Self-hosted control plane for AI agents: dispatch tasks, review runs, track spend, and operate OpenClaw, Claude Code, Codex, and other runtimes.
This report summarizes scanner evidence for builderz-labs/mission-control, a TypeScript project with 6,338 GitHub stars. SynthScan examined 187,677 lines of code across 726 source files, recording 429 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 5.8 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 143 finding(s).
Are imports declared and package/API names verified? 26 finding(s).
Are wrappers, guards, and repeated structures necessary? 358 finding(s).
Which changes need focused human review? 429 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 429 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | install.sh | 14 | # ── Defaults ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | install.sh | 22 | # ── Parse arguments ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 38 | # ── Helpers ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 129 | # ── Clone or update repo ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 156 | # ── Generate .env ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 204 | # ── Docker deployment ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 234 | # ── Local deployment ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 266 | # ── Systemd service ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 312 | # ── OpenClaw fleet check ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 410 | # ── Main ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/skills-crud.spec.ts | 21 | // ── GET /api/skills ─────────────────────────── | COMMENT |
| MEDIUM | tests/skills-crud.spec.ts | 34 | // ── POST /api/skills ────────────────────────── | COMMENT |
| MEDIUM | tests/skills-crud.spec.ts | 81 | // ── GET /api/skills?mode=content ────────────── | COMMENT |
| MEDIUM | tests/skills-crud.spec.ts | 114 | // ── PUT /api/skills ─────────────────────────── | COMMENT |
| MEDIUM | tests/skills-crud.spec.ts | 150 | // ── DELETE /api/skills ──────────────────────── | COMMENT |
| MEDIUM | tests/skills-crud.spec.ts | 183 | // ── Security checks ─────────────────────────── | COMMENT |
| MEDIUM | tests/skills-crud.spec.ts | 231 | // ── Path traversal protection ───────────────── | COMMENT |
| MEDIUM | tests/agent-self-register.spec.ts | 18 | // ── POST /api/agents/register ───────────────────────── | COMMENT |
| MEDIUM | tests/exec-approval-allowlist.spec.ts | 114 | // ── Auth ────────────────────────────────────── | COMMENT |
| MEDIUM | tests/notifications.spec.ts | 14 | // ── GET /api/notifications ─────────────────── | COMMENT |
| MEDIUM | tests/notifications.spec.ts | 49 | // ── POST /api/notifications ────────────────── | COMMENT |
| MEDIUM | tests/notifications.spec.ts | 73 | // ── PUT /api/notifications ─────────────────── | COMMENT |
| MEDIUM | tests/quality-review.spec.ts | 14 | // ── POST /api/quality-review ───────────────── | COMMENT |
| MEDIUM | tests/quality-review.spec.ts | 59 | // ── GET /api/quality-review ────────────────── | COMMENT |
| MEDIUM | tests/user-management.spec.ts | 14 | // ── POST /api/auth/users ───────────────────── | COMMENT |
| MEDIUM | tests/user-management.spec.ts | 56 | // ── GET /api/auth/users ────────────────────── | COMMENT |
| MEDIUM | tests/user-management.spec.ts | 66 | // ── PUT /api/auth/users ────────────────────── | COMMENT |
| MEDIUM | tests/user-management.spec.ts | 90 | // ── DELETE /api/auth/users ─────────────────── | COMMENT |
| MEDIUM | tests/injection-guard-endpoints.spec.ts | 22 | // ── POST /api/workflows ────────────────────── | COMMENT |
| MEDIUM | tests/injection-guard-endpoints.spec.ts | 51 | // ── POST /api/spawn ────────────────────────── | COMMENT |
| MEDIUM | tests/injection-guard-endpoints.spec.ts | 70 | // ── POST /api/agents/message ───────────────── | COMMENT |
| MEDIUM | tests/injection-guard-endpoints.spec.ts | 81 | // ── POST /api/chat/messages ────────────────── | COMMENT |
| MEDIUM | tests/local-agent-sync.spec.ts | 6 | // ── POST /api/agents/sync?source=local ──────── | COMMENT |
| MEDIUM | tests/local-agent-sync.spec.ts | 27 | // ── GET /api/agents (source field) ──────────── | COMMENT |
| MEDIUM | tests/search-and-export.spec.ts | 14 | // ── GET /api/search ────────────────────────── | COMMENT |
| MEDIUM | tests/search-and-export.spec.ts | 42 | // ── GET /api/export ────────────────────────── | COMMENT |
| MEDIUM | tests/search-and-export.spec.ts | 66 | // ── GET /api/activities ────────────────────── | COMMENT |
| MEDIUM | tests/alerts-crud.spec.ts | 14 | // ── POST /api/alerts ───────────────────────── | COMMENT |
| MEDIUM | tests/alerts-crud.spec.ts | 49 | // ── GET /api/alerts ────────────────────────── | COMMENT |
| MEDIUM | tests/alerts-crud.spec.ts | 62 | // ── PUT /api/alerts ────────────────────────── | COMMENT |
| MEDIUM | tests/alerts-crud.spec.ts | 86 | // ── DELETE /api/alerts ─────────────────────── | COMMENT |
| MEDIUM | tests/alerts-crud.spec.ts | 100 | // ── Full lifecycle ─────────────────────────── | COMMENT |
| MEDIUM | tests/diagnostics-api.spec.ts | 5 | // ── Auth ───────────────────────────────────── | COMMENT |
| MEDIUM | tests/diagnostics-api.spec.ts | 12 | // ── Response shape ─────────────────────────── | COMMENT |
| MEDIUM | tests/webhooks-crud.spec.ts | 14 | // ── POST /api/webhooks ─────────────────────── | COMMENT |
| MEDIUM | tests/webhooks-crud.spec.ts | 44 | // ── GET /api/webhooks ──────────────────────── | COMMENT |
| MEDIUM | tests/webhooks-crud.spec.ts | 62 | // ── PUT /api/webhooks ──────────────────────── | COMMENT |
| MEDIUM | tests/webhooks-crud.spec.ts | 99 | // ── DELETE /api/webhooks ───────────────────── | COMMENT |
| MEDIUM | tests/webhooks-crud.spec.ts | 113 | // ── Full lifecycle ─────────────────────────── | COMMENT |
| MEDIUM | tests/skills-registry.spec.ts | 6 | // ── GET /api/skills/registry (search) ───────── | COMMENT |
| MEDIUM | tests/skills-registry.spec.ts | 70 | // ── POST /api/skills/registry (install) ─────── | COMMENT |
| MEDIUM | tests/agents-crud.spec.ts | 14 | // ── POST /api/agents ───────────────────────── | COMMENT |
| MEDIUM | tests/agents-crud.spec.ts | 46 | // ── GET /api/agents ────────────────────────── | COMMENT |
| MEDIUM | tests/agents-crud.spec.ts | 68 | // ── GET /api/agents/[id] ───────────────────── | COMMENT |
| MEDIUM | tests/agents-crud.spec.ts | 95 | // ── PUT /api/agents/[id] ───────────────────── | COMMENT |
| MEDIUM | tests/agents-crud.spec.ts | 118 | // ── PUT /api/agents (bulk by name) ─────────── | COMMENT |
| MEDIUM | tests/agents-crud.spec.ts | 152 | // ── DELETE /api/agents/[id] ────────────────── | COMMENT |
| MEDIUM | tests/agents-crud.spec.ts | 169 | // ── Full lifecycle ─────────────────────────── | COMMENT |
| MEDIUM | tests/onboarding-api.spec.ts | 13 | // ── Auth ───────────────────────────────────── | COMMENT |
| MEDIUM | tests/onboarding-api.spec.ts | 27 | // ── GET ────────────────────────────────────── | COMMENT |
| 199 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/app/api/agents/[id]/files/route.ts | 36 | function resolveAgentWorkspacePath(workspace: string): string { | CODE |
| LOW | src/app/api/agents/[id]/soul/route.ts | 13 | function resolveAgentWorkspacePath(workspace: string): string { | CODE |
| LOW | src/app/api/local/flight-deck/route.ts | 13 | function getConfiguredFlightDeckPath(): string | null { | CODE |
| LOW | src/app/api/local/flight-deck/route.ts | 38 | function resolveFlightDeckInstallPath(): string | null { | CODE |
| LOW | src/app/api/integrations/route.ts | 259 | async function getIntegrationProbeSnapshot(): Promise<IntegrationProbeSnapshot> { | CODE |
| LOW | src/app/api/gateways/route.ts | 258 | function enrichGatewaysWithAgentCounts( | CODE |
| LOW | src/app/api/gateways/connect/route.ts | 46 | function isNonBrowserReachableHost(host: string): boolean { | CODE |
| LOW | src/app/api/gateways/control/route.ts | 42 | function startHermesGatewayDetached(hermesBin: string, homeDir: string): { pid: number | null; error?: string } { | CODE |
| LOW | src/app/api/gateways/control/route.ts | 78 | function stopHermesGatewayDetached(homeDir: string): { stopped: boolean; error?: string } { | CODE |
| LOW | src/app/api/notifications/deliver/route.ts | 274 | function formatNotificationMessage(notification: Notification): string { | CODE |
| LOW | src/app/api/onboarding/route.ts | 46 | function readUserOnboardingSetting(key: OnboardingSettingKey, username: string): string { | CODE |
| LOW | src/app/api/onboarding/route.ts | 52 | function writeUserOnboardingSetting(key: OnboardingSettingKey, value: string, actor: string) { | CODE |
| LOW | src/components/settings/agent-runtimes-section.tsx | 67 | function isRuntimeTransportFailure(error: unknown): boolean { | CODE |
| LOW | src/components/panels/settings-panel.tsx | 47 | function parseCoordinatorTargetAgents(rawAgents: any[]): CoordinatorTargetAgent[] { | CODE |
| LOW | src/components/panels/webhook-panel.tsx | 74 | function isWebhookTransportFailure(error: unknown): boolean { | CODE |
| LOW | src/components/panels/orchestration-bar.tsx | 58 | function isOrchestrationNetworkFailure(error: unknown): boolean { | CODE |
| LOW | …ents/dashboard/widgets/onboarding-checklist-widget.tsx | 16 | export function OnboardingChecklistWidget() { | CODE |
| LOW | src/lib/workspaces.ts | 112 | export function ensureTenantWorkspaceAccess( | CODE |
| LOW | src/lib/workspaces.ts | 126 | export function ensureTenantProjectAccess( | CODE |
| LOW | src/lib/codex-sessions.ts | 49 | function listRecentCodexSessionFiles(limit: number): ParsedFile[] { | CODE |
| LOW | src/lib/agent-workspace.ts | 12 | export function getAgentWorkspaceCandidates(agentConfig: any, agentName: string): string[] { | CODE |
| LOW | src/lib/task-routing.ts | 38 | export function resolveTaskImplementationTarget(task: TaskLike): TaskImplementationTarget { | CODE |
| LOW | src/lib/task-dispatch.ts | 106 | export function resolveTaskDispatchModelOverride(task: Pick<DispatchableTask, 'agent_config'>): string | null { | CODE |
| LOW | src/lib/task-dispatch.ts | 343 | export function extractDeferredCompletionText(waitPayload: any): string | null { | CODE |
| LOW | src/lib/task-dispatch.ts | 403 | function normalizeGatewayIdentifier(value: unknown): string | null { | CODE |
| LOW | src/lib/task-dispatch.ts | 409 | function buildDeferredCompletionMarkers(task: DeferredCompletionTask): string[] { | CODE |
| LOW | src/lib/task-dispatch.ts | 431 | function findAssistantTextAfterTaskPrompt(rawTranscript: string, task: DeferredCompletionTask): string | null { | CODE |
| LOW | src/lib/task-dispatch.ts | 455 | function recoverDeferredCompletionTextFromTranscript( | CODE |
| LOW | src/lib/task-dispatch.ts | 509 | export async function reconcileDeferredTaskCompletions(options: { | CODE |
| LOW | src/lib/task-dispatch.ts | 967 | function isDirectDispatchAvailable(provider?: DirectProvider): boolean { | CODE |
| LOW | src/lib/task-dispatch.ts | 1208 | async function callMiniMaxAnthropicCompatible( | CODE |
| LOW | src/lib/task-dispatch.ts | 1397 | function resolveGatewayAgentIdForReview(task: ReviewableTask): string { | CODE |
| LOW | src/lib/transcript-parser.ts | 67 | function normalizeTranscriptMessage(msg: any, timestamp?: string): TranscriptMessage | null { | CODE |
| LOW | src/lib/transcript-parser.ts | 110 | export function parseGatewayHistoryTranscript(messages: unknown[], limit: number): TranscriptMessage[] { | CODE |
| LOW | src/lib/hermes-sessions.ts | 99 | export function clearHermesDetectionCache(): void { | CODE |
| LOW | src/lib/password.ts | 23 | export function verifyPasswordWithRehashCheck(password: string, stored: string): { valid: boolean; needsRehash: boolean | CODE |
| LOW | src/lib/onboarding-session.ts | 17 | export function getOnboardingSessionDecision( | CODE |
| LOW⚡ | src/lib/onboarding-session.ts | 35 | export function readOnboardingDismissedThisSession(): boolean { | CODE |
| LOW⚡ | src/lib/onboarding-session.ts | 44 | export function markOnboardingDismissedThisSession(): void { | CODE |
| LOW⚡ | src/lib/onboarding-session.ts | 51 | export function clearOnboardingDismissedThisSession(): void { | CODE |
| LOW⚡ | src/lib/onboarding-session.ts | 58 | export function readOnboardingReplayFromStart(): boolean { | CODE |
| LOW⚡ | src/lib/onboarding-session.ts | 67 | export function markOnboardingReplayFromStart(): void { | CODE |
| LOW⚡ | src/lib/onboarding-session.ts | 74 | export function clearOnboardingReplayFromStart(): void { | CODE |
| LOW | src/lib/receipt-signing.ts | 48 | export function getOrCreateSigningKey(): ReceiptKeyPair { | CODE |
| LOW | src/lib/webhooks.ts | 70 | async function assertSafeWebhookDestination(urlStr: string): Promise<void> { | CODE |
| LOW | src/lib/browser-security.ts | 15 | export function shouldRedirectDashboardToHttps(input: { | CODE |
| LOW | src/lib/super-admin.ts | 44 | function getTenantWorkspaceDirname(): string { | CODE |
| LOW | src/lib/super-admin.ts | 353 | export function createTenantAndBootstrapJob(request: TenantBootstrapRequest, actor: string) { | CODE |
| LOW | src/lib/super-admin.ts | 480 | export function createTenantDecommissionJob(tenantId: number, request: TenantDecommissionRequest, actor: string) { | CODE |
| LOW | src/lib/super-admin.ts | 553 | export function transitionProvisionJobStatus( | CODE |
| LOW | src/lib/device-identity.ts | 263 | export async function getOrCreateDeviceIdentity(): Promise<DeviceIdentity> { | CODE |
| LOW | src/lib/device-identity.ts | 263 | export async function getOrCreateDeviceIdentity(): Promise<DeviceIdentity> { | CODE |
| LOW | src/lib/provider-subscriptions.ts | 182 | export function detectProviderSubscriptions(forceRefresh = false): SubscriptionDetectionResult { | CODE |
| LOW | src/lib/provider-subscriptions.ts | 201 | export function getProviderSubscriptionFlags(forceRefresh = false): Record<string, boolean> { | CODE |
| LOW | src/lib/auto-credentials.ts | 69 | export function ensureAutoGeneratedCredentials(): void { | CODE |
| LOW | src/lib/gateway-url.ts | 40 | export function buildGatewayPathFallbackUrls(rawUrl: string): string[] { | CODE |
| LOW | src/lib/task-status.ts | 29 | export function normalizeTaskCreateStatus( | CODE |
| LOW | src/lib/task-status.ts | 42 | export function normalizeTaskUpdateStatus(args: { | CODE |
| LOW | src/lib/opencode-sessions.ts | 151 | export function getOpenCodeBinaryCandidates(): string[] { | CODE |
| LOW | src/lib/session-cookie.ts | 16 | export function parseMcSessionCookieHeader(cookieHeader: string): string | null { | CODE |
| 38 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | README.md | 125 | export MC_API_KEY=replace-with-your-api-key | CODE |
| HIGH | README.md | 164 | env MC_URL=http://127.0.0.1:3000 MC_API_KEY=replace-with-your-api-key \ | CODE |
| HIGH | SKILL.md | 14 | **Auth header:** `x-api-key: <your-api-key>` | CODE |
| HIGH | docs/cli-integration.md | 12 | -H "x-api-key: YOUR_API_KEY" \ | CODE |
| HIGH | docs/cli-integration.md | 45 | -H "x-api-key: YOUR_API_KEY" \ | CODE |
| HIGH | docs/cli-integration.md | 64 | -H "x-api-key: YOUR_API_KEY" | CODE |
| HIGH | docs/cli-integration.md | 76 | -H "x-api-key: YOUR_API_KEY" \ | CODE |
| HIGH | docs/cli-integration.md | 90 | -H "x-api-key: YOUR_API_KEY" \ | CODE |
| HIGH | docs/quickstart.md | 23 | export MC_API_KEY=your-api-key | CODE |
| HIGH | docs/deployment.md | 186 | -e API_KEY=your-api-key \ | CODE |
| HIGH | docs/deployment.md | 408 | API_KEY=<your-api-key> | CODE |
| HIGH | src/lib/framework-templates.ts | 75 | -H "x-api-key: YOUR_API_KEY" \\ | CODE |
| HIGH | src/lib/framework-templates.ts | 89 | -H "x-api-key: YOUR_API_KEY" \\ | CODE |
| HIGH | src/lib/framework-templates.ts | 99 | -H "x-api-key: YOUR_API_KEY" \\ | CODE |
| HIGH | src/lib/framework-templates.ts | 123 | API_KEY = "YOUR_API_KEY" | CODE |
| HIGH | src/lib/framework-templates.ts | 172 | HEADERS = {"Content-Type": "application/json", "x-api-key": "YOUR_API_KEY"} | CODE |
| HIGH | src/lib/framework-templates.ts | 223 | HEADERS = {"Content-Type": "application/json", "x-api-key": "YOUR_API_KEY"} | CODE |
| HIGH | src/lib/framework-templates.ts | 261 | const HEADERS = { "Content-Type": "application/json", "x-api-key": "YOUR_API_KEY" }; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/orchestration.md | 243 | # Step 1: Research task for iris | COMMENT |
| LOW | docs/orchestration.md | 257 | # Step 2: Implementation task for scout (after iris finishes) | COMMENT |
| LOW | docs/orchestration.md | 272 | # Step 3: Review task for aegis | COMMENT |
| LOW | docs/quickstart.md | 11 | ## Step 1: Start Mission Control | COMMENT |
| LOW | docs/quickstart.md | 26 | ## Step 2: Register an Agent | COMMENT |
| LOW | docs/quickstart.md | 57 | ## Step 3: Create a Task | COMMENT |
| LOW | docs/quickstart.md | 89 | ## Step 4: Poll the Task Queue | COMMENT |
| LOW | docs/quickstart.md | 123 | ## Step 5: Complete the Task | COMMENT |
| LOW | docs/quickstart.md | 137 | ## Step 6: Send a Heartbeat | COMMENT |
| LOW⚡ | src/app/setup/page.tsx | 130 | // Step 1: Validating | COMMENT |
| LOW⚡ | src/app/setup/page.tsx | 135 | // Step 2: Creating account | COMMENT |
| LOW⚡ | src/app/setup/page.tsx | 162 | // Step 3: Configuring session | COMMENT |
| LOW⚡ | src/app/setup/page.tsx | 167 | // Step 4: Launching | COMMENT |
| LOW | src/components/terminal/terminal-view.tsx | 45 | // Step 1: Check PTY support via REST API | COMMENT |
| LOW | src/components/terminal/terminal-view.tsx | 62 | // Step 2: Load xterm.js dynamically (heavy dependency, client-only) | COMMENT |
| LOW | src/components/terminal/terminal-view.tsx | 151 | // Step 3: Connect WebSocket | COMMENT |
| LOW | src/lib/task-dispatch.ts | 1892 | // Step 1: Invoke via gateway (new session) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/app/setup/page.tsx | 130 | // Step 1: Validating | COMMENT |
| LOW⚡ | src/app/setup/page.tsx | 135 | // Step 2: Creating account | COMMENT |
| LOW⚡ | src/app/setup/page.tsx | 162 | // Step 3: Configuring session | COMMENT |
| LOW⚡ | src/app/setup/page.tsx | 167 | // Step 4: Launching | COMMENT |
| LOW | src/components/terminal/terminal-view.tsx | 45 | // Step 1: Check PTY support via REST API | COMMENT |
| LOW | src/components/terminal/terminal-view.tsx | 62 | // Step 2: Load xterm.js dynamically (heavy dependency, client-only) | COMMENT |
| LOW | src/components/terminal/terminal-view.tsx | 151 | // Step 3: Connect WebSocket | COMMENT |
| LOW | src/lib/task-dispatch.ts | 1892 | // Step 1: Invoke via gateway (new session) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 179 | # Set OPENCLAW_GATEWAY_HOST to the Docker host gateway IP so the container | COMMENT |
| LOW | install.sh | 322 | # Check if openclaw binary exists | COMMENT |
| LOW | scripts/notification-daemon.sh | 43 | # Check if Mission Control is running | COMMENT |
| LOW | scripts/notification-daemon.sh | 155 | # Check if daemon is already running | COMMENT |
| LOW | scripts/notification-daemon.sh | 175 | # Check if already running | COMMENT |
| LOW | scripts/agent-heartbeat.sh | 30 | # Check if Mission Control is running | COMMENT |
| LOW | scripts/agent-heartbeat.sh | 147 | # Check if Mission Control is running | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | docker-compose.yml | 21 | # not runtime. Setting them here only works if you rebuild the image: | COMMENT |
| LOW | scripts/notification-daemon.sh | 1 | #!/bin/bash | COMMENT |
| LOW | src/app/api/openclaw/doctor/route.ts | 21 | detail: [err?.stdout, err?.stderr, err?.message].filter(Boolean).join('\n').trim(), | COMMENT |
| LOW | src/lib/agent-runtimes.ts | 521 | // Detect Claude Code authentication. Claude supports two auth modes: | COMMENT |
| LOW | src/lib/task-dispatch.ts | 121 | if (task.agent_config) { | COMMENT |
| LOW | src/lib/task-dispatch.ts | 641 | return (process.env.ANTHROPIC_API_KEY || '').trim() || null | COMMENT |
| LOW | src/lib/task-dispatch.ts | 801 | outputTokens: data.usage.output_tokens || 0, | COMMENT |
| LOW | src/lib/claude-code-sessions.ts | 1 | // Per-agent Claude Code base-session lifecycle (#602). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | src/app/api/hermes/route.ts | 378 | elif event_name == "agent:end": | STRING |
| HIGH⚡ | src/app/api/hermes/route.ts | 380 | elif event_name == "session:start": | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | install.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/notification-daemon.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/agent-heartbeat.sh | 6 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/lib/google-auth.test.ts | 19 | json: async () => ({ aud: 'x', email: 'user@example.com', sub: 'sub', email_verified: false }), | CODE |
| LOW | src/lib/google-auth.test.ts | 32 | json: async () => ({ aud: 'wrong', email: 'user@example.com', sub: 'sub', email_verified: true }), | CODE |
| LOW | src/lib/google-auth.test.ts | 50 | json: async () => ({ aud: 'x', email: 'user@example.com', sub: 'sub', email_verified: 'true', name: 'User' }), | CODE |
| LOW | src/lib/google-auth.test.ts | 54 | email: 'user@example.com', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/load-env.sh | 4 | # This file is sourced by both POSIX sh and Bash startup scripts. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/gen-star-history.py | 14 | CODE | |
| LOW | scripts/check-workflow-action-pins.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/app/api/hermes/route.ts | 382 | except Exception as exc: | STRING |