AI agent toolkit: unified LLM API, agent loop, TUI, coding agent CLI
This report summarizes scanner evidence for badlogic/pi-mono, a TypeScript project with 119,082 GitHub stars. SynthScan examined 601,096 lines of code across 2383 source files, recording 692 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 1.9 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 532 finding(s).
Are imports declared and package/API names verified? 95 finding(s).
Are wrappers, guards, and repeated structures necessary? 516 finding(s).
Which changes need focused human review? 692 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 692 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | scripts/model-catalog-protocol.ts | 59 | export function getModelCatalogArtifactKey(revision: string, artifact: ModelCatalogArtifact): string { | CODE |
| LOW⚡ | scripts/model-catalog-protocol.ts | 63 | export function getModelCatalogProviderKey( | CODE |
| LOW⚡ | scripts/model-catalog-protocol.ts | 72 | export function isValidModelCatalogPiVersion(version: string): boolean { | CODE |
| LOW⚡ | scripts/model-catalog-protocol.ts | 77 | export function compareModelCatalogPiVersions(left: string, right: string): number { | CODE |
| LOW⚡ | scripts/model-catalog-protocol.ts | 85 | export function parseModelCatalogRepresentation( | CODE |
| LOW | packages/evals/test/configured-runtime.test.ts | 47 | function loadConfiguredModelRuntime(agentDir: string): Promise<ModelRuntime> { | CODE |
| LOW | packages/evals/src/report.ts | 360 | export function summarizeEvalObservations( | CODE |
| LOW | packages/evals/src/report.ts | 437 | export function formatEvalComparisonReport(report: EvalComparisonReport): string { | CODE |
| LOW | packages/evals/src/harness.ts | 130 | async function protectTransformedModules(): Promise<string[]> { | CODE |
| LOW | packages/evals/src/harness.ts | 474 | export function createPiCodingAgentHarness(options?: PiCodingAgentHarnessOptions): Harness<PiCodingAgentInput, string>; | CODE |
| LOW | packages/evals/src/harness.ts | 487 | export function resolveDocumentationVariant( | CODE |
| LOW | packages/evals/src/harness.ts | 520 | export function createPiDocumentationEvalHarness( | CODE |
| LOW | packages/coding-agent/test/model-runtime-test-utils.ts | 26 | export async function createInMemoryModelRegistry(credentials: CredentialStore): Promise<ModelRegistry> { | CODE |
| LOW | packages/coding-agent/test/sdk-stream-options.test.ts | 150 | async function createCacheWarmingSession(populate?: (manager: SessionManager, model: Model<Api>) => void) { | CODE |
| LOW | …s/coding-agent/test/sdk-codex-cache-probe-tool-loop.ts | 175 | function createMinimalResourceLoader(systemPrompt: string): ResourceLoader { | CODE |
| LOW | …s/coding-agent/test/sdk-codex-cache-probe-tool-loop.ts | 202 | function getWebSocketStatsSnapshot(sessionId: string): WebSocketStatsSnapshot { | CODE |
| LOW | packages/coding-agent/test/utilities.ts | 198 | export async function createTestExtensionsResult( | CODE |
| LOW | …ages/coding-agent/test/interactive-mode-status.test.ts | 613 | function createShowLoadedResourcesThis(options: { | CODE |
| LOW | packages/coding-agent/test/extensions-runner.test.ts | 1251 | async function loadSubscriptionExtension(factory: ExtensionFactory) { | CODE |
| LOW | packages/coding-agent/test/image-processing.test.ts | 68 | function jpegWithXmpBeforeOrientation(): string { | CODE |
| LOW | …coding-agent/test/session-selector-path-delete.test.ts | 52 | function createSymlinkedSessionPaths(): { | CODE |
| LOW | packages/coding-agent/test/test-harness.ts | 376 | async function createHarnessWithResourceLoader( | CODE |
| LOW | packages/coding-agent/test/test-harness.ts | 471 | export async function createHarnessWithExtensions(options: HarnessOptions = {}): Promise<Harness> { | CODE |
| LOW | …ckages/coding-agent/test/package-command-paths.test.ts | 115 | async function runPackageCommandDirectly(args: string[]): Promise<void> { | CODE |
| LOW | …ages/coding-agent/test/bash-close-hang-windows.test.ts | 13 | function createInheritedStdioCommand(pidFile: string): string { | CODE |
| LOW | …ding-agent/test/suite/agent-session-compaction.test.ts | 100 | async function createAbortableCompactionHarness(): Promise<{ | CODE |
| LOW | …gent/test/suite/agent-session-bash-persistence.test.ts | 18 | function createControlledBashOperations(invocations: ControlledBashInvocation[]): BashOperations { | CODE |
| LOW | …st/suite/regressions/5943-session-start-notify.test.ts | 120 | function createReloadCommandContext(overrides: ReloadCommandContextOverrides = {}): ReloadCommandContext { | CODE |
| LOW | …st/suite/regressions/5943-session-start-notify.test.ts | 188 | function createLoadedResourcesContext(): LoadedResourcesContext { | CODE |
| LOW | …te/regressions/2781-skill-collision-precedence.test.ts | 55 | function createSettingsWithPackage(pkgDir: string, scope: "user" | "project"): void { | CODE |
| LOW | …sions/4167-thinking-toggle-pending-tool-render.test.ts | 66 | function createFakeInteractiveModeThis(): RenderSessionContextThis { | CODE |
| LOW | …sions/4167-thinking-toggle-pending-tool-render.test.ts | 94 | function createAssistantToolCallMessage(): AssistantMessage { | CODE |
| LOW | …agent/examples/extensions/github-issue-autocomplete.ts | 91 | function createIssueAutocompleteProvider( | CODE |
| LOW | …xamples/extensions/custom-provider-gitlab-duo/index.ts | 210 | function invalidateDirectAccessToken() { | CODE |
| LOW | …es/coding-agent/examples/extensions/subagent/agents.ts | 116 | function findNearestProjectAgentsDir(cwd: string): string | null { | CODE |
| LOW | packages/coding-agent/src/main.ts | 129 | function isPlainRuntimeMetadataCommand(parsed: Args): boolean { | CODE |
| LOW | packages/coding-agent/src/main.ts | 243 | function findLocalSessionByExactId( | CODE |
| LOW | packages/coding-agent/src/main.ts | 560 | async function promptForMissingSessionCwd( | CODE |
| LOW | packages/coding-agent/src/migrations.ts | 84 | export function migrateSessionsFromAgentRoot(): void { | CODE |
| LOW | packages/coding-agent/src/migrations.ts | 157 | function migrateKeybindingsConfigFile(): void { | CODE |
| LOW | packages/coding-agent/src/migrations.ts | 222 | function checkDeprecatedExtensionDirs(baseDir: string, label: string): string[] { | CODE |
| LOW | packages/coding-agent/src/package-manager-cli.ts | 58 | function getActiveManagedInstallRoot(): string | undefined { | CODE |
| LOW | packages/coding-agent/src/package-manager-cli.ts | 606 | function updateTargetIncludesExtensions(target: UpdateTarget): boolean { | CODE |
| LOW | packages/coding-agent/src/package-manager-cli.ts | 638 | function printSelfUpdateUnavailable( | CODE |
| LOW | packages/coding-agent/src/package-manager-cli.ts | 659 | function printPnpmSelfUpdateMetadataHint(): void { | CODE |
| LOW | packages/coding-agent/src/package-manager-cli.ts | 786 | function prepareWindowsNpmSelfUpdate(): void { | CODE |
| LOW | packages/coding-agent/src/package-manager-cli.ts | 809 | function reportProjectTrustWarnings(warnings: readonly string[]): void { | CODE |
| LOW | packages/coding-agent/src/package-manager-cli.ts | 815 | async function createCommandSettingsManager(options: { | CODE |
| LOW | packages/coding-agent/src/config.ts | 49 | function normalizeSelfUpdatePackageTarget(target: SelfUpdatePackageTarget): { | CODE |
| LOW | packages/coding-agent/src/config.ts | 71 | function makeSelfUpdateCommandStep(command: string, args: string[]): SelfUpdateCommandStep { | CODE |
| LOW | packages/coding-agent/src/config.ts | 121 | function getSelfUpdateCommandForMethod( | CODE |
| LOW | packages/coding-agent/src/config.ts | 260 | function normalizeExistingPathForComparison(path: string, resolveSymlinks: boolean): string | undefined { | CODE |
| LOW | packages/coding-agent/src/config.ts | 279 | function getPathComparisonCandidates(path: string): string[] { | CODE |
| LOW | packages/coding-agent/src/config.ts | 313 | function isManagedByGlobalPackageManager(method: InstallMethod, packageName: string, npmCommand?: string[]): boolean { | CODE |
| LOW | packages/coding-agent/src/config.ts | 341 | export function getConfiguredSelfUpdateArgv(setting: string[] | undefined): string[] | undefined { | CODE |
| LOW | packages/coding-agent/src/config.ts | 348 | export function makeConfiguredSelfUpdateCommand( | CODE |
| LOW | packages/coding-agent/src/config.ts | 363 | export function getSelfUpdateUnavailableInstruction( | CODE |
| LOW | packages/coding-agent/src/config.ts | 504 | export function getBundledInteractiveAssetPath(name: string): string { | CODE |
| LOW | packages/coding-agent/src/config.ts | 511 | export function setEmbeddedQuickJSWasmPath(path: string): void { | CODE |
| LOW | packages/coding-agent/src/config.ts | 525 | export function resolveCodemodeWorkerSpecifier( | CODE |
| 391 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ding-agent/src/modes/interactive/components/mermaid.ts | 29 | // `┌──────────────┐ ┌──────────────┐` | COMMENT |
| MEDIUM | …ding-agent/src/modes/interactive/components/mermaid.ts | 31 | // `└──────────────┘ └──────────────┘` | COMMENT |
| MEDIUM | packages/durable/test/harness-structured.test.ts | 46 | // ─── A scriptable task ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-structured.test.ts | 201 | // ─── Ownership ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-structured.test.ts | 320 | // ─── Waiting ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-structured.test.ts | 739 | // ─── Completing ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-structured.test.ts | 850 | // ─── Abort order ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-structured.test.ts | 996 | // ─── Background and terminal owners ───────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-structured.test.ts | 1056 | // ─── Recovery ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-structured.test.ts | 1186 | // ─── Built-in tool rounds ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-structured.test.ts | 1432 | // ─── Review follow-ups ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-compaction.test.ts | 193 | // ─── Range selection ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-compaction.test.ts | 373 | // ─── Manual compaction ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-compaction.test.ts | 938 | // ─── Automatic compaction ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/harness-compaction.test.ts | 1618 | // ─── Recovery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/spec-usage.test.ts | 42 | // ─── Names the spec leaves to the application ──────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/spec-usage.test.ts | 91 | // ─── Section 7.1: extensions and host setup ────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/spec-usage.test.ts | 140 | // ─── Section 7.2: hooks reading extension state ────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/spec-usage.test.ts | 164 | // ─── Section 7.3: subagents ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/spec-usage.test.ts | 199 | // ─── Section 7.4 ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/spec-usage.test.ts | 206 | // ─── Section 5.1: a task with intent, effect, outcome ──────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/spec-usage.test.ts | 244 | // ─── Sequences ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/examples/26-plan-mode.ts | 26 | // ─── Product code: the plan extension ─────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/examples/26-plan-mode.ts | 65 | // ─── Host setup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/examples/32-tests-after-edits.ts | 25 | // ─── Product code: the project, an edit tool, and the test runner ───────────── | COMMENT |
| MEDIUM | packages/durable/test/examples/32-tests-after-edits.ts | 96 | // ─── Host setup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/examples/27-reviewer.ts | 29 | // ─── Product code: the reviewer extension ─────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/examples/27-reviewer.ts | 46 | // ─── Host setup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ckages/durable/test/examples/22-subagent-background.ts | 34 | // ─── Product code ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ckages/durable/test/examples/22-subagent-background.ts | 212 | // ─── Host setup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/examples/29-tool-override.ts | 26 | // ─── Product code ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/test/examples/29-tool-override.ts | 53 | // ─── Host setup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ckages/durable/test/examples/21-subagent-foreground.ts | 31 | // ─── Product code: the subagent extension ─────────────────────────────────── | COMMENT |
| MEDIUM | …ckages/durable/test/examples/21-subagent-foreground.ts | 79 | // ─── Host setup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/src/harness/scheduler.ts | 762 | // ─── Scheduling ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/src/harness/scheduler.ts | 1006 | // ─── Ownership ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/src/harness/scheduler.ts | 2614 | // ─── Invocation runtime ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/src/session/transaction.ts | 290 | // ─── Table reads ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/src/session/transaction.ts | 345 | // ─── Table writes ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/src/session/transaction.ts | 582 | // ─── Documents ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/src/session/transaction.ts | 755 | // ─── Settlement ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/durable/src/session/transaction.ts | 1060 | // ─── Helpers ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/contract.ts | 353 | // ─── Static types ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/connection.ts | 122 | // ─── relay ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/connection.ts | 309 | // ─── connection ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/object.ts | 38 | // ─── Services ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/object.ts | 132 | // ─── Declarations ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/object.ts | 360 | // ─── Host interface the runtime pieces use ─────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/object.ts | 401 | // ─── Contexts ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/object.ts | 558 | // ─── References ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/object.ts | 983 | // ─── Objects ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/object.ts | 1774 | // ─── The factory's `self` ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/link.ts | 105 | // ─── payload packing ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/link.ts | 240 | // ─── memory ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/link.ts | 280 | // ─── Node IPC ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/link.ts | 341 | // ─── WebSocket ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/delta/index.ts | 7 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/delta/index.ts | 12 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/delta/index.ts | 68 | // ─── Classification ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/chord/src/delta/index.ts | 78 | // ─── Overlap ───────────────────────────────────────────────────────────────── | COMMENT |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | packages/coding-agent/test/sdk-stream-options.test.ts | 197 | fixture.session.agent.state.messages = fixture.session.agent.state.messages.slice(1); | CODE |
| CRITICAL | …coding-agent/test/suite/agent-session-codemode.test.ts | 144 | harness.session.agent.state.tools.find((tool) => tool.name === name)?.description ?? ""; | CODE |
| CRITICAL | …coding-agent/test/suite/agent-session-codemode.test.ts | 220 | harness.session.agent.state.tools.find((tool) => tool.name === name)?.description ?? ""; | CODE |
| CRITICAL | …coding-agent/test/suite/agent-session-codemode.test.ts | 235 | const codemode = harness.session.agent.state.tools.find((tool) => tool.name === "codemode"); | CODE |
| CRITICAL | …coding-agent/test/suite/agent-session-codemode.test.ts | 835 | const codemode = harness.session.agent.state.tools.find((tool) => tool.name === "codemode"); | CODE |
| CRITICAL | …coding-agent/test/suite/agent-session-codemode.test.ts | 842 | const plain = overridden.session.agent.state.tools.find((tool) => tool.name === "codemode"); | CODE |
| CRITICAL | …ages/coding-agent/test/suite/agent-session-mcp.test.ts | 362 | const codemode = harness.session.agent.state.tools.find((tool) => tool.name === "codemode"); | CODE |
| CRITICAL | …ages/coding-agent/test/suite/agent-session-mcp.test.ts | 483 | const codemode = harness.session.agent.state.tools.find((tool) => tool.name === "codemode"); | CODE |
| CRITICAL | …ages/coding-agent/test/suite/agent-session-mcp.test.ts | 568 | const codemode = harness.session.agent.state.tools.find((tool) => tool.name === "codemode"); | CODE |
| CRITICAL | …ages/coding-agent/test/suite/agent-session-mcp.test.ts | 597 | harness.session.agent.state.tools.find((tool) => tool.name === name)?.description ?? ""; | CODE |
| CRITICAL | …ages/coding-agent/test/suite/agent-session-mcp.test.ts | 683 | const search = harness.session.agent.state.tools.find((tool) => tool.name === "mcp__docs__search"); | CODE |
| CRITICAL | …ages/coding-agent/test/suite/agent-session-mcp.test.ts | 684 | const fail = harness.session.agent.state.tools.find((tool) => tool.name === "mcp__docs__fail"); | CODE |
| CRITICAL | …ages/coding-agent/test/suite/agent-session-mcp.test.ts | 783 | const description = () => harness.session.agent.state.tools.find((tool) => tool.name === "codemode")?.description; | CODE |
| CRITICAL | …ages/coding-agent/test/suite/agent-session-mcp.test.ts | 991 | const toolSearch = harness.session.agent.state.tools.find((tool) => tool.name === "tool_search"); | CODE |
| CRITICAL | …nt/test/suite/agent-session-tool-orchestration.test.ts | 80 | const find = (name: string) => harness.session.agent.state.tools.find((tool) => tool.name === name); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | packages/durable/test/examples/18-json.ts | 75 | print({ view: watch.value }); | CODE |
| HIGH⚡ | packages/durable/test/examples/18-json.ts | 81 | print({ entries: watch.value.entries, live: watch.value.docs["pi.live"] }); | CODE |
| HIGH⚡ | packages/durable/test/examples/18-json.ts | 87 | print({ ...(entries.length === 0 ? {} : { entries }), live: value.docs["pi.live"] }); | CODE |
| HIGH | packages/chord/test/next/bench/relay.ts | 322 | print( | CODE |
| HIGH | packages/chord/test/next/bench/relay.ts | 359 | print("Hold to live, the 1,000-item notes list view (133.7 KiB snapshot)", ["Case", "time"], rows); | CODE |
| HIGH | packages/chord/test/next/bench/relay.ts | 536 | print( | CODE |
| HIGH | packages/chord/test/next/bench/relay.ts | 578 | print( | CODE |
| HIGH | …es/chord/test/next/examples/36-plugin-failures/main.ts | 109 | print(await plugins.reload(host, bad, context)); | CODE |
| HIGH | …es/chord/test/next/examples/36-plugin-failures/main.ts | 121 | print(await plugins.reload(host, good, context)); | CODE |
| HIGH | …es/chord/test/next/examples/36-plugin-failures/main.ts | 150 | print(await plugins.reload(host, await buildDirty(["@example/greeter"]), context)); | CODE |
| HIGH | …/chord/test/next/examples/38-watch-and-rollout/main.ts | 105 | print(await plugins.rollout(steps, built, context)); | CODE |
| HIGH⚡ | …/chord/test/next/examples/38-watch-and-rollout/main.ts | 121 | print(await plugins.rollout([steps[0]!, unreachable, steps[1]!], notes, context)); | CODE |
| HIGH⚡ | …/chord/test/next/examples/38-watch-and-rollout/main.ts | 123 | print(await plugins.rollout(steps, notes, context)); | CODE |
| HIGH⚡ | …/chord/test/next/examples/38-watch-and-rollout/main.ts | 131 | print(await plugins.rollout(steps, await plugins.build(plugins.state.value.dirty, context), context)); | CODE |
| HIGH | …/chord/test/next/examples/38-watch-and-rollout/main.ts | 142 | print(await plugins.rollout(steps, early, context)); | CODE |
| HIGH | …/chord/test/next/examples/38-watch-and-rollout/main.ts | 144 | print(await plugins.rollout(steps, await plugins.build(plugins.state.value.dirty, context), context)); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/coding-agent/test/git-update.test.ts | 32 | git(["config", "--local", "user.email", "test@test.com"], repoDir); | CODE |
| LOW | packages/coding-agent/test/git-update.test.ts | 117 | git(["config", "--local", "user.email", "test@test.com"], installedDir); | CODE |
| LOW | …ages/coding-agent/test/session-selector-search.test.ts | 118 | const filler = "lorem ipsum dolor sit amet ".repeat(400); | CODE |
| LOW | …ages/coding-agent/test/session-selector-search.test.ts | 118 | const filler = "lorem ipsum dolor sit amet ".repeat(400); | CODE |
| LOW | packages/coding-agent/docs/extensions.md | 2799 | const name = await ctx.ui.input("Name:", "placeholder"); | CODE |
| LOW | packages/coding-agent/docs/rpc-extension-ui.md | 75 | "placeholder": "type something..." | CODE |
| LOW | packages/tui/test/markdown.test.ts | 194 | `1. Lorem ipsum dolor sit amet. | CODE |
| LOW | packages/tui/test/markdown.test.ts | 194 | `1. Lorem ipsum dolor sit amet. | CODE |
| LOW | packages/tui/test/markdown.test.ts | 211 | "1. Lorem ipsum dolor sit amet.", | CODE |
| LOW | packages/tui/test/markdown.test.ts | 211 | "1. Lorem ipsum dolor sit amet.", | CODE |
| LOW | packages/tui/test/markdown.test.ts | 1788 | assert.ok(joinedPlain.includes("user@example.com"), "Should contain email"); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1008 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1008 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1011 | assert.strictEqual(chunks[0]!.text, "Lorem ipsum dolor sit "); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1016 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1016 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1019 | assert.strictEqual(chunks[0]!.text, "Lorem ipsum dolor sit "); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1024 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1024 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1027 | assert.strictEqual(chunks[0]!.text, "Lorem ipsum dolor sit "); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1033 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1033 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1036 | assert.strictEqual(chunks[0]!.text, "Lorem ipsum dolor sit "); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1042 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1042 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1045 | assert.strictEqual(chunks[0]!.text, "Lorem ipsum dolor sit "); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1051 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1051 | const chunks = wordWrapLine("Lorem ipsum dolor sit amet, consectetur", 30); | CODE |
| LOW⚡ | packages/tui/test/editor.test.ts | 1054 | assert.strictEqual(chunks[0]!.text, "Lorem ipsum dolor sit "); | CODE |
| LOW | packages/tui/test/editor.test.ts | 2220 | "user@example.com", | CODE |
| LOW | packages/tui/src/components/markdown.ts | 763 | // For mailto: links strip the prefix (autolinked emails use text="foo@bar.com" | COMMENT |
| LOW | packages/ai/test/mistral-reasoning-mode.test.ts | 57 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/total-tokens.test.ts | 41 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | packages/ai/test/total-tokens.test.ts | 41 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | packages/ai/test/anthropic-thinking-disable.test.ts | 35 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/mistral-tool-schema.test.ts | 42 | apiKey: "fake-key", | CODE |
| LOW | …test/anthropic-empty-thinking-signature-compat.test.ts | 70 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 120 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 149 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 173 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 197 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 223 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 314 | apiKey: "sk-fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 341 | apiKey: "sk-fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 366 | apiKey: "sk-fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 393 | apiKey: "sk-fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 424 | apiKey: "sk-fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 467 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 492 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 524 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/cache-retention.test.ts | 586 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/anthropic-temperature-compat.test.ts | 51 | apiKey: "fake-key", | CODE |
| LOW | …ages/ai/test/anthropic-force-adaptive-thinking.test.ts | 54 | apiKey: "fake-key", | CODE |
| LOW | …ges/ai/test/anthropic-error-tool-result-images.test.ts | 53 | apiKey: "fake-key", | CODE |
| LOW | packages/ai/test/sampling-options.test.ts | 54 | apiKey: "fake-key", | CODE |
| LOW⚡ | packages/ai/test/context-overflow.test.ts | 28 | // Lorem ipsum paragraph for realistic token estimation | COMMENT |
| LOW⚡ | packages/ai/test/context-overflow.test.ts | 29 | const LOREM_IPSUM = `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore | CODE |
| LOW⚡ | packages/ai/test/context-overflow.test.ts | 29 | const LOREM_IPSUM = `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore | CODE |
| LOW | packages/chord/test/next-node/compression.test.ts | 13 | const bytes = UTF8.encode(JSON.stringify({ text: "lorem ipsum ".repeat(5000) })); | CODE |
| LOW | packages/chord/test/next/remote/relay.test.ts | 683 | const text = "lorem ipsum ".repeat(3000); | CODE |
| 3 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/durable/test-workers/worker.ts | 41 | #harness!: Harness; | COMMENT |
| MEDIUM | packages/durable/test-workers/worker.ts | 64 | this.#harness = await Harness.open( | CODE |
| MEDIUM⚡ | packages/durable/test-workers/worker.ts | 81 | await this.arm(this.#harness.wake()); | CODE |
| MEDIUM⚡ | packages/durable/test-workers/worker.ts | 82 | this.#harness.resume(); | CODE |
| MEDIUM⚡ | packages/durable/test-workers/worker.ts | 87 | return this.#harness; | CODE |
| MEDIUM | packages/durable/test-workers/worker.ts | 105 | await this.arm({ ...this.#harness.wake(), active: true }); | CODE |
| MEDIUM | packages/durable/test-workers/worker.ts | 106 | this.#harness.resume(); | CODE |
| MEDIUM⚡ | packages/durable/test-workers/worker.ts | 119 | return this.#harness.root(context, { agent: { model: { provider: "faux", modelId: "faux-1" } } }); | CODE |
| MEDIUM⚡ | packages/durable/test-workers/worker.ts | 124 | await this.arm({ ...this.#harness.wake(), active: true }); | CODE |
| MEDIUM⚡ | packages/durable/test-workers/worker.ts | 134 | this.#harness.resume(); | CODE |
| MEDIUM | packages/durable/src/harness/harness.ts | 122 | return this.#host.harness.resolveAgent(this.id, undefined, context); | CODE |
| MEDIUM | packages/durable/src/harness/harness.ts | 126 | return this.#host.harness.commitWith((tx) => configure(tx, this.id, change), context); | CODE |
| MEDIUM | packages/durable/src/harness/harness.ts | 140 | return this.#host.harness.commitWith((tx) => createCompaction(tx, this.id, input), context); | CODE |
| MEDIUM⚡ | packages/durable/src/harness/harness.ts | 153 | return this.#host.harness.commitWith(change, context, { conversationId: this.id }, options); | CODE |
| MEDIUM⚡ | packages/durable/src/harness/harness.ts | 157 | return readContext(this.#host.harness, this.#host.storage, this.id, context, options?.at); | CODE |
| MEDIUM⚡ | packages/durable/src/harness/harness.ts | 167 | return this.#host.harness.readOnLine((storage) => storage.scanEntries(scan, limit, cursor, context)); | CODE |
| MEDIUM | packages/chord/docs/next/durable-observers/index.html | 119 | proposal. Code is Durable's <code>session/session.ts</code> and <code>harness/*.ts</code> at HEAD, simplified. Nothi | CODE |
| MEDIUM | packages/chord/docs/next/durable-observers/index.html | 162 | <p><strong>Durable</strong> is pi's agent harness; a <strong>Session</strong> is its one line of atomic commits. <st | CODE |
| MEDIUM | packages/chord/docs/next/durable-observers/index.html | 439 | <td><code>packages/durable/src/session/session.ts</code> (<code>#runCommit</code>, <code>#publish</code>), <code>harness | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 153 | connects to the server, loads its plugins and opens the agent's harness. One of the plugins, code mode, needs the | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 546 | <figure class="fig anim"><svg viewBox="0 0 720 331" width="100%" role="img" aria-label="Code mode on W parks on the harn | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 690 | admission check, as p2's <code>whenRegistered</code> and its harness prerequisites are today.</p> | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 998 | there" is the app's admission check, not a registry rule; Durable's own "model unavailable" wait | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 1495 | <td>The hold binds to <code>SessionTransfer</code>, whose attempt parks on <code>Harness</code>: <code>loading</code>, t | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 1550 | <td>S keeps W1's hold as refused, <code>not_served</code>. ModelRuntime is <code>failed { waiting }</code>. W1's | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 1557 | <td>S's commit re-runs its refused hold and sends <code>loading { hold, attempt }</code>, then <code>bound</code>. M | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 1675 | <td>Transcript (on W1) follows the harness through <code>Harnesses.value.observeConversation(...)</code> and declares <c | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 1676 | <td><code>self.follow</code> is Transcript's own step: S1 ends the observer <code>failed</code>, so Transcript fails | CODE |
| MEDIUM | packages/chord/docs/next/dependencies/index.html | 2225 | attach runs Durable's code), not a dependency; a follower declares <code>retryOn</code> on the registry it reads the | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/coding-agent/src/core/package-manager.ts | 817 | // Step 1: Apply includes (or all if no includes) | COMMENT |
| LOW⚡ | packages/coding-agent/src/core/package-manager.ts | 825 | // Step 2: Apply excludes | COMMENT |
| LOW⚡ | packages/coding-agent/src/core/package-manager.ts | 830 | // Step 3: Force-include (add back from allPaths, overriding exclusions) | COMMENT |
| LOW⚡ | packages/coding-agent/src/core/package-manager.ts | 839 | // Step 4: Force-exclude (remove even if included or force-included) | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 33 | // Step 1: Create context with the calculate tool | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 40 | // Step 2: Ask the LLM to make a tool call | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 47 | // Step 3: Get the assistant's response (should contain a tool call) | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 61 | // Step 4: Send a user message WITHOUT providing tool result | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 69 | // Step 5: The fix should filter out the orphaned tool call, and the request should succeed | COMMENT |
| LOW | packages/ai/test/tool-call-id-normalization.test.ts | 51 | // Step 1: Generate tool call with github-copilot | COMMENT |
| LOW | packages/ai/test/tool-call-id-normalization.test.ts | 90 | // Step 2: Complete with openrouter (uses openai-completions API) | COMMENT |
| LOW | packages/ai/test/tool-call-id-normalization.test.ts | 121 | // Step 1: Generate tool call with github-copilot | COMMENT |
| LOW | packages/ai/test/tool-call-id-normalization.test.ts | 153 | // Step 2: Complete with openai-codex (uses openai-codex-responses API) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/coding-agent/src/core/package-manager.ts | 817 | // Step 1: Apply includes (or all if no includes) | COMMENT |
| LOW⚡ | packages/coding-agent/src/core/package-manager.ts | 825 | // Step 2: Apply excludes | COMMENT |
| LOW⚡ | packages/coding-agent/src/core/package-manager.ts | 830 | // Step 3: Force-include (add back from allPaths, overriding exclusions) | COMMENT |
| LOW⚡ | packages/coding-agent/src/core/package-manager.ts | 839 | // Step 4: Force-exclude (remove even if included or force-included) | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 33 | // Step 1: Create context with the calculate tool | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 40 | // Step 2: Ask the LLM to make a tool call | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 47 | // Step 3: Get the assistant's response (should contain a tool call) | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 61 | // Step 4: Send a user message WITHOUT providing tool result | COMMENT |
| LOW⚡ | packages/ai/test/tool-call-without-result.test.ts | 69 | // Step 5: The fix should filter out the orphaned tool call, and the request should succeed | COMMENT |
| LOW | packages/ai/test/tool-call-id-normalization.test.ts | 51 | // Step 1: Generate tool call with github-copilot | COMMENT |
| LOW | packages/ai/test/tool-call-id-normalization.test.ts | 90 | // Step 2: Complete with openrouter (uses openai-completions API) | COMMENT |
| LOW | packages/ai/test/tool-call-id-normalization.test.ts | 121 | // Step 1: Generate tool call with github-copilot | COMMENT |
| LOW | packages/ai/test/tool-call-id-normalization.test.ts | 153 | // Step 2: Complete with openai-codex (uses openai-codex-responses API) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/build-binaries.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/auto-pi.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | packages/coding-agent/test/path-utils.test.ts | 81 | // é = e + combining acute accent (U+0301) | COMMENT |
| LOW | packages/coding-agent/test/tree-selector.test.ts | 441 | // Tree structure: | COMMENT |
| LOW | packages/coding-agent/docs/compaction.md | 301 | ```typescript | COMMENT |
| LOW | packages/coding-agent/docs/extensions.md | 601 | ### Agent Events | COMMENT |
| LOW | packages/coding-agent/examples/sdk/11-sessions.ts | 41 | }); | COMMENT |
| LOW | packages/tui/native/napi.h | 1 | #ifndef PI_NAPI_H | COMMENT |
| LOW | packages/tui/test/editor.test.ts | 4281 | COMMENT | |
| LOW | packages/tui/src/stdin-buffer.ts | 221 | if (char === ESC && seqEnd < remaining.length && remaining[seqEnd] !== "\\") { | COMMENT |
| LOW | packages/tui/src/keys.ts | 741 | logicalShiftedSymbol && | COMMENT |
| LOW | packages/ai/test/provider-error-body-regression.test.ts | 1 | // Per-tier provider regression for issues/provider-error-body-passthrough. | COMMENT |
| LOW | …ckages/ai/test/provider-error-body-passthrough.test.ts | 1 | // Regression test for issues/provider-error-body-passthrough | COMMENT |
| LOW | …ages/ai/test/anthropic-tool-name-normalization.test.ts | 141 | if (toolCall.type === "toolCall") { | COMMENT |
| LOW | packages/ai/src/types.ts | 381 | /** Ask a capable provider to return a durable handle and continue the request asynchronously. */ | COMMENT |
| LOW | packages/ai/src/utils/error-body.ts | 1 | // Shared normalization for provider HTTP error objects. | COMMENT |
| LOW | packages/ai/src/api/openai-completions.ts | 1521 | const promptTokens = rawUsage.prompt_tokens || 0; | COMMENT |
| LOW | packages/chord/src/wire.ts | 1 | import { type Static, type TSchema, Type } from "typebox"; | COMMENT |
| LOW | packages/chord/src/delta/index.ts | 541 | const node = resolveValue(root, path); | COMMENT |
| LOW | packages/chord/src/next/host/members.ts | 1 | // The member check (Q14): an implementation is one variant with exactly that variant's members, methods being | COMMENT |
| LOW | .github/workflows/nix.yml | 1 | name: Nix | COMMENT |
| LOW | .github/workflows/issue-analysis.yml | 1 | # Runs the repo's /is prompt against an issue when the `pi-analyze` label is added | COMMENT |
| LOW | .github/workflows/issue-analysis.yml | 21 | # creation permission. The analysis job uses it to upload the exported | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | packages/ai/README.md | 1703 | apiKey: 'your-api-key' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/create-source-archive.sh | 2 | # Create the deterministic source archive uploaded with GitHub releases. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/create-source-archive.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/build-binaries.sh | 6 | # Usage: | COMMENT |