Home / decolua / 9router
AI Slop Code RIsk Monitor

decolua/9router

Unlimited FREE AI coding. Connect Claude Code, Codex, Cursor, Cline, Copilot, Antigravity to FREE Claude/GPT/Gemini via 40+ providers. Auto-fallback, RTK -40% tokens, never hit limits.

7.3 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for decolua/9router, a JavaScript project with 30,578 GitHub stars. SynthScan examined 281,331 lines of code across 1555 source files, recording 778 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 7.3 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

7.3
Adjusted Signal
7.3
Raw Pattern Score
100%
Time Factor
2026-10-08
Last Push
30.6K
Stars
JavaScript
Language
281.3K
Lines of Code
1.6K
Files
778
Pattern Hits
2026-10-12
Scan Date
0.11
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 8.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 391 finding(s).

Hallucinated Dependency & Supply Chain Risk 15.6/100 · LOW

Are imports declared and package/API names verified? 189 finding(s).

Agent Over-Engineering Ratio 14.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 438 finding(s).

PR Review Velocity Impact 30.8/100 · MEDIUM

Which changes need focused human review? 778 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 176MEDIUM 204LOW 397

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 778 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Magic Placeholder Names176 hits · 930 pts
SeverityFileLineSnippetContext
HIGHREADME.md1480Authorization: Bearer your-api-keyCODE
HIGHREADME.md1496Authorization: Bearer your-api-keyCODE
HIGHREADME.zh-CN.md1246Authorization: Bearer your-api-keyCODE
HIGHREADME.zh-CN.md1262Authorization: Bearer your-api-keyCODE
HIGHgitbook/content/vi/troubleshooting.md247 -H "Authorization: Bearer your-api-key"CODE
HIGHgitbook/content/vi/integration/other-tools.md21API Key: your-api-key-from-dashboardCODE
HIGHgitbook/content/vi/integration/other-tools.md28API Key: your-api-key-from-dashboardCODE
HIGHgitbook/content/vi/integration/other-tools.md55 api_key="your-api-key-from-dashboard",CODE
HIGHgitbook/content/vi/integration/other-tools.md75 apiKey: "your-api-key-from-dashboard",CODE
HIGHgitbook/content/vi/integration/other-tools.md94 -H "Authorization: Bearer your-api-key-from-dashboard" \CODE
HIGHgitbook/content/vi/integration/other-tools.md113Authorization: Bearer your-api-key-from-dashboardCODE
HIGHgitbook/content/vi/integration/other-tools.md136 openai_api_key="your-api-key-from-dashboard",CODE
HIGHgitbook/content/vi/integration/other-tools.md153 api_key="your-api-key-from-dashboard",CODE
HIGHgitbook/content/vi/integration/other-tools.md169openai.api_key = "your-api-key-from-dashboard"CODE
HIGHgitbook/content/vi/integration/other-tools.md201 apiKey: "your-api-key-from-dashboard",CODE
HIGHgitbook/content/vi/integration/other-tools.md227 api_key="your-api-key-from-dashboard",CODE
HIGHgitbook/content/vi/integration/other-tools.md256ROUTER_API_KEY=your-api-key-from-dashboardCODE
HIGHgitbook/content/vi/integration/other-tools.md277 api_key="your-api-key",CODE
HIGHgitbook/content/vi/integration/other-tools.md298 api_key="your-api-key",CODE
HIGHgitbook/content/vi/integration/other-tools.md344- Kiểm tra format header Authorization: `Bearer your-api-key`CODE
HIGHgitbook/content/vi/integration/continue.md33 "apiKey": "your-api-key-from-dashboard",CODE
HIGH⚡gitbook/content/vi/integration/continue.md48 "apiKey": "your-api-key-from-dashboard",CODE
HIGH⚡gitbook/content/vi/integration/continue.md55 "apiKey": "your-api-key-from-dashboard",CODE
HIGH⚡gitbook/content/vi/integration/continue.md62 "apiKey": "your-api-key-from-dashboard",CODE
HIGH⚡gitbook/content/vi/integration/continue.md69 "apiKey": "your-api-key-from-dashboard",CODE
HIGHgitbook/content/vi/integration/continue.md145 "apiKey": "your-api-key",CODE
HIGHgitbook/content/vi/integration/continue.md164 "apiKey": "your-api-key",CODE
HIGHgitbook/content/vi/integration/roo.md26API Key: your-api-key-from-dashboardCODE
HIGHgitbook/content/vi/integration/roo.md32API Key: your-api-key-from-dashboardCODE
HIGHgitbook/content/vi/providers/cheap.md55API Key: zhipu-your-api-key-hereCODE
HIGHgitbook/content/vi/features/quota-tracking.md565Authorization: Bearer your-api-keyCODE
HIGHgitbook/content/vi/features/quota-tracking.md618Authorization: Bearer your-api-keyCODE
HIGHgitbook/content/vi/features/combos.md384 -H "Authorization: Bearer your-api-key" \CODE
HIGHgitbook/content/vi/getting-started/installation.md150 -H "Authorization: Bearer your-api-key"CODE
HIGHgitbook/content/vi/getting-started/installation.md172 -H "Authorization: Bearer your-api-key" \CODE
HIGHgitbook/content/ja/troubleshooting.md247 -H "Authorization: Bearer your-api-key"CODE
HIGHgitbook/content/ja/integration/other-tools.md21API Key: your-api-key-from-dashboardCODE
HIGHgitbook/content/ja/integration/other-tools.md28API Key: your-api-key-from-dashboardCODE
HIGHgitbook/content/ja/integration/other-tools.md55 api_key="your-api-key-from-dashboard",CODE
HIGHgitbook/content/ja/integration/other-tools.md75 apiKey: "your-api-key-from-dashboard",CODE
HIGHgitbook/content/ja/integration/other-tools.md94 -H "Authorization: Bearer your-api-key-from-dashboard" \CODE
HIGHgitbook/content/ja/integration/other-tools.md113Authorization: Bearer your-api-key-from-dashboardCODE
HIGHgitbook/content/ja/integration/other-tools.md136 openai_api_key="your-api-key-from-dashboard",CODE
HIGHgitbook/content/ja/integration/other-tools.md153 api_key="your-api-key-from-dashboard",CODE
HIGHgitbook/content/ja/integration/other-tools.md169openai.api_key = "your-api-key-from-dashboard"CODE
HIGHgitbook/content/ja/integration/other-tools.md201 apiKey: "your-api-key-from-dashboard",CODE
HIGHgitbook/content/ja/integration/other-tools.md227 api_key="your-api-key-from-dashboard",CODE
HIGHgitbook/content/ja/integration/other-tools.md256ROUTER_API_KEY=your-api-key-from-dashboardCODE
HIGHgitbook/content/ja/integration/other-tools.md277 api_key="your-api-key",CODE
HIGHgitbook/content/ja/integration/other-tools.md298 api_key="your-api-key",CODE
HIGHgitbook/content/ja/integration/continue.md33 "apiKey": "your-api-key-from-dashboard",CODE
HIGH⚡gitbook/content/ja/integration/continue.md48 "apiKey": "your-api-key-from-dashboard",CODE
HIGH⚡gitbook/content/ja/integration/continue.md55 "apiKey": "your-api-key-from-dashboard",CODE
HIGH⚡gitbook/content/ja/integration/continue.md62 "apiKey": "your-api-key-from-dashboard",CODE
HIGH⚡gitbook/content/ja/integration/continue.md69 "apiKey": "your-api-key-from-dashboard",CODE
HIGHgitbook/content/ja/integration/continue.md145 "apiKey": "your-api-key",CODE
HIGHgitbook/content/ja/integration/continue.md164 "apiKey": "your-api-key",CODE
HIGHgitbook/content/ja/integration/roo.md26API Key: your-api-key-from-dashboardCODE
HIGHgitbook/content/ja/integration/roo.md32API Key: your-api-key-from-dashboardCODE
HIGHgitbook/content/ja/providers/cheap.md55API Key: zhipu-your-api-key-hereCODE
116 more matches not shown…
Decorative Section Separators193 hits · 615 pts
SeverityFileLineSnippetContext
MEDIUMopen-sse/config/ttsModels.js3// ── Voice definitions (DRY — reused across providers) ──────────────────────COMMENT
MEDIUMopen-sse/config/ttsModels.js51// ── TTS Config (config-driven, single source of truth) ─────────────────────COMMENT
MEDIUMopen-sse/config/ttsModels.js135// ── Helper: get voices for a specific model ────────────────────────────────COMMENT
MEDIUMopen-sse/config/ttsModels.js142// ── Build flat entries for PROVIDER_MODELS backward compat ─────────────────COMMENT
MEDIUM⚡open-sse/providers/REGISTRY_TEMPLATE.js17 // ── identity ────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/providers/REGISTRY_TEMPLATE.js24 // ── auth hints (only when relevant) ──────────────────────────────────────COMMENT
MEDIUM⚡open-sse/providers/REGISTRY_TEMPLATE.js30 // ── UI display ───────────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/providers/REGISTRY_TEMPLATE.js43 // ── transport (HTTP runtime) → PROVIDERS[id] ─────────────────────────────COMMENT
MEDIUMopen-sse/providers/REGISTRY_TEMPLATE.js60 // ── oauth flow → PROVIDER_OAUTH[id] (omit for pure API-key) ───────────────COMMENT
MEDIUMopen-sse/providers/REGISTRY_TEMPLATE.js76 // ── media (non-LLM services) → PROVIDER_MEDIA[id] ────────────────────────COMMENT
MEDIUMopen-sse/providers/REGISTRY_TEMPLATE.js87 // ── models (omit = no key; [] = explicit empty) ──────────────────────────COMMENT
MEDIUMopen-sse/providers/REGISTRY_TEMPLATE.js94 // ── optional flags ───────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/providers/capabilities.js22// ── HOW TO ADD / UPDATE A MODEL ──────────────────────────────────────COMMENT
MEDIUMopen-sse/providers/capabilities.js340 // ── Claude (4.6+ = adaptive thinking; older/haiku = budget) ──────COMMENT
MEDIUMopen-sse/providers/capabilities.js368 // ── OpenAI GPT-6.x (vision + thinking + web search) ──────────────COMMENT
MEDIUMopen-sse/providers/capabilities.js377 // ── OpenAI GPT-5.x (vision + thinking + web search) ──────────────COMMENT
MEDIUMopen-sse/providers/capabilities.js395 // ── OpenAI o-series (reasoning, vision) ──────────────────────────COMMENT
MEDIUMopen-sse/providers/capabilities.js401 // ── Grok (vision + Live Search) ──────────────────────────────────COMMENT
MEDIUMopen-sse/providers/capabilities.js425 // ── Kimi (enabled→reasoning_effort; K2.7-code cannot disable) ─────COMMENT
MEDIUMopen-sse/providers/capabilities.js463 // ── MiniMax (M3 = adaptive; M2.x cannot disable) ─────────────────COMMENT
MEDIUM⚡open-sse/providers/capabilities.js476 // ── Llama (4 = vision/1M; 3.x = text-only/128K) ──────────────────COMMENT
MEDIUM⚡open-sse/providers/capabilities.js480 // ── Mistral (Large 3 = vision/256K; codestral text) ──────────────COMMENT
MEDIUM⚡open-sse/providers/capabilities.js485 // ── Cohere (Command A Vision = vision; others text) ──────────────COMMENT
MEDIUM⚡open-sse/providers/capabilities.js489 // ── Perplexity (web search native) ───────────────────────────────COMMENT
MEDIUMopen-sse/providers/capabilities.js504 // ── Others ───────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/utils/proxyFetch.js8// ─── TLS fingerprinting via got-scraping (browser-like JA3) ───────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js28// ─── Binary discovery ────────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js66// ─── ACP JSON-RPC helper ────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js74// ─── Client-tools → MCP bridge ───────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js250// ─── Multi-turn message → single prompt builder ─────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js303// ─── DevinCliExecutor ─────────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js453 // ── JSON-RPC state machine ──────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js597 // ── stdout reader (NDJSON) ──────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js616 // ── Initialize response ───────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js631 // ── session/new response → get sessionId ──────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js650 // ── session/prompt response (ack / final result) ────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js708 // ── Streaming notifications (session/update) ──────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js765 // ── Error responses ───────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js789 // ── Send initialize ───────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/devin-cli.js825// ─── Helpers ─────────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js25// ─── Model alias map (catalog name → Windsurf wire name) ─────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js27 // ── Cognition SWE ───────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js32 // ── Claude Opus 4.7 — effort-tiered ─────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js39 // ── Claude Opus/Sonnet 4.6 ──────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js46 // ── Claude 4.5 ──────────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js52 // ── GPT-5.5 ─────────────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/windsurf.js65 // ── GPT-5.4 ─────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js81 // ── GPT-5.3-Codex ───────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js91 // ── GPT-5.2 ─────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js98 // ── GPT-5 ───────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js100 // ── GPT-4.1 / 4o ────────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js104 // ── Gemini ──────────────────────────────────────────────────────────────COMMENT
MEDIUM⚡open-sse/executors/windsurf.js114 // ── Others ──────────────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/windsurf.js125// ─── Minimal protobuf encoder ────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/windsurf.js167// ─── Protobuf message builders ───────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/windsurf.js207// ─── gRPC-web framing ────────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/windsurf.js218// ─── Protobuf response decoder ───────────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/windsurf.js350// ─── OpenAI messages → Windsurf wire ─────────────────────────────────────────COMMENT
MEDIUMopen-sse/executors/windsurf.js371// ─── WindsurfExecutor ────────────────────────────────────────────────────────COMMENT
MEDIUMopen-sse/handlers/ttsCore.js14// ── Response Formatter (DRY) ───────────────────────────────────COMMENT
133 more matches not shown…
Hyper-Verbose Identifiers240 hits · 246 pts
SeverityFileLineSnippetContext
LOWcustom-server.js18function startBackgroundTokenRefreshFromCustomServer() {CODE
LOWopen-sse/config/kiroConstants.js63export function applyKiroThinkingOverride(body, override) {CODE
LOWopen-sse/config/kiroConstants.js147export function resolveKiroThinkingBudget(body, headers, model) {CODE
LOWopen-sse/config/kiroConstants.js203function extractKiroGptEffortLevel(body) {CODE
LOWopen-sse/config/kiroConstants.js218export function buildKiroAdditionalModelRequestFields(body, effortPath = "output_config", model) {CODE
LOWopen-sse/config/kiroConstants.js253export function supportsKiroAdditionalModelRequestFields(model) {CODE
LOWopen-sse/config/kiroConstants.js262export function buildKiroAdditionalModelRequestFieldsForModel(body, model) {CODE
LOWopen-sse/config/kiroConstants.js368export function buildThinkingSystemPrefix(budget = KIRO_THINKING_BUDGET_DEFAULT) {CODE
LOWopen-sse/config/providers.js16export function resolveXiaomiTokenplanBaseUrl(credentials) {CODE
LOWopen-sse/config/grokCli.js10export function supportsGrokCliReasoningEffort(model) {CODE
LOWopen-sse/transformer/responsesTransformer.js54export function createResponsesApiTransformStream(logger = null) {CODE
LOWopen-sse/transformer/streamToJsonConverter.js49export async function convertResponsesStreamToJson(stream) {CODE
LOWopen-sse/providers/capabilities.js80export function capabilitiesFromServiceKind(kind) {CODE
LOWopen-sse/providers/capabilities.js531export function aggregateComboCapabilities(comboModels, comboLookup = null, resolveCaps = null, _depth = 0) {CODE
LOWopen-sse/utils/streamHandler.js102export function createDisconnectAwareStream(transformStream, streamController, onAbortTerminal = null) {CODE
LOWopen-sse/utils/opencodeFingerprint.js44export function concealFingerprintToolNames(tools) {CODE
LOWopen-sse/utils/opencodeFingerprint.js82export function appendMissingFingerprintTools(tools, flat) {CODE
LOWopen-sse/utils/claudeCloaking.js33export function extractClaudeSessionIdFromUserId(userId) {CODE
LOWopen-sse/utils/codexToolSchema.js78export function stripCodexUnsupportedPatterns(schema, stats = { removed: 0 }) {CODE
LOWopen-sse/utils/stream.js538export function createSSETransformStreamWithLogger(targetFormat, sourceFormat, provider = null, reqLogger = null, toolNaCODE
LOWopen-sse/utils/stream.js556export function createPassthroughStreamWithLogger(provider = null, reqLogger = null, model = null, connectionId = null, CODE
LOWopen-sse/utils/bypassHandler.js128function createNonStreamingResponse(sourceFormat, model, text) {CODE
LOWopen-sse/utils/bypassHandler.js279function createOpenAIStreamingChunks(completeResponse) {CODE
LOWopen-sse/utils/cursorProtobuf.js1093export function encodeMcpResultToolNotFound(name) {CODE
LOWopen-sse/utils/proxyFetch.js217function resolveConnectionProxyUrl(targetUrl, proxyOptions) {CODE
LOW⚡open-sse/utils/responsesStreamHelpers.js13export function getOpenAIResponsesEventName(eventName, chunk) {CODE
LOW⚡open-sse/utils/responsesStreamHelpers.js19export function isOpenAIResponsesTerminalEvent(eventName, chunk) {CODE
LOW⚡open-sse/utils/responsesStreamHelpers.js29export function buildAbortedResponsesTerminalBytes() {CODE
LOW⚡open-sse/utils/responsesStreamHelpers.js34export function formatIncompleteOpenAIResponsesStreamFailure() {CODE
LOWopen-sse/utils/sessionManager.js131function extractAntigravitySession(body) {CODE
LOWopen-sse/utils/kiroSessionReplay.js134export function clearKiroSessionReplayStore() {CODE
LOWopen-sse/shared/mimoAccount.js75async function readDesktopAccountCookies() {CODE
LOWopen-sse/shared/mimoAccount.js287export function invalidateMimoAccountCookieCache() {CODE
LOWopen-sse/shared/zedAuth.js60export function encodeZedPrivateKeyVerifier(privateKeyPem) {CODE
LOWopen-sse/shared/zedAuth.js64export function decodeZedPrivateKeyVerifier(verifier) {CODE
LOWopen-sse/shared/zedAuth.js214export async function fetchZedAuthenticatedUser(credentials, options = {}) {CODE
LOWopen-sse/shared/clineAuth.js19export function getClineAuthorizationHeader(token) {CODE
LOWopen-sse/shared/qoder/contextTier.js76export function estimateQoderPromptTokens({ system, messages, tools } = {}) {CODE
LOWopen-sse/shared/qoder/attachments.js67function extractUrlFromUploadResponse(json) {CODE
LOWopen-sse/shared/qoder/attachments.js287export async function rewriteQoderMessageAttachments(messages, {CODE
LOWopen-sse/translator/formats/claude.js203function hasForeignServerToolUseId(block) {CODE
LOWopen-sse/translator/formats/claude.js215export function normalizeClaudePassthrough(body, model = "") {CODE
LOWopen-sse/translator/formats/gemini.js55export function convertOpenAIContentToParts(content) {CODE
LOWopen-sse/translator/formats/gemini.js147function removeUnsupportedKeywords(obj, keywords) {CODE
LOWopen-sse/translator/formats/gemini.js187function convertEnumValuesToStrings(obj) {CODE
LOWopen-sse/translator/formats/gemini.js359export function cleanJSONSchemaForAntigravity(schema) {CODE
LOWopen-sse/translator/formats/gemini.js457export function sanitizeFunctionResponsePayload(value) {CODE
LOWopen-sse/translator/formats/gemini.js468function sanitizeFunctionResponsePart(part) {CODE
LOWopen-sse/translator/formats/responsesApi.js84export function convertResponsesApiFormat(body) {CODE
LOWopen-sse/translator/response/openai-to-antigravity.js9export function openaiToAntigravityResponse(chunk, state) {CODE
LOWopen-sse/translator/response/openai-responses.js50export function openaiToOpenAIResponsesResponse(chunk, state) {CODE
LOWopen-sse/translator/response/openai-responses.js447function recordCompletedOutputItem(state, outputIndex, item) {CODE
LOWopen-sse/translator/response/openai-responses.js453function collectCompletedOutputItems(state) {CODE
LOWopen-sse/translator/response/openai-responses.js510export function openaiResponsesToOpenAIResponse(chunk, state) {CODE
LOWopen-sse/translator/response/commandcode-to-openai.js52export function commandCodeToOpenAIResponse(chunk, state) {CODE
LOWopen-sse/translator/request/claude-to-kiro.js45function convertClaudeMessagesToKiro(messages, model) {CODE
LOWopen-sse/translator/request/openai-to-gemini.js27function sanitizeGeminiFunctionName(name) {CODE
LOWopen-sse/translator/request/openai-to-gemini.js56function createToolCallIdUniquifier() {CODE
LOWopen-sse/translator/request/openai-to-gemini.js377function wrapInCloudCodeEnvelopeForClaude(model, claudeRequest, credentials = null, signature = DEFAULT_THINKING_AG_SIGNCODE
LOWopen-sse/translator/request/openai-to-gemini.js516export function openaiToAntigravityRequest(model, body, stream, credentials = null) {CODE
180 more matches not shown…
Structural Annotation Overuse49 hits · 88 pts
SeverityFileLineSnippetContext
LOW⚡open-sse/translator/index.js109 // Step 1: source -> openai (if source is not openai)COMMENT
LOW⚡open-sse/translator/index.js119 // Step 2: openai -> target (if target is not openai)COMMENT
LOWopen-sse/translator/index.js205 // Step 1: target -> openai (if target is not openai)COMMENT
LOWopen-sse/translator/index.js218 // Step 2: openai -> source (if source is not openai)COMMENT
LOWcli/scripts/build-cli.js158 // Step 0: Sync version from app/cli/package.json to app/package.jsonCOMMENT
LOWcli/scripts/build-cli.js171 // Step 1: Build app with Next.js (workspace tracing root → traced node_modules in standalone).COMMENT
LOW⚡cli/scripts/build-cli.js193 // Step 2: Clean old app/cli/app if existsCOMMENT
LOW⚡cli/scripts/build-cli.js200 // Step 3: Copy Next.js standalone build to app/cli/app.COMMENT
LOWcli/scripts/build-cli.js260 // Step 4: Copy static filesCOMMENT
LOWcli/scripts/build-cli.js272 // Step 5: Copy public folder if existsCOMMENT
LOWcli/scripts/build-cli.js283 // Step 6: Copy vendor-chunks (required for production)COMMENT
LOWcli/scripts/build-cli.js302 // Step 7: Copy MITM server files (not bundled by Next.js standalone)COMMENT
LOWcli/scripts/build-cli.js324 // Step 8: Build MITM server (config driven - see app/cli/scripts/buildMitm.js)COMMENT
LOW⚡cli/src/cli/menus/providers.js580 // Step 1: Request device codeCOMMENT
LOW⚡cli/src/cli/menus/providers.js799 // Step 1: Select typeCOMMENT
LOW⚡cli/src/cli/menus/providers.js809 // Step 2: InputsCOMMENT
LOW⚡cli/src/cli/menus/providers.js819 // Step 3: API type (OpenAI only)COMMENT
LOWcli/src/cli/menus/providers.js482 // Step 1: Get auth URLCOMMENT
LOWcli/src/cli/menus/providers.js504 // Step 2: Show URL and instructionsCOMMENT
LOWcli/src/cli/menus/providers.js527 // Step 3: Parse callback URL and extract codeCOMMENT
LOWcli/src/cli/menus/providers.js553 // Step 4: Exchange code for tokensCOMMENT
LOWcli/src/cli/menus/providers.js604 // Step 2: Show instructionsCOMMENT
LOWcli/src/cli/menus/providers.js621 // Step 3: Poll for tokenCOMMENT
LOW⚡gitbook/content/en/features/combos.md71### Step 1: Open DashboardCOMMENT
LOW⚡gitbook/content/en/features/combos.md78### Step 2: Navigate to CombosCOMMENT
LOW⚡gitbook/content/en/features/combos.md84### Step 3: Configure ComboCOMMENT
LOWgitbook/content/en/features/combos.md105### Step 4: SaveCOMMENT
LOWgitbook/content/en/features/combos.md112### Step 5: Use in CLICOMMENT
LOW⚡gitbook/content/en/deployment/cloud.md16### Step 1: Clone RepositoryCOMMENT
LOW⚡gitbook/content/en/deployment/cloud.md23### Step 2: Install DependenciesCOMMENT
LOW⚡gitbook/content/en/deployment/cloud.md29### Step 3: Build ApplicationCOMMENT
LOW⚡gitbook/content/en/deployment/cloud.md35### Step 4: Configure Environment VariablesCOMMENT
LOW⚡gitbook/content/en/deployment/cloud.md56### Step 5: Create Data DirectoryCOMMENT
LOW⚡gitbook/content/en/deployment/cloud.md63### Step 6: Start ApplicationCOMMENT
LOW⚡gitbook/content/en/deployment/cloud.md69### Step 7: Setup PM2 for ProductionCOMMENT
LOWgitbook/content/en/deployment/cloud.md217### Step 1: Install NginxCOMMENT
LOWgitbook/content/en/deployment/cloud.md224### Step 2: Configure NginxCOMMENT
LOWgitbook/content/en/deployment/cloud.md283### Step 3: Enable SiteCOMMENT
LOWgitbook/content/en/deployment/cloud.md296### Step 4: Setup SSL with Let's EncryptCOMMENT
LOWsrc/app/api/oauth/iflow/cookie/route.js28 // Step 1: GET API key info to get the nameCOMMENT
LOWsrc/app/api/oauth/iflow/cookie/route.js65 // Step 2: POST to refresh API keyCOMMENT
LOWsrc/app/api/cli-tools/cowork-mcp-tools/route.js20 // Step 1: initializeCOMMENT
LOW⚡src/app/api/cli-tools/cowork-mcp-tools/route.js42 // Step 2: notifications/initialized (required by spec before tools/list)COMMENT
LOW⚡src/app/api/cli-tools/cowork-mcp-tools/route.js50 // Step 3: tools/listCOMMENT
LOWsrc/app/(dashboard)/dashboard/translator/page.js67 // Step 1: detect provider/format from model fieldCOMMENT
LOWsrc/mitm/manager.js534 // Step 1: Generate Root CA if missing or expiredCOMMENT
LOWsrc/mitm/manager.js574 // Step 2: Spawn server (Root CA already installed in Step 1.5)COMMENT
LOWsrc/lib/oauth/providers/kiro.js18 // Step 1: Register client with AWS SSO OIDCCOMMENT
LOWsrc/lib/oauth/providers/kiro.js41 // Step 2: Request device authorizationCOMMENT
Over-Commented Block63 hits · 63 pts
SeverityFileLineSnippetContext
LOWopen-sse/config/awsConstants.js21// request cannot be signed with a key that dies mid-stream.COMMENT
LOWopen-sse/config/awsConstants.js41// and a plain `[NAME]` section in ~/.aws/credentials may also contain spaces. `/` is left out:COMMENT
LOWopen-sse/providers/REGISTRY_TEMPLATE.js41 },COMMENT
LOWopen-sse/providers/REGISTRY_TEMPLATE.js61 // oauth: {COMMENT
LOWopen-sse/providers/REGISTRY_TEMPLATE.js81 // embeddingConfig: { baseUrl: "...", authType: "apikey", authHeader: "bearer", models: [{ id: "emb-1", name: "Emb",COMMENT
LOWopen-sse/providers/thinkingLevels.js61 { pattern: "*deepseek-v4.*", levels: ["none", "low", "medium", "high", "xhigh", "max"] },COMMENT
LOWopen-sse/providers/capabilities.js1// Model capabilities — what each model can read/do beyond plain text.COMMENT
LOWopen-sse/providers/capabilities.js21//COMMENT
LOWopen-sse/providers/capabilities.js141 "glm-4.5v": { vision: true, videoInput: true, reasoning: true, thinkingFormat: "zai", contextWindow: 64000, mCOMMENT
LOWopen-sse/providers/capabilities.js261 "glm-5.0": { reasoning: true, thinkingFormat: "openai", contextWindow: 200000, maxOutput: 48000 },COMMENT
LOWopen-sse/providers/capabilities.js301 },COMMENT
LOWopen-sse/providers/registry/selfhosted-tts.js1// Self-hosted, OpenAI-compatible text-to-speech (Kokoro-FastAPI, openedai-speech,COMMENT
LOWopen-sse/providers/registry/zed.js41 },COMMENT
LOWopen-sse/providers/registry/selfhosted-embedding.js1// Self-hosted, OpenAI-compatible embeddings (llama.cpp / llama-server, vLLM,COMMENT
LOWopen-sse/providers/registry/selfhosted-stt.js1// Self-hosted, OpenAI-compatible speech-to-text (whisper.cpp, faster-whisper,COMMENT
LOWopen-sse/providers/registry/codebuddy-cn.js41 // Quota endpoint differs from the chat gateway: POST returns nested TencentCOMMENT
LOWopen-sse/providers/registry/deepseek.js21 category: "apikey",COMMENT
LOWopen-sse/utils/codexToolSchema.js1// Codex-specific tool JSON Schema compatibility.COMMENT
LOWopen-sse/utils/proxyFetch.js381 // If strictProxy is enabled, fail hard instead of falling back to directCOMMENT
LOWopen-sse/utils/streamHelpers.js121 if (sourceFormat === FORMATS.CLAUDE && data && data.type) {COMMENT
LOWopen-sse/utils/requestLogger.js81 // for (const key of Object.keys(masked)) {COMMENT
LOWopen-sse/translator/formats/claude.js501 if (modelCaps.forcedToolChoice === false && (body.tool_choice?.type === "any" || body.tool_choice?.type === "tool")) {COMMENT
LOWopen-sse/translator/request/openai-to-kiro.js321COMMENT
LOWopen-sse/translator/concerns/paramSupport.js1import { getCapabilitiesForModel } from "../../providers/capabilities.js";COMMENT
LOWopen-sse/executors/devin-cli.js401 // inject WINDSURF_API_KEY: this provider is noAuth, and a bogus/leaked keyCOMMENT
LOWopen-sse/executors/trae.js1import { BaseExecutor } from "./base.js";COMMENT
LOWopen-sse/executors/zed.js1// ZedHostedExecutor — routes requests to Zed's hosted LLM aggregatorCOMMENT
LOWopen-sse/executors/kiro.js281 * The Kiro IDE gateway (runtime.*.kiro.dev) expects Kiro OIDC/social tokensCOMMENT
LOWopen-sse/handlers/geminiLiveStt.js1import { Buffer } from "node:buffer";COMMENT
LOWopen-sse/handlers/chatCore.js81COMMENT
LOWopen-sse/handlers/videoProviders/vertex.js1// Vertex AI (Veo) video jobs.COMMENT
LOW…sse/handlers/embeddingProviders/selfhostedEmbedding.js1// Self-hosted embeddings — like openaiCompatNode, but the baseUrl is REQUIRED.COMMENT
LOWopen-sse/handlers/imageProviders/huggingface.js1// HuggingFace Inference Providers router — returns binary imageCOMMENT
LOWopen-sse/handlers/ttsProviders/selfhostedTts.js1// Self-hosted OpenAI-compatible TTS — POST {baseUrl}/v1/audio/speech.COMMENT
LOWopen-sse/handlers/ttsProviders/selfhostedTts.js21 // would 404 with nothing pointing at the cause.COMMENT
LOWtests/unit/claude-thinking-stream-boundaries.test.js1// Thinking/answer boundaries across the OpenAI pivot.COMMENT
LOWtests/unit/strict-proxy-enforcement.test.js1// #4333: "Strict Proxy" did not hold. With a strict pool assigned and everyCOMMENT
LOWtests/unit/cline-free-models-envelope.test.js1// Cline free models (z-ai/glm-5.3-flash, deepseek-v4-flash) wrap non-streamCOMMENT
LOWtests/unit/elevenlabs-stt.test.js1// ElevenLabs Scribe STT transport contract.COMMENT
LOWtests/unit/gemini-live-stt.test.js1// Gemini Live (realtime bidi) STT transport contract.COMMENT
LOWtests/unit/opencode-go-transport-routing.test.js1// Offline routing matrix for opencode-go models.COMMENT
LOWtests/unit/zed-native-auth.test.js1// Acceptance suite for the Zed native-app auth fix.COMMENT
LOWtests/translator/openai-thinking-display.test.js1// OpenAI-format clients asking for reasoning get Claude's thinking text back.COMMENT
LOW…tor/real/opencode-go-thinking-placeholder.real.test.js1// REAL: opencode.go /messages thinking-placeholder acceptance + real-thinking pass-back.COMMENT
LOW…tor/real/opencode-go-thinking-passthrough.real.test.js1// REAL multi-turn thinking pass-back matrix for opencode-go DeepSeek.COMMENT
LOWtests/translator/real/opencode-go-deepseek.real.test.js1// REAL endpoint matrix for opencode-go DeepSeek models.COMMENT
LOW…anslator/real/opencode-zen-free-responses.real.test.js1// REAL: zero-cost responses-path smoke on OpenCode Zen's free tier.COMMENT
LOW…anslator/real/deepseek-official-responses.real.test.js1// REAL matrix: DeepSeek OFFICIAL Responses API — direct behavior vs 9router translation.COMMENT
LOWcli/hooks/trayRuntime.js1// Lazy install systray2 for macOS/Linux into USER_DATA_DIR/runtime/node_modules.COMMENT
LOWcli/scripts/buildTrayArm64.js1#!/usr/bin/env nodeCOMMENT
LOWsrc/sse/services/keyAccess.js1// Per-API-key access control for the /v1/* inference keys.COMMENT
LOWsrc/app/api/auth/login/route.js61COMMENT
LOWsrc/app/api/cli-tools/hermes-settings/hermesYaml.js1// Pure text helpers for editing Hermes `config.yaml` / `.env` in place.COMMENT
LOWsrc/shared/constants/cliTools.js61 { id: "simple-task", name: "Qwen3 Coder Next", alias: "simple-task" },COMMENT
LOWsrc/shared/constants/cliTools.js581 configType: "custom",COMMENT
LOWsrc/shared/utils/ssrfGuard.js1// SSRF guard: block internal/private/metadata targets for server-side fetch.COMMENT
LOWsrc/shared/utils/bulkAdd.js1// Bulk-add API-key planner.COMMENT
LOWsrc/lib/oauth/constants/oauth.js121export const CODEBUDDY_INTL_CONFIG = { ...PROVIDER_OAUTH["codebuddy-intl"] };COMMENT
LOWsrc/lib/oauth/providers/glm.js1import crypto from "crypto";COMMENT
LOWsrc/lib/oauth/providers/minimax-code-shared.js1// MiniMax Code (mcode) OAuth device flow — shared factory for the two siteCOMMENT
3 more matches not shown…
Verbosity Indicators33 hits · 57 pts
SeverityFileLineSnippetContext
LOW⚡open-sse/translator/index.js109 // Step 1: source -> openai (if source is not openai)COMMENT
LOW⚡open-sse/translator/index.js119 // Step 2: openai -> target (if target is not openai)COMMENT
LOWopen-sse/translator/index.js205 // Step 1: target -> openai (if target is not openai)COMMENT
LOWopen-sse/translator/index.js218 // Step 2: openai -> source (if source is not openai)COMMENT
LOWcli/scripts/build-cli.js158 // Step 0: Sync version from app/cli/package.json to app/package.jsonCOMMENT
LOWcli/scripts/build-cli.js171 // Step 1: Build app with Next.js (workspace tracing root → traced node_modules in standalone).COMMENT
LOW⚡cli/scripts/build-cli.js193 // Step 2: Clean old app/cli/app if existsCOMMENT
LOW⚡cli/scripts/build-cli.js200 // Step 3: Copy Next.js standalone build to app/cli/app.COMMENT
LOWcli/scripts/build-cli.js260 // Step 4: Copy static filesCOMMENT
LOWcli/scripts/build-cli.js272 // Step 5: Copy public folder if existsCOMMENT
LOWcli/scripts/build-cli.js283 // Step 6: Copy vendor-chunks (required for production)COMMENT
LOWcli/scripts/build-cli.js302 // Step 7: Copy MITM server files (not bundled by Next.js standalone)COMMENT
LOWcli/scripts/build-cli.js324 // Step 8: Build MITM server (config driven - see app/cli/scripts/buildMitm.js)COMMENT
LOW⚡cli/src/cli/menus/providers.js580 // Step 1: Request device codeCOMMENT
LOW⚡cli/src/cli/menus/providers.js799 // Step 1: Select typeCOMMENT
LOW⚡cli/src/cli/menus/providers.js809 // Step 2: InputsCOMMENT
LOW⚡cli/src/cli/menus/providers.js819 // Step 3: API type (OpenAI only)COMMENT
LOWcli/src/cli/menus/providers.js482 // Step 1: Get auth URLCOMMENT
LOWcli/src/cli/menus/providers.js504 // Step 2: Show URL and instructionsCOMMENT
LOWcli/src/cli/menus/providers.js527 // Step 3: Parse callback URL and extract codeCOMMENT
LOWcli/src/cli/menus/providers.js553 // Step 4: Exchange code for tokensCOMMENT
LOWcli/src/cli/menus/providers.js604 // Step 2: Show instructionsCOMMENT
LOWcli/src/cli/menus/providers.js621 // Step 3: Poll for tokenCOMMENT
LOWsrc/app/api/oauth/iflow/cookie/route.js28 // Step 1: GET API key info to get the nameCOMMENT
LOWsrc/app/api/oauth/iflow/cookie/route.js65 // Step 2: POST to refresh API keyCOMMENT
LOWsrc/app/api/cli-tools/cowork-mcp-tools/route.js20 // Step 1: initializeCOMMENT
LOW⚡src/app/api/cli-tools/cowork-mcp-tools/route.js42 // Step 2: notifications/initialized (required by spec before tools/list)COMMENT
LOW⚡src/app/api/cli-tools/cowork-mcp-tools/route.js50 // Step 3: tools/listCOMMENT
LOWsrc/app/(dashboard)/dashboard/translator/page.js67 // Step 1: detect provider/format from model fieldCOMMENT
LOWsrc/mitm/manager.js534 // Step 1: Generate Root CA if missing or expiredCOMMENT
LOWsrc/mitm/manager.js574 // Step 2: Spawn server (Root CA already installed in Step 1.5)COMMENT
LOWsrc/lib/oauth/providers/kiro.js18 // Step 1: Register client with AWS SSO OIDCCOMMENT
LOWsrc/lib/oauth/providers/kiro.js41 // Step 2: Request device authorizationCOMMENT
Fake / Example Data12 hits · 15 pts
SeverityFileLineSnippetContext
LOWtests/unit/kiro-external-idp.test.js6const TEST_EMAIL = "user@example.com";CODE
LOWtests/unit/aws-credentials.test.js431 for (const profile of ["default", "my-sso-profile", "acct_1.prod", "sso:role", "user@example.com", "team+ops", "50%"CODE
LOWtests/unit/grok-cli-models.test.js58 providerSpecificData: { email: "user@example.com" },CODE
LOWtests/unit/grok-cli-usage.test.js56 email: "user@example.com",CODE
LOWtests/unit/grok-cli-usage.test.js252 email: "user@example.com",CODE
LOW⚡tests/unit/saml.test.js100 email: "user@example.com",CODE
LOW⚡tests/unit/saml.test.js101 displayName: "Jane Doe",CODE
LOW⚡tests/unit/saml.test.js108 expect(pickSamlEmail(mockProfile, {})).toBe("user@example.com");CODE
LOW⚡tests/unit/saml.test.js121 expect(pickSamlDisplayName(mockProfile, {})).toBe("Jane Doe");CODE
LOW⚡tests/unit/saml.test.js126 pickSamlDisplayName({ email: "user@example.com" }, {})CODE
LOW⚡tests/unit/saml.test.js127 ).toBe("user@example.com");CODE
LOW…oard)/dashboard/providers/[id]/BulkImportCodexModal.js13 "email": "user@example.com"CODE
Modern AI Meta-Vocabulary5 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUMCHANGELOG.md20- **Capabilities**: mark GLM-5.3 as unable to disable thinking (#4656); correct GLM-5.2/5.3 context window to 1M (#4544)CODE
MEDIUMopen-sse/providers/models/schema.js6// touched, so word/suffix hyphens stay intact ("-thinking", "-agentic", "qwen3-coder-next").COMMENT
MEDIUMtests/__baseline__/baseline-results.json1{"numTotalTestSuites":209,"numPassedTestSuites":192,"numFailedTestSuites":17,"numPendingTestSuites":0,"numTotalTests":67CODE
MEDIUMtests/__baseline__/current.json1{"numTotalTestSuites":276,"numPassedTestSuites":259,"numFailedTestSuites":17,"numPendingTestSuites":0,"numTotalTests":84CODE
MEDIUMsrc/app/api/v1/models/route.js473 // -thinking/-agentic variants per account). On failure, fall back toCOMMENT
Excessive Try-Catch Wrapping5 hits · 10 pts
SeverityFileLineSnippetContext
MEDIUMgitbook/content/vi/integration/other-tools.md288 print(f"Error: {e}")CODE
MEDIUMgitbook/content/ja/integration/other-tools.md288 print(f"Error: {e}")CODE
MEDIUMgitbook/content/zh-CN/integration/other-tools.md288 print(f"Error: {e}")CODE
MEDIUMgitbook/content/es/integration/other-tools.md288 print(f"Error: {e}")CODE
MEDIUMgitbook/content/en/integration/other-tools.md288 print(f"Error: {e}")CODE
Hallucination Indicators1 hit · 10 pts
SeverityFileLineSnippetContext
CRITICAL…rd)/dashboard/cli-tools/components/OpenCodeToolCard.js62 setSubagentModel(status.config.agent.explorer.model.replace("9router/", ""));CODE
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMopen-sse/config/codexInstructions.js30## Codex CLI harness, sandboxing, and approvalsCOMMENT