get_computer_use_access_store() -> ComputerUseAccessStore: | CODE |
| LOW | …gins/bundle/computer-use/computer_use/feature_state.py | 101 | def get_computer_use_feature_state() -> ComputerUseFeatureState: | CODE |
| 11998 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 17 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/patch_approval.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/pet_paths.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/router.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 4 | CODE | |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/server.py | 4 | CODE | |
| LOW | …/bundle/qwenpaw-pet/qwenpaw_pet_desktop/pet_package.py | 4 | CODE | |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 4 | CODE | |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/cli.py | 4 | CODE | |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 4 | CODE | |
| LOW | plugins/bundle/cloudpaw/a2a_mode.py | 7 | CODE | |
| LOW | plugins/bundle/cloudpaw/a2a_mode.py | 20 | CODE | |
| LOW | plugins/bundle/cloudpaw/routers/a2a.py | 15 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/a2a_config_helper.py | 8 | CODE | |
| LOW | plugins/bundle/cloudpaw/prompts/master_prompt.py | 11 | CODE | |
| LOW | …/skills/terraform-cli-setup/scripts/setup_terraform.py | 14 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/gateway_adapter.py | 9 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/call_stream.py | 14 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/client_manager.py | 9 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/auth_interceptor.py | 9 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/auth_interceptor.py | 14 | CODE | |
| LOW | plugins/bundle/chrome/extension_setup.py | 4 | CODE | |
| LOW | plugins/bundle/chrome/plugin.py | 4 | CODE | |
| LOW | plugins/bundle/chrome/transport/state.py | 4 | CODE | |
| LOW | plugins/bundle/chrome/api/routes.py | 5 | CODE | |
| LOW | plugins/bundle/chrome/assets/scripts/handshake.py | 4 | CODE | |
| LOW | plugins/bundle/chrome/assets/scripts/nm_host.py | 5 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultraqa/prompts.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultraqa/mode.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultraqa/mode.py | 19 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultraqa/mode.py | 21 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultraqa/gate.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultrawork/prompts.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultrawork/mode.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultrawork/mode.py | 18 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultrawork/mode.py | 20 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultrawork/gate.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/ralph/prompts.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/ralph/mode.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/ralph/mode.py | 19 | CODE | |
| LOW | plugins/bundle/omp_workflows/ralph/mode.py | 21 | CODE | |
| LOW | plugins/bundle/omp_workflows/ralph/gate.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/shared/constants.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/shared/mode_base.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/shared/role_prompts.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/shared/fork_guard.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/shared/args.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/shared/loop_ui_i18n.py | 8 | CODE | |
| LOW | plugins/bundle/omp_workflows/shared/state.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/team/prompts.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/team/mode.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/team/mode.py | 21 | CODE | |
| LOW | plugins/bundle/omp_workflows/team/mode.py | 23 | CODE | |
| LOW | plugins/bundle/omp_workflows/team/gate.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/autopilot/prompts.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/autopilot/mode.py | 4 | CODE | |
| LOW | plugins/bundle/omp_workflows/autopilot/mode.py | 19 | CODE | |
| LOW | plugins/bundle/omp_workflows/autopilot/mode.py | 21 | CODE | |
| LOW | plugins/bundle/omp_workflows/autopilot/gate.py | 4 | CODE | |
| 2715 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 176 | except Exception as exc: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 206 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 260 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 297 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_runner.py | 308 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_approval.py | 61 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_approval.py | 119 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/patch_approval.py | 136 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/pet_paths.py | 23 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/pet_paths.py | 48 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/plugin.py | 64 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/plugin.py | 114 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/plugin.py | 121 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/plugin.py | 135 | except Exception: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/plugin.py | 150 | except Exception: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/plugin.py | 159 | except Exception: | CODE |
| LOW⚡ | plugins/bundle/qwenpaw-pet/plugin.py | 165 | except Exception: | CODE |
| MEDIUM | plugins/bundle/qwenpaw-pet/emitter.py | 90 | def _read_token() -> str | None: | CODE |
| MEDIUM | plugins/bundle/qwenpaw-pet/emitter.py | 271 | def _clear_desktop_spawn_markers() -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 191 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 239 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 368 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 590 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 691 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 744 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 778 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 789 | except Exception as exc: | CODE |
| LOW | …/bundle/qwenpaw-pet/qwenpaw_pet_desktop/pet_package.py | 148 | except Exception: | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 37 | except Exception: | CODE |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 192 | except Exception: | CODE |
| MEDIUM | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 124 | def clear_spawn_claim() -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/cli.py | 45 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 39 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 47 | except Exception: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 109 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 57 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 100 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 395 | except Exception as _import_exc: # noqa: BLE001 pylint: disable=broad-except | CODE |
| LOW | plugins/bundle/cloudpaw/hooks.py | 476 | except Exception as exc: # noqa: BLE001 pylint: disable=broad-except | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 39 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 89 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 158 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 174 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 322 | except Exception as e: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 378 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 396 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 415 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 427 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 451 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 488 | except Exception as e: | CODE |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 510 | except Exception as exc: | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/plugin.py | 117 | except Exception as exc: | CODE |
| LOW⚡ | plugins/bundle/cloudpaw/plugin.py | 182 | except Exception as e: | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 70 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 239 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 263 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 313 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 357 | except Exception as exc: | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 405 | except Exception: | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 457 | except Exception as exc: | CODE |
| 2440 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …re-demo/thinking-log-middleware/thinking_log_plugin.py | 0 | always create the middleware (unconditional activation). | STRING |
| HIGH | website/public/docs/plugins.zh.md | 0 | always create the middleware (unconditional activation). | STRING |
| HIGH | website/public/docs/plugins.en.md | 0 | always create the middleware (unconditional activation). | STRING |
| HIGH | …s/middleware-demo/tracing-middleware/tracing_plugin.py | 0 | logs tool call name, input, and execution duration. | STRING |
| HIGH | website/public/docs/plugins.zh.md | 0 | logs tool call name, input, and execution duration. | STRING |
| HIGH | website/public/docs/plugins.en.md | 0 | logs tool call name, input, and execution duration. | STRING |
| HIGH | …s/middleware-demo/tracing-middleware/tracing_plugin.py | 0 | create tracingmiddleware when qwenpaw_trace env var is set. | STRING |
| HIGH | website/public/docs/plugins.zh.md | 0 | create tracingmiddleware when qwenpaw_trace env var is set. | STRING |
| HIGH | website/public/docs/plugins.en.md | 0 | create tracingmiddleware when qwenpaw_trace env var is set. | STRING |
| HIGH | …pps/qwenpaw-creator/backend/api/project_file_routes.py | 0 | neutralize cr/lf in user-provided values before logging. | STRING |
| HIGH | …s/qwenpaw-creator/backend/api/file_execution_routes.py | 0 | neutralize cr/lf in user-provided values before logging. | STRING |
| HIGH | …pps/qwenpaw-creator/backend/api/file_session_routes.py | 0 | neutralize cr/lf in user-provided values before logging. | STRING |
| HIGH | …ins/apps/qwenpaw-creator/backend/api/project_routes.py | 0 | neutralize cr/lf in user-provided values before logging. | STRING |
| HIGH | …/apps/qwenpaw-creator/backend/api/file_asset_routes.py | 0 | neutralize cr/lf in user-provided values before logging. | STRING |
| HIGH | …ugins/apps/qwenpaw-creator/backend/api/model_routes.py | 0 | neutralize cr/lf in user-provided values before logging. | STRING |
| HIGH | …reator/backend/services/media_files/local_execution.py | 0 | neutralize cr/lf in user-provided values before logging. | STRING |
| HIGH | …-creator/backend/services/file_agent_runtime/driver.py | 0 | neutralize cr/lf in user-provided values before logging. | STRING |
| HIGH | tests/unit/sandbox/test_windows_elevated_sandbox.py | 0 | test execute() method with mocked process creation. | STRING |
| HIGH | tests/unit/sandbox/test_windows_appcontainer_sandbox.py | 0 | test execute() method with mocked process creation. | STRING |
| HIGH | tests/unit/sandbox/test_windows_unelevated_sandbox.py | 0 | test execute() method with mocked process creation. | STRING |
| HIGH | tests/unit/sandbox/test_windows_elevated_sandbox.py | 0 | successful command returns exit_code=0, no violation. | STRING |
| HIGH | tests/unit/sandbox/test_windows_appcontainer_sandbox.py | 0 | successful command returns exit_code=0, no violation. | STRING |
| HIGH | tests/unit/sandbox/test_windows_unelevated_sandbox.py | 0 | successful command returns exit_code=0, no violation. | STRING |
| HIGH | tests/unit/sandbox/test_windows_elevated_sandbox.py | 0 | access denied in stderr → sandbox_violation is populated. | STRING |
| HIGH | tests/unit/sandbox/test_windows_appcontainer_sandbox.py | 0 | access denied in stderr → sandbox_violation is populated. | STRING |
| HIGH | tests/unit/sandbox/test_windows_unelevated_sandbox.py | 0 | access denied in stderr → sandbox_violation is populated. | STRING |
| HIGH | tests/unit/channels/test_voice.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_imessage.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_telegram.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_xiaoyi.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_feishu.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_mqtt.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_qq.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_wecom.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_discord.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_mattermost.py | 0 | constructor should store all basic configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_voice.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_telegram.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_feishu.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_mqtt.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_qq.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_wecom.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_discord.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_mattermost.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_xiaoyi.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_imessage.py | 0 | constructor should initialize internal data structures. | STRING |
| HIGH | tests/unit/channels/test_telegram.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_xiaoyi.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_mqtt.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_wecom.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_mattermost.py | 0 | get_to_handle_from_request should fallback to user_id. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | tests for dingtalkchannel initialization and factory methods. verifies correct storage of configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_feishu.py | 0 | tests for dingtalkchannel initialization and factory methods. verifies correct storage of configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_qq.py | 0 | tests for dingtalkchannel initialization and factory methods. verifies correct storage of configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_dingtalk.py | 0 | tests for dingtalkchannel initialization and factory methods. verifies correct storage of configuration parameters. | STRING |
| HIGH | tests/unit/channels/test_wechat.py | 0 | constructor should store advanced configuration parameters. | STRING |
| 153 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …re-demo/thinking-log-middleware/thinking_log_plugin.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | …s/middleware-demo/tracing-middleware/tracing_plugin.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/server.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 377 | def set_state(self, state: str) -> None: | CODE |
| LOW | plugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/app.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/cloudpaw/a2a_mode.py | 182 | __all__ = ["A2AMode"] | CODE |
| LOW | plugins/bundle/cloudpaw/plugin.py | 91 | def _update_pool_manifest(pool_dir: Path) -> None: | CODE |
| LOW | plugins/bundle/cloudpaw/tools/manage_prd.py | 14 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 263 | def set_value(self, key_path: str, value: str) -> None: | CODE |
| LOW | plugins/bundle/chrome/extension_setup.py | 274 | def set_value(self, key_path: str, value: str) -> None: | CODE |
| LOW | plugins/bundle/chrome/plugin.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/chrome/transport/state.py | 27 | __all__ = ["NMBridgeRouteState", "get_nm_bridge_route_state"] | CODE |
| LOW | plugins/bundle/chrome/assets/scripts/handshake.py | 134 | __all__ = [ | CODE |
| LOW | plugins/bundle/chrome/assets/scripts/nm_host.py | 156 | def _set_binary_stdio() -> None: | CODE |
| LOW | plugins/bundle/omp_workflows/ultraqa/mode.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/omp_workflows/ultrawork/mode.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/omp_workflows/ralph/mode.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/omp_workflows/shared/mode_base.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/omp_workflows/shared/mode_base.py | 131 | __all__ = ["OMPModeBase", "info_msg", "rewrite_user_msg"] | CODE |
| LOW | plugins/bundle/omp_workflows/shared/state.py | 14 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/omp_workflows/team/mode.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/omp_workflows/autopilot/mode.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/computer-use/computer_use/__init__.py | 11 | __all__ = ["computer_use"] | CODE |
| LOW | plugins/bundle/computer-use/computer_use/lifecycle.py | 28 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/bundle/computer-use/computer_use/lifecycle.py | 53 | __all__ = ["ComputerUseTurnEndHook"] | CODE |
| LOW | …gins/bundle/computer-use/computer_use/feature_state.py | 49 | def set_enabled(self, value: bool) -> None: | CODE |
| LOW | …bundle/computer-use/computer_use/transport/__init__.py | 8 | __all__ = [ | CODE |
| LOW | plugins/channel/azure_bot/auth.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/channel/azure_bot/channel.py | 40 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/channel/azure_bot/__init__.py | 6 | __all__ = ["AzureBotChannel"] | CODE |
| LOW | plugins/channel/azure_bot/plugin.py | 8 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/apps/agent-kanban/backend/main.py | 36 | logger = logging.getLogger(__name__) | CODE |
| LOW | plugins/apps/qwenpaw-data/backend/config.py | 405 | def set_context_env_vars() -> None: | CODE |
| LOW | plugins/apps/qwenpaw-data/backend/main.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | …w-creator/backend/tests/prompts/test_prompt_surface.py | 180 | def _set_image_model(monkeypatch, name: str) -> None: | CODE |
| LOW | …w-creator/backend/tests/prompts/test_prompt_surface.py | 184 | def _set_video_model(monkeypatch, name: str) -> None: | CODE |
| LOW | plugins/apps/qwenpaw-creator/backend/utils/__init__.py | 9 | __all__ = [ | CODE |
| LOW | plugins/apps/qwenpaw-creator/backend/utils/logger.py | 271 | __all__ = [ | CODE |
| LOW | …/apps/qwenpaw-creator/backend/models/provider_tasks.py | 105 | __all__ = [ | CODE |
| LOW | …gins/apps/qwenpaw-creator/backend/models/text_model.py | 319 | __all__ = ["chat_completion"] | CODE |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/s2v_model.py | 399 | __all__ = [ | CODE |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/tts_model.py | 566 | __all__ = [ | CODE |
| LOW | …pps/qwenpaw-creator/backend/models/tts_capabilities.py | 138 | __all__ = [ | CODE |
| LOW | …s/qwenpaw-creator/backend/models/video_capabilities.py | 1343 | __all__ = [ | CODE |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/asr_model.py | 1101 | __all__ = ["ASRResult", "ASRSegment", "transcribe"] | CODE |
| LOW | …qwenpaw-creator/backend/models/dashscope_multimodal.py | 46 | __all__ = ["DashScopeNativeDataBlock", "DashScopeNativeFormatter"] | CODE |
| LOW | …/apps/qwenpaw-creator/backend/models/native_content.py | 141 | __all__ = ["native_content_blocks"] | CODE |
| LOW | …/apps/qwenpaw-creator/backend/models/image/__init__.py | 32 | __all__ = [ | CODE |
| LOW | plugins/apps/qwenpaw-creator/backend/schemas/skills.py | 50 | __all__ = [ | CODE |
| LOW | …/apps/qwenpaw-creator/backend/schemas/render_review.py | 126 | __all__ = [ | CODE |
| LOW | …ins/apps/qwenpaw-creator/backend/schemas/run_review.py | 109 | __all__ = [ | CODE |
| LOW | …creator/backend/api/file_source_intelligence_routes.py | 134 | __all__ = ["router"] | CODE |
| LOW | …pps/qwenpaw-creator/backend/api/content_disposition.py | 41 | __all__ = ["inline_content_disposition"] | CODE |
| LOW | …s/qwenpaw-creator/backend/api/file_execution_routes.py | 711 | __all__ = ["router"] | CODE |
| LOW | …pps/qwenpaw-creator/backend/api/file_session_routes.py | 715 | __all__ = ["router"] | CODE |
| LOW | …/apps/qwenpaw-creator/backend/api/file_media_routes.py | 710 | __all__ = ["router"] | CODE |
| LOW | …/apps/qwenpaw-creator/backend/api/file_asset_routes.py | 1918 | __all__ = ["router"] | CODE |
| LOW | …ps/qwenpaw-creator/backend/api/observability_routes.py | 71 | __all__ = ["router"] | CODE |
| LOW | …/apps/qwenpaw-creator/backend/api/work_graph_routes.py | 126 | __all__ = ["router"] | CODE |
| LOW | plugins/apps/qwenpaw-creator/backend/domain/__init__.py | 14 | __all__ = [ | CODE |
| 869 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 67 | CODE | |
| LOW | …ugins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/window.py | 238 | CODE | |
| LOW | …gins/bundle/qwenpaw-pet/qwenpaw_pet_desktop/runtime.py | 260 | CODE | |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 303 | CODE | |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 349 | CODE | |
| LOW | plugins/bundle/cloudpaw/agents_setup.py | 400 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 117 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 198 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/manage_prd.py | 254 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/a2a_call.py | 27 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/a2a_call.py | 353 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/a2a_call.py | 238 | CODE | |
| LOW | plugins/bundle/cloudpaw/modules/a2a/client_manager.py | 276 | CODE | |
| LOW | plugins/bundle/chrome/extension_setup.py | 829 | CODE | |
| LOW | plugins/bundle/omp_workflows/ultraqa/mode.py | 79 | CODE | |
| LOW | plugins/bundle/omp_workflows/ralph/mode.py | 79 | CODE | |
| LOW | plugins/bundle/computer-use/computer_use/client.py | 125 | CODE | |
| LOW | …le/computer-use/computer_use/transport/windows_pipe.py | 473 | CODE | |
| LOW | plugins/channel/azure_bot/channel.py | 964 | CODE | |
| LOW | plugins/channel/azure_bot/channel.py | 1516 | CODE | |
| LOW | plugins/apps/agent-kanban/backend/main.py | 411 | CODE | |
| LOW | plugins/apps/agent-kanban/backend/main.py | 460 | CODE | |
| LOW | plugins/apps/agent-kanban/backend/main.py | 735 | CODE | |
| LOW | plugins/apps/agent-kanban/backend/main.py | 809 | CODE | |
| LOW | plugins/apps/agent-kanban/backend/main.py | 1088 | CODE | |
| LOW | plugins/apps/agent-kanban/backend/main.py | 1127 | CODE | |
| LOW | plugins/apps/qwenpaw-data/docker/seed/seed.py | 178 | CODE | |
| LOW | plugins/apps/qwenpaw-creator/backend/main.py | 318 | CODE | |
| LOW | plugins/apps/qwenpaw-creator/backend/dev_main.py | 44 | CODE | |
| LOW | …reator/backend/tests/media_files/test_motion_design.py | 189 | CODE | |
| LOW | …pps/qwenpaw-creator/backend/utils/structured_output.py | 18 | CODE | |
| LOW | plugins/apps/qwenpaw-creator/backend/utils/retry.py | 16 | CODE | |
| LOW | plugins/apps/qwenpaw-creator/backend/utils/retry.py | 22 | CODE | |
| LOW | …/apps/qwenpaw-creator/backend/utils/remote_download.py | 56 | CODE | |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/vlm_model.py | 366 | CODE | |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/vlm_model.py | 427 | CODE | |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/vlm_model.py | 516 | CODE | |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/vlm_model.py | 844 | CODE | |
| LOW | plugins/apps/qwenpaw-creator/backend/models/config.py | 122 | CODE | |
| LOW | plugins/apps/qwenpaw-creator/backend/models/config.py | 145 | CODE | |
| LOW | …apps/qwenpaw-creator/backend/models/embedding_model.py | 39 | CODE | |
| LOW | …gins/apps/qwenpaw-creator/backend/models/text_model.py | 183 | CODE | |
| LOW | …ins/apps/qwenpaw-creator/backend/models/video_model.py | 569 | CODE | |
| LOW | …ins/apps/qwenpaw-creator/backend/models/concurrency.py | 24 | CODE | |
| LOW | …s/qwenpaw-creator/backend/models/video_capabilities.py | 702 | CODE | |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/asr_model.py | 270 | CODE | |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/asr_model.py | 452 | CODE | |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/asr_model.py | 867 | CODE | |
| LOW | …ugins/apps/qwenpaw-creator/backend/models/asr_model.py | 1026 | CODE | |
| LOW | …paw-creator/backend/models/image/dashscope_provider.py | 352 | CODE | |
| LOW | …paw-creator/backend/models/image/dashscope_provider.py | 479 | CODE | |
| LOW | …s/qwenpaw-creator/backend/models/image/bfl_provider.py | 256 | CODE | |
| LOW | …wenpaw-creator/backend/models/image/openai_provider.py | 387 | CODE | |
| LOW | …gins/apps/qwenpaw-creator/backend/models/image/base.py | 307 | CODE | |
| LOW | …gins/apps/qwenpaw-creator/backend/models/image/base.py | 574 | CODE | |
| LOW | …pps/qwenpaw-creator/backend/api/project_file_routes.py | 542 | CODE | |
| LOW | …pps/qwenpaw-creator/backend/api/project_file_routes.py | 619 | CODE | |
| LOW | …pps/qwenpaw-creator/backend/api/project_file_routes.py | 968 | CODE | |
| LOW | …ins/apps/qwenpaw-creator/backend/api/example_routes.py | 301 | CODE | |
| LOW | …ins/apps/qwenpaw-creator/backend/api/project_routes.py | 559 | CODE | |
| 840 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 440 | # Step 1: Lock versions initially | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 443 | # Step 2: Update to latest within constraints | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 446 | # Step 3: Review changes | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 449 | # Step 4: Commit lock file | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 483 | # Step 1: Add for_each, keep count commented | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 484 | # Step 2: Add moved blocks for each resource | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 485 | # Step 3: Run terraform plan (should show "moved" not "destroy/create") | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 486 | # Step 4: Apply changes | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 487 | # Step 5: Remove commented count | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 509 | # Step 1: Create secret in AWS Secrets Manager (outside Terraform) | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 512 | # Step 2: Update Terraform to use data sources | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 513 | # Step 3: Use write-only argument (Terraform 1.11+) | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 514 | # Step 4: Remove random_password resource or variable | COMMENT |
| LOW⚡ | …w/skills/terraform-skill/references/quick-reference.md | 515 | # Step 5: Apply and verify secret not in state | COMMENT |
| LOW | …paw/skills/terraform-skill/references/code-patterns.md | 616 | # Step 1: Lock versions in versions.tf | COMMENT |
| LOW⚡ | …paw/skills/terraform-skill/references/code-patterns.md | 628 | # Step 2: Generate lock file (commit this) | COMMENT |
| LOW⚡ | …paw/skills/terraform-skill/references/code-patterns.md | 632 | # Step 3: Update providers when needed | COMMENT |
| LOW⚡ | …paw/skills/terraform-skill/references/code-patterns.md | 636 | # Step 4: Review and test changes before committing | COMMENT |
| LOW | website/public/docs/cli.en.md | 354 | # Step 1: Query available sessions | COMMENT |
| LOW | website/public/docs/cli.en.md | 357 | # Step 2: Send message using queried parameters | COMMENT |
| LOW | website/public/docs/memory-evolving-and-proactive.en.md | 124 | ### Step 1: Deciding it is time to speak | COMMENT |
| LOW | website/public/docs/memory-evolving-and-proactive.en.md | 139 | ### Step 2: What it knows about your work | COMMENT |
| LOW | website/public/docs/memory-evolving-and-proactive.en.md | 155 | ### Step 3: From “what you're doing” to “what would help” | COMMENT |
| LOW | website/public/docs/memory-evolving-and-proactive.en.md | 179 | ### Step 4: Do the work first, then decide whether to speak | COMMENT |
| LOW | website/public/docs/memory-evolving-and-proactive.en.md | 195 | ### Step 5: Where the message goes | COMMENT |
| LOW | website/public/docs/practice-agent-team.en.md | 94 | ### Step 1: Deploy AgentTeams | COMMENT |
| LOW | website/public/docs/practice-agent-team.en.md | 114 | ### Step 2: Create Agent Team | COMMENT |
| LOW | website/public/docs/practice-agent-team.en.md | 174 | ### Step 3: Assign Tasks and Observe Collaboration | COMMENT |
| LOW | website/public/docs/practice-agent-team.en.md | 192 | ### Step 4: Human-in-the-Loop and Result Retrieval | COMMENT |
| LOW | website/public/docs/channels.en.md | 1351 | ### Step 1: Create an App Registration | COMMENT |
| LOW | website/public/docs/channels.en.md | 1392 | ### Step 2: Create the Azure Bot Resource | COMMENT |
| LOW | website/public/docs/channels.en.md | 1415 | ### Step 3: Expose the Webhook Endpoint | COMMENT |
| LOW | website/public/docs/channels.en.md | 1441 | ### Step 4: Set the Messaging Endpoint | COMMENT |
| LOW | website/public/docs/channels.en.md | 1454 | ### Step 5: Enable Channels (Optional) | COMMENT |
| LOW | website/public/docs/channels.en.md | 1460 | ### Step 6: Connect to QwenPaw | COMMENT |
| LOW | website/public/docs/heartbeat.en.md | 40 | ## Step 1: Write HEARTBEAT.md | COMMENT |
| LOW | website/public/docs/heartbeat.en.md | 70 | ## Step 2: Configure heartbeat | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 40 | ### Step 2: Initialize | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 59 | ### Step 3: Start the server | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 75 | ### Step 1: Install | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 150 | ### Step 2: Initialize | COMMENT |
| LOW | website/public/docs/quickstart.en.md | 169 | ### Step 3: Start the server | COMMENT |
| LOW⚡ | website/public/blog/creator-install-guide.en.md | 62 | ## Step 1: Open the Main Interface | COMMENT |
| LOW⚡ | website/public/blog/creator-install-guide.en.md | 72 | ## Step 2: Open the Apps Center | COMMENT |
| LOW⚡ | website/public/blog/creator-install-guide.en.md | 82 | ## Step 3: Select Creator and Choose Install | COMMENT |
| LOW⚡ | website/public/blog/creator-install-guide.en.md | 92 | ## Step 4: Wait for Installation to Finish | COMMENT |
| LOW⚡ | website/public/blog/creator-install-guide.en.md | 102 | ## Step 5: Confirm Successful Installation | COMMENT |
| LOW⚡ | website/public/blog/creator-install-guide.en.md | 112 | ## Step 6: Find Creator Under My Apps | COMMENT |
| LOW⚡ | website/public/blog/creator-install-guide.en.md | 122 | ## Step 7: Choose Open and Start Creating | COMMENT |
| LOW | tests/integration/test_acp_runner.py | 485 | # Step 1: start | COMMENT |
| LOW | tests/integration/test_acp_runner.py | 527 | # Step 2: close (same chat_id via same target) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 616 | # Step 2: Delete the AppContainer profile | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 621 | # Step 3: Handle metadata file | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 717 | # Step 2: Remove firewall rules | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 727 | # Step 3: Delete the local user account | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 737 | # Step 4: Remove user profile directory | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 745 | # Step 5: Handle metadata file | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 1242 | # Step 1: Deny paths protection (no admin required, do first so | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 1247 | # Step 2: AppContainer sandboxes (no admin required) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 1255 | # Step 3: Elevated sandboxes (admin required) | COMMENT |
| 354 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/integration/test_acp_runner.py | 485 | # Step 1: start | COMMENT |
| LOW | tests/integration/test_acp_runner.py | 527 | # Step 2: close (same chat_id via same target) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 616 | # Step 2: Delete the AppContainer profile | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 621 | # Step 3: Handle metadata file | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 717 | # Step 2: Remove firewall rules | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 727 | # Step 3: Delete the local user account | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 737 | # Step 4: Remove user profile directory | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 745 | # Step 5: Handle metadata file | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 1242 | # Step 1: Deny paths protection (no admin required, do first so | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 1247 | # Step 2: AppContainer sandboxes (no admin required) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 1255 | # Step 3: Elevated sandboxes (admin required) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 1272 | # Step 4: Unelevated sandboxes (no admin required) | COMMENT |
| LOW⚡ | scripts/cleanup_windows_sandbox.py | 1281 | # Step 5: Clean up empty directories | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 586 | # Step 1: Remove ACL entries | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 675 | # Step 1: Remove ACL entries | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 797 | # Step 1: Remove ACL entries | COMMENT |
| LOW | scripts/cleanup_windows_sandbox.py | 814 | # Step 2: Handle metadata file | COMMENT |
| LOW | scripts/review-bot/prompts.py | 105 | ## Step 1: PR Metadata and the Change Map | COMMENT |
| LOW | scripts/review-bot/prompts.py | 122 | ## Step 2: Read Before You Conclude | COMMENT |
| LOW | scripts/review-bot/prompts.py | 181 | ## Step 3: Output the Review Report | COMMENT |
| LOW⚡ | scripts/review-bot/prompts.py | 270 | ## Step 1: Fetch PR Information | COMMENT |
| LOW | scripts/review-bot/prompts.py | 282 | ## Step 2: Analyze and Review | COMMENT |
| LOW | scripts/review-bot/prompts.py | 293 | ## Step 3: Output the Review Report | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 23 | # Step 0: Prerequisites | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 79 | # Step 1: Build console static assets | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 93 | # Step 2: Build PyInstaller backend | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 106 | # Step 3: Build Tauri app | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 137 | # Step 4: Collect distribution artifacts | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 60 | # Step 1: Navigate to voice transcription page | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 64 | # Step 2: Verify page loaded (voice page has no breadcrumb). | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 85 | # Step 3: Verify page title | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 91 | # Step 4: Verify and interact with voice service config controls | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 109 | # Step 5: Verify config form | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 115 | # Step 6: Verify controls are clickable/interactable | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 161 | # Step 1: Navigate to voice transcription page | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 165 | # Step 2: Find voice service config control | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 223 | # Step 4: Verify save button enabled and click save | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 233 | # Step 5: Restore original state | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 267 | # Step 4: Verify save | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 271 | # Step 5: Restore original state | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 321 | # Step 1: Navigate to voice transcription page | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 325 | # Step 2: Verify Twilio or voice config area | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 374 | # Step 4: Verify save button exists and is enabled | COMMENT |
| LOW⚡ | e2e/tests/test_voice.py | 383 | # Step 5: Verify Webhook URL display | COMMENT |
| LOW | e2e/tests/test_voice.py | 126 | # Step 7: Verify save button exists | COMMENT |
| LOW | e2e/tests/test_voice.py | 201 | # Step 3: Switch to another option | COMMENT |
| LOW | e2e/tests/test_voice.py | 256 | # Step 3: Toggle switch | COMMENT |
| LOW | e2e/tests/test_voice.py | 339 | # Step 3: Verify config fields and test input | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 58 | # Step 1: Open the Security page | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 62 | # Step 2: Verify breadcrumb | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 74 | # Step 3: Verify the tabs exist | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 85 | # Step 4: Verify the Tool Guard tab is active by default | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 94 | # Step 5: Verify the Tool Guard enable switch and toggle it | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 116 | # Step 6: Verify the protected-tools dropdown exists | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 122 | # Step 7: Switch to the File Guard tab | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 131 | # Step 8: Verify the File Guard enable switch | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 138 | # Step 9: Verify the File Guard path input | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 171 | # Step 1: Open the Security page | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 175 | # Step 2: Switch to the File Guard tab | COMMENT |
| LOW⚡ | e2e/tests/test_security.py | 185 | # Step 3: Verify the add-button initial state (should be disabled on empty input) | COMMENT |
| 285 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/apps/qwenpaw-creator/backend/api/file_media_routes.py | 480 | if (proto && typeof proto.seek === 'function') { | CODE |
| HIGH | …ps/qwenpaw-creator/backend/services/document_reader.py | 136 | "(pip install playwright && playwright install chromium) " | CODE |
| HIGH | …-creator/backend/services/run_review/rubric_prompts.py | 148 | {{"check_key": "<{check_keys} 各一条>", "passed": true/false, "severity": "minor"/"major", "evidence_timestamp_ms": nul | CODE |
| HIGH | …-creator/backend/services/media_files/motion_design.py | 205 | tl.totalTime(Math.max(0, t), o && o.suppressEvents === true); } }; | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 116 | const timing = animation.effect && animation.effect.getComputedTiming | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 118 | : null; | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 121 | timing.iterations === Infinity ? 1 : timing.iterations || 1; | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 122 | const endMs = (timing.delay || 0) + (timing.duration || 0) * iterations; | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 128 | if (proto && typeof proto.seek === 'function') { | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 146 | ? payload : Number(payload.milliseconds || 0); | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 148 | ? 0 : Number(payload.outputMs || 0); | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 150 | ? milliseconds : Number(payload.playheadMs || milliseconds); | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 155 | if (proto && typeof proto.seek === 'function') { | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 199 | Number(style.opacity || 1) < 0.05 | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 204 | if (rect.width < 1 || rect.height < 1) continue; | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 208 | points.push([ | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 215 | if (x < 0 || y < 0 || x >= innerWidth || y >= innerHeight) { | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 229 | (top && parent.contains(top)) || | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 230 | (top && top.contains(parent)); | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 235 | const cls = top.className && top.className.toString | CODE |
| HIGH⚡ | …creator/backend/services/media_files/motion_overlay.py | 236 | ? top.className.toString().split(/\s+/).slice(0, 2).join('.') | CODE |
| HIGH | …ator/backend/services/media_files/motion_blueprints.py | 34 | " tl.totalTime(Math.max(0, t), o && o.suppressEvents === true); } };" | CODE |
| HIGH | …creator/backend/services/project_files/jq_transform.py | 162 | "Cannot use null (null) as object key" in message | CODE |
| HIGH | …aw-creator/backend/services/source_analysis/service.py | 1016 | # Key present (any value, including null) marks a new-format | COMMENT |
| HIGH | …/apps/qwenpaw-creator/scripts/build_example_archive.py | 230 | The original gigabyte-scale videos stay URL-backed (``file_id`` null) so | STRING |
| HIGH⚡ | tests/unit/sandbox/test_windows_elevated_sandbox.py | 360 | # First character accessible via .value is empty (first null) | COMMENT |
| HIGH | tests/unit/sandbox/test_bubblewrap_sandbox.py | 86 | f"deny_path file not masked with /dev/null, args={args}", | CODE |
| HIGH | tests/integration/test_fork_and_coding_mode.py | 326 | idle-state values (status=idle, count=0, timestamps null). | STRING |
| HIGH | scripts/verify/desktop_verify.py | 422 | btnDisabled = disabledByAttr || disabledByCls; | CODE |
| HIGH | scripts/verify/desktop_verify.py | 465 | if (btnRecovered && hasRealText) { | CODE |
| HIGH | e2e/pages/coding_page.py | 279 | # If the project-select modal pops up (project_dir undefined), | COMMENT |
| HIGH | e2e/pages/chat_page.py | 643 | if (btnEnabled && hasRealText) { | STRING |
| HIGH | e2e/pages/chat_page.py | 1193 | if (k && k.indexOf('approval_level-') === 0) { | STRING |
| HIGH | src/qwenpaw/app/_app.py | 795 | "`npm ci && npm run build` in the `console/` " | CODE |
| HIGH | src/qwenpaw/app/routers/project_directory.py | 146 | Pass ``{"path": null}`` to reset to the default workspace directory. | STRING |
| HIGH | src/qwenpaw/config/config.py | 1869 | "Optional explicit cloud model slot; when null, uses " | CODE |
| HIGH | src/qwenpaw/harnesses/runtime.py | 198 | for item in text_stream.push( | CODE |
| HIGH | src/qwenpaw/harnesses/runtime.py | 204 | for item in text_stream.push( | CODE |
| HIGH | src/qwenpaw/agents/tools/shell.py | 1250 | (`cd /repo && pytest`). | STRING |
| HIGH | …wenpaw/agents/skills/pptx-zh/scripts/office/soffice.py | 151 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-zh/scripts/office/soffice.py | 170 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-zh/scripts/office/soffice.py | 179 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-zh/scripts/office/soffice.py | 193 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-en/scripts/office/soffice.py | 151 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-en/scripts/office/soffice.py | 170 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-en/scripts/office/soffice.py | 179 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-en/scripts/office/soffice.py | 193 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-en/scripts/office/soffice.py | 151 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-en/scripts/office/soffice.py | 170 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-en/scripts/office/soffice.py | 179 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/pptx-en/scripts/office/soffice.py | 193 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-zh/scripts/office/soffice.py | 151 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-zh/scripts/office/soffice.py | 170 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-zh/scripts/office/soffice.py | 179 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/xlsx-zh/scripts/office/soffice.py | 193 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-en/scripts/office/soffice.py | 153 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-en/scripts/office/soffice.py | 172 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-en/scripts/office/soffice.py | 181 | if (sockfd >= 0 && sockfd < 1024 && is_shimmed[sockfd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-en/scripts/office/soffice.py | 195 | if (fd >= 0 && fd < 1024 && is_shimmed[fd]) { | CODE |
| HIGH | …wenpaw/agents/skills/docx-zh/scripts/office/soffice.py | 153 | if (sv[0] >= 0 && sv[0] < 1024) { | CODE |
| 14 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | plugins/tool/qwen-image/qwen_image_tool.py | 66 | Resolve an image path or URL to a usable string. If the input is an HTTP/HTTPS URL, return it as-is. If the inp | STRING |
| HIGH | plugins/tool/qwen-image/qwen_image_tool.py | 142 | Download image from URL and save to local directory. Args: image_url: Public URL of the image. save | STRING |
| HIGH | plugins/tool/wan27/wan27_tool.py | 43 | Resolve an image path or URL to a usable URL. If the input is an HTTP/HTTPS URL, return it as-is. If the input | STRING |
| HIGH | plugins/tool/wan27/wan27_tool.py | 115 | Download video from URL and save to local directory. Args: video_url: Public URL of the video. save | STRING |
| HIGH | plugins/tool/gpt-image2/gpt_image2_tool.py | 558 | Convert image path/URL to API format. Args: image_path: Web URL or local file path Returns: di | STRING |
| HIGH | e2e/utils/helpers.py | 143 | Wait for a condition to be satisfied. Args: condition_func: Condition function; returning a truthy val | STRING |
| HIGH | e2e/utils/helpers.py | 172 | Retry an operation. Args: operation_func: Operation function max_retries: Maximum number of re | STRING |
| HIGH | e2e/pages/chat_page.py | 332 | Send a message (strict-validation version). Strictly isolated from the previous round: 1. Snap | STRING |
| HIGH | src/qwenpaw/drivers/handlers/mcp_stateful_client.py | 562 | Call a tool on the MCP server. Args: name: Tool name arguments: Tool arguments (optiona | STRING |
| HIGH | src/qwenpaw/app/multi_agent_manager.py | 169 | Get agent workspace by ID (lazy loading with dedup). If workspace doesn't exist in memory, it will be created a | STRING |
| HIGH | src/qwenpaw/app/utils.py | 21 | Resolve *user_path* under *root* and reject path-traversal attempts. Uses :py:meth:`Path.is_relative_to` instead of | STRING |
| HIGH | src/qwenpaw/app/utils.py | 51 | Build a project destination directory under *base* from *name*. Validates that *name* is a single path component (n | STRING |
| HIGH | src/qwenpaw/app/agent_context.py | 58 | Get agent workspace for current request. Priority: 1. agent_id parameter (explicit override) 2. request.sta | STRING |
| HIGH | src/qwenpaw/app/routers/plugins.py | 118 | Return the directory that contains plugin.json. Args: base: Root of the extracted archive Returns: | STRING |
| HIGH | src/qwenpaw/app/routers/mcp_oauth.py | 214 | Discover OAuth endpoints via RFC 9728 + RFC 8414 / OIDC discovery. Args: mcp_url: Remote MCP server URL | STRING |
| HIGH | src/qwenpaw/app/routers/tools.py | 259 | Toggle tool enabled status for active agent. Args: tool_name: Tool function name request: FastAPI r | STRING |
| HIGH | src/qwenpaw/app/routers/tools.py | 305 | Update tool async_execution setting for active agent. Args: tool_name: Tool function name async_exe | STRING |
| HIGH | src/qwenpaw/app/routers/tools.py | 451 | Update tool configuration. Args: tool_name: Tool function name body: Configuration update r | STRING |
| HIGH | src/qwenpaw/app/routers/messages.py | 21 | Get MultiAgentManager from app state. Args: request: FastAPI request object Returns: MultiAgen | STRING |
| HIGH | src/qwenpaw/app/routers/messages.py | 85 | Send a text message to a channel. This endpoint allows agents to proactively send messages to users via configu | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 58 | Get the chat manager for the active agent. Args: request: FastAPI request object Returns: Chat | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 76 | Get the session for the active agent. Args: request: FastAPI request object Returns: SafeJSONS | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 713 | Get detailed information about a specific chat by UUID. Args: request: FastAPI request (for agent context) | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 800 | Update an existing chat. Args: chat_id: Chat UUID spec: Partial chat update payload mgr: Ch | STRING |
| HIGH | src/qwenpaw/app/chats/api.py | 831 | Delete a chat by UUID. Note: This only deletes the chat spec (UUID mapping). JSONSession state is NOT deleted. | STRING |
| HIGH | src/qwenpaw/app/chats/manager.py | 546 | Archive a single chat. Idempotent: already-archived chats are returned unchanged (archived_at is NOT refreshed). | STRING |
| HIGH | src/qwenpaw/app/approvals/service.py | 433 | Block and wait for approval decision with timeout. Args: request_id: Approval request ID | STRING |
| HIGH | src/qwenpaw/app/channels/command_registry.py | 100 | Register command to priority level. Args: command_prefix: Command prefix (e.g. "/stop") | STRING |
| HIGH | src/qwenpaw/app/channels/command_registry.py | 141 | Check if query is a registered control command. Args: query: User query (e.g. "/stop" or "normal qu | STRING |
| HIGH | src/qwenpaw/app/channels/command_registry.py | 180 | Get priority level for a query. Args: query: User query (e.g. "/stop" or "normal question") | STRING |
| HIGH | src/qwenpaw/app/channels/command_registry.py | 225 | Get priority name from level number. Args: level: Priority level number Returns: | STRING |
| HIGH | src/qwenpaw/app/channels/manager.py | 562 | Get health status for a specific channel. Args: channel_name: Channel identifier (e.g. "dingtalk", | STRING |
| HIGH | src/qwenpaw/app/channels/manager.py | 590 | Restart a single channel by stopping and re-starting it. The channel is stopped, then a fresh instance is creat | STRING |
| HIGH | src/qwenpaw/app/channels/wechat/client.py | 163 | Block until QR code is confirmed or timeout. Args: qrcode: QR code string from get_bot_qrcode(). | STRING |
| HIGH | src/qwenpaw/app/channels/wechat/utils.py | 30 | Decrypt AES-128-ECB encrypted bytes. Args: data: Encrypted bytes (from CDN). key_b64: AES key — acc | STRING |
| HIGH | src/qwenpaw/config/config.py | 3289 | Load an agent configuration with fingerprint-based caching. The fingerprint detects same-mtime atomic replacements. | STRING |
| HIGH | src/qwenpaw/plugins/loader.py | 299 | Load plugin manifest from JSON file. Args: manifest_path: Path to plugin.json Returns: | STRING |
| HIGH | src/qwenpaw/plugins/loader.py | 681 | Load a single plugin. Args: manifest: Plugin manifest source_path: Path to plugin direc | STRING |
| HIGH | src/qwenpaw/plugins/loader.py | 1088 | Copy plugin files, install deps, and load plugin at runtime. The plugin directory is copied into ``install_dir` | STRING |
| HIGH | src/qwenpaw/plugins/architecture.py | 212 | Create a manifest from a ``plugin.json`` dictionary. Thin wrapper around :meth:`model_validate` kept for backwa | STRING |
| HIGH | src/qwenpaw/runtime/commands/control/__init__.py | 211 | Dispatch control command to appropriate handler. Args: query: User query (e.g. "/stop session=123") | STRING |
| HIGH | src/qwenpaw/runtime/commands/control/base.py | 64 | Handle the control command. Args: context: Control command context Returns: Re | STRING |
| HIGH | src/qwenpaw/agents/command_handler.py | 1287 | Process conversation system commands. Args: query: Command string (e.g., "/compact", "/new", "/mess | STRING |
| HIGH | src/qwenpaw/agents/model_factory.py | 810 | Format a video block for OpenAI-compatible API. Local files are converted to base64 data URLs; web URLs are pas | STRING |
| HIGH | src/qwenpaw/agents/memory/base_memory_manager.py | 670 | Return the memory manager class for the given backend name. If the backend is not registered, falls back to the fir | STRING |
| HIGH | src/qwenpaw/agents/utils/file_handling.py | 80 | Read text file with multiple encoding attempts for cross-platform compatibility. This function handles files cr | STRING |
| HIGH | src/qwenpaw/cli/plugin_commands.py | 461 | Download and extract plugin from URL. Args: url: Plugin zip file URL Returns: Tuple of (plugin | STRING |
| HIGH | src/qwenpaw/sandbox/windows_appcontainer_sandbox.py | 117 | Creates an AppContainer profile and returns its SID string. If a profile with the same name already exists, its SID | STRING |
| HIGH | src/qwenpaw/sandbox/windows_appcontainer_sandbox.py | 364 | Builds SECURITY_CAPABILITIES and a proc-thread attribute list. Args: kernel32: Loaded kernel32 DLL handle. | STRING |
| HIGH | src/qwenpaw/sandbox/windows_appcontainer_sandbox.py | 452 | Launches a process inside the AppContainer via ``CreateProcessW``. Args: cmd: Command to execute. c | STRING |
| HIGH | src/qwenpaw/sandbox/windows_unelevated_sandbox.py | 636 | Converts a SID string to a PSID pointer. Args: sid_string: SID in string form (e.g. ``S-1-5-21-…``). R | STRING |
| HIGH | src/qwenpaw/sandbox/windows_unelevated_sandbox.py | 662 | Converts a PSID pointer to its string representation. Args: psid: Pointer to a SID structure. advap | STRING |
| HIGH | src/qwenpaw/sandbox/windows_unelevated_sandbox.py | 692 | Creates a well-known SID by type constant. Args: sid_type: Well-known SID type (e.g. 1 for Everyone). | STRING |
| HIGH | src/qwenpaw/sandbox/windows_unelevated_sandbox.py | 738 | Extracts the Logon SID from a token's group list. Args: h_token: Handle to an access token. Returns: | STRING |
| HIGH | src/qwenpaw/sandbox/windows_unelevated_sandbox.py | 962 | Creates inheritable stdout/stderr pipes for child process I/O. Args: kernel32: Optional pre-loaded kernel32 | STRING |
| HIGH | src/qwenpaw/sandbox/windows_unelevated_sandbox.py | 1595 | Creates a WRITE_RESTRICTED token for the unelevated sandbox. Restricting SID list: ``[cap_sid, logon_sid, Everyone] | STRING |
| HIGH | src/qwenpaw/sandbox/windows_unelevated_sandbox.py | 1817 | Creates a suspended process under the restricted token, then resumes it. Args: h_token: Restricted token ha | STRING |
| HIGH | src/qwenpaw/sandbox/config.py | 697 | Creates a sandbox instance for the given configuration. Dispatches to the appropriate backend based on ``config.mod | STRING |
| HIGH | src/qwenpaw/sandbox/linux_sandbox.py | 144 | Create a Landlock ruleset and return its fd. Args: handled_access_fs: Bitmask of filesystem access rights t | STRING |
| HIGH | src/qwenpaw/sandbox/windows_elevated_sandbox.py | 353 | Encrypts a string using DPAPI (current user scope). Args: plaintext: String to encrypt. Returns: | STRING |
| 3 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …/tests/source_analysis/test_source_analysis_service.py | 195 | source = next(iter(snapshot.project.sources.sources.items.values())) | CODE |
| CRITICAL | …or/backend/services/file_agent_runtime/native_media.py | 304 | for source in snapshot.project.sources.sources.items.values() | CODE |
| CRITICAL | …w-creator/backend/services/media/source_observation.py | 378 | for item in snapshot.project.sources.sources.items.values() | STRING |
| CRITICAL⚡ | tests/unit/hub/test_control_app.py | 272 | assert hub_client.app.state.runtime_service.registry.list() == [] | CODE |
| CRITICAL | tests/unit/hub/test_control_app.py | 527 | assert client.app.state.runtime_service.registry.list() == [] | CODE |
| CRITICAL | tests/unit/channels/test_feishu.py | 2899 | mock_client.im.v1.message.areply.assert_called_once() | CODE |
| CRITICAL⚡ | src/qwenpaw/app/channels/feishu/channel.py | 2225 | resp = await self._client.cardkit.v1.card.asettings(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 573 | resp = self._client.contact.v3.user.get(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 877 | resp = await self._client.im.v1.message_reaction.acreate(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 901 | resp = await self._client.im.v1.message_resource.aget(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 942 | resp = await self._client.im.v1.message_resource.aget(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1136 | resp = await self._client.im.v1.message.aget(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1370 | resp = await self._client.im.v1.image.acreate(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1435 | resp = await self._client.im.v1.file.acreate(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1511 | resp = await self._client.im.v1.message.acreate(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 1566 | resp = await self._client.im.v1.message.areply(req) | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 2084 | create_resp = await self._client.cardkit.v1.card.acreate( | CODE |
| CRITICAL | src/qwenpaw/app/channels/feishu/channel.py | 2163 | resp = await self._client.cardkit.v1.card_element.acontent(req) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | plugins/bundle/qwenpaw-pet/emitter.py | 362 | # Create the bridge token *before* spawning so the very first | COMMENT |
| MEDIUM | plugins/apps/agent-kanban/backend/main.py | 904 | # Create a single synthetic message from all trace content | COMMENT |
| MEDIUM | …enpaw-creator/backend/services/project_files/assets.py | 979 | # Creating the final hard link legitimately changes ctime/link count. The | COMMENT |
| MEDIUM | tests/unit/app/chats/test_session.py | 264 | # Create the file so the empty-key check runs *after* the file-exists | COMMENT |
| MEDIUM⚡ | tests/unit/plugins/test_plugin_api_extensions.py | 276 | # Create a temp plugin with relative import | COMMENT |
| MEDIUM⚡ | tests/unit/plugins/test_plugin_api_extensions.py | 465 | # Create a fake skill | COMMENT |
| MEDIUM | tests/unit/plugins/test_plugin_api_extensions.py | 151 | # Create a fake loaded plugin record | COMMENT |
| MEDIUM | tests/unit/plugins/test_plugin_api_extensions.py | 294 | # Create a helper module | COMMENT |
| MEDIUM | tests/unit/workspace/test_prompt.py | 19 | # Create a simple AGENTS.md | COMMENT |
| MEDIUM | tests/unit/agents/utils/test_audio_transcription.py | 454 | # Create a real audio file so open() doesn't fail | COMMENT |
| MEDIUM | tests/unit/agents/utils/test_file_handling.py | 301 | # Create a file that the mock download would produce | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_telegram.py | 963 | # Create a test file | COMMENT |
| MEDIUM | tests/unit/channels/test_telegram.py | 1013 | # Create a file larger than 50MB | COMMENT |
| MEDIUM | tests/unit/channels/test_xiaoyi.py | 861 | # Create a message larger than TEXT_CHUNK_LIMIT | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 703 | # Create a mock part without url | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 735 | # Create a test file | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 762 | # Create a test file | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 812 | # Create a valid base64 data URL | COMMENT |
| MEDIUM | tests/unit/channels/test_imessage.py | 878 | # Create a large base64 data URL | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_feishu.py | 1107 | # Create a file just over the limit | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_dingtalk.py | 3886 | # Create a response without 'data' attribute to avoid triggering | COMMENT |
| MEDIUM | tests/unit/channels/test_dingtalk.py | 1946 | # Create a test file | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_discord.py | 817 | # Create a mock request | COMMENT |
| MEDIUM | tests/unit/channels/test_discord.py | 833 | # Create a message with various content | COMMENT |
| MEDIUM | tests/unit/channels/test_mattermost.py | 1101 | # Create a test image file | COMMENT |
| MEDIUM | tests/unit/channels/test_mattermost.py | 1298 | # Create a typing task | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_base_core.py | 628 | # Create a mock that doesn't auto-create attributes | COMMENT |
| MEDIUM⚡ | tests/unit/channels/test_base_core.py | 640 | # Create a mock error with message attribute | COMMENT |
| MEDIUM | e2e/tests/test_channels.py | 397 | # Define the four channels and their expected distinctive field keywords | COMMENT |
| MEDIUM | e2e/tests/test_coding.py | 185 | # Create a project up-front to give us a real existing path. | COMMENT |
| MEDIUM | src/qwenpaw/app/channels/wechat/channel.py | 559 | # Create a per-thread HTTP client | COMMENT |
| MEDIUM | src/qwenpaw/app/channels/wechat/channel.py | 1662 | # Create the background refresh task. | COMMENT |
| MEDIUM⚡ | …wenpaw/security/skill_scanner/data/default_policy.yaml | 3 | # This file defines the built-in security policy. Every setting here can be | COMMENT |
| MEDIUM | src/qwenpaw/agents/model_factory.py | 2144 | # Create the formatter based on the model's native one. In 2.0 every | COMMENT |
| MEDIUM | src/qwenpaw/agents/tools/shell.py | 384 | # Create the temp file path without auto-delete; we rely solely on | COMMENT |
| MEDIUM | src/qwenpaw/agents/tools/shell.py | 1360 | # Create a copy with resolved shell and timeout to avoid mutating | COMMENT |
| MEDIUM | src/qwenpaw/cli/channels_cmd.py | 912 | # Create a temporary Config object for the interactive configurator | COMMENT |
| MEDIUM | src/qwenpaw/sandbox/windows_unelevated_sandbox.py | 2225 | # Create a new sandbox instance | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | website/public/docs/mcp.zh.md | 70 | "API_KEY": "your-api-key" | CODE |
| HIGH | website/public/docs/mcp.en.md | 70 | "API_KEY": "your-api-key" | CODE |
| HIGH | website/public/docs/api-tutorial.zh.md | 68 | -H "Authorization: Bearer <YOUR_TOKEN>" \ | CODE |
| HIGH | website/public/docs/api-tutorial.zh.md | 839 | -H "Authorization: Bearer <YOUR_TOKEN>" \ | CODE |
| HIGH | website/public/docs/api-tutorial.en.md | 68 | -H "Authorization: Bearer <YOUR_TOKEN>" \ | CODE |
| HIGH | website/public/docs/api-tutorial.en.md | 839 | -H "Authorization: Bearer <YOUR_TOKEN>" \ | CODE |
| HIGH | website/public/docs/embedding.en.md | 149 | "api_key": "your-api-key", | CODE |
| HIGH | website/public/docs/embedding.zh.md | 149 | "api_key": "your-api-key", | CODE |
| HIGH | website/public/docs/channels.en.md | 1212 | --api-key <your-api-key> \ | CODE |
| HIGH | website/public/docs/channels.en.md | 1291 | "livekit_api_key": "your-api-key", | CODE |
| HIGH | website/public/docs/channels.zh.md | 1230 | --api-key <your-api-key> \ | CODE |
| HIGH | website/public/docs/channels.zh.md | 1309 | "livekit_api_key": "your-api-key", | CODE |
| HIGH⚡ | …s/unit/security/skill_scanner/test_pattern_analyzer.py | 368 | placeholder_markers={"<YOUR_API_KEY>"}, | CODE |
| HIGH⚡ | …s/unit/security/skill_scanner/test_pattern_analyzer.py | 368 | placeholder_markers={"<YOUR_API_KEY>"}, | CODE |
| HIGH | console/src/pages/Agent/MCP/index.tsx | 98 | "API_KEY": "<YOUR_API_KEY>" | CODE |
| HIGH | console/src/pages/Agent/MCP/index.tsx | 98 | "API_KEY": "<YOUR_API_KEY>" | CODE |
| HIGH | console/src/pages/Agent/MCP/index.tsx | 121 | "API_KEY": "<YOUR_API_KEY>" | CODE |
| HIGH | console/src/pages/Agent/MCP/index.tsx | 121 | "API_KEY": "<YOUR_API_KEY>" | CODE |
| HIGH⚡ | …wenpaw/security/skill_scanner/data/default_policy.yaml | 131 | - "your-api-key" | CODE |
| HIGH⚡ | …wenpaw/security/skill_scanner/data/default_policy.yaml | 132 | - "your_api_key" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/chrome/frontend/src/index.tsx | 778 | tone?: "blue" | "default" | "placeholder" | "primary"; | CODE |
| LOW | plugins/bundle/chrome/frontend/src/index.tsx | 787 | : tone === "placeholder" | CODE |
| LOW | plugins/bundle/chrome/frontend/src/index.tsx | 1293 | tone="placeholder" | CODE |
| LOW | plugins/bundle/chrome/frontend/src/index.tsx | 1310 | tone="placeholder" | CODE |
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 48 | "placeholder": ("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"), | CODE |
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 55 | "placeholder": "App Password (Client Secret)", | CODE |
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 62 | "placeholder": ("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"), | CODE |
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 69 | "placeholder": "0.0.0.0", | CODE |
| LOW⚡ | plugins/channel/azure_bot/plugin.py | 77 | "placeholder": "3978", | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 102 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 111 | "placeholder": "qwen3.7-plus" | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 118 | "placeholder": "https://dashscope.aliyuncs.com/compatible-mode/v1" | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 133 | "placeholder": "Uses Text API Key when empty", | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 142 | "placeholder": "qwen3.7-plus" | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 149 | "placeholder": "Uses Text Base URL when empty" | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 273 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 282 | "placeholder": "https://routify.alibaba-inc.com/protocol/openai" | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 290 | "placeholder": "gpt-image-2" | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 298 | "placeholder": "qwen-mt-image", | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 492 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 501 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW⚡ | plugins/apps/qwenpaw-creator/plugin.json | 510 | "placeholder": "wan2.7-r2v", | CODE |
| LOW | plugins/apps/qwenpaw-creator/plugin.json | 172 | "placeholder": "tvly-...", | CODE |
| LOW | plugins/apps/qwenpaw-creator/plugin.json | 180 | "placeholder": "serper key", | CODE |
| LOW | plugins/apps/qwenpaw-creator/plugin.json | 431 | {"name": "api_key", "label": "TTS API Key", "type": "password", "required": false, "placeholder": "sk-...", "h | CODE |
| LOW | plugins/apps/qwenpaw-creator/plugin.json | 443 | {"name": "api_key", "label": "S2V API Key", "type": "password", "required": false, "placeholder": "sk-...", "h | CODE |
| LOW | plugins/apps/qwenpaw-creator/plugin.json | 468 | "placeholder": "qwen3-vl-embedding" | CODE |
| LOW | plugins/apps/qwenpaw-creator/plugin.json | 476 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW | plugins/apps/qwenpaw-creator/plugin.json | 565 | "placeholder": "https://oss-cn-hangzhou.aliyuncs.com" | CODE |
| LOW | plugins/apps/qwenpaw-creator/plugin.json | 579 | "placeholder": "https://cdn.example.com" | CODE |
| LOW | …components/assets/__tests__/AssetMediaPreview.test.tsx | 14 | placeholderClassName="placeholder" | CODE |
| LOW | …components/assets/__tests__/AssetMediaPreview.test.tsx | 32 | placeholderClassName="placeholder" | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 32 | "placeholder": "sk-...", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 60 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 68 | "placeholder": "120", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 86 | "placeholder": "sk-...", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 115 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW | plugins/tool/qwen-image/plugin.json | 123 | "placeholder": "120", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 32 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 40 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 48 | "placeholder": "600", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 66 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 74 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 82 | "placeholder": "600", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 100 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 108 | "placeholder": "https://dashscope.aliyuncs.com/api/v1", | CODE |
| LOW⚡ | plugins/tool/wan27/plugin.json | 116 | "placeholder": "600", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 33 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 41 | "placeholder": "https://api.openai.com/v1/images/generations", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 49 | "placeholder": "60", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 67 | "placeholder": "sk-...", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 75 | "placeholder": "https://api.openai.com/v1/images/edits", | CODE |
| LOW⚡ | plugins/tool/gpt-image2/plugin.json | 83 | "placeholder": "60", | CODE |
| LOW | website/public/docs/plugins.zh.md | 1576 | "placeholder": "your-bot-token-here", | CODE |
| LOW | website/public/docs/plugins.en.md | 1593 | "placeholder": "your-bot-token-here", | CODE |
| LOW⚡ | tests/unit/app/mail/test_mail_access_control_store.py | 104 | validate_acl_address("user@example.com") | CODE |
| LOW | tests/unit/harnesses/test_qoder_adapter.py | 284 | "email": "user@example.com", | CODE |
| LOW | tests/integration/test_backup.py | 418 | files={"_": ("placeholder", b"", "text/plain")}, | CODE |
| LOW | console/src/locales/zh.json | 281 | "placeholder": "后端日志会显示在这里。", | CODE |
| LOW | console/src/locales/zh.json | 453 | "placeholder": "可选的快照名称" | CODE |
| 29 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/cloudpaw/a2a_mode.py | 110 | # Check if agent exists | COMMENT |
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 141 | # Check if it's a 2D array (all items are 10-column rows) | COMMENT |
| LOW | plugins/bundle/cloudpaw/tools/proposal_choice.py | 161 | # Check if it's a 3D array (multiple proposals) | COMMENT |
| LOW | plugins/apps/agent-kanban/backend/main.py | 1164 | # Check if agent is idle (no running task for this agent) | COMMENT |
| LOW | tests/contract/__init__.py | 81 | # Check if it's a concrete implementation (not abstract) | COMMENT |
| LOW | tests/contract/channels/__init__.py | 121 | # Check if the subclass method is different from BaseChannel's | COMMENT |
| LOW | scripts/run_tests.py | 268 | # Check if pytest is installed | COMMENT |
| LOW | scripts/check-channels.sh | 43 | # Check if we're in a git repo | COMMENT |
| LOW | scripts/check-channels.sh | 61 | # Check if base.py changed | COMMENT |
| LOW | scripts/check-channels.sh | 91 | # Check if dependencies are installed | COMMENT |
| LOW | scripts/install.sh | 286 | # Check if console assets were included in the installed package | COMMENT |
| LOW | e2e/tests/test_skill_pool.py | 629 | # Check if a dialog/drawer opened, or import ran directly | COMMENT |
| LOW | src/qwenpaw/exceptions.py | 662 | # Check if has status_code attribute (typical for API errors) | COMMENT |
| LOW | src/qwenpaw/app/auth.py | 201 | # Check if token is revoked | COMMENT |
| LOW | src/qwenpaw/app/rate_limiter.py | 139 | # Check if IP should be locked based on rate limiting rules | COMMENT |
| LOW | src/qwenpaw/app/agent_context.py | 96 | # Check if agent exists and is enabled | COMMENT |
| LOW⚡ | src/qwenpaw/app/migration.py | 90 | # Check if already migrated | COMMENT |
| LOW | src/qwenpaw/app/migration.py | 483 | # Check if workspace already has skills | COMMENT |
| LOW | src/qwenpaw/app/routers/auth.py | 66 | # Check if user account is locked | COMMENT |
| LOW | src/qwenpaw/app/routers/auth.py | 73 | # Check if IP is locked or rate-limited | COMMENT |
| LOW | src/qwenpaw/app/routers/config.py | 941 | # Check if sandbox backend is actually available on this platform. | COMMENT |
| LOW | src/qwenpaw/app/chats/title_generator.py | 88 | # Check if this is a proactive session message | COMMENT |
| LOW | src/qwenpaw/app/channels/unified_queue_manager.py | 175 | # Check if already exists | COMMENT |
| LOW | src/qwenpaw/app/channels/unified_queue_manager.py | 394 | # Check if queue is empty and idle | COMMENT |
| LOW | src/qwenpaw/app/channels/manager.py | 154 | # Check if channel is enabled | COMMENT |
| LOW | src/qwenpaw/app/channels/manager.py | 234 | # Check if payload already has normalized session_id | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 547 | # Check if there's already an active connection for this agent_id | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 1187 | # Check if adding this line would exceed limit | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 1424 | # Check if this is a reasoning/thinking message type | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 1426 | # Check if thinking is filtered | COMMENT |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 1578 | # Check if any part exceeds chunk limit | COMMENT |
| LOW | src/qwenpaw/app/channels/wecom/utils.py | 71 | # Check if second row is separator (contains only -, :, |, spaces) | COMMENT |
| LOW | src/qwenpaw/app/channels/wechat/channel.py | 685 | # Check if text looks like a filename (has extension) | COMMENT |
| LOW | src/qwenpaw/app/channels/wechat/channel.py | 1161 | # Check if file exists | COMMENT |
| LOW | src/qwenpaw/app/channels/qq/channel.py | 1350 | # Check if attachment is a voice message and has ASR text. | COMMENT |
| LOW⚡ | src/qwenpaw/config/config.py | 3666 | # Check if already migrated (new structure has only AgentProfileRef) | COMMENT |
| LOW⚡ | src/qwenpaw/config/config.py | 3671 | # Check if default agent config exists | COMMENT |
| LOW | …qwenpaw/security/tool_guard/guardians/rule_guardian.py | 324 | # Check if it's a flag vs an absolute path | COMMENT |
| LOW | src/qwenpaw/runtime/commands/control/__init__.py | 8 | # Check if a query is a control command | STRING |
| LOW | src/qwenpaw/runtime/commands/control/model_handler.py | 206 | # Check if this is the active model | COMMENT |
| LOW | src/qwenpaw/agents/command_handler.py | 1147 | # Check if there's a compressed summary | COMMENT |
| LOW | src/qwenpaw/agents/prompt.py | 167 | # Check if markers exist | COMMENT |
| LOW | …paw/agents/tools/deprecated_browser/browser_control.py | 1678 | # Check if sync browser is still connected | COMMENT |
| LOW | …paw/agents/tools/deprecated_browser/browser_control.py | 1706 | # Check if async browser is still connected | COMMENT |
| LOW | …c/qwenpaw/agents/memory/proactive/proactive_trigger.py | 215 | # Check if last message is already proactive | COMMENT |
| LOW⚡ | …qwenpaw/agents/memory/proactive/proactive_responder.py | 373 | # Check if the agent has active tasks (busy with user messages) | COMMENT |
| LOW⚡ | …qwenpaw/agents/memory/proactive/proactive_responder.py | 382 | # Check if any chat was updated since the baseline timestamp | COMMENT |
| LOW | src/qwenpaw/agents/hooks/bootstrap.py | 62 | # Check if bootstrap has already been triggered before | COMMENT |
| LOW | src/qwenpaw/cli/plugin_commands.py | 376 | # Check if tool already exists | COMMENT |
| LOW | src/qwenpaw/cli/plugin_commands.py | 437 | # Check if tool exists | COMMENT |
| LOW | src/qwenpaw/agent_stats/service.py | 399 | # Check if session is in a channel subdirectory | COMMENT |
| LOW | src/qwenpaw/pawapp/task.py | 69 | # Check if channel is closed and queue is empty | COMMENT |
| LOW | src/qwenpaw/governance/tool_adapter.py | 327 | # Check if execution_level is "off" (dev mode) — allow pass-through | COMMENT |
| LOW | src/qwenpaw/governance/tool_adapter.py | 432 | # Check if sandbox violation was returned (state=DENIED) | COMMENT |
| LOW | src/qwenpaw/governance/detectors.py | 226 | # Check if it's actually a directory on disk | COMMENT |
| LOW | src/qwenpaw/governance/detectors.py | 401 | # Check if rule applies to this tool | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | plugins/apps/qwenpaw-data/backend/config.py | 74 | # The host has no "active embedding model" concept, so reuse shares the | COMMENT |
| MEDIUM | plugins/apps/qwenpaw-data/backend/main.py | 313 | # embedding model) from the environment so the Configure page | COMMENT |
| MEDIUM | plugins/apps/qwenpaw-data/backend/main.py | 774 | # The host has no "active embedding model" concept; reuse shares | COMMENT |
| MEDIUM | …tests/file_agent_runtime/test_specialist_file_tools.py | 48 | # The editing director is a pure orchestration role: composition/export | COMMENT |
| MEDIUM | …aw-creator/backend/services/run_review/media_review.py | 75 | # Frame-reference tolerance for the anti-hallucination bounds check: a | COMMENT |
| MEDIUM | …aw-creator/backend/services/run_review/media_review.py | 297 | # Anti-hallucination: an NA must explain itself. | COMMENT |
| MEDIUM | website/public/docs/quickstart.en.md | 425 | #### 👥 Create multi-agent | COMMENT |
| MEDIUM | tests/unit/agents/test_acp_available_commands.py | 751 | # The model context window and the compaction threshold flow through so the | COMMENT |
| MEDIUM | tests/unit/pawapp/test_qwenpaw_data_datasources.py | 185 | # The host has no "active embedding model" concept: only the provider's | COMMENT |
| MEDIUM⚡ | …es/qwenpawmail-mcp/src/qwenpawmail_mcp/thread_store.py | 778 | # mailbox statistics aggregation (server.py only orchestrates) | COMMENT |
| MEDIUM⚡ | e2e/tests/test_agent_core.py | 30 | # AC-001: Fork project + multi-agent collaboration | COMMENT |
| MEDIUM | e2e/tests/test_agent_core.py | 112 | # Send a task that would benefit from multi-agent | COMMENT |
| MEDIUM | e2e/tests/test_agent_core.py | 121 | # Look for multi-agent indicators | COMMENT |
| MEDIUM⚡ | src/qwenpaw/app/_app.py | 654 | # Stop multi-agent manager (stops all agents and their components) | COMMENT |
| MEDIUM⚡ | src/qwenpaw/app/migration.py | 92 | # 1. Multiple agents already exist (multi-agent config), OR | COMMENT |
| MEDIUM | src/qwenpaw/app/routers/agents.py | 926 | # Dest may already exist when create_skills_dir scaffolding ran. | COMMENT |
| MEDIUM | src/qwenpaw/app/routers/messages.py | 117 | # Get multi-agent manager from app state (via request) | COMMENT |
| MEDIUM | src/qwenpaw/app/chats/manager.py | 503 | # that never used an override has no leftover scaffolding. | COMMENT |
| MEDIUM⚡ | src/qwenpaw/app/channels/sip/livekit_backend.py | 168 | # Room connection (event-driven) | COMMENT |
| MEDIUM⚡ | src/qwenpaw/modes/mission/prompts.py | 11 | # Master prompt — injected into the *main* agent that orchestrates the loop. | COMMENT |
| MEDIUM | src/qwenpaw/providers/provider_manager_discovery.py | 254 | # This orchestration method intentionally keeps fetch, normalization, | COMMENT |
| MEDIUM | …ts/context/visual_compression/pipeline/tool_results.py | 471 | # Request orchestration calls this only after frozen history has replaced | COMMENT |
| MEDIUM | src/qwenpaw/agents/acp/server.py | 1219 | # context window. This is distinct from the cumulative ``tok`` | COMMENT |
| MEDIUM | src/qwenpaw/local_models/manager.py | 240 | # application, you might want to use a dependency injection framework. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/qwenpaw-pet/requirements.txt | 1 | # Keep in sync with plugin.json -> dependencies. | COMMENT |
| LOW | plugins/bundle/qwenpaw-pet/emitter.py | 21 | logger = logging.getLogger("qwenpaw.pet_desktop") | COMMENT |
| LOW | plugins/bundle/qwenpaw-pet/frontend/src/index.tsx | 1 | // React and antd are injected by the QwenPaw console host at runtime; | COMMENT |
| LOW | plugins/bundle/cloudpaw/hooks.py | 141 | COMMENT | |
| LOW | plugins/bundle/computer-use/computer_use/client.py | 101 | ) -> None: | COMMENT |
| LOW | plugins/apps/qwenpaw-data/requirements.txt | 1 | # QwenPaw-Data domain packages run in the isolated managed service environment. | COMMENT |
| LOW | plugins/apps/qwenpaw-data/docker-compose.yml | 1 | # One-shot QwenPaw Data demo stack. | COMMENT |
| LOW | plugins/apps/qwenpaw-data/scripts/sync-context-ui.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | plugins/apps/qwenpaw-data/scripts/setup-pypi.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | plugins/apps/qwenpaw-creator/requirements.txt | 1 | # QwenPaw supplies the shared framework/runtime dependencies. Keep only | COMMENT |
| LOW | …aw-creator/backend/services/run_review/media_review.py | 81 | # Strong references to in-flight review tasks: the event loop only keeps | COMMENT |
| LOW | …-creator/backend/services/media_files/r2v_execution.py | 4901 | ) | COMMENT |
| LOW | …reator/backend/services/media_files/local_execution.py | 2001 | # leaves sub-frame gaps at every joint. The mp4 muxer stretches | COMMENT |
| LOW | …reator/backend/services/media_files/local_execution.py | 3341 | recomposed over and over. | COMMENT |
| LOW | …enpaw-creator/backend/services/project_files/models.py | 1061 | # ducks the footage audio under it and must not overlap natively voiced | COMMENT |
| LOW | plugins/apps/qwenpaw-creator/scripts/dev.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/unit/app/chats/test_session.py | 441 | # --------------------------------------------------------------------------- | COMMENT |
| LOW | tests/unit/agents/__init__.py | 1 | # -*- coding: utf-8 -*- | COMMENT |
| LOW | tests/unit/agents/tools/__init__.py | 1 | # -*- coding: utf-8 -*- | COMMENT |
| LOW | tests/unit/channels/test_base_core.py | 1521 | base_channel.send_content_parts.assert_not_awaited() | COMMENT |
| LOW | tests/unit/channels/test_base_core.py | 1541 | # | COMMENT |
| LOW | tests/contract/channels/test_dingtalk_contract.py | 181 | # - DingTalk tests pass (dev tested locally) | COMMENT |
| LOW | tests/integration/test_acp_runner.py | 421 | records[0]["status"] == "success" | COMMENT |
| LOW | tests/integration/conftest.py | 421 | # 15s default lets cold-start endpoints (ACP getter, heartbeat) | COMMENT |
| LOW | scripts/docker_build.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/check-channels.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/verify/requirements-verify.txt | 1 | # Dependencies for scripts/verify/desktop_verify.py UI drivers. | COMMENT |
| LOW | scripts/review-bot/review_runner.py | 61 | # so the streaming reader needs a width cap as well as a height cap. | COMMENT |
| LOW | scripts/pack-tauri/build_pyinstaller.sh | 61 | # Install PyInstaller if not present | COMMENT |
| LOW | .github/workflows/release.yml | 1 | # QwenPaw unified release orchestrator (draft-driven, all-or-nothing). | COMMENT |
| LOW | .github/workflows/desktop-publish.yml | 1 | # Reusable "publish" half of the desktop release: take the desktop artifacts | COMMENT |
| LOW | .github/workflows/codeql.yml | 1 | name: CodeQL | COMMENT |
| LOW | .github/workflows/full-tests-nightly.yml | 1 | name: Full Tests Nightly | COMMENT |
| LOW | .github/workflows/full-tests-nightly.yml | 81 | with: | COMMENT |
| LOW | .github/workflows/full-tests-nightly.yml | 181 | COMMENT | |
| LOW | .github/workflows/full-tests-nightly.yml | 281 | # Pin setuptools <82 on EVERY platform. setuptools >= 82 removes | COMMENT |
| LOW | .github/workflows/full-tests-nightly.yml | 341 | # intermittently surface as ``httpx.ReadTimeout`` (e.g. the real | COMMENT |
| LOW | .github/workflows/full-tests-nightly.yml | 361 | set -e | COMMENT |
| LOW | .github/workflows/full-tests-nightly.yml | 401 | .coverage.integration | COMMENT |
| LOW | .github/workflows/creator-release.yml | 81 | # index (or when forced via workflow_dispatch). Keeps re-runs and | COMMENT |
| LOW | .github/workflows/qwenpaw-data-release.yml | 1 | # Standalone release pipeline for the QwenPaw-Data (qwenpaw-data) plugin. | COMMENT |
| LOW | .github/workflows/pr-preview-tests.yml | 1 | name: PR preview tests | COMMENT |
| LOW | .github/workflows/pr-preview-tests.yml | 101 | - name: Install dependencies | COMMENT |
| LOW | .github/workflows/pr-preview-tests.yml | 161 | # raises AttributeError the fallback does not catch — crashing the | COMMENT |
| LOW | .github/workflows/tests.yml | 341 | # upgrades to the latest release (84.x) while backtracking the | COMMENT |
| LOW | .github/workflows/tests.yml | 641 | coverage.combined.xml | COMMENT |
| LOW | e2e/tests/test_tools.py | 21 | COMMENT | |
| LOW | e2e/scripts/start_test_server.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | e2e/pages/agents_page.py | 61 | # ``data-status`` attribute (disabled/pending/starting/running/failed) | COMMENT |
| LOW | e2e/pages/channels_page.py | 41 | # button-like div — no status dot, no tag). Fresh workspaces have only | COMMENT |
| LOW | console/src-tauri/src/computer_use_runtime.rs | 861 | // predictable name in a world-writable /tmp can be pre-created by another | COMMENT |
| LOW | console/src-tauri/src/backend_download.rs | 321 | COMMENT | |
| LOW | console/src-tauri/src/runtime_env.rs | 1 | //! Environment the desktop shell hands to the Python backend sidecar. | COMMENT |
| LOW | …nsole/src-tauri/src/bin/qwenpaw-computer-use-helper.rs | 1 | //! The Computer Use helper: a process whose only job is to serve the automation | COMMENT |
| LOW | …sole/src-tauri/src/computer_use_server/app_identity.rs | 1 | //! Naming an application, and starting one. | COMMENT |
| LOW | …sole/src-tauri/src/computer_use_server/app_identity.rs | 41 | app_id: app_id_from_path(&path), | COMMENT |
| LOW | console/src-tauri/src/computer_use_server/dispatch.rs | 61 | "type_text", | COMMENT |
| LOW | console/src-tauri/src/computer_use_server/dispatch.rs | 101 | /// parked on a lock is not reading that connection, so it would wake later and | COMMENT |
| LOW | console/src-tauri/src/computer_use_server/dispatch.rs | 681 | Ok(()) | COMMENT |
| LOW | console/src-tauri/src/computer_use_server/state.rs | 1 | //! What the platform leaves share: the shape of a window, an observation, and | COMMENT |
| 24 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/bundle/cloudpaw/hooks.py | 618 | CODE | |
| LOW | plugins/bundle/cloudpaw/tools/manage_prd.py | 254 | CODE | |
| LOW | plugins/bundle/chrome/assets/scripts/nm_host.py | 417 | CODE | |
| LOW | plugins/bundle/computer-use/computer_use/dispatch.py | 303 | CODE | |
| LOW | plugins/channel/azure_bot/channel.py | 96 | CODE | |
| LOW | …ins/apps/qwenpaw-creator/backend/models/video_model.py | 569 | CODE | |
| LOW | …ps/qwenpaw-creator/backend/api/observability_routes.py | 43 | CODE | |
| LOW | …eator/backend/services/media_files/motion_templates.py | 113 | CODE | |
| LOW | …-creator/backend/services/media_files/motion_design.py | 987 | CODE | |
| LOW | …-creator/backend/services/media_files/motion_design.py | 1116 | CODE | |
| LOW | …-creator/backend/services/media_files/r2v_execution.py | 5003 | CODE | |
| LOW | …-creator/backend/services/media_files/r2v_execution.py | 1348 | CODE | |
| LOW | …enpaw-creator/backend/services/project_files/commit.py | 324 | CODE | |
| LOW | …paw-creator/backend/services/web_grounding/pipeline.py | 94 | CODE | |
| LOW | …or/backend/services/file_agent_runtime/model_client.py | 737 | CODE | |
| LOW | …ator/backend/services/runtime_files/execution_store.py | 455 | CODE | |
| LOW | …ator/backend/services/runtime_files/execution_store.py | 770 | CODE | |
| LOW | …ator/backend/services/runtime_files/execution_store.py | 1164 | CODE | |
| LOW | …reator/backend/services/runtime_files/session_store.py | 299 | CODE | |
| LOW | …wenpaw-creator/backend/services/media/source_memory.py | 1755 | CODE | |
| LOW | tests/unit/app/conftest.py | 121 | CODE | |
| LOW | tests/unit/app/approvals/test_service.py | 42 | CODE | |
| LOW | tests/unit/app/approvals/test_driver_gate.py | 49 | CODE | |
| LOW | tests/unit/cli/test_providers_cmd.py | 30 | CODE | |
| LOW | tests/integration/helpers.py | 264 | CODE | |
| LOW | packages/qwenpawmail-mcp/src/qwenpawmail_mcp/server.py | 690 | CODE | |
| LOW | packages/qwenpawmail-mcp/src/qwenpawmail_mcp/server.py | 963 | CODE | |
| LOW | …es/qwenpawmail-mcp/src/qwenpawmail_mcp/thread_store.py | 579 | CODE | |
| LOW | e2e/pages/inbox_page.py | 176 | CODE | |
| LOW | e2e/pages/cronjobs_page.py | 162 | CODE | |
| LOW | src/qwenpaw/app/routers/agent_scoped.py | 64 | CODE | |
| LOW | src/qwenpaw/app/mail/mail_access_control.py | 53 | CODE | |
| LOW | src/qwenpaw/app/chats/utils.py | 142 | CODE | |
| LOW | src/qwenpaw/app/channels/base.py | 124 | CODE | |
| LOW | src/qwenpaw/app/channels/dingtalk/channel.py | 158 | CODE | |
| LOW | src/qwenpaw/app/channels/yuanbao/channel.py | 133 | CODE | |
| LOW | src/qwenpaw/app/channels/xiaoyi/channel.py | 359 | CODE | |
| LOW | src/qwenpaw/app/channels/feishu/channel.py | 209 | CODE | |
| LOW | src/qwenpaw/app/channels/wecom/channel.py | 136 | CODE | |
| LOW | src/qwenpaw/app/channels/wechat/channel.py | 75 | CODE | |
| LOW | src/qwenpaw/app/channels/telegram/channel.py | 308 | CODE | |
| LOW | src/qwenpaw/app/channels/slack/channel.py | 130 | CODE | |
| LOW | src/qwenpaw/app/channels/mattermost/channel.py | 109 | CODE | |
| LOW | src/qwenpaw/app/channels/onebot/channel.py | 295 | CODE | |
| LOW | src/qwenpaw/app/channels/imessage/channel.py | 43 | CODE | |
| LOW | src/qwenpaw/app/channels/mqtt/channel.py | 37 | CODE | |
| LOW | src/qwenpaw/app/channels/discord_/channel.py | 54 | CODE | |
| LOW | src/qwenpaw/app/channels/matrix/channel.py | 206 | CODE | |
| LOW | src/qwenpaw/app/channels/qq/channel.py | 657 | CODE | |
| LOW | src/qwenpaw/modes/mission/prompts.py | 840 | CODE | |
| LOW | src/qwenpaw/runtime/tool_registry.py | 216 | CODE | |
| LOW | src/qwenpaw/runtime/builder.py | 85 | CODE | |
| LOW | src/qwenpaw/agents/command_handler.py | 124 | CODE | |
| LOW | src/qwenpaw/agents/middlewares.py | 736 | CODE | |
| LOW | src/qwenpaw/agents/tools/utils.py | 477 | CODE | |
| LOW | …paw/agents/tools/deprecated_browser/browser_control.py | 2402 | CODE | |
| LOW | …paw/agents/tools/deprecated_browser/browser_control.py | 5056 | CODE | |
| LOW | src/qwenpaw/agents/context/scroll/recall_tool.py | 926 | CODE | |
| LOW | src/qwenpaw/agents/context/scroll/memoryspace.py | 342 | CODE | |
| LOW | src/qwenpaw/agents/context/scroll/memoryspace.py | 734 | CODE | |
| 3 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …reator/backend/services/media_files/audio_execution.py | 88 | """Duration of a WAV payload, robust against streaming-writer headers. | STRING |
| MEDIUM | …creator/backend/services/media_files/motion_overlay.py | 64 | # Loop seam gate: a seamless loop must paint (nearly) identical pixels at | COMMENT |
| MEDIUM⚡ | …ator/backend/services/media_files/motion_blueprints.py | 575 | # Text-free decoration blueprints (loop=True, seamless period) | STRING |
| LOW⚡ | tests/unit/channels/test_dingtalk.py | 906 | # Should not raise, just return | COMMENT |
| MEDIUM | tests/integration/test_console_chat_task.py | 173 | # rather than a specific value to remain robust. | COMMENT |
| MEDIUM | e2e/pages/coding_page.py | 230 | # filtering by visibility is more robust. | COMMENT |
| MEDIUM | console/package-lock.json | 12905 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| LOW | src/qwenpaw/app/routers/config.py | 501 | # For custom channels, just use the dict | COMMENT |
| MEDIUM | src/qwenpaw/app/workspace/service_factories.py | 261 | # harness runtimes cannot handle the dict wake requests built by the | COMMENT |
| MEDIUM | …qwenpaw/security/tool_guard/guardians/rule_guardian.py | 229 | # Use a more robust approach to split commands while respecting quotes | COMMENT |
| MEDIUM | src/qwenpaw/providers/openai_chat_model_compat.py | 665 | """OpenAIChatModel with robust parsing for malformed tool-call chunks | STRING |
| MEDIUM | src/qwenpaw/cli/update_cmd.py | 36 | """Return robust text-decoding settings for subprocess output. | STRING |
| MEDIUM | src/qwenpaw/sandbox/macos_sandbox.py | 45 | # TODO: this remains a heuristic. A robust solution would be to read | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/unit/runtime/test_executor_finished_at.py | 149 | CODE | |
| MEDIUM | tests/unit/runtime/test_executor_finished_at.py | 157 | CODE | |
| MEDIUM | tests/unit/agents/tools/test_run_tool_batch_engine.py | 509 | CODE | |
| MEDIUM | tests/unit/agents/tools/test_run_tool_batch_engine.py | 523 | CODE | |
| MEDIUM | tests/unit/agents/tools/test_run_tool_batch.py | 978 | CODE | |
| MEDIUM | tests/unit/agents/tools/test_run_tool_batch.py | 1008 | CODE | |
| MEDIUM | tests/unit/channels/test_dingtalk.py | 1728 | CODE | |
| MEDIUM | src/qwenpaw/app/routers/console.py | 325 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | plugins/apps/qwenpaw-data/scripts/sync-context-ui.sh | 18 | # Usage: | COMMENT |
| LOW | plugins/apps/qwenpaw-creator/scripts/dev.sh | 4 | # Usage: | COMMENT |
| LOW⚡ | tests/contract/providers/test_provider_contract.py | 92 | # Example usage: | COMMENT |
| LOW | scripts/check-channels.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/pack-tauri/build_macos_pyinstaller.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/pack-tauri/build_pyinstaller.sh | 5 | # Usage: | COMMENT |
| LOW | e2e/scripts/start_test_server.sh | 4 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .github/workflows/issue-welcome.yml | 107 | `> Our [contribution policy](https://github.com/${context.repo.owner}/${context.repo.repo}/issues/4333 | CODE |
| HIGH | .github/workflows/pr-welcome.yml | 98 | `> Our [contribution policy](https://github.com/${context.repo.owner}/${context.repo.repo}/issues/4333 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/pr-welcome.yml | 320 | comment += `Great job using the PR template! Don't forget to fill in the **Testing** section with how to | CODE |
| LOW | .github/workflows/pr-welcome.yml | 404 | comment += `Great job using the PR template! Don't forget to fill in the **Testing** section with how to | CODE |
| LOW | src/qwenpaw/modes/mission/prompts.py | 532 | - Gotchas encountered (e.g., "don't forget to update Z when changing W") | CODE |