1.7

Adjusted Signal

1.7

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

17.2K

Stars

Language

1.9M

Lines of Code

6.6K

Files

1.7K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1428 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.5/100 · LOW

Are imports declared and package/API names verified? 174 finding(s).

Agent Over-Engineering Ratio 1.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 224 finding(s).

PR Review Velocity Impact 7.3/100 · LOW

Which changes need focused human review? 1729 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 70HIGH 7MEDIUM 218LOW 1434

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1729 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1022 hits · 996 pts

Severity	File	Line	Snippet	Context
LOW	install.sh	721	esac	COMMENT
LOW	mise.toml	41	"go:mvdan.cc/sh/v3/cmd/shfmt" = "v3.12.0"	COMMENT
LOW	mise.toml	81	# Pre-installs the binary so the upstream devcontainers-cli coder	COMMENT
LOW	.vale.ini	1	# Vale configuration for Coder documentation.	COMMENT
LOW	.vale.ini	81	[docs/reference/cli/agent-firewall.md]	COMMENT
LOW	compose.yaml	1	services:	COMMENT
LOW	enterprise/aibridgeproxyd/aibridgeproxyd.go	181	// Used to correlate requests/responses with their originating CONNECT.	COMMENT
LOW	enterprise/aibridgeproxyd/aibridgeproxyd.go	201	ListenAddr string	COMMENT
LOW	enterprise/aibridgeproxyd/aibridgeproxyd.go	221	// (non-provider-host) requests through. If empty, tunneled requests connect	COMMENT
LOW	enterprise/aibridgeproxyd/aibridgeproxyd.go	641	// for use by downstream handlers.	COMMENT
LOW	enterprise/aibridgeproxyd/metrics.go	21	// MITMRequestsTotal counts MITM requests handled by the proxy.	COMMENT
LOW	enterprise/provisionerd/remoteprovisioners.go	361	}	COMMENT
LOW	enterprise/provisionerd/remoteprovisioners.go	381	//	COMMENT
LOW	enterprise/tailnet/pgcoord.go	61	} else {	COMMENT
LOW	enterprise/tailnet/pgcoord.go	81	// │ ┌──────────▼┐ ┌────────┐	COMMENT
LOW	enterprise/tailnet/pgcoord.go	861	if len(resp.PeerUpdates) == 0 {	COMMENT
LOW	enterprise/tailnet/multiagent_test.go	261	ma1.AssertEventuallyHasDERP(agent1.ID, 1)	COMMENT
LOW	enterprise/tailnet/pgcoord_test.go	521	client11.AssertEventuallyResponsesClosed(agpl.CloseErrCoordinatorClose)	COMMENT
LOW	enterprise/scaletest/agentfake/agent.go	221	// (metadata and the derp subscriber). runConnectionReports is excluded: the	COMMENT
LOW	enterprise/cli/aigatewaystart_test.go	501	// Then: the 401 on the gateway's redial terminates the command.	COMMENT
LOW	enterprise/dbcrypt/cliutil_test.go	521	require.NoError(t, err, "user %s", u.ID)	COMMENT
LOW	enterprise/dbcrypt/cliutil_test.go	781	// DecryptErr simulates an operator omitting an old key from --old-keys.	COMMENT
LOW	enterprise/dbcrypt/doc.go	1	// Package dbcrypt provides a database.Store wrapper that encrypts/decrypts	COMMENT
LOW	enterprise/dbcrypt/doc.go	21	// Encryption keys are stored in the database in the table `dbcrypt_keys`.	COMMENT
LOW	enterprise/dbcrypt/cipher_internal_test.go	81		COMMENT
LOW	enterprise/coderd/roles.go	21	)	COMMENT
LOW	enterprise/coderd/roles.go	81	Detail: err.Error(),	COMMENT
LOW	enterprise/coderd/roles.go	181	// deleteOrgRole will remove a custom role from an organization	COMMENT
LOW	enterprise/coderd/workspacequota_test.go	741	// - BeginTX -> Bump! -> GetQuota -> GetAllowance -> UpdateCost -> EndTx	COMMENT
LOW	enterprise/coderd/workspacequota_test.go	801	// while doing a quota commit.	COMMENT
LOW	enterprise/coderd/workspacequota_test.go	861	t.Run("ActivityBump", func(t *testing.T) {	COMMENT
LOW	enterprise/coderd/workspacequota_test.go	921	// \| W1 Quota Tx \| \|	COMMENT
LOW	enterprise/coderd/workspacequota_test.go	961	// +---------------------+----------------------------------+	COMMENT
LOW	enterprise/coderd/workspacequota_test.go	1001	assert.NoError(t, one.Done())	COMMENT
LOW	enterprise/coderd/workspacequota_test.go	1061	// Workspaces do not share templates or orgs	COMMENT
LOW	enterprise/coderd/workspacequota_test.go	1121	// +---------------------+---------------------+	COMMENT
LOW	enterprise/coderd/idpsync.go	741	// @Param organization path string true "Organization ID" format(uuid)	COMMENT
LOW	enterprise/coderd/idpsync.go	781	}	COMMENT
LOW	enterprise/coderd/groups.go	461	// @Param after_id query string false "After ID" format(uuid)	COMMENT
LOW	enterprise/coderd/groups.go	561		COMMENT
LOW	enterprise/coderd/provisionerdaemons_test.go	281	// Confirm the close was driven by a key lookup, not another path (no	COMMENT
LOW	enterprise/coderd/templates_test.go	2001	}	COMMENT
LOW	enterprise/coderd/aibridge.go	61	// reference a valid resource in the expected scope.	COMMENT
LOW	enterprise/coderd/aibridge.go	281	//	COMMENT
LOW	enterprise/coderd/aibridge.go	1101	// @Summary Get organization groups AI spend	COMMENT
LOW	enterprise/coderd/aibridge.go	1281	// @Description Returns per-user, per-group, per-model, per-provider aggregated AI spend for the organization as CSV, bu	COMMENT
LOW	enterprise/coderd/aibridge.go	1401	// @Description Returns one page of per-user AI spend for the organization, most expensive first, built from the same ra	COMMENT
LOW	enterprise/coderd/aibridge.go	1561	// @Summary Get group members AI spend by organization	COMMENT
LOW	enterprise/coderd/aimodelprices.go	81	}	COMMENT
LOW	enterprise/coderd/workspaceproxy.go	461	// @Tags Enterprise	COMMENT
LOW	enterprise/coderd/workspaceproxy.go	541	// in the database and returns a signed token that can be used to authenticate	COMMENT
LOW	enterprise/coderd/workspaceproxy.go	741	})	COMMENT
LOW	enterprise/coderd/workspaceproxy.go	861	}	COMMENT
LOW	enterprise/coderd/aibridge_test.go	1181	for i, s := range res.Sessions {	COMMENT
LOW	enterprise/coderd/aibridge_test.go	1261	require.NotZero(t, res.Sessions[1].LastActiveAt, "session C should have last_active_at set")	COMMENT
LOW	enterprise/coderd/coderd_test.go	981	// which resulted in the other peer thinking the client was a new peer.	COMMENT
LOW	enterprise/coderd/licenses.go	41	// re-read licenses from the database and recompute entitlements.	COMMENT
LOW	enterprise/coderd/licenses.go	61	// postLicense adds a new Enterprise license to the cluster. We allow multiple different licenses	COMMENT
LOW	enterprise/coderd/licenses.go	241		COMMENT
LOW	enterprise/coderd/schedule/template.go	361	// to avoid failures below. Add a week to account for timezones.	COMMENT
962 more matches not shown…

Hallucination Indicators70 hits · 810 pts

Severity	File	Line	Snippet	Context
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	55	if dumpDir := coderAPI.DeploymentValues.AI.BridgeProxyConfig.APIDumpDir.String(); dumpDir != "" {	CODE
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	63	coderAPI.DeploymentValues.AI.BridgeProxyConfig.Target.String(),	CODE
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	70	ListenAddr: coderAPI.DeploymentValues.AI.BridgeProxyConfig.ListenAddr.String(),	CODE
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	71	TLSCertFile: coderAPI.DeploymentValues.AI.BridgeProxyConfig.TLSCertFile.String(),	CODE
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	72	TLSKeyFile: coderAPI.DeploymentValues.AI.BridgeProxyConfig.TLSKeyFile.String(),	CODE
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	74	MITMCertFile: coderAPI.DeploymentValues.AI.BridgeProxyConfig.MITMCertFile.String(),	CODE
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	75	MITMKeyFile: coderAPI.DeploymentValues.AI.BridgeProxyConfig.MITMKeyFile.String(),	CODE
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	76	UpstreamProxy: coderAPI.DeploymentValues.AI.BridgeProxyConfig.UpstreamProxy.String(),	CODE
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	77	UpstreamProxyCA: coderAPI.DeploymentValues.AI.BridgeProxyConfig.UpstreamProxyCA.String(),	CODE
CRITICAL⚡	enterprise/cli/aibridgeproxyd.go	78	AllowedPrivateCIDRs: coderAPI.DeploymentValues.AI.BridgeProxyConfig.AllowedPrivateCIDRs.Value(),	CODE
CRITICAL	enterprise/cli/server.go	92	DERPServerRelayAddress: options.DeploymentValues.DERP.Server.RelayURL.String(),	CODE
CRITICAL	enterprise/cli/server.go	93	DERPServerRegionID: int(options.DeploymentValues.DERP.Server.RegionID.Value()),	CODE
CRITICAL	enterprise/cli/server.go	171	if options.DeploymentValues.AI.BridgeProxyConfig.Enabled.Value() {	CODE
CRITICAL	enterprise/coderd/aibridgeproxy.go	57	if !api.DeploymentValues.AI.BridgeProxyConfig.Enabled.Value() {	CODE
CRITICAL	enterprise/coderd/coderd.go	1008	codersdk.FeatureAIBridge: api.DeploymentValues.AI.BridgeConfig.Enabled.Value(),	CODE
CRITICAL	enterprise/coderd/aibridgeserve.go	146	OAuth2ProviderEnabled: api.DeploymentValues.OAuth2.Provider.Enable.Value(),	CODE
CRITICAL	enterprise/coderd/aibridge.go	1229	retention := api.DeploymentValues.AI.BridgeConfig.Retention.Value()	CODE
CRITICAL	enterprise/coderd/workspaceproxy.go	739	DERPForceWebSockets: api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),	CODE
CRITICAL	enterprise/coderd/coderdenttest/coderdenttest.go	113	DERPServerRegionID: int(oop.DeploymentValues.DERP.Server.RegionID.Value()),	CODE
CRITICAL	enterprise/wsproxy/wsproxy_test.go	208	require.Len(t, connInfo.DERPMap.Regions, 3+len(api.DeploymentValues.DERP.Server.STUNAddresses.Value()))	CODE
CRITICAL	enterprise/wsproxy/wsproxy_test.go	278	require.Len(t, connInfo.DERPMap.Regions, 3+len(api.DeploymentValues.DERP.Server.STUNAddresses.Value()))	CODE
CRITICAL	cli/support.go	421	docsURL = bun.Deployment.Config.Values.DocsURL.String()	CODE
CRITICAL	coderd/exp_chats_hooks_test.go	72	require.NoError(t, opts.DeploymentValues.AI.Chat.HookURL.Set(consumer.URL))	CODE
CRITICAL	coderd/exp_chats_hooks_test.go	126	require.NoError(t, opts.DeploymentValues.AI.Chat.HookURL.Set(consumer.URL))	CODE
CRITICAL	coderd/exp_chats_hooks_test.go	164	require.NoError(t, opts.DeploymentValues.AI.Chat.HookURL.Set(consumer.URL))	CODE
CRITICAL	coderd/exp_chats_hooks_test.go	271	require.NoError(t, opts.DeploymentValues.AI.Chat.HookURL.Set(consumer.URL))	CODE
CRITICAL	coderd/exp_chats_hooks_test.go	406	require.NoError(t, opts.DeploymentValues.AI.Chat.HookURL.Set(consumer.URL))	CODE
CRITICAL	coderd/exp_chats_hooks_test.go	509	require.NoError(t, opts.DeploymentValues.AI.Chat.HookURL.Set(consumer.URL))	CODE
CRITICAL	coderd/coderd.go	773	OAuth2Provider: api.DeploymentValues.OAuth2.Provider.Enable.Value(),	CODE
CRITICAL	coderd/coderd.go	787	AIGatewayEnabled: options.DeploymentValues.AI.BridgeConfig.Enabled.Value(),	CODE
CRITICAL⚡	coderd/coderd.go	873	options.DeploymentValues.DERP.Config.ForceWebSockets.Value(),	CODE
CRITICAL⚡	coderd/coderd.go	874	options.DeploymentValues.DERP.Config.BlockDirect.Value(),	CODE
CRITICAL⚡	coderd/coderd.go	884	maxChatsPerAcquire := options.DeploymentValues.AI.Chat.AcquireBatchSize.Value()	CODE
CRITICAL⚡	coderd/coderd.go	891	streamSilenceTimeout := options.DeploymentValues.AI.Chat.StreamSilenceTimeout.Value()	CODE
CRITICAL	coderd/coderd.go	908	if options.DeploymentValues.AI.BridgeConfig.Enabled.Value() {	CODE
CRITICAL	coderd/coderd.go	942	AllowBYOK: options.DeploymentValues.AI.BridgeConfig.AllowBYOK.Value(),	CODE
CRITICAL	coderd/coderd.go	945	AlwaysEnableDebugLogs: options.DeploymentValues.AI.Chat.DebugLoggingEnabled.Value(),	CODE
CRITICAL	coderd/coderd.go	1028	DisableDatabaseInserts: !options.DeploymentValues.StatsCollection.UsageStats.Enable.Value(),	CODE
CRITICAL	coderd/coderd.go	1103	oauth2ProviderEnabled := api.DeploymentValues.OAuth2.Provider.Enable.Value()	CODE
CRITICAL	coderd/coderd.go	1978	if !options.DeploymentValues.StatsCollection.UsageStats.Enable.Value() {	CODE
CRITICAL	coderd/aibridged.go	77	OAuth2ProviderEnabled: api.DeploymentValues.OAuth2.Provider.Enable.Value(),	CODE
CRITICAL	coderd/workspaceagentsrpc.go	185	DisableDirectConnections: api.DeploymentValues.DERP.Config.BlockDirect.Value(),	CODE
CRITICAL	coderd/workspaceagentsrpc.go	186	DerpForceWebSockets: api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),	CODE
CRITICAL	coderd/workspaces_test.go	1556	assert.Equal(t, newLastSeenAt.UTC(), ws.LatestBuild.MatchedProvisioners.MostRecentlySeen.Time.UTC())	CODE
CRITICAL	coderd/exp_chats_test.go	1795	require.NoError(t, opts.DeploymentValues.AI.Chat.HookURL.Set(consumer.URL))	CODE
CRITICAL	coderd/exp_chats.go	1050	if api.DeploymentValues.AI.BridgeConfig.AllowBYOK.Value() {	CODE
CRITICAL	coderd/exp_chats.go	6315	return api.DeploymentValues != nil && api.DeploymentValues.AI.Chat.DebugLoggingEnabled.Value()	CODE
CRITICAL	coderd/exp_chats.go	8189	byokEnabled := api.DeploymentValues.AI.BridgeConfig.AllowBYOK.Value()	CODE
CRITICAL	coderd/exp_chats.go	8217	if !api.DeploymentValues.AI.BridgeConfig.AllowBYOK.Value() {	CODE
CRITICAL	coderd/exp_chats.go	8374	AllowUserAPIKey: api.DeploymentValues.AI.BridgeConfig.AllowBYOK.Value(),	CODE
CRITICAL	coderd/exp_chats.go	8490	if api.DeploymentValues.AI.BridgeConfig.AllowBYOK.Value() {	CODE
CRITICAL	coderd/exp_chats.go	8530	AllowUserAPIKey: api.DeploymentValues.AI.BridgeConfig.AllowBYOK.Value(),	CODE
CRITICAL	coderd/ai_providers.go	655	if !api.DeploymentValues.AI.BridgeProxyConfig.Enabled.Value() \|\| !provider.Enabled \|\| provider.Deleted {	CODE
CRITICAL	coderd/deployment_test.go	48	require.Empty(t, scrubbed.Values.OAuth2.Github.ClientSecret.Value())	CODE
CRITICAL	coderd/workspaceagents.go	1199	DERPForceWebSockets: api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),	CODE
CRITICAL	coderd/workspaceagents.go	1200	DisableDirectConnections: api.DeploymentValues.DERP.Config.BlockDirect.Value(),	CODE
CRITICAL	coderd/workspaceagents.go	1221	DERPForceWebSockets: api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),	CODE
CRITICAL	coderd/workspaceagents.go	1222	DisableDirectConnections: api.DeploymentValues.DERP.Config.BlockDirect.Value(),	CODE
CRITICAL	coderd/database/dbpurge/dbpurge.go	256	aibridgeRetention := i.vals.AI.BridgeConfig.Retention.Value()	CODE
CRITICAL	coderd/coderdtest/coderdtest.go	547	dvStunAddresses = options.DeploymentValues.DERP.Server.STUNAddresses.Value()	CODE
10 more matches not shown…

Decorative Section Separators126 hits · 477 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	enterprise/tailnet/pgcoord.go	68	// ┌────────────┐	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	69	// ┌────────────► handshaker ├────────┐	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	70	// │ └────────────┘ │	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	71	// │ ┌──────────┐ │	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	72	// ├────────────► tunneler ├──────────┤	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	73	// │ └──────────┘ │	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	75	// ┌────────┐ ┌────────┐ ┌───▼───┐	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	76	// │ connIO ├───────► binder ├────────► store │	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	78	// │ └────────┘ ┌──────┤ │	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	79	// │ │ └───────┘	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	81	// │ ┌──────────▼┐ ┌────────┐	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	83	// └────────────┤ querier ◄─────┤ pubsub │	COMMENT
MEDIUM⚡	enterprise/tailnet/pgcoord.go	85	// └───────────┘ └────────┘	COMMENT
MEDIUM⚡	vpn/speaker.go	65	// ┌────────┐ sendCh	COMMENT
MEDIUM⚡	vpn/speaker.go	66	// ◄─────│ ◄────────────────────────────────────────────────────────────────── ◄┐	COMMENT
MEDIUM⚡	vpn/speaker.go	69	// │ │ ┌───────────────────┐ ┌──────┼──────┐	COMMENT
MEDIUM⚡	vpn/speaker.go	70	// ──────► ┼────────► recvFromSerdes() │ rpc │rpc handling │ │	COMMENT
MEDIUM⚡	vpn/speaker.go	71	// └────────┘ recvCh │ ┼────────────► ◄──── unaryRPC()	COMMENT
MEDIUM⚡	vpn/speaker.go	74	// │ │ └─────────────┘ ┌ ─ ─│─ ─ ─ ─ ─ ─ ─ ┐	COMMENT
MEDIUM⚡	vpn/speaker.go	75	// │ ┼──────────────────────────────────────────► request handling	COMMENT
MEDIUM⚡	vpn/speaker.go	76	// └───────────────────┘ requests (outside speaker)	COMMENT
MEDIUM	tailnet/coordinator.go	36	// ┌──────────────────┐ ┌────────────────────┐ ┌───────────────────┐ ┌──────────────────┐	COMMENT
MEDIUM	tailnet/coordinator.go	38	// └──────────────────┘ └────────────────────┘ └───────────────────┘ └──────────────────┘	COMMENT
MEDIUM	tailnet/coordinator.go	129	// ┌──────────────────┐ ┌────────────────────┐ ┌───────────────────┐ ┌──────────────────┐	COMMENT
MEDIUM	tailnet/coordinator.go	131	// └──────────────────┘ └────────────────────┘ └───────────────────┘ └──────────────────┘	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	237	// . veth ┌────────┐ veth	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	238	// . ┌─────────────────┤ Bridge ├───────────────────┐	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	242	// . ┌───────┴───────┐ ┌───────┴─────────┐ ┌────────┴────────┐	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	244	// . └───────────────┘ └───────┬─────────┘ └────────┬────────┘	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	248	// . ┌───────┴─────────┐ ┌────────┴────────┐	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	250	// . └─────────────────┘ └─────────────────┘	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	408	// . ┌──────────────┐	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	410	// . │ Server ├─────────────────────────────────────┐	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	412	// . └──────────────┘ │ fdac:38fa:ffff:3::1	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	413	// . ┌──────────────┐ ┌─────┴───────┐	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	415	// . │ Client 1 ├───────────────────────────────┤ Router │	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	417	// . └──────────────┘ └─────┬───────┘	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	418	// . ┌──────────────┐ │ fdac:38fa:ffff:2::1	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	420	// . │ Client 2 ├─────────────────────────────────────┘	COMMENT
MEDIUM⚡	tailnet/test/integration/network.go	422	// . └──────────────┘	COMMENT
MEDIUM⚡	cli/cliui/resources.go	37	// ┌────────────────────────────────────────────────────────────────────────────┐	COMMENT
MEDIUM⚡	cli/cliui/resources.go	39	// ├────────────────────────────────────────────────────────────────────────────┤	COMMENT
MEDIUM⚡	cli/cliui/resources.go	41	// ├────────────────────────────────────────────────────────────────────────────┤	COMMENT
MEDIUM⚡	cli/cliui/resources.go	44	// ├────────────────────────────────────────────────────────────────────────────┤	COMMENT
MEDIUM⚡	cli/cliui/resources.go	48	// └────────────────────────────────────────────────────────────────────────────┘	COMMENT
MEDIUM⚡	coderd/boundaryusage/doc.go	54	// ┌───────┐ ┌───────────────┐ ┌──────────┐ ┌────┐ ┌───────────┐	COMMENT
MEDIUM⚡	coderd/boundaryusage/doc.go	56	// └───┬───┘ └───────┬───────┘ └────┬─────┘ └──┬─┘ └─────┬─────┘	COMMENT
MEDIUM⚡	coderd/boundaryusage/doc.go	59	// ├──────────────────►│ │ │ │	COMMENT
MEDIUM⚡	coderd/boundaryusage/doc.go	61	// │ ├────────────────►│ │ │	COMMENT
MEDIUM⚡	coderd/boundaryusage/doc.go	65	// ├──────────────────►│ │ │ │	COMMENT
MEDIUM⚡	coderd/boundaryusage/doc.go	67	// │ ├────────────────►│ │ │	COMMENT
MEDIUM⚡	coderd/boundaryusage/doc.go	70	// │ │ ├────────────►│ │	COMMENT
MEDIUM⚡	coderd/boundaryusage/doc.go	74	// │ │ ├────────────►│ │	COMMENT
MEDIUM⚡	coderd/boundaryusage/doc.go	78	// │ │ │ │◄───────────┤	COMMENT
MEDIUM	…derd/x/chatd/chatdebug/model_coverage_internal_test.go	33	// ── struct-to-struct mappings ──────────────────────────	COMMENT
MEDIUM	…derd/x/chatd/chatdebug/model_coverage_internal_test.go	155	// ── message part types (normalizeMessageParts) ────────	COMMENT
MEDIUM	…derd/x/chatd/chatdebug/model_coverage_internal_test.go	274	// ── tool types (normalizeTools) ───────────────────────	COMMENT
MEDIUM	examples/templates/x/docker-chat-sandbox/main.tf	31	# -------------------------------------------------------------------	COMMENT
MEDIUM	examples/templates/x/docker-chat-sandbox/main.tf	33	# -------------------------------------------------------------------	COMMENT
MEDIUM	examples/templates/x/docker-chat-sandbox/main.tf	86	# -------------------------------------------------------------------	COMMENT
66 more matches not shown…

Structural Annotation Overuse109 hits · 187 pts

Severity	File	Line	Snippet	Context
LOW⚡	enterprise/coderd/scim/users_internal_test.go	525	// Step 1: Get the user. Verify fields match.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	532	// Step 2: Replace with active=false → suspended.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	540	// Step 3: Get → confirm inactive.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	545	// Step 4: Patch active=true → dormant (shown as active in SCIM).	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	552	// Step 5: Get → confirm active again.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	557	// Step 6: Delete → suspended.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	561	// Step 7: Get → confirm inactive after delete.	COMMENT
LOW⚡	.agents/skills/refine-plan/SKILL.md	98	### Step 1: Review Current Plan for Completeness	COMMENT
LOW⚡	.agents/skills/refine-plan/SKILL.md	107	### Step 2: Identify Gaps	COMMENT
LOW⚡	.agents/skills/refine-plan/SKILL.md	111	### Step 3: Handle Unclear Requirements	COMMENT
LOW⚡	.agents/skills/refine-plan/SKILL.md	115	### Step 4: Define Test Cases	COMMENT
LOW⚡	.agents/skills/refine-plan/SKILL.md	119	### Step 5: Structure with Red-Green-Refactor	COMMENT
LOW⚡	.agents/skills/refine-plan/SKILL.md	123	### Step 6: Add Verification Steps	COMMENT
LOW⚡	agent/immortalstreams/backedpipe/backed_reader.go	51	// Step 1: Wait until we have a reader or are closed	COMMENT
LOW⚡	agent/immortalstreams/backedpipe/backed_reader.go	60	// Step 2: Perform the read while holding the mutex	COMMENT
LOW⚡	agent/x/agentdesktop/api_test.go	1165	// Step 1: Start recording.	COMMENT
LOW⚡	agent/x/agentdesktop/api_test.go	1173	// Step 2: Stop recording (gets first MP4 data).	COMMENT
LOW⚡	agent/x/agentdesktop/api_test.go	1184	// Step 3: Start again with the same ID - should succeed	COMMENT
LOW⚡	agent/x/agentdesktop/api_test.go	1191	// Step 4: Stop again - should return NEW MP4 data.	COMMENT
LOW	docs/install/prepare/registry-mirror.md	19	## Step 1: Create the Remote Terraform Repository	COMMENT
LOW	docs/install/prepare/registry-mirror.md	35	## Step 2: Verify the Repository Configuration	COMMENT
LOW	docs/install/prepare/registry-mirror.md	46	## Step 3: Configure Terraform CLI	COMMENT
LOW	docs/install/prepare/registry-mirror.md	74	## Step 4: Update Template Module Sources	COMMENT
LOW	docs/install/prepare/registry-mirror.md	94	## Step 5: Configure the control plane or provisioners	COMMENT
LOW	docs/install/prepare/registry-mirror.md	144	## Step 6: Point the template builder at your mirror	COMMENT
LOW	docs/ai-coder/agents/getting-started.md	29	## Step 1: Configure an LLM provider and model	COMMENT
LOW	docs/ai-coder/agents/getting-started.md	60	## Step 2: Start your first Coder Agent	COMMENT
LOW	docs/admin/networking/workspace-proxies.md	30	## Step 1: Create the proxy	COMMENT
LOW	docs/admin/networking/workspace-proxies.md	49	## Step 2: Deploy the proxy	COMMENT
LOW	docs/admin/users/github-auth.md	54	## Step 1: Configure the OAuth application in GitHub	COMMENT
LOW	docs/admin/users/github-auth.md	75	## Step 2: Configure Coder with the OAuth credentials	COMMENT
LOW	docs/admin/users/oidc-auth/index.md	7	## Step 1: Set Redirect URI with your OIDC provider	COMMENT
LOW	docs/admin/users/oidc-auth/index.md	14	## Step 2: Configure Coder with the OpenID Connect credentials	COMMENT
LOW	docs/admin/users/oidc-auth/microsoft.md	12	## Step 1: Create an OAuth App Registration in Microsoft Azure	COMMENT
LOW	docs/admin/users/oidc-auth/microsoft.md	34	## Step 2: Configure Coder OIDC for Microsoft Entra ID	COMMENT
LOW	docs/admin/users/oidc-auth/google.md	12	## Step 1: Create an OAuth client in Google Cloud	COMMENT
LOW	docs/admin/users/oidc-auth/google.md	20	## Step 2: Configure Coder OIDC for Google	COMMENT
LOW	docs/tutorials/azure-federation.md	18	## Step 1: Generate Client Certificate & PKCS bundle	COMMENT
LOW	docs/tutorials/azure-federation.md	34	## Step 2: Create Azure Application & Service Principal	COMMENT
LOW⚡	docs/tutorials/azure-federation.md	47	## Step 3: Assign Client Certificate to the Azure Application	COMMENT
LOW⚡	docs/tutorials/azure-federation.md	52	## Step 4: Set Permissions on the Service Principal	COMMENT
LOW⚡	docs/tutorials/azure-federation.md	61	## Step 5: Configure Coder to use the Client Certificate	COMMENT
LOW	docs/get-started/index.md	53	## Step 1: Install a container runtime	COMMENT
LOW	docs/get-started/index.md	146	## Step 2: Install and start Coder	COMMENT
LOW	docs/get-started/index.md	198	## Step 3: Initial setup	COMMENT
LOW	docs/get-started/index.md	209	## Step 4: Create your first template and workspace	COMMENT
LOW	docs/get-started/index.md	258	## Step 5: Launch your workspace	COMMENT
LOW	docs/get-started/index.md	276	## Step 6: Connect your IDE	COMMENT
LOW	…/get-started/customize-your-template/add-a-language.md	54	## Step 1: Add the Ruby option	COMMENT
LOW	…/get-started/customize-your-template/add-a-language.md	93	## Step 2: Add Ruby to your workspace	COMMENT
LOW	…/get-started/customize-your-template/add-a-language.md	124	## Step 3: Check whether Ruby is installed	COMMENT
LOW	…/get-started/customize-your-template/add-a-language.md	143	## Step 4: Install Ruby when the workspace starts	COMMENT
LOW	…/get-started/customize-your-template/add-a-language.md	203	## Step 5: Add a Ruby preset	COMMENT
LOW	…rted/customize-your-template/authenticate-to-github.md	37	## Step 1: Require GitHub authentication	COMMENT
LOW	…rted/customize-your-template/authenticate-to-github.md	70	## Step 2: Connect your workspace to GitHub	COMMENT
LOW	…rted/customize-your-template/authenticate-to-github.md	104	## Step 3: Clone a private repository	COMMENT
LOW	…/customize-your-template/install-command-line-tools.md	37	## Step 1: Install Homebrew and mise	COMMENT
LOW	…/customize-your-template/install-command-line-tools.md	88	## Step 2: Install a tool with each manager	COMMENT
LOW	…/customize-your-template/install-command-line-tools.md	112	## Step 3: Restart the workspace and compare	COMMENT
LOW	…/customize-your-template/install-command-line-tools.md	179	## Step 4: Make Homebrew survive restarts	COMMENT
49 more matches not shown…

Modern AI Meta-Vocabulary50 hits · 158 pts

Severity	File	Line	Snippet	Context
MEDIUM	AGENTS.md	70	## Repository guardrails	COMMENT
MEDIUM	CLAUDE.md	70	## Repository guardrails	COMMENT
MEDIUM	enterprise/coderd/aibridge.go	280	// threads including agentic actions and thinking blocks.	COMMENT
MEDIUM	enterprise/coderd/exp_chats_test.go	72	// Gateway routing while the agentic inner loop exists; see	COMMENT
MEDIUM	enterprise/coderd/license/license.go	483	// and caps concurrent agentic chats the same as an explicit	COMMENT
MEDIUM	contributing/modules.md	88	### 2. Generate module scaffolding	COMMENT
MEDIUM	.claude/docs/AGENT_FAILURES.md	140	- Existing docs or tools: `AGENTS.md`, [API Design Guardrails](WORKFLOWS.md#api-design-guardrails),	CODE
MEDIUM	agent/agentfiles/files_test.go	2669	// regressions that weaken the guardrails get caught. Each case runs	COMMENT
MEDIUM	docs/ai-coder/index.md	7	Coder supports several ways to run and [govern](#govern-ai-activity-with-ai-governance) coding agents, depending on how	CODE
MEDIUM	docs/ai-coder/index.md	9	- [Coder Agents](#coder-agents), self-hosted AI workflow infrastructure best suited for headless, automated background t	CODE
MEDIUM	coderd/database/models.go	5045	// The interception which directly caused this interception to occur, usually through an agentic loop or threaded conve	COMMENT
MEDIUM	coderd/database/models.go	5051	// Groups related interceptions into a logical session. Determined by a priority chain: (1) client_session_id — an expl	COMMENT
MEDIUM	coderd/database/db2sdk/db2sdk.go	1215	// agentic actions from tool usages and model thoughts, and aggregates	COMMENT
MEDIUM	coderd/database/db2sdk/db2sdk.go	1494	// Root interception only, each agentic action carries its own priced model.	COMMENT
MEDIUM	coderd/x/chatd/turn_environment_internal_test.go	1296	// Three-step agentic turn: each step re-sends the whole	COMMENT
MEDIUM	examples/templates/aws-multi-agent/README.md	10	# AWS multi-agent instance identity verification	COMMENT
MEDIUM	codersdk/aibridge.go	425	// thread details including agentic actions and thinking blocks.	COMMENT
MEDIUM	…/SessionThreadsPage/SessionThreadsPageView.stories.tsx	142	// Opens the agentic loop before searching so ToolCallBlock mounts with	COMMENT
MEDIUM	…hreadsPage/SessionTimeline/SessionTimeline.stories.tsx	229	// Filtering to a tool name keeps only the thread whose agentic loop contains	COMMENT
MEDIUM	…ridge/internal/integrationtest/bridge_internal_test.go	2206	// appended by the inner agentic loop. If the raw payload is not kept in sync with	COMMENT
MEDIUM	…ridge/internal/integrationtest/bridge_internal_test.go	2214	// After the agentic loop the messages must contain at minimum:	COMMENT
MEDIUM	…ridge/internal/integrationtest/bridge_internal_test.go	2249	// appended by the inner agentic loop.	COMMENT
MEDIUM	…ridge/internal/integrationtest/bridge_internal_test.go	2256	// After the agentic loop the messages must contain at minimum:	COMMENT
MEDIUM	…ge/internal/integrationtest/responses_internal_test.go	1055	// TestResponsesInjectedTool tests that injected MCP tool calls trigger the inner agentic loop,	COMMENT
MEDIUM	…ge/internal/integrationtest/responses_internal_test.go	1276	// Wait for both requests to be made (inner agentic loop).	COMMENT
MEDIUM	…ge/internal/integrationtest/responses_internal_test.go	1310	// rewrites its usage with the sum from both agentic-loop iterations.	COMMENT
MEDIUM	aibridge/internal/testutil/mockserverproxier.go	21	// Use it to exercise injected-tool agentic loops where the test does not	COMMENT
MEDIUM⚡	aibridge/intercept/keyfailover_test.go	47	// fixture returns the txtar fixture for the given mode. When agentic is true	COMMENT
MEDIUM⚡	aibridge/intercept/keyfailover_test.go	52	// produces once the agentic stream has started. It is empty for responses,	COMMENT
MEDIUM⚡	aibridge/intercept/keyfailover_test.go	53	// which buffers agentic events and writes the error status directly instead,	COMMENT
MEDIUM⚡	aibridge/intercept/keyfailover_test.go	57	// emits. A successful agentic continuation streams the final response, so its	COMMENT
MEDIUM	aibridge/intercept/keyfailover_test.go	419	// agentic-loop continuation: the initial client request and the subsequent	COMMENT
MEDIUM	aibridge/intercept/keyfailover_test.go	557	// all agentic-loop iterations (one per upstream attempt).	COMMENT
MEDIUM	aibridge/intercept/eventstream/eventstream.go	228	// Gateway behaving like a reverse proxy, removing the inner agentic loop	COMMENT
MEDIUM	aibridge/intercept/messages/blocking.go	112	// Rebuilt per iteration: i.reqPayload mutates when an agentic	COMMENT
MEDIUM	aibridge/intercept/messages/base.go	422	// latest payload (including any messages appended during the agentic tool loop)	COMMENT
MEDIUM	aibridge/intercept/messages/streaming.go	167	// Per-iteration walker. An iteration is either an agentic	COMMENT
MEDIUM	aibridge/intercept/chatcompletions/base.go	179	// Disable parallel tool calls when injectable tools are present to simplify the inner agentic loop.	COMMENT
MEDIUM	aibridge/intercept/chatcompletions/streaming.go	169	// iteration is either an agentic continuation or a failover retry after	COMMENT
MEDIUM	aibridge/intercept/responses/base_internal_test.go	208	// Function/agentic tools expose both id and call_id; both are captured.	COMMENT
MEDIUM	aibridge/intercept/responses/reqpayload.go	130	// Request was likely not initiated by a prompt but is an iteration of agentic loop.	COMMENT
MEDIUM⚡	aibridge/intercept/responses/injected_tools.go	66	// disableParallelToolCalls disables parallel tool calls, to simplify the inner agentic loop.	COMMENT
MEDIUM⚡	aibridge/intercept/responses/injected_tools.go	78	// handleInnerAgenticLoop orchestrates the inner agentic loop whereby injected tools	COMMENT
MEDIUM⚡	aibridge/intercept/responses/injected_tools.go	81	// in its own agentic loop.	COMMENT
MEDIUM	aibridge/intercept/responses/injected_tools.go	103	// handleInjectedToolCalls checks for function calls that we need to handle in our inner agentic loop.	COMMENT
MEDIUM	aibridge/intercept/responses/injected_tools.go	213	// request's input list. This is used in agentic loops where we need to feed the model's output	COMMENT
MEDIUM	aibridge/intercept/responses/streaming.go	108	// Only injected tools let the inner agentic loop rerun upstream, which	COMMENT
MEDIUM	aibridge/intercept/responses/streaming.go	149	// agentic continuation or a failover retry after the previous key was	COMMENT
MEDIUM	aibridge/intercept/responses/streaming.go	170	// agentic mode the inner loop buffers events	COMMENT
MEDIUM	aibridge/client/session.go	84	// conversation; it does seem to persist across an agentic loop though, which is	COMMENT

Verbosity Indicators68 hits · 118 pts

Severity	File	Line	Snippet	Context
LOW⚡	enterprise/coderd/scim/users_internal_test.go	525	// Step 1: Get the user. Verify fields match.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	532	// Step 2: Replace with active=false → suspended.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	540	// Step 3: Get → confirm inactive.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	545	// Step 4: Patch active=true → dormant (shown as active in SCIM).	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	552	// Step 5: Get → confirm active again.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	557	// Step 6: Delete → suspended.	COMMENT
LOW⚡	enterprise/coderd/scim/users_internal_test.go	561	// Step 7: Get → confirm inactive after delete.	COMMENT
LOW	enterprise/coderd/prebuilds/claim_test.go	367	spy.claims.Store(0) // Reset counter because we need to check if any new claim requests happen.	CODE
LOW⚡	agent/immortalstreams/backedpipe/backed_reader.go	51	// Step 1: Wait until we have a reader or are closed	COMMENT
LOW⚡	agent/immortalstreams/backedpipe/backed_reader.go	60	// Step 2: Perform the read while holding the mutex	COMMENT
LOW⚡	agent/x/agentdesktop/api_test.go	1165	// Step 1: Start recording.	COMMENT
LOW⚡	agent/x/agentdesktop/api_test.go	1173	// Step 2: Stop recording (gets first MP4 data).	COMMENT
LOW⚡	agent/x/agentdesktop/api_test.go	1184	// Step 3: Start again with the same ID - should succeed	COMMENT
LOW⚡	agent/x/agentdesktop/api_test.go	1191	// Step 4: Stop again - should return NEW MP4 data.	COMMENT
LOW	coderd/users.go	420	// So we need to check if the userRows is empty and return an empty array if so.	COMMENT
LOW⚡	coderd/mcp.go	2353	// Step 1: Discover the Protected Resource Metadata	COMMENT
LOW⚡	coderd/mcp.go	2362	// Step 2: Fetch Authorization Server Metadata (RFC 8414)	COMMENT
LOW	coderd/mcp.go	2384	// Step 3: Register via Dynamic Client Registration	COMMENT
LOW	coderd/oauth2_test.go	1840	// Step 1: Authorization with resource parameter and PKCE.	COMMENT
LOW	coderd/oauth2_test.go	1875	// Step 2: Token exchange with resource parameter	COMMENT
LOW⚡	coderd/oauth2_test.go	1889	// Step 3: Test API access with token audience validation	COMMENT
LOW⚡	coderd/oauth2_test.go	1898	// Step 4: Test refresh token flow with resource parameter	COMMENT
LOW	coderd/database/dbauthz/dbauthz.go	7104	// If the template requires the active version we need to check if	COMMENT
LOW⚡	coderd/workspaceapps/proxy.go	458	// Step 1: Pass on if subdomain-based application proxying is not	COMMENT
LOW⚡	coderd/workspaceapps/proxy.go	465	// Step 2: Get the request Host.	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	960	// Step 1: Simulate authorization code flow by creating an authorization code	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1012	// Step 2: Exchange authorization code for access token and refresh token.	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1053	// Step 3: Use access token to authenticate with MCP endpoint	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1093	// Step 4: Refresh the access token using refresh token	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1128	// Step 5: Use new access token to create another MCP connection	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1182	// Step 1: Attempt unauthenticated MCP access	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1204	// Step 2: Perform dynamic client registration (RFC 7591)	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1245	// Step 3: Perform OAuth2 authorization code flow with dynamically registered client.	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1303	// Step 4: Exchange authorization code for access token.	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1339	// Step 5: Use access token to get user information via MCP	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1387	// Step 6: Refresh the token	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1418	// Step 7: Use refreshed token to get user information again via MCP	COMMENT
LOW	coderd/mcp/mcp_e2e_test.go	1450	// Step 8: Compare user information before and after token refresh	COMMENT
LOW	coderd/autobuild/lifecycle_executor.go	146	// permissions to read provisioner daemons, but we need to check if there's any for the job prior to the	COMMENT
LOW	coderd/coderdtest/coderdtest.go	1880	// permissions to read provisioner daemons, but we need to check if there's any for the job prior to the	COMMENT
LOW	coderd/x/chatd/integration_test.go	114	// Step 1: Send a message that triggers web_search.	COMMENT
LOW	coderd/x/chatd/integration_test.go	173	// Step 2: Send a follow-up message.	COMMENT
LOW	coderd/x/chatd/integration_test.go	373	// Step 1: Send a message that triggers reasoning.	COMMENT
LOW	coderd/x/chatd/integration_test.go	417	// Step 2: Send a follow-up message.	COMMENT
LOW	coderd/x/chatd/integration_test.go	522	// Step 1: Send a message that triggers reasoning.	COMMENT
LOW	coderd/x/chatd/integration_test.go	566	// Step 2: Send a follow-up message.	COMMENT
LOW	coderd/x/chatd/chatprompt/chatprompt_test.go	535	// Step 1: assistant calls spawn_agent (local) + web_search	COMMENT
LOW	coderd/x/chatd/chatprompt/chatprompt_test.go	713	// Step 1: assistant calls spawn_agent + legacy spawn_agent + web_search (PE).	COMMENT
LOW	coderd/x/chatd/chatprompt/chatprompt_test.go	744	// Step 2: assistant with sources/text + wait_agent x2.	COMMENT
LOW	coderd/x/chatd/chatprompt/chatprompt_test.go	1485	// Step 1: While queued, db2sdk.ChatQueuedMessage parses the	COMMENT
LOW	coderd/x/chatd/chatprompt/chatprompt_test.go	1502	// Step 2: PromoteQueued copies the raw bytes into	COMMENT
LOW	coderd/x/chatd/chatprompt/chatprompt_test.go	1518	// Step 3: The promoted message is used for LLM dispatch.	COMMENT
LOW	coderd/wsbuilder/wsbuilder.go	1215	// Step 1: Mutate template manually set version tags	COMMENT
LOW	coderd/wsbuilder/wsbuilder.go	1227	// Step 2: Fetch tags from the template	COMMENT
LOW	coderd/wsbuilder/wsbuilder.go	1264	// Step 1: Mutate template version tags	COMMENT
LOW	coderd/wsbuilder/wsbuilder.go	1276	// Step 2: Mutate workspace tags:	COMMENT
LOW⚡	scripts/docker-dev/setup-init.sh	16	# Step 1: Create first user (idempotent - creates OR logs in)	COMMENT
LOW⚡	scripts/docker-dev/setup-init.sh	25	# Step 2: Create or retrieve bootstrap token	COMMENT
LOW⚡	.github/workflows/triage-via-chat-api.yaml	36	# Step 1: Determine the GitHub user and issue URL.	COMMENT
LOW⚡	.github/workflows/triage-via-chat-api.yaml	85	# Step 2: Verify the triggering user has push access.	COMMENT
8 more matches not shown…

Fake / Example Data96 hits · 100 pts

Severity	File	Line	Snippet	Context
LOW	server.json	27	"placeholder": "coder.example.com"	CODE
LOW	agent/agentgit/agentgit_test.go	56	gitCmd(t, dir, "config", "user.email", "test@test.com")	CODE
LOW	agent/agentgit/agentgit_test.go	505	gitCmd(t, innerDir, "config", "user.email", "test@test.com")	CODE
LOW	agent/agentgit/agentgit_test.go	1251	gitCmd(t, dir, "config", "user.email", "test@test.com")	CODE
LOW	docs/reference/api/templates.md	2867	"placeholder": "string"	CODE
LOW	docs/reference/api/authorization.md	123	"email": "user@example.com",	CODE
LOW	docs/reference/api/authorization.md	166	"email": "user@example.com",	CODE
LOW	docs/reference/api/authorization.md	200	"email": "user@example.com"	CODE
LOW	docs/reference/api/workspaces.md	1798	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	516	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	701	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	804	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	866	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	947	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	1171	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	1406	"company_name": "Acme Corp",	CODE
LOW	docs/reference/api/enterprise.md	2070	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	2185	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	2299	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	2364	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	3925	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	3951	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	4082	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	4107	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	5510	"value": "user@example.com"	CODE
LOW	docs/reference/api/enterprise.md	5549	"value": "user@example.com"	CODE
LOW	docs/reference/api/enterprise.md	5628	"value": "user@example.com"	CODE
LOW	docs/reference/api/enterprise.md	5664	"email": "user@example.com",	CODE
LOW	docs/reference/api/enterprise.md	5720	"value": "user@example.com"	CODE
LOW	docs/reference/api/enterprise.md	5756	"email": "user@example.com",	CODE
LOW	docs/reference/api/audit.md	73	"email": "user@example.com",	CODE
LOW	docs/reference/api/users.md	41	"email": "user@example.com",	CODE
LOW	docs/reference/api/users.md	93	"email": "user@example.com",	CODE
LOW	docs/reference/api/users.md	123	"email": "user@example.com",	CODE
LOW	docs/reference/api/users.md	471	"email": "user@example.com",	CODE
LOW	docs/reference/api/users.md	1384	"email": "user@example.com",	CODE
LOW	docs/reference/api/users.md	1443	"email": "user@example.com",	CODE
LOW	docs/reference/api/users.md	1514	"email": "user@example.com",	CODE
LOW	docs/reference/api/users.md	1573	"email": "user@example.com",	CODE
LOW	docs/reference/api/users.md	1632	"email": "user@example.com",	CODE
LOW	cli/templateedit_test.go	44	desc := "lorem ipsum dolor sit amet et cetera"	CODE
LOW	cli/templateedit_test.go	44	desc := "lorem ipsum dolor sit amet et cetera"	CODE
LOW	cli/root_test.go	453	"--agent-token", "fake-token",	CODE
LOW	cli/root_test.go	455	require.Equal(t, "fake-token", client.GetSessionToken())	CODE
LOW	cli/gitaskpass_test.go	37	inv.Environ.Set("CODER_AGENT_TOKEN", "fake-token")	CODE
LOW	cli/gitaskpass_test.go	44	inv.Environ.Set("CODER_AGENT_TOKEN", "fake-token")	CODE
LOW	cli/gitaskpass_test.go	62	inv.Environ.Set("CODER_AGENT_TOKEN", "fake-token")	CODE
LOW	cli/gitaskpass_test.go	93	inv.Environ.Set("CODER_AGENT_TOKEN", "fake-token")	CODE
LOW	cli/restart_test.go	78	{Name: ephemeralParameterName, Value: "placeholder"},	CODE
LOW	cli/restart_test.go	136	{Name: ephemeralParameterName, Value: "placeholder"},	CODE
LOW	cli/restart_test.go	196	{Name: ephemeralParameterName, Value: "placeholder"},	CODE
LOW	cli/restart_test.go	254	{Name: ephemeralParameterName, Value: "placeholder"},	CODE
LOW⚡	provisioner/terraform/tfparse/tfparse_test.go	446	"region" = try(split(".", var.region)[1], "placeholder")	CODE
LOW⚡	provisioner/terraform/tfparse/tfparse_test.go	447	"az" = try(split(".", data.coder_parameter.az.value)[1], "placeholder")	CODE
LOW⚡	provisioner/terraform/tfparse/tfparse_test.go	451	expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "placeholder", "az": "plac	CODE
LOW	provisioner/terraform/tfparse/tfparse_test.go	482	"region" = try(split(".", var.region)[1], "placeholder")	CODE
LOW	provisioner/terraform/tfparse/tfparse_test.go	483	"az" = try(split(".", data.coder_parameter.az.value)[1], "placeholder")	CODE
LOW	coderd/templates_test.go	1006	Description: new("lorem ipsum dolor sit amet et cetera"),	CODE
LOW	coderd/templates_test.go	1006	Description: new("lorem ipsum dolor sit amet et cetera"),	CODE
LOW	coderd/userauth_test.go	2549	"email": "user@example.com",	CODE
36 more matches not shown…

Hyper-Verbose Identifiers97 hits · 97 pts

Severity	File	Line	Snippet	Context
LOW	site/e2e/helpers.ts	64	export function requireTerraformProvisioner() {	CODE
LOW	site/e2e/tests/deployment/security.spec.ts	38	async function verifyStrictTransportSecurity(	CODE
LOW	site/src/serviceWorker.ts	68	async function handlePushSubscriptionChange(	CODE
LOW	site/src/serviceWorker.test.ts	255	function makeNotificationClickEvent(url?: string) {	CODE
LOW	site/src/serviceWorker.test.ts	336	function makePushSubscriptionChangeEvent(	CODE
LOW	site/src/testHelpers/handlers.ts	466	function userSecretFromCreateRequest(	CODE
LOW	site/src/testHelpers/handlers.ts	482	function userSecretFromUpdateRequest(	CODE
LOW	site/src/testHelpers/websockets.ts	170	export function mockDynamicParameterWebSocket(): readonly [	CODE
LOW	site/src/testHelpers/renderHelpers.tsx	118	export function renderWithTemplateSettingsLayout(	CODE
LOW	site/src/testHelpers/renderHelpers.tsx	155	export function renderWithWorkspaceSettingsLayout(	CODE
LOW	site/src/testHelpers/renderHelpers.tsx	192	export function renderWithOrganizationSettingsLayout(	CODE
LOW	site/src/utils/currency.ts	45	export function isPositiveFiniteDollarAmount(dollars: string): boolean {	CODE
LOW	site/src/utils/staleChunkReload.ts	33	export function isStaleChunkReloadPending(): boolean {	CODE
LOW	site/src/utils/time.ts	155	export function relativeTimeWithoutSuffix(date: DateTimeInput) {	CODE
LOW	…e/src/components/Autocomplete/Autocomplete.stories.tsx	404	render: function WithCustomRenderOptionStory() {	CODE
LOW	site/src/components/Markdown/Markdown.tsx	161	function parseChildrenAsAlertContent(	CODE
LOW	site/src/components/Chart/Chart.tsx	353	function getPayloadConfigFromPayload(	CODE
LOW	…c/components/LinearProgress/LinearProgress.stories.tsx	60	render: function ControlledDeterminateRender() {	CODE
LOW	site/src/theme/externalImages.ts	110	export function getExternalImageStylesFromUrl(	CODE
LOW	site/src/api/chatModelOptions.ts	137	export function isFieldVisibleForProvider(	CODE
LOW	site/src/api/api.ts	301	function normalizeGetTemplatesOptions(	CODE
LOW	site/src/api/api.ts	4349	function getConfiguredAxiosInstance(): AxiosInstance {	CODE
LOW	site/src/api/queries/workspaces.ts	302	export async function invalidateWorkspaceMutationQueries(	CODE
LOW	site/src/api/queries/workspaceBuilds.ts	16	export function workspaceBuildParametersKey(workspaceBuildId: string) {	CODE
LOW	site/src/api/queries/groups.ts	108	export function paginatedGroupsByOrganization(	CODE
LOW	site/src/api/queries/groups.ts	239	export function groupsByUserIdInOrganization(organization: string) {	CODE
LOW	site/src/modules/workspaces/activity.ts	11	export function getWorkspaceActivityStatus(	CODE
LOW	site/src/modules/workspaces/health.ts	70	export function getAgentConnectivityIssues(	CODE
LOW	…/workspaces/DynamicParameter/DynamicParameter.test.tsx	546	function ParameterWithExternalUpdate() {	CODE
LOW	site/src/modules/apps/workspaceApps.ts	23	export function findWorkspaceAppWithAgent(	CODE
LOW	site/src/modules/notifications/utils.tsx	52	export function selectDisabledPreferences(data: NotificationPreference[]) {	CODE
LOW	…dules/notifications/NotificationsInbox/InboxAvatar.tsx	49	function isInboxNotificationFallbackIcon(	CODE
LOW	site/src/pages/AuditPage/AuditPageView.stories.tsx	138	render: function AuditPageViewWithResourceTypeMenu(args) {	CODE
LOW	…uditLogRow/AuditLogDescription/AuditLogDescription.tsx	67	function AppSessionAuditLogDescription({ auditLog }: AuditLogDescriptionProps) {	CODE
LOW	site/src/pages/AgentsPage/utils/agentWorkspaceUtils.ts	84	export function shouldNavigateAfterArchive(	CODE
LOW	site/src/pages/AgentsPage/utils/agentWorkspaceUtils.ts	120	export async function resolveArchiveAndDeleteAction(	CODE
LOW	site/src/pages/AgentsPage/utils/agentWorkspaceUtils.ts	166	export function fetchArchiveAndDeleteAction(	CODE
LOW	site/src/pages/AgentsPage/utils/agentWorkspaceUtils.ts	203	export function notifyArchiveAndDeleteFailed(	CODE
LOW	site/src/pages/AgentsPage/utils/chatAttachments.ts	42	export async function classifyAttachmentFailureResponse(	CODE
LOW	site/src/pages/AgentsPage/utils/rightPanelTabStorage.ts	11	export function getPersistedRightPanelTabs(	CODE
LOW	site/src/pages/AgentsPage/utils/rightPanelTabStorage.ts	32	export function savePersistedRightPanelTabs(	CODE
LOW	site/src/pages/AgentsPage/utils/rightPanelTabStorage.ts	49	export function getPersistedVisibleSingletonTabs(	CODE
LOW	site/src/pages/AgentsPage/utils/rightPanelTabStorage.ts	73	export function savePersistedVisibleSingletonTabs(	CODE
LOW	site/src/pages/AgentsPage/utils/rightPanelTabStorage.ts	85	export function getPersistedDefaultTerminalHidden(chatID: string): boolean {	CODE
LOW	site/src/pages/AgentsPage/utils/rightPanelTabStorage.ts	93	export function savePersistedDefaultTerminalHidden(	CODE
LOW	site/src/pages/AgentsPage/utils/rightPanelTabStorage.ts	105	export function clearPersistedRightPanelState(chatID: string): void {	CODE
LOW	site/src/pages/AgentsPage/utils/fetchTextAttachment.ts	17	export function formatTextAttachmentPreview(	CODE
LOW	site/src/pages/AgentsPage/utils/fetchTextAttachment.ts	31	export function decodeInlineTextAttachment(content: string): string {	CODE
LOW	site/src/pages/AgentsPage/utils/fetchTextAttachment.ts	45	export function encodeInlineTextAttachment(text: string): string {	CODE
LOW	site/src/pages/AgentsPage/utils/fetchTextAttachment.ts	50	export function getTextAttachmentErrorMessage(error: unknown): string \| null {	CODE
LOW	site/src/pages/AgentsPage/utils/fetchTextAttachment.ts	66	export async function fetchTextAttachmentContent(	CODE
LOW	site/src/pages/AgentsPage/utils/sidebarTabStorage.ts	9	export function savePersistedSidebarTabId(chatID: string, tabID: string): void {	CODE
LOW	site/src/pages/AgentsPage/utils/sidebarTabStorage.ts	16	export function clearPersistedSidebarTabId(chatID: string): void {	CODE
LOW	…e/src/pages/AgentsPage/utils/projectsSectionStorage.ts	2	export function projectsSectionCollapsedStorageKey(userId: string): string {	CODE
LOW	…e/src/pages/AgentsPage/utils/projectsSectionStorage.ts	7	export function getPersistedProjectsSectionExpanded(userId: string): boolean {	CODE
LOW	…e/src/pages/AgentsPage/utils/projectsSectionStorage.ts	22	export function savePersistedProjectsSectionExpanded(	CODE
LOW	site/src/pages/AgentsPage/utils/draftStorage.ts	18	export function getPersistedDraftInputValue(	CODE
LOW	site/src/pages/AgentsPage/utils/rightPanelTabs.ts	27	export function isSingletonRightPanelTabId(	CODE
LOW	site/src/pages/AgentsPage/utils/rightPanelTabs.ts	120	export function validateUserRightPanelTabs(	CODE
LOW	…pages/AgentsPage/components/UsageIndicator.stories.tsx	50	const withUnavailableWorkspaceCount = function WithUnavailableWorkspaceCount(	CODE
37 more matches not shown…

AI Slop Vocabulary19 hits · 53 pts

Severity	File	Line	Snippet	Context
MEDIUM	agent/agentcontainers/api.go	652	// We utilize a TickerFunc here instead of a regular Ticker so that	COMMENT
MEDIUM	provisioner/terraform/provision.go	154	// Essentially some of the modules were not archived because they were too large.	COMMENT
MEDIUM	coderd/database/generate.sh	18	# Dump the updated schema (use make to utilize caching).	COMMENT
MEDIUM	coderd/database/dbauthz/setup_test.go	500	// to assert the more nuanced RBAC checks.	COMMENT
MEDIUM	coderd/rbac/roles.go	373	// Essentially we did not foresee different deployments needing slightly	COMMENT
MEDIUM	coderd/rbac/authz.go	328	// caching. To utilize the caching, the context passed to Authorize() must be	COMMENT
MEDIUM	coderd/coderdtest/oidctest/idp.go	774	// Essentially this is used to fake the Coderd side of the exchange.	COMMENT
MEDIUM	coderd/templatebuilder/render.go	141	// one agent. Reading count/for_each from each block body is robust to nested	COMMENT
MEDIUM	coderd/wsbuilder/wsbuilder.go	380	// In order to utilize this cache, the functions that compute build attributes use a pointer receiver type.	COMMENT
MEDIUM⚡	examples/examples.gen.json	199	"markdown": "\n# Remote Development on Kubernetes Pods (with Devcontainers)\n\nProvision Devcontainers as [Coder works	CODE
MEDIUM⚡	examples/examples.gen.json	199	"markdown": "\n# Remote Development on Kubernetes Pods (with Devcontainers)\n\nProvision Devcontainers as [Coder works	CODE
LOW	examples/templates/gcp-devcontainer/main.tf	140	# If we have a cached image, use the cached image's environment variables. Otherwise, just use	COMMENT
LOW	examples/templates/aws-devcontainer/main.tf	229	# Otherwise, just use the environment variables we've defined in locals.	COMMENT
MEDIUM	scripts/harbor-coder/install.sh	17	# The harness itself is local source, so it has no hash; install it without	COMMENT
MEDIUM	.github/workflows/eval-coder-agents.yaml	138	# The harness always comes from the candidate so both arms run the same code.	COMMENT
MEDIUM	site/pnpm-lock.yaml	5986	resolution: {integrity: sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lU	CODE
MEDIUM	site/src/contexts/useProxyLatency.ts	36	// way to utilize them, we will ignore them for all practical purposes.	COMMENT
MEDIUM	site/src/pages/WorkspacePage/useResourcesNav.ts	13	// robust implementation.	COMMENT
MEDIUM	aibridge/intercept/responses/injected_tools.go	216	// The conversion uses the openai-go library's ToParam() methods where available, which leverage	COMMENT

Self-Referential Comments14 hits · 42 pts

Severity	File	Line	Snippet	Context
MEDIUM	…ioner/terraform/testdata/resources/.terraform.lock.hcl	1	# This file is maintained automatically by "terraform init".	COMMENT
MEDIUM	examples/lima/coder-docker.yaml	96	# Create an initial template	COMMENT
MEDIUM	examples/lima/coder-incus.yaml	108	# Create an initial Incus template	COMMENT
MEDIUM	examples/templates/gcp-devcontainer/main.tf	196	# Create a persistent disk to store the workspace data.	COMMENT
MEDIUM	examples/templates/gcp-devcontainer/main.tf	222	# Create a VM where the workspace will run.	COMMENT
MEDIUM	examples/templates/gcp-devcontainer/main.tf	254	# Create a Coder agent to manage the workspace.	COMMENT
MEDIUM	scripts/harbor-coder/harbor_coder/bootstrap.py	129	# Creating a model only becomes the default when it is the first one;	COMMENT
MEDIUM	scripts/harbor-coder/template/.terraform.lock.hcl	1	# This file is maintained automatically by "terraform init".	COMMENT
MEDIUM	scripts/ironbank/build_ironbank.sh	58	# Create a coder.tar.gz file.	COMMENT
MEDIUM	.github/workflows/backport.yaml	191	# Create the backport branch from the target release branch.	COMMENT
MEDIUM	.github/workflows/backport.yaml	254	# Create the PR first, then attach label/assignee/reviewer	COMMENT
MEDIUM	.github/workflows/cherry-pick.yaml	102	# Create the backport branch from the target release branch.	COMMENT
MEDIUM	.github/workflows/pr-deploy.yaml	465	# Create a user for the github.actor	COMMENT
MEDIUM	helm/artifacthub-repo.yml	1	# This file is uploaded to GCS at helm.coder.com/v2/artifacthub-repo.yml and	COMMENT

Slop Phrases15 hits · 35 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/examples.gen.json	16	"markdown": "\n# Remote Development on AWS EC2 VMs using a Devcontainer\n\nProvision AWS EC2 VMs as [Coder workspaces]	CODE
MEDIUM	examples/examples.gen.json	108	"markdown": "\n# Remote Development on Docker Containers (with Envbuilder)\n\nProvision Envbuilder containers based on	CODE
MEDIUM	examples/examples.gen.json	122	"markdown": "\n# Remote Development in a Devcontainer on Google Compute Engine\n\n![Architecture Diagram](./architectu	CODE
MEDIUM⚡	examples/examples.gen.json	199	"markdown": "\n# Remote Development on Kubernetes Pods (with Devcontainers)\n\nProvision Devcontainers as [Coder works	CODE
MEDIUM	examples/templates/docker/main.tf	60	# For basic resources, you can use the `coder stat` command.	COMMENT
MEDIUM	examples/templates/docker-devcontainer/main.tf	90	# For basic resources, you can use the `coder stat` command.	COMMENT
MEDIUM	examples/templates/docker-envbuilder/main.tf	261	# For basic resources, you can use the `coder stat` command.	COMMENT
LOW	examples/templates/gcp-devcontainer/main.tf	151	# NOTE: make sure to test changes by uncommenting the local_file resource at the bottom of this file	COMMENT
MEDIUM	examples/templates/kubernetes-devcontainer/main.tf	353	# For basic resources, you can use the `coder stat` command.	COMMENT
MEDIUM	examples/templates/kubernetes/main.tf	123	# For basic resources, you can use the `coder stat` command.	COMMENT
LOW	scripts/rules.go	15	// Note: don't forget to run `golangci-lint cache clean`!	COMMENT
MEDIUM	.github/pr-deployments/template/main.tf	106	# For basic resources, you can use the `coder stat` command.	COMMENT
LOW	.github/workflows/ci.yaml	552	# make sure to adjust NUM_PARALLEL_PACKAGES and NUM_PARALLEL_TESTS below	COMMENT
LOW	.github/workflows/nightly-gauntlet.yaml	15	# make sure to adjust NUM_PARALLEL_PACKAGES and NUM_PARALLEL_TESTS below	COMMENT
MEDIUM	…ules/templates/TemplateFiles/TemplateFiles.stories.tsx	11	'terraform {\n required_providers {\n coder = {\n source = "coder/coder"\n }\n docker = {\n source	CODE

Redundant / Tautological Comments19 hits · 28 pts

Severity	File	Line	Snippet	Context
LOW	install.sh	569	# Check if the unzip package is installed. If not error peacefully.	COMMENT
LOW	.claude/scripts/format.sh	75	# Check if canonicalization failed or if the resolved path is outside the repo	COMMENT
LOW	.claude/scripts/format.sh	95	# Check if file exists	COMMENT
LOW	.devcontainer/filebrowser/install.sh	9	# Check if filebrowser is installed.	COMMENT
LOW	.devcontainer/filebrowser/install.sh	35	# Check if filebrowser db exists.	COMMENT
LOW	examples/jfrog/docker/main.tf	100	# Set GOPROXY to use the Artifactory "go" repository.	COMMENT
LOW	scripts/update-release-calendar.sh	29	# Check if a minor version is a known active ESR version.	COMMENT
LOW	scripts/update-release-calendar.sh	220	# Check if the markdown comments exist in the file	COMMENT
LOW	scripts/pnpm_install.sh	16	# Check if existing node_modules are valid	COMMENT
LOW	scripts/check_site_icons.sh	35	# Check if the file is in the exception list	COMMENT
LOW	scripts/docker-dev/setup-multi-org.sh	19	# Check if a license has not yet been added	COMMENT
LOW	scripts/docker-dev/setup-template.sh	27	# Check if template already exists in this org.	COMMENT
LOW	scripts/oauth2/test-manual-flow.sh	27	# Check if app credentials are set	COMMENT
LOW	scripts/oauth2/test-manual-flow.sh	34	# Check if Go is installed	COMMENT
LOW	scripts/release/check_commit_metadata.sh	109	# Iterate over the array in groups of two	COMMENT
LOW	scripts/release/check_commit_metadata.sh	252	# Check if this is a potential cherry-pick.	COMMENT
LOW	.github/workflows/cherry-pick.yaml	93	# Check if backport branch already exists (idempotency for re-runs).	COMMENT
LOW	.github/workflows/cherry-pick.yaml	150	# Check if a PR already exists for this branch (idempotency	COMMENT
LOW	.github/workflows/release.yaml	755	# Check if a PR already exists.	COMMENT

Synthetic Comment Markers4 hits · 22 pts

Severity	File	Line	Snippet	Context
HIGH	CONTRIBUTING.md	380	are followed. If most of your PR was generated by AI, please read and comply with these rules before submitting.	CODE
HIGH	contributing/AI_CONTRIBUTING.md	3	This document defines rules for contributions where an AI system is the primary author of the code (i.e., most of the pu	CODE
HIGH	docs/.style/style-guide/formatting.md	206	The auto-generated Coder CLI reference under `docs/reference/cli/` labels its command-usage blocks `console`.	CODE
HIGH	codersdk/deployment.go	3371	// Change the env from the auto-generated CODER_RATE_LIMIT_API to the	COMMENT

Magic Placeholder Names2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	docs/admin/integrations/platformx.md	48	\| `GETDX_API_KEY` \| API key for PlatformX \| `your-api-key` \|	CODE
HIGH	docs/admin/users/oidc-auth/index.md	136	CODER_SCIM_AUTH_HEADER="your-api-key"	CODE

TODO Padding5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	enterprise/coderd/prebuilds/reconcile.go	245	// TODO: implement pubsub listener to allow reconciling a specific template imperatively once it has been changed,	COMMENT
LOW	enterprise/coderd/prebuilds/reconcile.go	569	// TODO: implement template-specific reconciliations later	COMMENT
LOW	cli/exp_scaletest.go	819	// TODO: implement this flag	COMMENT
LOW	coderd/notifications/dispatch/smtp.go	52	// TODO: implement DKIM/SPF/DMARC? https://github.com/emersion/go-msgauth	COMMENT
LOW⚡	aibridge/intercept/responses/injected_tools.go	68	// TODO: implement parallel tool calls.	COMMENT

Example Usage Blocks5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	enterprise/audit/generate.sh	8	# Usage:	COMMENT
LOW	cli/cliui/filter.go	12	// Example usage:	COMMENT
LOW	scripts/rbac-authz/benchmark_authz.sh	12	# Usage:	COMMENT
LOW	.github/workflows/backport.yaml	12	# Usage:	COMMENT
LOW	.github/workflows/cherry-pick.yaml	5	# Usage:	COMMENT

Unused Imports5 hits · 5 pts

Severity	File	Line	Context
LOW	scripts/harbor-coder/harbor_coder/bootstrap.py	10	CODE
LOW	scripts/harbor-coder/harbor_coder/client.py	9	CODE
LOW	scripts/harbor-coder/harbor_coder/agent.py	8	CODE
LOW	scripts/harbor-coder/harbor_coder/environment.py	12	CODE
LOW	scripts/harbor-coder/harbor_coder/compare.py	10	CODE

Cross-Language Confusion1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	scripts/harbor-coder/harbor_coder/environment.py	40	RUN chmod 0755 /usr/local/bin/coder && mkdir -p /logs /tests && chmod 0777 /logs /tests	CODE

Excessive Try-Catch Wrapping1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	scripts/harbor-coder/harbor_coder/bootstrap.py	69	except Exception as e: # noqa: BLE001	CODE

Deep Nesting1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	scripts/harbor-coder/harbor_coder/client.py	81		CODE

coder/coder

Open-Source Code Quality, Security and Technical Debt Review