Mobile app automation and verification for AI coding agents. CLI, MCP server, and typed Node.js API for iOS, Android, HarmonyOS, TV, web, macOS, and Linux.
This report summarizes scanner evidence for callstack/agent-device, a TypeScript project with 4,972 GitHub stars. SynthScan examined 843,810 lines of code across 4739 source files, recording 4855 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 6.0 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 4763 finding(s).
Are imports declared and package/API names verified? 49 finding(s).
Are wrappers, guards, and repeated structures necessary? 4552 finding(s).
Which changes need focused human review? 4855 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 4855 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tsdown.config.ts | 68 | function dropAmbientDeclarationImport( | CODE |
| LOW | test/integration/smoke-provider-cli-disconnect.test.ts | 27 | function createProviderDaemonFixture(t: TestContext): ProviderDaemonFixture { | CODE |
| LOW | test/integration/smoke-provider-cli-disconnect.test.ts | 70 | async function connectBrowserStackProvider( | CODE |
| LOW | test/integration/smoke-provider-cli-disconnect.test.ts | 116 | async function disconnectProviderSession( | CODE |
| LOW | test/integration/smoke-provider-cli-disconnect.test.ts | 137 | function assertProviderDisconnectRpc(rpcRequests: any[], activeSession: string): void { | CODE |
| LOW | test/integration/test-helpers.ts | 69 | export function createIntegrationTestContext(options: IntegrationTestContextOptions) { | CODE |
| LOW | test/integration/test-helpers.ts | 165 | function formatLastSnapshotContext(args: string[]): string { | CODE |
| LOW | test/integration/smoke-macos-coverage.test.ts | 138 | function commandsExecutedByMacOsLiveScenarios(): string[] { | CODE |
| LOW | test/integration/smoke-macos-coverage.test.ts | 154 | function commandsExecutedInScenarioSource( | CODE |
| LOW | test/integration/client-api-doc-snippets.test.ts | 142 | function stubFreeNamesAndRecompile(tmpDir: string, firstPassOutput: string): string { | CODE |
| LOW | test/integration/smoke-web-platform.test.ts | 285 | async function forceKillManagedBrowserProcesses(status: AgentBrowserToolStatus): Promise<void> { | CODE |
| LOW | test/integration/smoke-web-platform.test.ts | 307 | async function settleManagedBrowserProcesses( | CODE |
| LOW | test/integration/smoke-web-platform.test.ts | 628 | function formatLastSnapshotContext(context: WebSmokeContext): string { | CODE |
| LOW | test/integration/recording-contact-sheet.test.ts | 148 | function assertReportedSizeMatchesHeader(bytes: Buffer, data: ContactSheetData): void { | CODE |
| LOW | test/integration/recording-contact-sheet.test.ts | 181 | function assertCellTimesIncreaseWithinTheClip( | CODE |
| LOW | test/integration/recording-contact-sheet.test.ts | 200 | function assertEveryCellClearedTheThreshold( | CODE |
| LOW | test/integration/recording-contact-sheet.test.ts | 212 | function createRecordingIntegrationContext(platform: 'ios' | 'android', testName: string) { | CODE |
| LOW | test/integration/smoke-ios-simulator-coverage.test.ts | 147 | function assertReplayActionFitsViewport(action: ReplayAction, viewport: Viewport): void { | CODE |
| LOW | test/integration/smoke-ios-simulator-coverage.test.ts | 161 | function assertReplayFitsViewports(replayPath: string, viewports: readonly Viewport[]): void { | CODE |
| LOW | test/integration/recording-overlay.test.ts | 241 | function createRecordingIntegrationContext(platform: 'ios' | 'android', testName: string) { | CODE |
| LOW | test/integration/smoke-ios-target-activation.test.ts | 171 | function missingDisclosureEvidence(last: Awaited<ReturnType<typeof runStep>> | undefined): string { | CODE |
| LOW | test/integration/linux-e2e/coverage.ts | 30 | export function liveCommandsForLinuxReplay(): PublicCommand[] { | CODE |
| LOW | test/integration/linux-e2e/coverage.ts | 38 | export function liveCommandsForLinuxCommandEvidence(): PublicCommand[] { | CODE |
| LOW | test/integration/linux-e2e/live-runner.ts | 80 | async function runCommandDiscoveryEvidence(context: LinuxContext): Promise<void> { | CODE |
| LOW | test/integration/interaction-contract/fixtures.ts | 35 | export function drawerWithVisibleTwinSnapshot(): SnapshotState { | CODE |
| LOW | test/integration/interaction-contract/fixtures.ts | 67 | export function equivalentWrapperChainSnapshot(): SnapshotState { | CODE |
| LOW | test/integration/interaction-contract/fixtures.ts | 109 | export function edgeGrazingDrawerSnapshot(): SnapshotState { | CODE |
| LOW | test/integration/interaction-contract/fixtures.ts | 245 | export function nonHittableButtonSnapshot(): SnapshotState { | CODE |
| LOW | test/integration/interaction-contract/fixtures.ts | 338 | export function runnerPresentedDragEndpointsNodes(): RawSnapshotNode[] { | CODE |
| LOW | test/integration/interaction-contract/fixtures.ts | 389 | export function keyboardCoveredTabBarSnapshot(): SnapshotState { | CODE |
| LOW | test/integration/interaction-contract/daemon-harness.ts | 140 | export function runnerGestureViewportEntry(): ProviderScenarioProviderEntry { | CODE |
| LOW | …tegration/provider-scenarios/android-lifecycle.test.ts | 316 | async function runAndroidSetupAndInstallWorkflow( | CODE |
| LOW | …tegration/provider-scenarios/android-lifecycle.test.ts | 499 | async function runAndroidAppControlAndObservabilityWorkflow( | CODE |
| LOW | …tegration/provider-scenarios/android-lifecycle.test.ts | 716 | async function runAndroidCaptureInteractionAndReplayWorkflow( | CODE |
| LOW⚡ | …tegration/provider-scenarios/android-lifecycle.test.ts | 1053 | function assertAndroidProviderContract(world: AndroidSettingsWorld): void { | CODE |
| LOW⚡ | …tegration/provider-scenarios/android-lifecycle.test.ts | 1063 | function assertAndroidInventoryContract(world: AndroidSettingsWorld): void { | CODE |
| LOW⚡ | …tegration/provider-scenarios/android-lifecycle.test.ts | 1072 | function assertAndroidInstallAndLaunchContract(world: AndroidSettingsWorld): void { | CODE |
| LOW | …tegration/provider-scenarios/android-lifecycle.test.ts | 1102 | function assertAndroidPushAndEventContract(world: AndroidSettingsWorld): void { | CODE |
| LOW | …tegration/provider-scenarios/android-lifecycle.test.ts | 1173 | function assertAndroidObservabilityContract(world: AndroidSettingsWorld): void { | CODE |
| LOW | …tegration/provider-scenarios/android-lifecycle.test.ts | 1189 | function assertAndroidInteractionContract(world: AndroidSettingsWorld): void { | CODE |
| LOW | …tegration/provider-scenarios/android-lifecycle.test.ts | 1253 | function assertAndroidShutdownContract(world: AndroidSettingsWorld): void { | CODE |
| LOW | test/integration/provider-scenarios/ios-fold.test.ts | 39 | function writeDisplayInventoryFixture(jsonOutputPath: string): void { | CODE |
| LOW | test/integration/provider-scenarios/ios-fold.test.ts | 163 | function createFoldLedgerAppleToolProvider(params: { | CODE |
| LOW | test/integration/provider-scenarios/ios-fold.test.ts | 299 | function assertFoldLedgerPhaseCoverage(ledger: readonly FoldLedgerCall[]): void { | CODE |
| LOW | …egration/provider-scenarios/android-dialog-fixtures.ts | 7 | export function androidRuntimePermissionXml(): string { | CODE |
| LOW | …egration/provider-scenarios/android-dialog-fixtures.ts | 57 | export function androidButtonlessAlertXml(): string { | CODE |
| LOW | …n/provider-scenarios/limrun-ios-snapshot-owner.test.ts | 165 | function limrunRuntimeDependencies(): LimrunRuntimeDependencies { | CODE |
| LOW | test/integration/provider-scenarios/linux-world.ts | 163 | async function discoverLocalLinuxInventory(): Promise<DeviceInfo[]> { | CODE |
| LOW | test/integration/provider-scenarios/linux-world.ts | 168 | function linuxCalculatorSnapshotNodes(): Array<{ | CODE |
| LOW | …ation/provider-scenarios/android-recording-fixtures.ts | 28 | export async function createAndroidRecordingScenarioHarness( | CODE |
| LOW | …ation/provider-scenarios/android-recording-fixtures.ts | 52 | export function seedAndroidRecordingResource( | CODE |
| LOW | …tion/provider-scenarios/android-ime-lifecycle-world.ts | 20 | export function androidImeInputTextBroadcast(text: string): string[] { | CODE |
| LOW | …tion/provider-scenarios/android-ime-lifecycle-world.ts | 51 | export function createAndroidProviderShellState(): AndroidProviderShellState { | CODE |
| LOW | …tion/provider-scenarios/android-ime-lifecycle-world.ts | 61 | export function androidImeLifecycleAdbResult( | CODE |
| LOW | …tion/provider-scenarios/android-ime-lifecycle-world.ts | 95 | export function updateAndroidProviderImeShellState( | CODE |
| LOW | …vider-scenarios/android-recording-provider-fixtures.ts | 34 | export function createAndroidRecordingProvider(params: { | CODE |
| LOW | …vider-scenarios/android-recording-provider-fixtures.ts | 159 | function respondToProcessDirectory(command: string, processes: Map<string, NativeProcess>) { | CODE |
| LOW | …vider-scenarios/android-recording-provider-fixtures.ts | 182 | function respondToScreenrecordCommand(command: string, processes: Map<string, NativeProcess>) { | CODE |
| LOW⚡ | test/integration/provider-scenarios/android-world.ts | 421 | function androidClipboardMutationAdbResult(args: readonly string[]): AndroidAdbResult | undefined { | CODE |
| LOW⚡ | test/integration/provider-scenarios/android-world.ts | 428 | function androidDoctorProbeAdbResult(args: readonly string[]): AndroidAdbResult | undefined { | CODE |
| 4449 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README.md | 41 | # Start a session. | COMMENT |
| LOW | vitest.config.ts | 21 | // (B) was left open: one fork dies mid-file, alone, with no test attributed. Scanning every | COMMENT |
| LOW | vitest.config.ts | 81 | // production timeout budgets. slowTestThreshold surfaces creep in local | COMMENT |
| LOW | vitest.config.ts | 141 | // The nightly XCTest lane's reporter/liveness check, which otherwise only ever | COMMENT |
| LOW | vitest.config.ts | 161 | // The packager's Swift comment scanner: pure string transform, and the only place a | COMMENT |
| LOW | vitest.config.ts | 181 | // npm trusts release.yml, so its token boundary is asserted on the parsed workflow. | COMMENT |
| LOW | …nner/AgentDeviceRunnerUITests/RunnerAXSnapshotBridge.h | 61 | customActionLimit:(NSInteger)customActionLimit | COMMENT |
| LOW | …/AgentDeviceRunnerUITests/RunnerTests+TextTyping.swift | 141 | // The shape this command posts, decided once: a spaced per-character plan, a peeled warmup plus | COMMENT |
| LOW | …r/AgentDeviceRunnerUITests/RunnerTests+Lifecycle.swift | 21 | #endif | COMMENT |
| LOW | …eviceRunner/AgentDeviceRunnerUITests/RunnerTests.swift | 81 | // frame rate, and only a capture this slow counts as main-thread occupancy. | COMMENT |
| LOW | …eviceRunner/AgentDeviceRunnerUITests/RunnerTests.swift | 101 | var inFlightCommandWaiters: [String: [@Sendable ((data: Data, shouldFinish: Bool)) -> Void]] = [:] | COMMENT |
| LOW | …eviceRunner/AgentDeviceRunnerUITests/RunnerTests.swift | 121 | var snapshotXCTestChannelPenaltyUntil = Date.distantPast | COMMENT |
| LOW | …eviceRunner/AgentDeviceRunnerUITests/RunnerTests.swift | 141 | // content-dependent grind (#1105: seconds to minutes on live Bluesky screens) cannot pin | COMMENT |
| LOW | …eviceRunner/AgentDeviceRunnerUITests/RunnerTests.swift | 201 | // the extension that reads it) because Swift extensions cannot hold stored properties. | COMMENT |
| LOW | …eviceRunner/AgentDeviceRunnerUITests/RunnerTests.swift | 241 | /// The XCTest fetch wordings whose recorded issue carries the AX server's own error text: the | COMMENT |
| LOW | …r/AgentDeviceRunnerUITests/RunnerTests+TextEntry.swift | 61 | static let readinessTimeout: TimeInterval = 2.0 | COMMENT |
| LOW | …r/AgentDeviceRunnerUITests/RunnerTests+TextEntry.swift | 81 | /// channel, a clear pass on a React Native bottom-sheet field took 1.18–1.26 s over 22 passes | COMMENT |
| LOW | …nerUITests/RunnerTests+SynthesizedCommitDeadline.swift | 1 | import XCTest | COMMENT |
| LOW | …nerUITests/RunnerTests+SynthesizedCommitDeadline.swift | 61 | /// `fill` cannot report ok while the select-all-and-retype it posted is still uncommitted — or | COMMENT |
| LOW | …ntDeviceRunnerUITests/RunnerTests+TextEntryFocus.swift | 1 | import XCTest | COMMENT |
| LOW | …ner/AgentDeviceRunnerUITests/RunnerXCTestEventBridge.h | 1 | #import <Foundation/Foundation.h> | COMMENT |
| LOW | …ner/AgentDeviceRunnerUITests/RunnerXCTestEventBridge.h | 41 | }; | COMMENT |
| LOW | …entDeviceRunnerUITests/RunnerSelectorMatchPolicy.swift | 21 | } | COMMENT |
| LOW | …nner/AgentDeviceRunnerUITests/RunnerTests+Models.swift | 41 | case shutdown | COMMENT |
| LOW | …nner/AgentDeviceRunnerUITests/RunnerTests+Models.swift | 61 | /// `prepareActiveCommandContext` is where that one platform exception is written. | COMMENT |
| LOW | …nner/AgentDeviceRunnerUITests/RunnerTests+Models.swift | 81 | /// decision alone and cannot silently move another. `Command.traits` resolves them against the | COMMENT |
| LOW | …er/AgentDeviceRunnerUITests/RunnerTapPointPolicy.swift | 1 | import XCTest | COMMENT |
| LOW | …eRunnerUITests/RunnerTests+SnapshotCaptureTarget.swift | 21 | } | COMMENT |
| LOW | …nnerUITests/AgentDeviceRunnerUITests-Bridging-Header.h | 1 | #import "RunnerObjCExceptionCatcher.h" | COMMENT |
| LOW | …ntDeviceRunnerUITests/RunnerScrollViewportPolicy.swift | 1 | import XCTest | COMMENT |
| LOW | …nner/AgentDeviceRunnerUITests/RunnerAXSnapshotBridge.m | 21 | NSString *const RunnerAXSnapshotCustomActionsTruncatedKey = @"truncated"; | COMMENT |
| LOW | …nner/AgentDeviceRunnerUITests/RunnerAXSnapshotBridge.m | 401 | } | COMMENT |
| LOW | …nner/AgentDeviceRunnerUITests/RunnerAXSnapshotBridge.m | 421 | /// deep extension filled in since serialization is not a merged element, so | COMMENT |
| LOW | …viceRunnerUITests/RunnerTests+TextEntryReadiness.swift | 81 | } | COMMENT |
| LOW | …viceRunnerUITests/RunnerTests+TextEntryReadiness.swift | 121 | return focusedTextInput(app: app) | COMMENT |
| LOW | …er/AgentDeviceRunnerUITests/RunnerTests+Keyboard.swift | 1 | import XCTest | COMMENT |
| LOW | …er/AgentDeviceRunnerUITests/RunnerTests+Keyboard.swift | 21 | static let settleSampleInterval: TimeInterval = 0.15 | COMMENT |
| LOW | …er/AgentDeviceRunnerUITests/RunnerTests+Keyboard.swift | 81 | COMMENT | |
| LOW | …er/AgentDeviceRunnerUITests/RunnerTests+Keyboard.swift | 221 | return (wasVisible: true, dismissed: !visible, visible: visible, mechanism: visible ? nil : .dismissKey) | COMMENT |
| LOW | …tDeviceRunnerUITests/RunnerTests+CommandDispatch.swift | 521 | switch command.traits.launchPolicy { | COMMENT |
| LOW | …DeviceRunnerUITests/RunnerTests+CommandExecution.swift | 461 | // A foldable lights one panel at a time while `XCUIScreen.main` names one fixed panel, so an | COMMENT |
| LOW | …AgentDeviceRunnerUITests/RunnerTests+Interaction.swift | 221 | /// The app window interactions and captures are booked against: the first window the app | COMMENT |
| LOW | …ceRunnerUITests/RunnerTests+SynthesizedTextEntry.swift | 81 | #endif | COMMENT |
| LOW | …entDeviceRunnerUITests/RunnerTests+ScrollGesture.swift | 1 | import XCTest | COMMENT |
| LOW | …iceRunnerUITests/RunnerTests+SnapshotCapturePlan.swift | 1 | import XCTest | COMMENT |
| LOW | …ts/UnitTests/RunnerTests+AXSnapshotFallbackTests.swift | 21 | [64, 56, 40, 24, 12] | COMMENT |
| LOW | …nnerUITests/UnitTests/RunnerTests+LifecycleTests.swift | 121 | extension RunnerTests { | COMMENT |
| LOW | …unnerUITests/UnitTests/RunnerTests+SnapshotTests.swift | 221 | .completed, | COMMENT |
| LOW | …tTests/RunnerTests+ApplicationStateRawValueTests.swift | 1 | import XCTest | COMMENT |
| LOW | …ests/UnitTests/RunnerTests+CommandExecutionTests.swift | 61 | "Falling back to XCTest coordinate tap may be slower and can still need a healthy accessibility tree." | COMMENT |
| LOW | …ests/UnitTests/RunnerTests+CommandExecutionTests.swift | 121 | // and XCTest answered `No matches found for Element at index 1 from input {(TextField)}` — a recorded | COMMENT |
| LOW | …s/RunnerTests+BlockingSystemModalResolutionTests.swift | 21 | // flag on macOS, so the host lane runs the real branch on every PR. | COMMENT |
| LOW | …Tests/UnitTests/RunnerTests+TextEntryPolicyTests.swift | 641 | ] | COMMENT |
| LOW | …eRunnerUITests/UnitTests/RunnerTests+ModelsTests.swift | 201 | /// `readOnly: .always`, plus `alert`'s `get` action, which its `.conditional` case resolved to the | COMMENT |
| LOW | …ntDeviceRunner/RecordingScripts/recording-frames.swift | 1 | import AVFoundation | COMMENT |
| LOW | …tDeviceRunner/AgentDeviceRunner/AgentDeviceRunnerApp.m | 461 | [textField removeFromSuperview]; | COMMENT |
| LOW | apple/snapshot-bridge/SnapshotBridge.m | 1 | /* | COMMENT |
| LOW | test/ci/root-docs-paths-ignore.test.ts | 1 | // Regression pin for #1781 A9: the five root-level docs files | COMMENT |
| LOW | test/integration/client-api-doc-snippets.test.ts | 1 | import fs from 'node:fs'; | COMMENT |
| LOW | …on/provider-scenarios/remote-upload-lease-beat.test.ts | 401 | COMMENT | |
| 171 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …nner/AgentDeviceRunnerUITests/RunnerAXSnapshotBridge.m | 768 | result[@"placeholder"] = [self stringValueForKey:@"placeholderValue" snapshot:snapshot] ?: @""; | CODE |
| LOW | …eRunnerUITests/RunnerTests+PrivateAXPresentation.swift | 56 | placeholder: privateAXPresentationString(raw["placeholder"]), | CODE |
| LOW | …/UnitTests/RunnerTests+SnapshotPresentationTests.swift | 58 | #"[{"actions":["Open menu"],"depth":2,"enabled":true,"focused":true,"hiddenContentAbove":true,"hiddenContentBelow" | COMMENT |
| LOW | …/UnitTests/RunnerTests+SnapshotPresentationTests.swift | 101 | XCTAssertFalse(encoded.contains("placeholder"), encoded) | CODE |
| LOW | …UnitTests/RunnerTests+PrivateAXPresentationTests.swift | 129 | "placeholder": "Type your name", "frame": frame(16, 200, 370, 44), "children": []], | CODE |
| LOW | …UnitTests/RunnerTests+PrivateAXPresentationTests.swift | 131 | "placeholder": "", "frame": frame(16, 300, 370, 44), "children": []] | CODE |
| LOW⚡ | …vider-scenarios/cloud-webdriver-ios-text-entry.test.ts | 147 | ['label=Email', 'user@example.com'], | CODE |
| LOW⚡ | …vider-scenarios/cloud-webdriver-ios-text-entry.test.ts | 153 | assert.equal(data.text, 'user@example.com'); | CODE |
| LOW⚡ | …vider-scenarios/cloud-webdriver-ios-text-entry.test.ts | 156 | assert.equal(server.fieldValues.email, 'user@example.com'); | CODE |
| LOW | …vider-scenarios/cloud-webdriver-ios-text-entry.test.ts | 178 | assert.equal(nodes?.find((node) => node.identifier === 'email')?.value, 'user@example.com'); | CODE |
| LOW | …vider-scenarios/cloud-webdriver-ios-text-entry.test.ts | 195 | ['label=Email', 'user@example.com'], | CODE |
| LOW | …vider-scenarios/cloud-webdriver-ios-text-entry.test.ts | 219 | server.focusField('email', 'user@example.com'); | CODE |
| LOW | …vider-scenarios/cloud-webdriver-ios-text-entry.test.ts | 234 | assert.equal(server.fieldValues.email, 'user@example.com'); | CODE |
| LOW | website/docs/docs/commands.md | 490 | agent-device find label "Email" fill "user@example.com" | CODE |
| LOW | website/docs/docs/quick-start.md | 120 | agent-device find label "Email" fill "user@example.com" | CODE |
| LOW | website/docs/docs/snapshots.md | 111 | # @e8 [other] "John Doe" | COMMENT |
| LOW | website/docs/docs/snapshots.md | 112 | # @e9 [other] "John Doe" | COMMENT |
| LOW | website/docs/docs/selectors.md | 13 | agent-device find label "Email" fill "user@example.com" | CODE |
| LOW | …es/provider-webdriver/src/webdriver-interactor.test.ts | 385 | const pending = interactor.fill(12, 24, 'user@example.com').then( | CODE |
| LOW | packages/provider-webdriver/src/browserstack.test.ts | 26 | await fs.writeFile(appPath, 'placeholder'); | CODE |
| LOW | packages/provider-webdriver/src/browserstack.test.ts | 61 | await fs.writeFile(appPath, 'placeholder'); | CODE |
| LOW | packages/provider-webdriver/src/browserstack.test.ts | 82 | await fs.writeFile(path.join(tempDir, 'App.apk'), 'placeholder'); | CODE |
| LOW | packages/provider-webdriver/src/webdriver-source.ts | 221 | facts: Pick<RawSnapshotNode, 'editable' | 'password' | 'placeholder' | 'hintShowing'>; | CODE |
| LOW | packages/provider-webdriver/src/webdriver-utils.test.ts | 112 | await fs.writeFile(path.join(tempDir, 'App.apk'), 'placeholder'); | CODE |
| LOW | packages/capture-kit/src/snapshot-occlusion.test.ts | 579 | value: 'user@example.com', | CODE |
| LOW | …hot/snapshot-presentation/repeated-nav-subtree.test.ts | 69 | ['user@example.com', true], | CODE |
| LOW | packages/platform-android/src/ui-hierarchy-node.ts | 15 | | 'placeholder' | CODE |
| LOW | …/platform-android/src/__tests__/app-deployment.test.ts | 40 | await fs.writeFile(apkPath, 'placeholder', 'utf8'); | CODE |
| LOW | …/platform-android/src/__tests__/app-deployment.test.ts | 60 | await fs.writeFile(apkPath, 'placeholder', 'utf8'); | CODE |
| LOW | …/platform-android/src/__tests__/app-deployment.test.ts | 98 | await fs.writeFile(apkPath, 'placeholder', 'utf8'); | CODE |
| LOW | …/platform-android/src/__tests__/app-deployment.test.ts | 144 | await fs.writeFile(aabPath, 'placeholder', 'utf8'); | CODE |
| LOW | …/platform-android/src/__tests__/app-deployment.test.ts | 217 | await fs.writeFile(aabPath, 'placeholder', 'utf8'); | CODE |
| LOW | …/platform-android/src/__tests__/app-deployment.test.ts | 250 | await fs.writeFile(aabPath, 'placeholder', 'utf8'); | CODE |
| LOW | …latform-android/src/__tests__/fill-diagnostics.test.ts | 94 | const details = buildFillFailureDetails('Acme Ltd', { | CODE |
| LOW | …latform-android/src/__tests__/fill-diagnostics.test.ts | 107 | assert.equal(details.expected, 'Acme Ltd'); | CODE |
| LOW | …android/src/__tests__/ui-hierarchy-placeholder.test.ts | 52 | expect(JSON.parse(JSON.stringify(byId('name-label')))).not.toHaveProperty('placeholder'); | CODE |
| LOW | …platform-android/src/__tests__/text-input-fill.test.ts | 469 | 'Acme Ltd', | CODE |
| LOW | packages/provider-testmu/src/testmu.test.ts | 146 | await fs.writeFile(appPath, 'placeholder'); | CODE |
| LOW | packages/provider-testmu/src/testmu.test.ts | 199 | await fs.writeFile(appPath, 'placeholder'); | CODE |
| LOW | packages/provider-testmu/src/testmu.test.ts | 266 | await fs.writeFile(appPath, 'placeholder'); | CODE |
| LOW | …kages/platform-apple/src/snapshot-source/cache.test.ts | 20 | await writeFile(path.join(root, 'placeholder'), 'unused'); | CODE |
| LOW | src/daemon/response-views.ts | 128 | 'placeholder', | CODE |
| LOW | src/daemon/handlers/__tests__/session-reinstall.test.ts | 120 | fs.writeFileSync(appPath, 'placeholder'); | CODE |
| LOW | src/daemon/handlers/__tests__/session-reinstall.test.ts | 171 | fs.writeFileSync(appPath, 'placeholder'); | CODE |
| LOW | src/daemon/handlers/__tests__/session-reinstall.test.ts | 232 | fs.writeFileSync(appPath, 'placeholder'); | CODE |
| LOW | src/daemon/handlers/__tests__/session-reinstall.test.ts | 270 | fs.writeFileSync(appPath, 'placeholder'); | CODE |
| LOW | src/daemon/handlers/__tests__/session-reinstall.test.ts | 310 | fs.writeFileSync(appPath, 'placeholder'); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/platform-linux/src/linux-env.ts | 22 | // ── Cached input tool resolution ─────────────────────────────────────── | COMMENT |
| MEDIUM | packages/platform-linux/src/atspi-bridge.ts | 25 | // ── Limits (matching macOS helper's SnapshotTraversalLimits) ──────────── | COMMENT |
| MEDIUM | packages/platform-linux/src/atspi-bridge.ts | 58 | // ── Public types ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/platform-linux/src/atspi-bridge.ts | 86 | // ── Public API ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/platform-linux/src/input-actions.ts | 8 | // ── Low-level wrappers ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/platform-linux/src/input-actions.ts | 91 | // ── Mouse actions ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/platform-linux/src/input-actions.ts | 177 | // ── Swipe / scroll ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/platform-linux/src/input-actions.ts | 292 | // ── Keyboard actions ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ges/platform-linux/src/__tests__/input-actions.test.ts | 53 | // ── xdotool tests ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ges/platform-linux/src/__tests__/input-actions.test.ts | 92 | // ── ydotool tests ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/platform-linux/src/__tests__/clipboard.test.ts | 37 | // ── X11 clipboard ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/platform-linux/src/__tests__/clipboard.test.ts | 85 | // ── Wayland clipboard ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/platform-apple/src/runner/runner-contract.ts | 427 | // ── Listener endpoint and token ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …atform-apple/src/runner/runner-error-classification.ts | 363 | // ── Startup classification (#2680) ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …atform-apple/src/runner/runner-error-classification.ts | 363 | // ── Startup classification (#2680) ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/selectors/src/internal/match.test.ts | 218 | // ── appName / windowTitle selectors ────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/integration/support/daemon-leak-model.ts | 16 | // scaffold, daemon.json/daemon.lock may exist only while a | COMMENT |
| MEDIUM | test/integration/support/daemon-leak-oracle.ts | 102 | // scaffold leaves no file behind), plus the `lifecycle` of durable capture | COMMENT |
| MEDIUM | website/docs/docs/build-an-integration.md | 133 | ## Batch orchestration for custom transports | COMMENT |
| MEDIUM | website/docs/docs/client-api.md | 308 | [Batch orchestration for custom transports](/docs/build-an-integration#batch-orchestration-for-custom-transports). | CODE |
| MEDIUM | scripts/layering/runtime-execution-policy.ts | 6 | // Evidence: 7b48531d3b (#2081) retired ADR-0019 cutover scaffolding this policy outlived; | COMMENT |
| MEDIUM | scripts/layering/runtime-execution-policy.ts | 7 | // 4454aef139 (#2092) removed the retired migration scaffolding alongside it. | COMMENT |
| MEDIUM | scripts/layering/application-lifecycle-policy.ts | 6 | // this ownership check protects; 7b48531d3b (#2081) retired the cutover scaffolding around it. | COMMENT |
| MEDIUM | scripts/layering/session-resource-ownership.ts | 5 | // Evidence: 7b48531d3b (#2081) retired ADR-0019 cutover scaffolding this policy protected during | COMMENT |
| MEDIUM | scripts/layering/source-execution-policy.ts | 5 | // Evidence: 7b48531d3b (#2081) retired ADR-0019 cutover scaffolding alongside this policy; | COMMENT |
| MEDIUM | scripts/layering/source-execution-policy.ts | 6 | // 4454aef139 (#2092) removed the retired migration scaffolding it depended on. | COMMENT |
| MEDIUM | packages/replay-port/src/daemon-port/native-command.ts | 27 | * #1555 P5 (decomposition): the replay request's own orchestration — routing, plan resolution, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | linux/atspi-dump.py | 98 | def get_numeric_value(accessible): | CODE |
| MEDIUM | linux/atspi-dump.py | 111 | def has_state(state_set, state_type): | CODE |
| MEDIUM | linux/atspi-dump.py | 232 | def get_app_info(app): | CODE |
| MEDIUM | linux/atspi-dump.py | 277 | def parse_int_arg(value, name): | CODE |
| LOW⚡ | linux/atspi-dump.py | 107 | except Exception: | CODE |
| LOW⚡ | linux/atspi-dump.py | 114 | except Exception: | CODE |
| LOW⚡ | linux/atspi-dump.py | 124 | except Exception: | CODE |
| LOW⚡ | linux/atspi-dump.py | 129 | except Exception: | CODE |
| LOW⚡ | linux/atspi-dump.py | 134 | except Exception: | CODE |
| LOW⚡ | linux/atspi-dump.py | 216 | except Exception: | CODE |
| LOW⚡ | linux/atspi-dump.py | 218 | except Exception: | CODE |
| LOW⚡ | linux/atspi-dump.py | 227 | except Exception: | CODE |
| LOW⚡ | linux/atspi-dump.py | 235 | except Exception: | CODE |
| LOW⚡ | linux/atspi-dump.py | 239 | except Exception: | CODE |
| LOW | linux/atspi-dump.py | 40 | except Exception: | CODE |
| LOW | linux/atspi-dump.py | 70 | except Exception: | CODE |
| LOW | linux/atspi-dump.py | 94 | except Exception: | CODE |
| LOW | linux/atspi-dump.py | 148 | except Exception: | CODE |
| LOW | linux/atspi-dump.py | 184 | except Exception: | CODE |
| LOW | linux/atspi-dump.py | 197 | except Exception: | CODE |
| LOW | linux/atspi-dump.py | 266 | except Exception: | CODE |
| LOW | linux/atspi-dump.py | 324 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …egration/nightly/concurrency-torture/claim-registry.ts | 6 | // (#1416 out-of-scope). This model preserves the *invariants* the harness asserts: | COMMENT |
| MEDIUM⚡ | .github/workflows/mutation-affected.yml | 6 | # exits non-zero on a harness failure, never on a score. | COMMENT |
| MEDIUM⚡ | .github/workflows/mutation-affected.yml | 9 | # spends mutants on one thing only — proving the harness still runs end to end | COMMENT |
| MEDIUM⚡ | .github/workflows/mutation-affected.yml | 10 | # when the harness itself changes. `select` therefore returns an empty matrix | COMMENT |
| MEDIUM⚡ | .github/workflows/mutation-affected.yml | 15 | # On a harness diff the matrix is the canary (`LANE_CANARY`, selected by | COMMENT |
| MEDIUM | .github/workflows/conformance-regenerate.yml | 50 | # harness over the corpus, and rewrites fixtures/ + corpus/manifest.json. | COMMENT |
| MEDIUM | src/daemon/handlers/__tests__/snapshot-handler.test.ts | 297 | // #1076 versioned refs — shared harness for the refsGeneration tests below. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | linux/atspi-dump.py | 197 | except Exception: | CODE |
| HIGH | linux/atspi-dump.py | 218 | except Exception: | CODE |
| HIGH | linux/atspi-dump.py | 227 | except Exception: | CODE |
| HIGH | linux/atspi-dump.py | 266 | except Exception: | CODE |
| HIGH | linux/atspi-dump.py | 216 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …st/integration/provider-scenarios/web-provider.test.ts | 276 | const button = refreshed.json.result.data.nodes.find( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | website/docs/docs/ai-sdk.md | 16 | AI_GATEWAY_API_KEY=your_api_key | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/mcp/router.ts | 63 | async function handleRequest(method: string, params: unknown, era: ProtocolEra): Promise<unknown> { | CODE |
| LOW | src/daemon/request-router.ts | 209 | async function handleRequest(req: DaemonRequest): Promise<DaemonResponse> { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | linux/atspi-dump.py | 201 | CODE | |
| LOW | linux/atspi-dump.py | 244 | CODE | |
| LOW | linux/atspi-dump.py | 288 | CODE |