Apache Maka (Incubating) is a local-first AI agent workspace. Model messages, tool calls, tool results, permission decisions, and termination events are recorded as an append-only log.
This report presents the forensic synthetic code analysis of apache/maka, a TypeScript project with 3,981 GitHub stars. SynthScan v2.0 examined 1,111,242 lines of code across 2972 source files, recording 4110 pattern matches distributed across 14 syntactic categories. The overall adjusted score of 4.0 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 4110 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/archive/2026-06-24-runtime-ledger-backfill.md | 411 | export function backfillRuntimeEventsFromStoredMessages(input: RuntimeEventBackfillInput): RuntimeEventBackfillResult { | CODE |
| LOW | packages/ui/stories/model-picker.stories.tsx | 123 | render: function ExistingConversationRender() { | CODE |
| LOW | packages/ui/stories/model-picker.stories.tsx | 264 | render: function ThinkingLevelSeparateRender() { | CODE |
| LOW | packages/ui/src/composer-helpers.ts | 56 | export function deriveComposerModelSwitchAvailability(input: { | CODE |
| LOW | packages/ui/src/composer-helpers.ts | 133 | export function rememberComposerHistoryEntry(entries: string[], text: string): string[] { | CODE |
| LOW | packages/ui/src/chat-turn.tsx | 799 | function splitTimelineAtUserMessages( | CODE |
| LOW | packages/ui/src/chat-turn.tsx | 1083 | export function ModelProviderRetryIndicator(props: { retry: LiveProviderRetry }) { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 131 | export function compareScheduledTaskBySort(a: ScheduledTask, b: ScheduledTask, sort: 'created-desc' | 'next-run-asc' | ' | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 141 | function scheduledTaskStatusDisplayRank(task: ScheduledTask): number { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 148 | function scheduledTaskNextRunSortValue(task: ScheduledTask): number { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 152 | function scheduledTaskLastRunSortValue(task: ScheduledTask): number { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 156 | export function normalizeScheduledTaskSearchQuery(query: string): string { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 160 | export function scheduledTaskMatchesSearch(task: ScheduledTask, query: string, locale: UiLocale): boolean { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 176 | export function scheduledTaskStatusGroupLabel(status: ScheduledTaskStatus, locale: UiLocale): string { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 184 | export function scheduledTaskRunRangeStart(range: 'day' | 'week' | 'month' | 'all', now: number): number | null { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 194 | export function scheduledTaskEditableRunAt(task: ScheduledTask, now: number = Date.now()): number { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 204 | export function scheduledTaskRecurrenceValue(task: ScheduledTask): ScheduledTaskRecurrence { | CODE |
| LOW⚡ | packages/ui/src/scheduled-task-helpers.ts | 212 | export function duplicateScheduledTaskTitle(title: string, locale: UiLocale): string { | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 62 | export function toScheduledTaskLocalDateTimeValue(ts: number): string { | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 68 | export function scheduledTaskTemplateNextRunAt(template: ScheduledTaskExampleTemplate, now: number = Date.now()): number | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 84 | export function scheduledTaskFormValidation(input: { | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 115 | export function formatScheduledTaskDeliveryProviderList(): string { | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 119 | export function compareScheduledTaskForDisplay(a: ScheduledTask, b: ScheduledTask, locale: UiLocale): number { | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 251 | export function formatScheduledTaskRecurrence(task: ScheduledTask, locale: UiLocale): string { | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 263 | export function formatScheduledTaskDeliveryTargetLabel(effect: ScheduledTaskEffect, locale: UiLocale): string { | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 322 | export function createScheduledTaskFormSeed(now: number = Date.now()): ScheduledTaskFormSeed { | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 337 | export function scheduledTaskTemplateSeed(template: ScheduledTaskExampleTemplate, now: number = Date.now()): ScheduledTa | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 348 | function scheduledTaskFormSeedFromTask(task: ScheduledTask): ScheduledTaskFormSeed { | CODE |
| LOW | packages/ui/src/scheduled-task-helpers.ts | 371 | export function scheduledTaskDuplicateSeed(task: ScheduledTask, locale: UiLocale): ScheduledTaskFormSeed { | CODE |
| LOW | packages/ui/src/search-modal.tsx | 126 | function searchModalThrownErrorMessage( | CODE |
| LOW | packages/ui/src/user-question-prompt-state.ts | 35 | export function buildUserQuestionResponse( | CODE |
| LOW | packages/ui/src/streaming-display-redaction.ts | 75 | export function createStreamingDisplayRedactionState( | CODE |
| LOW | packages/ui/src/streaming-display-redaction.ts | 99 | export function appendStreamingDisplayRedaction( | CODE |
| LOW | packages/ui/src/streaming-display-redaction.ts | 219 | export function truncateStreamingDisplayAppend( | CODE |
| LOW | packages/ui/src/streaming-display-redaction.ts | 247 | export function truncateStreamingDisplayTail( | CODE |
| LOW | packages/ui/src/titlebar-session-identity.tsx | 54 | export function deriveTitlebarProjectName(options: { | CODE |
| LOW | packages/ui/src/attachment-image.tsx | 45 | export function SessionAttachmentProvider(props: { | CODE |
| LOW | packages/ui/src/chat-view.tsx | 900 | export function DeepResearchProgressPanel({ | CODE |
| LOW | packages/ui/src/use-message-selection-quote.ts | 62 | export function preservesNativeSelectionScroll( | CODE |
| LOW | packages/ui/src/live-turn-projection.ts | 114 | function projectToolActivityIdentity(event: { | CODE |
| LOW | packages/ui/src/live-turn-projection.ts | 617 | export function reconcileTerminalLiveTurn( | CODE |
| LOW | packages/ui/src/skill-status.ts | 42 | function hasManagedUpdateAttention(skill: SkillEntry): boolean { | CODE |
| LOW | packages/ui/src/skill-status.ts | 81 | export function skillExceptionalStateLabel(skill: SkillEntry, copy: SkillsCopy): string | null { | CODE |
| LOW | packages/ui/src/skill-status.ts | 117 | export function formatSkillLibraryDescription(skill: SkillEntry, copy: SkillsCopy): string | undefined { | CODE |
| LOW | packages/ui/src/chat-input-behavior.ts | 85 | export function fileTransferContainsFiles(types: Iterable<string>, fileCount: number): boolean { | CODE |
| LOW | packages/ui/src/materialize.ts | 241 | function materializeToolResultStatus( | CODE |
| LOW | packages/ui/src/materialize.ts | 625 | export function applyShellRunOverlayEntry( | CODE |
| LOW | packages/ui/src/materialize.ts | 646 | export function toolActivityPresentationStatus(item: ToolActivityItem): ToolActivityStatus { | CODE |
| LOW | packages/ui/src/materialize.ts | 857 | export function foldShellRunToolActivities( | CODE |
| LOW | packages/ui/src/turn-virtualizer.ts | 58 | export function turnVirtualizationRequired( | CODE |
| LOW | packages/ui/src/turn-virtualizer.ts | 100 | export function turnVirtualWindowForRange( | CODE |
| LOW | packages/ui/src/turn-virtualizer.ts | 108 | export function turnVirtualWindowForViewport( | CODE |
| LOW | packages/ui/src/turn-virtualizer.ts | 144 | export function stableTurnVirtualWindowForViewport( | CODE |
| LOW | packages/ui/src/turn-virtualizer.ts | 223 | export function reconcileTurnVirtualWindow( | CODE |
| LOW⚡ | packages/ui/src/inline-reference.tsx | 30 | export function inlineReferenceFileBasename(relativePath: string): string { | CODE |
| LOW⚡ | packages/ui/src/inline-reference.tsx | 35 | export function workspaceFileInlineReference(relativePath: string): InlineReferenceVisual { | CODE |
| LOW⚡ | packages/ui/src/inline-reference.tsx | 44 | export function workspaceFileReferencePositions(root: Node): WorkspaceFileReferencePosition[] { | CODE |
| LOW | packages/ui/src/streaming-presentation.ts | 25 | export function isProgressiveStreamingEnabled(streaming?: boolean): boolean { | CODE |
| LOW | packages/ui/src/streaming-presentation.ts | 48 | export function isTimeDrivenMotionEnabled(within?: Element | null): boolean { | CODE |
| LOW | packages/ui/src/transcript-projection.ts | 76 | export function createTranscriptProjection(): TranscriptProjection { | CODE |
| 3622 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .asf.yaml | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | deny.toml | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | .pr_agent.toml | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | .coderabbit.yaml | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | native/runtime-host-peer/Cargo.toml | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | native/runtime-host-peer/rust-toolchain.toml | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | native/gitoxide-helper/Cargo.toml | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | native/gitoxide-helper/rust-toolchain.toml | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | experiments/windows-sandbox/launcher/Cargo.toml | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | experiments/windows-sandbox/launcher/src/protocol.rs | 41 | pub network: NetworkMode, | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 181 | std::mem::forget(profile); | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 201 | /// AppContainer-confined and Job-accounted, and that exits cleanly, fails | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 221 | // the lifecycle never runs unlocked. | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 261 | // returns an error, so availability fails closed for this cycle. The | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 461 | // descendant may still hold this AppContainer identity), so it is surfaced | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 581 | } | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 621 | } | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 681 | | DESKTOP_ENUMERATE; | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 701 | /// plus any hidden windows/menus the child creates, so 512 KiB (a sixth of the | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 761 | /// off the interactive desktop, so code that never re-attaches cannot | COMMENT |
| LOW | …ments/windows-sandbox/launcher/src/windows_launcher.rs | 1641 | result.push('"'); | COMMENT |
| LOW | experiments/windows-sandbox/launcher/src/acl_ledger.rs | 61 | /// a live lease and would recover grants that are still in use. The names are | COMMENT |
| LOW | experiments/windows-sandbox/launcher/src/acl_ledger.rs | 81 | } | COMMENT |
| LOW | experiments/windows-sandbox/launcher/src/acl_ledger.rs | 321 | /// The pre-existing object keeps whatever security descriptor its creator gave | COMMENT |
| LOW | scripts/release-eval-smoke-sitecustomize.py | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | scripts/generate-app-icons.py | 1 | # Licensed to the Apache Software Foundation (ASF) under one | COMMENT |
| LOW | scripts/generate-app-icons.py | 81 | return ("%g %g %g %g" % (x0, y0, x1 - x0, y1 - y0), int(x1 - x0), int(y1 - y0)) | COMMENT |
| LOW | packages/ui/stories/capability-audit-strip.stories.tsx | 21 | import type { CapabilityAuditReport } from '@maka/core/capability-audit'; | COMMENT |
| LOW | packages/ui/src/chat-empty-hero.tsx | 81 | // Greet the user by name when they've set one in Personalization Settings. | COMMENT |
| LOW | packages/ui/src/chat-view.tsx | 361 | const turns = useTranscriptProjection({ | COMMENT |
| LOW | packages/ui/src/chat-view.tsx | 381 | // timeline — as `turns[last]`. Only the tail TurnView gets a fresh | COMMENT |
| LOW | packages/ui/src/scheduled-task-inspector.tsx | 21 | // | COMMENT |
| LOW | packages/ui/src/skill-status.ts | 21 | // | COMMENT |
| LOW | packages/ui/src/chat-surface-layout.tsx | 101 | // Unconditional: an authority nobody attaches a scroller to writes nothing | COMMENT |
| LOW | packages/ui/src/use-chat-scroll.ts | 61 | // A new conversation arrives at its tail. Nothing special positions it: the | COMMENT |
| LOW | packages/ui/src/use-chat-scroll.ts | 81 | void Promise.resolve(loadEarlierRef.current?.()).catch(() => undefined); | COMMENT |
| LOW | packages/ui/src/composer.tsx | 961 | : mentionCopy.skillsAriaLabel, | COMMENT |
| LOW | packages/ui/src/composer.tsx | 1241 | // Keystrokes made during an IME composition never reach this handler — the | COMMENT |
| LOW | packages/ui/src/composer.tsx | 1361 | // disabled reasons (empty draft, in-flight import) keep the neutral label. | COMMENT |
| LOW | packages/ui/src/composer.tsx | 1821 | icon={<Sparkles size={ICON_SIZE.control} aria-hidden="true" />} | COMMENT |
| LOW | packages/ui/src/composer.tsx | 1841 | } | COMMENT |
| LOW | packages/ui/src/skills-panel.tsx | 21 | // | COMMENT |
| LOW | packages/ui/src/transcript-scroll-authority.tsx | 141 | const target = root; | COMMENT |
| LOW | packages/ui/src/transcript-scroll-authority.tsx | 181 | // Everything that moves the tail without the reader asking, watched in | COMMENT |
| LOW | packages/ui/src/index.ts | 61 | export * from './toast.js'; | COMMENT |
| LOW | packages/ui/src/session-sidebar-nav.tsx | 121 | // One sentence, serving as both the tooltip and the accessible name. | COMMENT |
| LOW | packages/ui/src/toast.tsx | 21 | // | COMMENT |
| LOW | packages/ui/src/session-list-panel.tsx | 81 | <SegmentedControlItem value="project" label={copy.groupByProject} /> | COMMENT |
| LOW | packages/ui/src/markdown-body.tsx | 161 | // edges, which is the defect this whole change exists to remove. One | COMMENT |
| LOW | packages/ui/src/skill-inspector.tsx | 21 | // | COMMENT |
| LOW | packages/ui/src/use-roving-row-focus.ts | 21 | // | COMMENT |
| LOW | packages/ui/src/use-roving-row-focus.ts | 61 | [containerRef], | COMMENT |
| LOW | packages/ui/src/prompt-anchor-rail.tsx | 441 | // tick there while the rail sat at scrollTop 0. | COMMENT |
| LOW | packages/ui/src/prompt-anchor-rail.tsx | 481 | const root = scrollRef.current; | COMMENT |
| LOW | packages/ui/src/primitives/module-page.tsx | 21 | // | COMMENT |
| LOW | packages/ui/src/primitives/module-page.tsx | 41 | // | COMMENT |
| LOW | packages/ui/src/primitives/module-page.tsx | 121 | // rows would have less room than their own content needs. | COMMENT |
| LOW | packages/ui/src/primitives/page-header.tsx | 21 | // | COMMENT |
| LOW | packages/ui/src/primitives/stat-tile.tsx | 21 | // | COMMENT |
| LOW | packages/core/src/bot-chat-settings.ts | 201 | ...(allowedUserIds ? { allowedUserIds } : { allowedUserIds: undefined }), | COMMENT |
| 236 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/ui/src/skills-panel.tsx | 241 | // ── Derived views ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/ui/src/skills-panel.tsx | 336 | // ── Catalog rows (市场 / 内置): one job each — install. ────────────── | COMMENT |
| MEDIUM | packages/ui/src/primitives/chat.tsx | 131 | // ── shared base ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/ui/src/primitives/chat.tsx | 139 | // ── file diff (shared with apps/desktop artifact-preview) ───────────── | COMMENT |
| MEDIUM | packages/ui/src/primitives/chat.tsx | 154 | // ── terminal ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/ui/src/primitives/chat.tsx | 182 | // ── explore agent / subagent (shared shell) ─────────────────────────── | COMMENT |
| MEDIUM | packages/ui/src/primitives/chat.tsx | 215 | // ── web search ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/ui/src/primitives/chat.tsx | 230 | // ── load-tool result card (separate base; not an overlay) ───────────── | COMMENT |
| MEDIUM | packages/ui/src/__tests__/materialize.test.ts | 259 | // ── #1307: the timeline model stays flat (fold is a render concern) ────────── | COMMENT |
| MEDIUM | packages/ui/src/__tests__/materialize.test.ts | 259 | // ── #1307: the timeline model stays flat (fold is a render concern) ────────── | COMMENT |
| MEDIUM | packages/core/src/tool-quiet-preview.ts | 36 | // ── Locale ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/tool-quiet-preview.ts | 81 | // ── Tool command extraction ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/tool-quiet-preview.ts | 95 | // ── Key priority tables ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/tool-quiet-preview.ts | 147 | // ── Secret masking ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/tool-quiet-preview.ts | 166 | // ── Helpers ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/tool-quiet-preview.ts | 219 | // ── Public API: invocation line ───────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/tool-quiet-preview.ts | 319 | // ── Public API: args preview (live wire) ──────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/tool-quiet-preview.ts | 506 | // ── Public API: quiet JSON value ───────────────────────────────────────── | COMMENT |
| MEDIUM | packages/core/src/tool-quiet-preview.ts | 608 | // ── Internal: headline / remainder ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 178 | // ── Model text ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 203 | // ── Model thinking ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 229 | // ── Tool calls / results ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 371 | // ── Session sandbox boundary ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 433 | // ── Steering: a user message injected mid-turn at a step boundary ───── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 457 | // ── Transient provider retry progress ──────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 477 | // ── Plan handoff (placeholder; Phase 5/7 refines) ───────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 497 | // ── Token usage ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 549 | // ── Error ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/session-event-runtime-mapper.ts | 571 | // ── Terminal: abort + complete ──────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/path-containment.ts | 186 | // ── Contained file I/O ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/path-containment.ts | 271 | // ── Generic type guard ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/path-containment.ts | 278 | // ── Crypto helper ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/runtime/src/skills-context.ts | 213 | // ── Public API: budget ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 43 | // ── Limits ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 58 | // ── Types ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 181 | // ── Prompt rendering ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 227 | // ── Public API: gating ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 249 | // ── Public API: context selection ──────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 378 | // ── Public API: prompt fragment ─────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 420 | // ── Public API: load instructions ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 514 | // ── Public API: search ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 526 | // ── Internal: search ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-context.ts | 626 | // ── Internal: decision helper ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-discovery.ts | 44 | // ── Types ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-discovery.ts | 162 | // ── Public API ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-discovery.ts | 322 | // ── Internal helpers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/runtime/src/skills-agent-tools.ts | 52 | // ── Constants ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/runtime/src/skills-agent-tools.ts | 61 | // ── Types ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/runtime/src/skills-agent-tools.ts | 71 | // ── Shadow selection tracker ────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-agent-tools.ts | 111 | // ── Public API ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-state.ts | 38 | // ── Types ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-state.ts | 73 | // ── Internal types ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-state.ts | 81 | // ── Public API ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/skills-state.ts | 319 | // ── Internal helpers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/ai-sdk-backend.ts | 701 | // ── Session context ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/ai-sdk-backend.ts | 711 | // ── Process-singleton deps ───────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/runtime/src/ai-sdk-backend.ts | 727 | // ── Optional knobs (defaults shown) ──────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/runtime/src/skills.ts | 37 | // ── From path-containment (contained I/O moved in #1408) ────────────────── | COMMENT |
| MEDIUM⚡ | packages/runtime/src/skills.ts | 37 | // ── From path-containment (contained I/O moved in #1408) ────────────────── | COMMENT |
| MEDIUM⚡ | packages/runtime/src/skills.ts | 45 | // ── From skills-metadata ────────────────────────────────────────────────── | COMMENT |
| 17 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …desktop/src/renderer/settings/bot-onboarding-modal.tsx | 69 | void window.maka.settings.bots.onboarding.cancel(sessionId).catch(() => undefined); | CODE |
| CRITICAL | …desktop/src/renderer/settings/bot-onboarding-modal.tsx | 82 | const result = await window.maka.settings.bots.onboarding.start({ | CODE |
| CRITICAL | …desktop/src/renderer/settings/bot-onboarding-modal.tsx | 114 | const result = await window.maka.settings.bots.onboarding.poll(sessionId); | CODE |
| CRITICAL | …desktop/src/renderer/settings/bot-onboarding-modal.tsx | 141 | const result = await window.maka.settings.bots.onboarding.openInBrowser(snapshot.sessionId); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | package-lock.json | 12282 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| MEDIUM⚡ | …/eval/harbor/deepseek-harness-profile/cordis.patch.yml | 12 | # `package.json` declares no bundles, so the harness composes this tree over an | COMMENT |
| MEDIUM⚡ | …/eval/harbor/deepseek-harness-profile/cordis.patch.yml | 17 | # Derived from the harness's own examples/jsonrpc-agent/minimal.cordis.yml — | COMMENT |
| MEDIUM⚡ | …/eval/harbor/deepseek-harness-profile/cordis.patch.yml | 24 | # Source: https://github.com/deepseek-ai/deepseek-harness | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/code-origin-audit.md | 83 | | 1 | `apps/desktop/src/main/__tests__/renderer-core-barrel-node-boundary.test.ts:30-52` | [`muratgur/ordinus`](https:// | CODE |
| MEDIUM | packages/ui/README.md | 58 | ## Contracts & guardrails | COMMENT |
| MEDIUM | apps/desktop/stories/app-shell.stories.tsx | 987 | // visual-acceptance scaffold for the transcript. Open this first, then the | COMMENT |
| MEDIUM | apps/desktop/src/renderer/README.md | 78 | ## Contracts & guardrails | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/core/src/__tests__/provider-catalog-contract.test.ts | 62 | const resolved = def.baseUrlTemplate.replace(/\$\{[^}]+\}/g, 'placeholder'); | CODE |
| LOW | packages/core/src/__tests__/interaction.test.ts | 450 | script: 'review note\npassword=dummy-value\nrun visible', | CODE |
| LOW | packages/core/src/__tests__/interaction.test.ts | 460 | assert.doesNotMatch(projected.prompt.review.arguments.text, /dummy-value/); | CODE |
| LOW | packages/core/src/__tests__/redaction.test.ts | 114 | assignment: 'review note\npassword=dummy-value\nrun visible', | CODE |
| LOW | packages/core/src/__tests__/redaction.test.ts | 182 | redactSecrets('# " review note\npassword=dummy-value\npython deploy.py --target production'), | CODE |
| LOW | …cli/src/__tests__/runtime-host-service-manager.test.ts | 1005 | await writeFile(join(base, 'placeholder'), '', 'utf8'); | CODE |
| LOW | …ps/desktop/src/main/__tests__/assistant-stream.test.ts | 121 | `${'lorem ipsum dolor sit amet '.repeat(200)} sk-deadbeef00000000deadbeef00000000`, | CODE |
| LOW | …ps/desktop/src/main/__tests__/assistant-stream.test.ts | 121 | `${'lorem ipsum dolor sit amet '.repeat(200)} sk-deadbeef00000000deadbeef00000000`, | CODE |
| LOW | apps/desktop/src/overlay/pip.html | 330 | <div id="placeholder" data-visible="1" aria-hidden="true"><div id="sweep"></div></div> | CODE |
| LOW | apps/desktop/src/overlay/pip.ts | 38 | const placeholder = document.getElementById('placeholder') as HTMLDivElement; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | packages/eval/harbor/relay_agent.py | 496 | prepared = await environment.exec("mkdir -p /logs/artifacts && chmod 700 /logs/artifacts") | STRING |
| HIGH | packages/eval/harbor/relay_agent.py | 619 | f"pgid=$(cat {shlex.quote(scope_path)} 2>/dev/null) || exit 0; " | STRING |
| HIGH | packages/eval/harbor/relay_agent.py | 646 | f"pgid=$(cat {shlex.quote(scope_path)} 2>/dev/null) || exit 4; " | STRING |
| HIGH | packages/eval/harbor/relay_agent.py | 648 | "kill -0 -- \"-$pgid\" 2>/dev/null; status=$?; " | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/generate-app-icons.py | 359 | CODE | |
| LOW | scripts/generate-app-icons.py | 425 | CODE | |
| LOW | scripts/generate-app-icons.py | 528 | CODE | |
| LOW | packages/eval/harbor/test_relay_lifecycle.py | 601 | CODE | |
| LOW | packages/eval/harbor/test_relay_lifecycle.py | 704 | CODE | |
| LOW | packages/eval/harbor/test_relay_contract.py | 393 | CODE | |
| LOW | packages/eval/harbor/test_relay_contract.py | 463 | CODE | |
| LOW | packages/eval/harbor/test_relay_contract.py | 544 | CODE | |
| LOW | packages/eval/harbor/relay_agent.py | 563 | CODE | |
| LOW | packages/eval/harbor/relay_agent.py | 114 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/eval/harbor/test_cell_egress_namespace.py | 32 | CODE | |
| LOW | packages/eval/harbor/test_relay_artifacts.py | 18 | CODE | |
| LOW | packages/eval/harbor/test_relay_artifacts.py | 20 | CODE | |
| LOW | packages/eval/harbor/eval_framework.py | 24 | CODE | |
| LOW | packages/eval/harbor/relay_agent.py | 20 | CODE | |
| LOW | packages/eval/harbor/test_egress_filter_live.py | 29 | CODE | |
| LOW | packages/eval/harbor/egress_filter.py | 20 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/eval/harbor/relay_agent.py | 602 | except Exception: | STRING |
| LOW | packages/eval/harbor/relay_agent.py | 606 | except Exception: | STRING |
| LOW | packages/eval/harbor/egress_filter.py | 172 | except Exception: | CODE |
| LOW | packages/eval/harbor/egress_filter.py | 230 | except Exception as error: | CODE |
| LOW | packages/eval/harbor/egress_filter.py | 241 | except Exception: | CODE |
| LOW | packages/eval/harbor/egress_filter.py | 307 | except Exception: | CODE |
| LOW | packages/eval/harbor/egress_filter.py | 326 | except Exception: | CODE |
| LOW | packages/eval/harbor/egress_filter.py | 335 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | README.md | 33 | <a href="https://deepwiki.com/apache/maka"><img src="https://img.shields.io/badge/DeepWiki-third--party%20AI%20docs-9B | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/eval/harbor/egress-proxy/entrypoint.sh | 25 | # Create the audit log if this is the first start. Truncating here would erase | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/eval/harbor/deepseek-codex-models.json | 54 | "instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your | CODE |
| LOW | packages/eval/harbor/deepseek-codex-models.json | 66 | "base_instructions": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your job i | CODE |