Never stop coding. Free MIT AI gateway: one endpoint, 359 providers (150+ free), 1200+ models Kimi, Claude, GPT, Gemini, GLM, DeepSeek, MiniMax. Works with Claude Code, Codex, Cursor, OpenCode, Cline & Copilot. Quota-aware auto-fallback, RTK+Caveman compression saves 15-95% tokens, MCP/A2A, Desktop/PWA. Built by hundreds of contributors
This report summarizes scanner evidence for diegosouzapw/OmniRoute, a TypeScript project with 75,020 GitHub stars. SynthScan examined 6,399,770 lines of code across 24111 source files, recording 14041 pattern matches distributed across 22 syntactic categories. The legacy adjusted pattern signal is 4.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 7137 finding(s).
Are imports declared and package/API names verified? 1627 finding(s).
Are wrappers, guards, and repeated structures necessary? 10744 finding(s).
Which changes need focused human review? 14041 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 14041 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docker-compose.selfhost.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.selfhost.yml | 3 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.selfhost.yml | 17 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .zizmor.yml | 29 | # ── Global settings ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .zizmor.yml | 33 | # ── Per-rule ignores ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .gitleaks.toml | 33 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .gitleaks.toml | 36 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .gitleaks.toml | 60 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .gitleaks.toml | 62 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker-compose.ollama-local.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | docker-compose.ollama-local.yml | 3 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.ollama-local.yml | 22 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 3 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 34 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 75 | # ── Redis (Rate Limiter Backend) ────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 97 | # ── Profile: base (minimal, no CLI tools) ────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 119 | # ── Profile: web (runner-web + Chromium/Playwright) ──────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 193 | # ── Profile: cli (CLIs installed inside container) ───────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 222 | # ── Profile: host (host-mounted CLI binaries, Linux-first) ──────── | COMMENT |
| MEDIUM | docker-compose.yml | 270 | # ── Profile: memory (Qdrant semantic-memory sidecar) ───────────── | COMMENT |
| MEDIUM | docker-compose.yml | 297 | # ── Profile: bifrost (Bifrost Go LLM-router sidecar) ───────────── | COMMENT |
| MEDIUM | docker-compose.yml | 324 | # ── Profile: cliproxyapi (CLIProxyAPI as sidecar) ───────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 359 | # ── Profile: codex-app-server (Codex CLI app-server sidecar) ────────── | COMMENT |
| MEDIUM⚡ | docker-compose.prod.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | docker-compose.prod.yml | 3 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.prod.yml | 27 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.prod.yml | 30 | # ── Redis (Rate Limiter Backend) ────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/fork-features.test.ts | 33 | // ── 1. normaliseFreeLabel ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/fork-features.test.ts | 69 | // ── 2. resolveApiBlock ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/fork-features.test.ts | 158 | // ── 3. debugLog ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/fork-features.test.ts | 248 | // ── Regression tests for the 3 HIGH-priority bot review fixes ─────────────── | COMMENT |
| MEDIUM⚡ | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 52 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 56 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 62 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 64 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 118 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 120 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 182 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 185 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 253 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 256 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 301 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 304 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 380 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 383 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 439 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 441 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 513 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 516 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 635 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 638 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 685 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 687 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 735 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 737 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 783 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 785 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/features.test.ts | 51 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/features.test.ts | 53 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| 5212 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …oute/opencode-plugin/tests/provider-id-routing.test.ts | 40 | function splitProviderFromDispatchedModel(modelStr: string): string { | CODE |
| LOW | @omniroute/opencode-plugin/tests/config-shim.test.ts | 181 | function throwingEnrichmentFetcher(): OmniRouteEnrichmentFetcher & { callCount: () => number } { | CODE |
| LOW | …mniroute/opencode-plugin/tests/gemini-sanitize.test.ts | 55 | function chatCompletionsWithDollarSchema(): Record<string, unknown> { | CODE |
| LOW | @omniroute/opencode-plugin/src/telemetry.ts | 58 | export function parseOmniRouteInferenceTelemetry(headers: Headers): OmniRouteInferenceTelemetry { | CODE |
| LOW | @omniroute/opencode-plugin/src/telemetry.ts | 133 | export function attachOmniRouteTelemetryToPayload( | CODE |
| LOW | @omniroute/opencode-plugin/src/telemetry.ts | 159 | export function attachOmniRouteTelemetryToSseLine( | CODE |
| LOW | @omniroute/opencode-plugin/src/telemetry.ts | 185 | export async function applyOmniRouteInferenceTelemetry(response: Response): Promise<Response> { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 295 | export function resolveEffectiveFeatureFlags( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 332 | export function sanitizeAutoSyncIntervalMs(value: unknown): number { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 367 | export function resolveOmniRoutePluginOptions(opts?: OmniRoutePluginOptions): Required< | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 429 | function trimLeadingOpencodePrefix(rawProviderId: string): string { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 452 | export function parseOmniRoutePluginOptions(opts: unknown): OmniRoutePluginOptions { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 506 | function hasOpenAiCompatEffortTierSuffix(modelId: string): boolean { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 702 | export function invalidateOmniRouteFetchCache( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 726 | export async function resolveOmniRouteRuntimeAuth( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 989 | export function createOmniRouteSyncModelsTool(args: { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 1876 | export function mapAutoComboToStaticEntry( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 2738 | export function formatCompressionPipeline(pipeline: OmniRouteCompressionStep[]): string { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3232 | export function createOmniRouteProviderHook( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3844 | export function createOmniRouteFetchInterceptor(config: { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3968 | function sanitizeToolSchemaContainer(payload: Record<string, unknown>): boolean { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4021 | export function sanitizeGeminiToolSchemas(payload: unknown): unknown { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4097 | export function createGeminiSanitizingFetch(inner: typeof fetch): typeof fetch { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4905 | function diskSnapshotIdentityFingerprint( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 5390 | export function createOmniRouteConfigHook( | CODE |
| LOW | @omniroute/opencode-provider/src/index.ts | 314 | export function buildOmniRouteOpenCodeConfig( | CODE |
| LOW | @omniroute/opencode-provider/src/index.ts | 725 | export function createOmniRouteComboConfig( | CODE |
| LOW | @omniroute/opencode-provider/src/index.ts | 835 | export function createOmniRouteAgentBlock( | CODE |
| LOW | @omniroute/opencode-provider/src/index.ts | 896 | export function createOmniRouteModesBlock( | CODE |
| LOW | @omniroute/opencode-plugin-v2/src/cache.ts | 108 | export function snapshotIdentityFingerprint( | CODE |
| LOW | @omniroute/opencode-plugin-v2/src/enrichment-report.ts | 22 | export function createSourceErrorReporter( | CODE |
| LOW | @omniroute/opencode-plugin-v2/src/options.ts | 91 | export function resolveManagementReadToken(optionValue: string | undefined): string | undefined { | CODE |
| LOW | @omniroute/opencode-plugin-v2/src/catalog.ts | 436 | function legacyCapabilitiesToInfoCapabilities( | CODE |
| LOW | @omniroute/opencode-plugin-v2/src/catalog.ts | 1123 | function warnProviderMatchedNothing( | CODE |
| LOW | @omniroute/opencode-plugin-v2/src/shared/models-map.ts | 152 | function warnDeprecatedPrefixesOnce(prefixes: string[]): void { | CODE |
| LOW | @omniroute/opencode-plugin-v2/src/shared/fingerprint.ts | 12 | export function catalogContentFingerprint( | CODE |
| LOW | open-sse/config/searchRegistry.ts | 423 | export function getSearchCredentialFallbacks(providerId: string): string[] { | CODE |
| LOW | open-sse/config/searchRegistry.ts | 480 | export function isUnconfiguredLoopbackSearchProvider( | CODE |
| LOW⚡ | open-sse/config/antigravityUpstream.ts | 17 | export function getAntigravityOnboardUrls(): string[] { | CODE |
| LOW⚡ | open-sse/config/antigravityUpstream.ts | 24 | function buildAntigravityDiscoveryUrls(path: string): string[] { | CODE |
| LOW⚡ | open-sse/config/antigravityUpstream.ts | 28 | export function getAntigravityModelsDiscoveryUrls(): string[] { | CODE |
| LOW⚡ | open-sse/config/antigravityUpstream.ts | 32 | export function getAntigravityFetchAvailableModelsUrls(): string[] { | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 78 | export function setOperatorProviderErrorRules( | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 396 | export function egressIpLockProvidersFromEnv( | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 415 | export function isEgressBucketedLockScope(provider: string | null | undefined): boolean { | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 427 | export function egressBucketedLockProviders(): string[] { | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 454 | export function hasOperatorRuleForProvider(provider: string | null | undefined): boolean { | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 487 | export function getProviderErrorRuleMatch( | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 585 | export function getOpencodeModelUnavailableMatch( | CODE |
| LOW | open-sse/config/contextEditing.ts | 48 | export function applyContextEditingToBody( | CODE |
| LOW | open-sse/config/contextEditing.ts | 132 | export function extractContextEditingTelemetry( | CODE |
| LOW | open-sse/config/vertexModels.ts | 64 | export function getVertexModelTargetFormat(model: string): "claude" | "openai" | null { | CODE |
| LOW | open-sse/config/bedrock.ts | 14 | export function extractBedrockRegionFromBaseUrl(value: string | null | undefined): string | null { | CODE |
| LOW⚡ | open-sse/config/bedrock.ts | 37 | export function buildBedrockControlBaseUrl(region: string): string { | CODE |
| LOW⚡ | open-sse/config/bedrock.ts | 41 | export function buildBedrockRuntimeBaseUrl(region: string): string { | CODE |
| LOW⚡ | open-sse/config/bedrock.ts | 45 | export function buildBedrockNativeModelsUrl(region: string): string { | CODE |
| LOW⚡ | open-sse/config/bedrock.ts | 49 | export function buildBedrockNativeInferenceProfilesUrl( | CODE |
| LOW | open-sse/config/bedrock.ts | 60 | export function buildBedrockNativeConverseUrl(region: string, modelId: string, stream = false) { | CODE |
| LOW | open-sse/config/bedrock.ts | 85 | export function getBedrockKnownModelLimits(modelId: string): { | CODE |
| LOW | open-sse/config/bedrock.ts | 121 | export function normalizeBedrockDiscoveredModels( | CODE |
| 5407 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | open-sse/mcp-server/README.md | 47 | export OMNIROUTE_API_KEY="your-api-key" | CODE |
| HIGH | docs/guides/USER_GUIDE.md | 1092 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/guides/USER_GUIDE.md | 1097 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/frameworks/SKILLS.md | 240 | "apiKeyId": "your-api-key-id" | CODE |
| HIGH | docs/i18n/sl/docs/guides/USER_GUIDE.md | 1026 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sl/docs/guides/USER_GUIDE.md | 1031 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sl/docs/frameworks/SKILLS.md | 238 | "apiKeyId": "your-api-key-id" | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 50 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 196 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 284 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 307 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 368 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 458 | Vse poti POST imajo enako obliko: `Bearer your-api-key` + telo JSON, preverjeno z Zod (`v1RerankSchema`, `v1ModerationSc | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 702 | curl -H "Authorization: Bearer <your-api-key>" \ | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 706 | curl -H "Authorization: Bearer <your-api-key>" \ | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 1046 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 1059 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 1119 | curl https://your-host.example/api/v1/vscode/YOUR_API_KEY/models | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 1120 | curl -X POST https://your-host.example/api/v1/vscode/YOUR_API_KEY/chat/completions \ | CODE |
| HIGH | docs/i18n/sl/docs/reference/API_REFERENCE.md | 1410 | Authorization: Bearer your-api-key # izbirno, razen če je nastavljen OMNIROUTE_API_KEY | CODE |
| HIGH | docs/i18n/sk/docs/guides/USER_GUIDE.md | 1028 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/guides/USER_GUIDE.md | 1033 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sk/docs/frameworks/SKILLS.md | 238 | "apiKeyId": "your-api-key-id" | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 50 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 221 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 309 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 332 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 393 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 483 | Všetky trasy POST majú rovnakú štruktúru: `Bearer your-api-key` + telo JSON validované pomocou Zod (`v1RerankSchema`, `v | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 723 | curl -H "Authorization: Bearer <your-api-key>" \ | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 727 | curl -H "Authorization: Bearer <your-api-key>" \ | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 1066 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 1079 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 1139 | curl https://your-host.example/api/v1/vscode/YOUR_API_KEY/models | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 1140 | curl -X POST https://your-host.example/api/v1/vscode/YOUR_API_KEY/chat/completions \ | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 1430 | Authorization: Bearer your-api-key # voliteľné, ak nie je nastavená premenná OMNIROUTE_API_KEY | CODE |
| HIGH | docs/i18n/ur/docs/guides/USER_GUIDE.md | 1028 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/guides/USER_GUIDE.md | 1033 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/ur/docs/frameworks/SKILLS.md | 238 | "apiKeyId": "your-api-key-id" | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 50 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 196 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 284 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 307 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 368 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 458 | تمام POST روٹس ایک ہی ساخت کی پیروی کرتے ہیں: `Bearer your-api-key` + Zod سے توثیق شدہ JSON باڈی (`v1RerankSchema`، `v1M | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 698 | curl -H "Authorization: Bearer <your-api-key>" \ | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 702 | curl -H "Authorization: Bearer <your-api-key>" \ | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 1041 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 1054 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 1114 | curl https://your-host.example/api/v1/vscode/YOUR_API_KEY/models | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 1115 | curl -X POST https://your-host.example/api/v1/vscode/YOUR_API_KEY/chat/completions \ | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 1405 | Authorization: Bearer your-api-key # اختیاری، جب تک OMNIROUTE_API_KEY سیٹ نہ ہو | CODE |
| HIGH | docs/i18n/sw/docs/guides/USER_GUIDE.md | 1028 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/guides/USER_GUIDE.md | 1033 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sw/docs/frameworks/SKILLS.md | 238 | "apiKeyId": "your-api-key-id" | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 50 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 196 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 271 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 294 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 355 | Authorization: Bearer your-api-key | CODE |
| 1032 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .mergify.yml | 1 | # Mergify merge queue — WS3.4/D5 of the v3.8.49 quality/velocity master plan. | COMMENT |
| LOW | .mergify.yml | 41 | # is intentionally NOT a condition here: the owner-applied `queue` label IS the | COMMENT |
| LOW | .mergify.yml | 61 | # NO batching: 'Merge Queue Batch' requires a paid Mergify tier (live finding | COMMENT |
| LOW | docker-compose.selfhost.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| LOW | .zizmor.yml | 1 | # .zizmor.yml — zizmor security audit configuration | COMMENT |
| LOW | .zizmor.yml | 21 | # This enforces the same stale-enforcement discipline as other allowlists in | COMMENT |
| LOW | .zizmor.yml | 41 | # <zizmor-audit-id>: # e.g. "unpinned-uses", "template-injection" | COMMENT |
| LOW | .zizmor.yml | 61 | # deploy-vps.yml uses `on: workflow_run` (after "Publish to Docker Hub"). | COMMENT |
| LOW | .zizmor.yml | 81 | # | COMMENT |
| LOW | socket.yml | 1 | # Socket.dev / Socket GitHub app configuration. | COMMENT |
| LOW | .gitleaks.toml | 1 | # .gitleaks.toml — Configuração do gitleaks para OmniRoute | COMMENT |
| LOW | .gitleaks.toml | 21 | # automaticamente. Sem esta seção, `gitleaks --config .gitleaks.toml` nunca | COMMENT |
| LOW | .gitleaks.toml | 61 | # Allowlist por-regra (adicionar conforme necessário durante o stale review) | COMMENT |
| LOW | .gitleaks.toml | 81 | # de métricas de latência; o terceiro é o valor PÚBLICO de um beta header da API | COMMENT |
| LOW | docker-compose.ollama-local.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| LOW | fly.toml | 41 | # Bind to all interfaces for Fly runtime networking. | COMMENT |
| LOW | docker-compose.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| LOW | docker-compose.yml | 21 | # docker compose --profile cliproxyapi up -d | COMMENT |
| LOW | docker-compose.yml | 361 | # the Codex CLI's own `codex app-server` over JSON-RPC/WebSocket instead of | COMMENT |
| LOW | docker-compose.prod.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| LOW | @omniroute/opencode-plugin/tests/provider.test.ts | 161 | // #6859: dynamic-hook catalog keys/ids/providerID use the unprefixed | COMMENT |
| LOW | …pencode-plugin/tests/debug-log-redaction-15159.test.ts | 1 | // Regression guard for audit #15159 O-05: the OpenCode plugin's debug log wrote | COMMENT |
| LOW | …oute/opencode-plugin/tests/provider-id-routing.test.ts | 101 | }); | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 641 | // Re-cast through `unknown` first: Auth is a discriminated union | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3301 | // Management-plane catalog reads may use a narrower read-only token. | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3541 | : undefined; | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3561 | if (comboNames.has(key)) delete models[key]; | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4201 | COMMENT | |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4401 | : undefined; | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4441 | if (usable && !isUsableRawModelId(raw.id, usable, enrichment)) continue; | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4741 | entry.reasoning = false; | COMMENT |
| LOW | @omniroute/opencode-plugin-v2/server.js | 1 | // Root entrypoint for OpenCode host plugin loading. | COMMENT |
| LOW | @omniroute/opencode-plugin-v2/tests/parity.test.ts | 141 | assert.equal(mAlpha.cost[0].input, 0); | COMMENT |
| LOW | @omniroute/opencode-plugin-v2/tests/parity.test.ts | 201 | } | COMMENT |
| LOW | @omniroute/opencode-plugin-v2/src/index.ts | 381 | COMMENT | |
| LOW | @omniroute/opencode-plugin-v2/src/options.ts | 61 | // Restore statically dropped entries named by 30-day usage analytics. | COMMENT |
| LOW | bin/_ops-common.sh | 1 | # bin/_ops-common.sh — shared helpers for the OmniRoute ops runbook scripts. | COMMENT |
| LOW | bin/rollback.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | open-sse/config/providerErrorRules.ts | 81 | operatorProviderErrorRules = {}; | COMMENT |
| LOW | open-sse/config/providerErrorRules.ts | 261 | } | COMMENT |
| LOW | open-sse/config/providerModels.ts | 261 | } | COMMENT |
| LOW | open-sse/config/providerModels.ts | 281 | // Copilot ships a new Claude id before the catalog is updated (e.g. claude-opus-5.5), | COMMENT |
| LOW | open-sse/config/providerFieldStrips.ts | 1 | // Fields that, when literally named in an upstream 400 body, are safe to strip and | COMMENT |
| LOW | open-sse/config/constants.ts | 21 | COMMENT | |
| LOW | open-sse/config/constants.ts | 41 | // Upper bound for adaptive stream readiness extensions (large histories, | COMMENT |
| LOW | open-sse/config/constants.ts | 61 | export const FETCH_BODY_TIMEOUT_MS = upstreamTimeouts.fetchBodyTimeoutMs; | COMMENT |
| LOW | open-sse/config/freeModelCatalog.data.ts | 1 | // HAND-CURATED free-tier catalog — there is no generator; edit the entries below directly. | COMMENT |
| LOW | open-sse/config/providers/registry/poe/index.ts | 1 | import type { RegistryEntry } from "../../shared.ts"; | COMMENT |
| LOW | open-sse/config/providers/registry/openrouter/index.ts | 21 | // OpenRouter multiplexes hundreds of independent upstream models behind one | COMMENT |
| LOW | open-sse/config/providers/registry/clinepass/index.ts | 1 | import type { RegistryEntry } from "../../shared.ts"; | COMMENT |
| LOW | open-sse/config/providers/registry/tokenrouter/index.ts | 1 | import type { RegistryEntry } from "../../shared.ts"; | COMMENT |
| LOW | open-sse/config/providers/registry/novita/index.ts | 21 | // advertises `input_modalities: ["text","image"]`, accepts an image part with HTTP 200, | COMMENT |
| LOW | open-sse/config/providers/registry/factory/index.ts | 1 | import type { RegistryEntry } from "../../shared.ts"; | COMMENT |
| LOW | open-sse/config/providers/registry/opencode/index.ts | 21 | name: "Big Pickle", | COMMENT |
| LOW | open-sse/config/providers/registry/opencode/go/index.ts | 361 | // #12196: the Go upstream serves this model only on /responses — | COMMENT |
| LOW | open-sse/config/providers/registry/opencode/go/index.ts | 381 | // medium/high/xhigh/max -> 200, "ultra" -> 400 (so declaring the exact set | COMMENT |
| LOW | …en-sse/config/providers/registry/opencode/zen/index.ts | 81 | // ── Grok ─────────────────────────────────────────────────── | COMMENT |
| LOW | …en-sse/config/providers/registry/opencode/zen/index.ts | 161 | { id: "minimax-m3", name: "MiniMax M3", contextLength: 1048576, supportsVision: true }, | COMMENT |
| LOW | open-sse/transformer/responsesTransformer.ts | 761 | } | COMMENT |
| LOW | open-sse/mcp-server/internalFetch.ts | 41 | function getOmniRouteApiKey(): string { | COMMENT |
| 943 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 257 | <img src="./docs/diagrams/tier-cascade.svg" width="100%" alt="OmniRoute request flow: your IDE or CLI (Claude Code, Curs | CODE |
| MEDIUM | README.md | 1705 | ### 🧠 Memory & RAG | COMMENT |
| MEDIUM | @omniroute/opencode-provider/README.md | 151 | - [OpenCode](https://opencode.ai) — the agentic CLI consumer. | CODE |
| MEDIUM⚡ | config/quality/file-size-baseline.json | 119 | "_rebaseline_2026_07_24_8470_hyperagent_sticky_thread": "PR #8470 (artickc, fix/hyperagent-tool-loop-thread-sticky) ow | CODE |
| MEDIUM⚡ | config/quality/file-size-baseline.json | 120 | "_rebaseline_2026_07_25_8494_capability_filter_fail_closed": "PR #8494 (fix/capability-filters-fail-closed, #8488) own | CODE |
| MEDIUM⚡ | config/quality/file-size-baseline.json | 130 | "_rebaseline_2026_07_21_7301_universal_cooldown_retry": "PR #7301 (ViFigueiredo, feat/universal-cooldown-retry) own gr | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 106 | "_rebaseline_2026_08_20_10574_reasoning_transport_fallback": "PR #10574 (jackjinke, fix/responses-reasoning-transport, | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 221 | "_rebaseline_2026_06_18_4189_combo_token_limits": "PR #4189 (megamen32) own growth: catalog.ts 1440->1463 (+23 at the | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 393 | "_rebaseline_2026_07_08_vb_reroute": "PR #6640 (Vision Bridge reroute) own growth, re-measured post-merge with origin/ | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 422 | "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-ss | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 508 | "_rebaseline_2026_08_24_video_bridge_fu02_fu07_sampler": "PRs #11344 (FU-02 one-frame scene-aware determinism) + #11 | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 512 | "_rebaseline_2026_08_28_mergebatch_v3851_ratchet_bank_reconcile": "/merge-batch 2026-08-28 (v3.8.51): boarding #1170 | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 631 | "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-sse/ | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 760 | "_rebaseline_2026_08_04_9268_gemini_schema_empty_choices": "Feature #9268 own growth: open-sse/utils/stream.ts 2889->2 | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 761 | "_rebaseline_2026_08_09_5696_capability_filter": "PR #9424 own growth: open-sse/handlers/chatCore.ts 5050->5061 (+11). | CODE |
| MEDIUM | config/quality/test-masking-allowlist.json | 167 | "reason": "v3.8.49 #8433: fix(guardrails) Vision Bridge describe-fallback ignora candidatos inalcançáveis — o test | CODE |
| MEDIUM | config/release/changelog-reconciliations.json | 333 | "- **fix(usage):** Non-streaming responses from every Claude-format provider now store the full prompt total, no | CODE |
| MEDIUM | config/release/changelog-reconciliations.json | 333 | "- **fix(usage):** Non-streaming responses from every Claude-format provider now store the full prompt total, no | CODE |
| MEDIUM | open-sse/config/providers/registry/devin-cli/index.ts | 16 | // tool-required combo routes. Use devin-cli-agentic (alias: dva) for tools. | COMMENT |
| MEDIUM | open-sse/config/providers/registry/openai/index.ts | 32 | // #15023: Sol and Luna are GPT-6 siblings with the same public API context window as | COMMENT |
| MEDIUM | open-sse/utils/claudeEffortVariants.ts | 110 | // Devin CLI catalogs (devin-cli / devin-cli-agentic / devin-desktop, aliases | COMMENT |
| MEDIUM | open-sse/utils/syncedEffortVariants.ts | 42 | // Devin CLI catalogs (devin-cli / devin-cli-agentic / devin-desktop, aliases | COMMENT |
| MEDIUM | open-sse/utils/stream.ts | 653 | // claude-format executors like devin-cli-agentic) received "Bash" on the | COMMENT |
| MEDIUM | open-sse/translator/webTools.ts | 4 | // calling — they reply with tool invocations as raw text. To let agentic clients use | COMMENT |
| MEDIUM | open-sse/translator/paramSupport.ts | 116 | // explicit max_tokens to 32000 whenever tools are present, so every agentic | COMMENT |
| MEDIUM | open-sse/translator/request/openai-to-kiro.ts | 203 | // images (the agentic tool-loop case), so the "(empty)" placeholder is only | COMMENT |
| MEDIUM | open-sse/translator/request/openai-to-kiro.ts | 893 | // OmniRoute so Kiro only receives a real upstream model ID. Non-functional agentic and | COMMENT |
| MEDIUM | open-sse/translator/helpers/openaiHelper.ts | 70 | // reasoning blobs inflate context on every subsequent agentic turn (O(n^2)). | COMMENT |
| MEDIUM | open-sse/translator/helpers/geminiHelper.ts | 61 | // #9617: array uniqueness keyword — agentic-CLI tool schemas (JSON-Schema | COMMENT |
| MEDIUM | open-sse/translator/helpers/geminiHelper.ts | 61 | // #9617: array uniqueness keyword — agentic-CLI tool schemas (JSON-Schema | COMMENT |
| MEDIUM | open-sse/executors/base.ts | 775 | // - 0c94c397d (#2743, 2026-05-26): a multi-agent review added a | COMMENT |
| MEDIUM | open-sse/executors/copilot-m365-web.ts | 401 | // exact echo back, or it drops the socket mid-turn on long agentic runs. | COMMENT |
| MEDIUM | open-sse/executors/copilot-m365-web.ts | 693 | // `tool_calls` with finish_reason "tool_calls" (OpenAI agentic-loop shape). | COMMENT |
| MEDIUM | open-sse/executors/kiro.ts | 635 | // the first content token, and on large/agentic contexts the gap before | COMMENT |
| MEDIUM | open-sse/executors/perplexity-web.ts | 672 | // #5927). Without this, streaming requests (the default for agentic | COMMENT |
| MEDIUM | open-sse/executors/perplexity-web.ts | 672 | // #5927). Without this, streaming requests (the default for agentic | COMMENT |
| MEDIUM | open-sse/executors/deepseek-web.ts | 521 | // trajectory instead of only the last user message, so agentic clients that never send | COMMENT |
| MEDIUM | open-sse/executors/deepseek-web.ts | 572 | // information". Fold them into the transcript as plain text, mirroring the agentic | COMMENT |
| MEDIUM | open-sse/executors/deepseek-web.ts | 921 | // Tool (agentic) requests replay the whole trajectory — prior tool calls and their | COMMENT |
| MEDIUM | open-sse/executors/notion-web.ts | 576 | // Optional custom agent (workflowId). Empty → default Notion AI (not agentic-specific). | COMMENT |
| MEDIUM | open-sse/executors/azureParamRules.ts | 78 | // agentic client (Claude Code, Cursor agent) on every turn. | COMMENT |
| MEDIUM | open-sse/executors/conol-web.ts | 134 | // other agentic protocol blocks into the user's text prompt. | COMMENT |
| MEDIUM | open-sse/executors/hyperagent.ts | 245 | // Strip common agentic / user-pin wrappers so the same user task fingerprints | COMMENT |
| MEDIUM | open-sse/executors/hyperagent.ts | 419 | // 2) Root user task (stable across agentic tool_calls reverse-convert + tool loops) | COMMENT |
| MEDIUM | open-sse/executors/promptql/threadSticky.ts | 70 | // system/developer often carry jailbreak/agentic pins that are shared across chats | COMMENT |
| MEDIUM | open-sse/executors/promptql/threadSticky.ts | 93 | // Tool-result follow-up wrappers (WinUI soft PromptQL / generic agentic) | COMMENT |
| MEDIUM | open-sse/handlers/usageExtractor.ts | 110 | // providers may have no prompt cache at all (devin-cli-agentic reports only | COMMENT |
| MEDIUM | open-sse/services/notionThreadSessions.ts | 176 | // Drop other common agentic preamble fingerprints if the whole pin leaked in. | COMMENT |
| MEDIUM | open-sse/services/fusion.ts | 367 | // with the full, unmodified body (tools/tool_choice intact) so agentic | COMMENT |
| MEDIUM | open-sse/services/reasoningInputPolicy.ts | 424 | // Default to "drop" for single-target requests so multi-turn agentic loops on direct | COMMENT |
| MEDIUM | open-sse/services/responsesInputSanitizer.ts | 22 | // Validated per input item of type function_call / function_call_output (the agentic | COMMENT |
| MEDIUM | open-sse/services/contextManager.ts | 23 | // through to 128k and blocking normal agentic tool loops with huge catalogs. | COMMENT |
| MEDIUM | open-sse/services/usage/fetcherProviders.ts | 108 | // Devin CLI agentic quota (Codeium seat-management GetUserStatus, protobuf) | COMMENT |
| MEDIUM | open-sse/services/usage/supportedProviders.ts | 104 | // Devin CLI agentic quota (Codeium seat-management GetUserStatus, protobuf) | COMMENT |
| MEDIUM | open-sse/services/compression/preservation.ts | 94 | // #13453: then the instruction envelopes agentic CLIs inject into user messages — | COMMENT |
| MEDIUM | open-sse/services/compression/preservation.ts | 94 | // #13453: then the instruction envelopes agentic CLIs inject into user messages — | COMMENT |
| MEDIUM | open-sse/services/autoCombo/complexityRouter.ts | 59 | // Tool-using / agentic requests need reliable function calling — floor at "cheap". | COMMENT |
| MEDIUM | open-sse/services/autoCombo/complexityRouter.ts | 97 | // favors function-calling-reliable models for agentic requests. | COMMENT |
| MEDIUM | tests/unit/conversationTracker.test.ts | 507 | // Discovered live: real agentic traffic (a tool-polling loop, "ack"/"poll" | COMMENT |
| MEDIUM | tests/unit/video-bridge-log-redaction.test.ts | 508 | // tests/unit/guardrails/videoBridgeSnapshotRedaction.test.ts. | COMMENT |
| 259 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | open-sse/mcp-server/__tests__/httpAuthContext.test.ts | 54 | headers: { "x-api-key": "placeholder" }, | CODE |
| LOW | tests/unit/antigravity-weekly-quota-4017.test.ts | 204 | accessToken: "fake-token-weekly-unique", | CODE |
| LOW | tests/unit/antigravity-weekly-quota-4017.test.ts | 249 | accessToken: "fake-token-weekly-unavailable", | CODE |
| LOW | tests/unit/noauth-autocombo-lockout-7623.test.ts | 78 | accessToken: "fake-token-locked", | CODE |
| LOW | tests/unit/noauth-autocombo-lockout-7623.test.ts | 85 | accessToken: "fake-token-healthy", | CODE |
| LOW | tests/unit/claudeAuthFile.test.ts | 250 | const email = "user@example.com"; | CODE |
| LOW | tests/unit/claudeAuthFile.test.ts | 328 | displayName: "John Doe", | CODE |
| LOW | tests/unit/claudeAuthFile.test.ts | 331 | assert.equal(extractClaudeEmail(conn), "John Doe"); | CODE |
| LOW⚡ | tests/unit/codex-import-route.test.ts | 53 | email: "user@example.com", | CODE |
| LOW⚡ | tests/unit/codex-import-route.test.ts | 58 | assert.equal(result.data.email, "user@example.com"); | CODE |
| LOW | tests/unit/antigravity-usage-service.test.ts | 26 | accessToken: "fake-token", | CODE |
| LOW | tests/unit/db-providers-access-token-1290.test.ts | 52 | email: "user@example.com", | CODE |
| LOW | tests/unit/db-providers-access-token-1290.test.ts | 59 | email: "user@example.com", | CODE |
| LOW | tests/unit/antigravity-dynamic-session-id-10443.test.ts | 6 | const credentials = { email: "user@example.com", connectionId: "conn_123" }; | CODE |
| LOW | …nit/antigravity-oauth-postexchange-nonblocking.test.ts | 72 | if (u.includes("userinfo")) return jsonRes({ email: "user@example.com" }); | CODE |
| LOW | …nit/antigravity-oauth-postexchange-nonblocking.test.ts | 187 | if (u.includes("userinfo")) return jsonRes({ email: "user@example.com" }); | CODE |
| LOW | …nit/antigravity-oauth-postexchange-nonblocking.test.ts | 216 | if (u.includes("userinfo")) return jsonRes({ email: "user@example.com" }); | CODE |
| LOW | tests/unit/combo-system-prompt-templates-5501.test.ts | 200 | body: bodyWithSystem("placeholder"), | CODE |
| LOW | tests/unit/combo-system-prompt-templates-5501.test.ts | 234 | body: bodyWithSystem("placeholder"), | CODE |
| LOW | tests/unit/combo-system-prompt-templates-5501.test.ts | 252 | body: bodyWithSystem("placeholder"), | CODE |
| LOW⚡ | tests/unit/maxai.test.ts | 630 | email: "user@example.com", | CODE |
| LOW⚡ | tests/unit/maxai.test.ts | 640 | assert.equal(init.body, JSON.stringify({ email: "user@example.com", app: "maxai_webapp" })); | CODE |
| LOW | tests/unit/maxai.test.ts | 670 | email: "user@example.com", | CODE |
| LOW | tests/unit/maxai.test.ts | 680 | email: "user@example.com", | CODE |
| LOW | tests/unit/maxai.test.ts | 692 | email: "user@example.com", | CODE |
| LOW | tests/unit/maxai.test.ts | 702 | assert.equal(body.email, "user@example.com"); | CODE |
| LOW | tests/unit/executor-command-code.test.ts | 52 | credentials: { apiKey: "fake-key" }, | CODE |
| LOW | tests/unit/executor-command-code.test.ts | 115 | credentials: { apiKey: "fake-key" }, | CODE |
| LOW | tests/unit/executor-command-code.test.ts | 183 | credentials: { apiKey: "fake-key" }, | CODE |
| LOW | tests/unit/executor-command-code.test.ts | 194 | assert.equal(headers.Authorization, "Bearer fake-key"); | CODE |
| LOW | tests/unit/openapi-spec-example-body.test.ts | 26 | "user@example.com" | CODE |
| LOW | tests/unit/db-api-key-groups.test.ts | 75 | const result = addKeyToGroup("fake-key-id", group.id); | CODE |
| LOW | tests/unit/codex-connection-edit-6562.test.ts | 78 | email: "user@example.com", | CODE |
| LOW | …sue-14629-commandcode-400-recovery-unreachable.test.ts | 59 | credentials: { apiKey: "fake-key" }, | CODE |
| LOW | …sue-14629-commandcode-400-recovery-unreachable.test.ts | 95 | credentials: { apiKey: "fake-key" }, | CODE |
| LOW | tests/unit/antigravity-discovery-bootstrap.test.ts | 50 | const projectId = await ensureAntigravityProjectAssigned("fake-token-1", mockFetch); | CODE |
| LOW | tests/unit/antigravity-discovery-bootstrap.test.ts | 56 | getAntigravityProjectFromCache("fake-token-1"), | CODE |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 73 | await ensureAntigravityProjectAssigned("fake-token-2", mockFetch); | CODE |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 74 | await ensureAntigravityProjectAssigned("fake-token-2", mockFetch); | CODE |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 75 | await ensureAntigravityProjectAssigned("fake-token-2", mockFetch); | CODE |
| LOW | tests/unit/adobe-firefly-browser-login.test.ts | 36 | Buffer.from(JSON.stringify({ email: "user@example.com", sub: "abc" })).toString("base64url") + | CODE |
| LOW | tests/unit/image-upscale-error-log.test.ts | 109 | const hostile = new Error("placeholder"); | CODE |
| LOW | tests/unit/image-upscale-error-log.test.ts | 127 | const hostile = new Error("placeholder"); | CODE |
| LOW | tests/unit/oauth-connection-test-timeout.test.ts | 52 | accessToken: "fake-token", | CODE |
| LOW | tests/unit/codex-app-server.test.ts | 698 | account: { type: "chatgpt", email: "user@example.com", planType: "pro" }, | CODE |
| LOW | tests/unit/codex-app-server.test.ts | 705 | assert.equal(status.account.email, "user@example.com"); | CODE |
| LOW | tests/unit/antigravity-quota-host-8965.test.ts | 141 | accessToken: "fake-token-host-test-8965", | CODE |
| LOW | tests/unit/antigravity-quota-host-8965.test.ts | 245 | accessToken: "fake-token-host-impact", | CODE |
| LOW | tests/unit/claudeAuthImport.test.ts | 217 | organization_name: "Acme Corp", | CODE |
| LOW | tests/unit/claudeAuthImport.test.ts | 246 | assert.equal(enriched.organizationName, "Acme Corp"); | CODE |
| LOW | tests/unit/antigravity-image-quota-visibility.test.ts | 105 | accessToken: "fake-token-image-quota", | CODE |
| LOW | …s/unit/xiaomi-mimo-token-plan-dispatcher-probe.test.ts | 48 | apiKey: "tp-fake-key", | CODE |
| LOW | tests/unit/codex-finalize-tokens.test.ts | 14 | email: "user@example.com", | CODE |
| LOW | tests/unit/codex-finalize-tokens.test.ts | 35 | assert.equal(tokenData.email, "user@example.com"); | CODE |
| LOW | tests/unit/db-providers-crud.test.ts | 440 | email: "user@example.com", | CODE |
| LOW | tests/unit/oauth-connection-tokenexpiresat-5326.test.ts | 31 | email: "user@example.com", | CODE |
| LOW | tests/unit/deepseek-web.test.ts | 131 | data: { biz_data: { token: "test-access-token-123", email: "test@test.com" } }, | CODE |
| LOW | tests/unit/oidc-callback.test.ts | 105 | email: "admin@example.com", | CODE |
| LOW | tests/unit/oidc-callback.test.ts | 200 | oidcAllowedSubjects: ["user-123", "admin@example.com"], | CODE |
| LOW | tests/unit/oidc-callback.test.ts | 259 | oidcAllowedSubjects: ["admin@example.com"], | CODE |
| 461 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | CONTRIBUTING.md | 364 | ### Step 1: Register Provider Constants | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 368 | ### Step 2: Add Executor (if custom logic needed) | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 372 | ### Step 3: Add Translator (if non-OpenAI format) | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 376 | ### Step 4: Add OAuth Config (if OAuth-based) | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 384 | ### Step 5: Register Models | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 388 | ### Step 6: Add Tests | COMMENT |
| LOW | open-sse/mcp-server/toolCardinality.ts | 137 | // Step 1: filter by scope / explicit allow, then apply deny. | COMMENT |
| LOW | open-sse/mcp-server/toolCardinality.ts | 156 | // Step 2: cap by maxTools. A negative max would silently drop tail entries via | COMMENT |
| LOW | open-sse/translator/index.ts | 507 | // Step 1: source -> openai (if source is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 574 | // Step 2: openai -> target (if target is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 911 | // Step 1: target -> openai (if target is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 924 | // Step 2: openai -> source (if source is not openai) | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1099 | // Step 1: GraphQL warmup initialises the conversation on Meta's side | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1113 | // Step 2: GraphQL mode switch sets the conversation's reasoning level | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1127 | // Step 3: Send message via WebSocket | COMMENT |
| LOW | open-sse/executors/muse-spark-web/fresh-access-token.ts | 45 | // Step 0: Heisenberg check refreshes the ecto_1_sess cookie via GraphQL | COMMENT |
| LOW | open-sse/executors/muse-spark-web/fresh-access-token.ts | 68 | // Step 1: Load meta.ai in headless Chromium via browserPool. | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 222 | // Step 1: Upload the audio file | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 290 | // Step 1: Upload the audio file (multipart/form-data) | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 830 | // Step 1: submit the job — multipart body with "data_file" (audio) + "config" (JSON) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 239 | // Step 2: Submit transcription request | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 259 | // Step 3: Poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 304 | // Step 2: Submit the pre-recorded transcription job | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 320 | // Step 3: Poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 710 | // Step 1: submit the job — multipart body with "media" (file) + "options" (JSON) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 726 | // Step 2: poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 852 | // Step 2: poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/videoGeneration/dashscopeHandler.ts | 115 | // Step 1: create async task (X-DashScope-Async: enable) | COMMENT |
| LOW | open-sse/handlers/videoGeneration/dashscopeHandler.ts | 138 | // Step 2: poll statusUrl/{task_id} until terminal | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 318 | // Step 1: Build base request | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 321 | // Step 2: Remap tool names | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 328 | // Step 5: Cache control | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 370 | // Step 6: Obfuscation (optional, per-provider setting) | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 375 | // Step 7: Serialize with CCH placeholder (strip internal sentinel fields) | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 379 | // Step 8: Sign with xxHash64 | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 69 | // Step 1: Tool-result compression | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 108 | // Step 2: Progressive aging | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 123 | // Step 3: Fallback summarizer for remaining long messages | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 72 | // Step 1: Open the breaker (failureThreshold: 1 -> one failure opens it) | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 82 | // Step 2: Wait past resetTimeout so _refreshOpenState transitions to HALF_OPEN | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 125 | // Step 3: catalog surfaces capabilities.effort_tiers for synced models. | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 171 | // Step 4: catalog generates `-{effort}` alias ids per declared tier. | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 269 | // Step 5: request-time `<prefix>/<model>-{effort}` alias resolution. | COMMENT |
| LOW⚡ | tests/unit/executor-huggingchat.test.ts | 76 | // Step 1: conversation creation succeeds. | COMMENT |
| LOW⚡ | tests/unit/executor-huggingchat.test.ts | 82 | // Step 2: the parent-message GET fails -> fetchInitialParentMessageId -> null. | COMMENT |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 226 | // Step 1: bootstrap project (what route.ts now does before the models loop). | COMMENT |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 229 | // Step 2: simulate a :models discovery request (what the loop does). | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 22 | // Step 1: Responses API format → Chat Completions format | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 62 | // Step 2: That Chat Completions chunk → Responses API events | COMMENT |
| LOW⚡ | …nit/translator-resp-openai-responses-roundtrip.test.ts | 116 | // Step 1: Responses → OpenAI (Chat Completions) | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 155 | // Step 2: OpenAI → Responses | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 411 | // Step 1: Initial state - track extra keys | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 415 | // Step 2: First request - should get primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 420 | // Step 3: Simulate 401 failure on primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 425 | // Step 4: Retry - should get a valid key (primary is still active, but round-robin may pick extra) | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 432 | // Step 5: Second 401 failure | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 437 | // Step 6: Third 401 failure - now primary becomes invalid | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 442 | // Step 7: Next request - should skip invalid primary and return extra key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 449 | // Step 8: Verify the invalid key count | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 452 | // Step 9: A3 guard check - connection with extra keys should NOT be disabled | COMMENT |
| 110 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | open-sse/mcp-server/toolCardinality.ts | 137 | // Step 1: filter by scope / explicit allow, then apply deny. | COMMENT |
| LOW | open-sse/mcp-server/toolCardinality.ts | 156 | // Step 2: cap by maxTools. A negative max would silently drop tail entries via | COMMENT |
| LOW | open-sse/translator/index.ts | 507 | // Step 1: source -> openai (if source is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 574 | // Step 2: openai -> target (if target is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 911 | // Step 1: target -> openai (if target is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 924 | // Step 2: openai -> source (if source is not openai) | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1099 | // Step 1: GraphQL warmup initialises the conversation on Meta's side | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1113 | // Step 2: GraphQL mode switch sets the conversation's reasoning level | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1127 | // Step 3: Send message via WebSocket | COMMENT |
| LOW | open-sse/executors/muse-spark-web/fresh-access-token.ts | 45 | // Step 0: Heisenberg check refreshes the ecto_1_sess cookie via GraphQL | COMMENT |
| LOW | open-sse/executors/muse-spark-web/fresh-access-token.ts | 68 | // Step 1: Load meta.ai in headless Chromium via browserPool. | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 222 | // Step 1: Upload the audio file | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 290 | // Step 1: Upload the audio file (multipart/form-data) | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 830 | // Step 1: submit the job — multipart body with "data_file" (audio) + "config" (JSON) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 239 | // Step 2: Submit transcription request | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 259 | // Step 3: Poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 304 | // Step 2: Submit the pre-recorded transcription job | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 320 | // Step 3: Poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 710 | // Step 1: submit the job — multipart body with "media" (file) + "options" (JSON) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 726 | // Step 2: poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 852 | // Step 2: poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/videoGeneration/dashscopeHandler.ts | 115 | // Step 1: create async task (X-DashScope-Async: enable) | COMMENT |
| LOW | open-sse/handlers/videoGeneration/dashscopeHandler.ts | 138 | // Step 2: poll statusUrl/{task_id} until terminal | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 318 | // Step 1: Build base request | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 321 | // Step 2: Remap tool names | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 328 | // Step 5: Cache control | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 370 | // Step 6: Obfuscation (optional, per-provider setting) | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 375 | // Step 7: Serialize with CCH placeholder (strip internal sentinel fields) | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 379 | // Step 8: Sign with xxHash64 | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 69 | // Step 1: Tool-result compression | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 108 | // Step 2: Progressive aging | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 123 | // Step 3: Fallback summarizer for remaining long messages | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 72 | // Step 1: Open the breaker (failureThreshold: 1 -> one failure opens it) | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 82 | // Step 2: Wait past resetTimeout so _refreshOpenState transitions to HALF_OPEN | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 125 | // Step 3: catalog surfaces capabilities.effort_tiers for synced models. | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 171 | // Step 4: catalog generates `-{effort}` alias ids per declared tier. | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 269 | // Step 5: request-time `<prefix>/<model>-{effort}` alias resolution. | COMMENT |
| LOW⚡ | tests/unit/executor-huggingchat.test.ts | 76 | // Step 1: conversation creation succeeds. | COMMENT |
| LOW⚡ | tests/unit/executor-huggingchat.test.ts | 82 | // Step 2: the parent-message GET fails -> fetchInitialParentMessageId -> null. | COMMENT |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 226 | // Step 1: bootstrap project (what route.ts now does before the models loop). | COMMENT |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 229 | // Step 2: simulate a :models discovery request (what the loop does). | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 22 | // Step 1: Responses API format → Chat Completions format | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 62 | // Step 2: That Chat Completions chunk → Responses API events | COMMENT |
| LOW⚡ | …nit/translator-resp-openai-responses-roundtrip.test.ts | 116 | // Step 1: Responses → OpenAI (Chat Completions) | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 155 | // Step 2: OpenAI → Responses | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 411 | // Step 1: Initial state - track extra keys | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 415 | // Step 2: First request - should get primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 420 | // Step 3: Simulate 401 failure on primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 425 | // Step 4: Retry - should get a valid key (primary is still active, but round-robin may pick extra) | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 432 | // Step 5: Second 401 failure | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 437 | // Step 6: Third 401 failure - now primary becomes invalid | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 442 | // Step 7: Next request - should skip invalid primary and return extra key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 449 | // Step 8: Verify the invalid key count | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 452 | // Step 9: A3 guard check - connection with extra keys should NOT be disabled | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 457 | // Step 10: Success on extra key - mark it as successful | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 463 | // Step 11: Recover primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 468 | // Step 12: Next request - can use primary again | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 619 | // Step 1: T07 code in chatCore.ts records key failure | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 622 | // Step 2: A3 guard in chat.ts checks if connection has extra keys | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 627 | // Step 3: With A3 guard, markAccountUnavailable should be skipped | COMMENT |
| 75 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/unit/guide-settings-route.test.ts | 135 | assert.ok(content.provider.omniroute.options.apiKey.startsWith("sk-")); | CODE |
| CRITICAL | tests/unit/guide-settings-route.test.ts | 144 | assert.ok(content.providers.omniroute.settings.apiKey.startsWith("sk-")); | CODE |
| CRITICAL | tests/unit/guide-settings-route.test.ts | 213 | assert.ok(content.provider.omniroute.options.apiKey.startsWith("sk-")); | CODE |
| CRITICAL | tests/unit/i18n-cli-namespaces.test.ts | 47 | pt.cliCommon.concept.code.phrase.includes("código"), | CODE |
| CRITICAL | tests/unit/batch_api.test.ts | 472 | !result.response.body.error.message.includes("Unexpected token"), | CODE |
| CRITICAL | tests/unit/translator-openai-to-gemini.test.ts | 153 | assert.deepEqual(cleaned.properties.payload.properties.nested.required.sort(), ["a", "b"]); | CODE |
| CRITICAL | tests/unit/v1-models-catalog-ttl.test.ts | 75 | const parsed = databaseSettingsSchema.shape.cache.shape.modelCatalogCacheTtlMs.safeParse( | CODE |
| CRITICAL | tests/unit/dashboard-localization-contract.test.ts | 80 | assert.ok(messages.featureFlags.definitions.REQUIRE_API_KEY.description.includes("khóa API")); | CODE |
| CRITICAL | tests/unit/dashboard-localization-contract.test.ts | 82 | messages.featureFlags.definitions.OMNIROUTE_AUTO_SYNC_CLAUDE_PROFILES.description.includes( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .mergify.yml | 37 | # anchor check succeeded" — robust to the path-filtered fast-gates (docs-only | COMMENT |
| MEDIUM | config/quality/file-size-baseline.json | 95 | "_rebaseline_2026_09_02_12429_wreq_migration_suite": "PR #12429 (wreq-js web-cookie transport): new test file tests/un | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 145 | "_rebaseline_2026_07_07_v3846_release_close": "Release v3.8.46 Phase 0 (generate-release) — drift de ciclo absorvido n | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 355 | "_rebaseline_2026_06_13_2743d_skipbreaker": "Re-baseline #2743 gap-d (testar consumer do skipProviderBreaker): combo.t | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 376 | "_rebaseline_2026_07_02_5899_airforce_v1_discovery": "PR #5904 own growth: provider-models-route.test.ts 1628->1752 (+ | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 422 | "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-ss | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 631 | "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-sse/ | CODE |
| LOW | config/quality/file-size-baseline.json | 436 | "_rebaseline_2026_07_02_5816_qoder": "PR #5816 (@AgentKiller45, qoder PAT via qodercli): qoderCli.ts 666->989, new-a | CODE |
| LOW | config/quality/file-size-baseline.json | 543 | "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->10 | CODE |
| LOW | config/quality/file-size-baseline.json | 645 | "_rebaseline_2026_07_02_5816_qoder": "PR #5816 (@AgentKiller45, qoder PAT via qodercli): qoderCli.ts 666->989, new-abo | CODE |
| LOW | config/quality/file-size-baseline.json | 685 | "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->1061 | CODE |
| MEDIUM | config/quality/test-masking-allowlist.json | 241 | "tests/unit/antigravity-client-profile.test.ts": "v3.8.49 #8013: o modelo de perfil harness/sdk/cli virou ide/cli unif | CODE |
| MEDIUM | open-sse/config/codexInstructions.ts | 33 | ## Codex CLI harness, sandboxing, and approvals | COMMENT |
| MEDIUM | open-sse/translator/request/openai-to-gemini/helpers.ts | 202 | // instead of rejecting it outright -- cheaper and more robust than trying to | COMMENT |
| MEDIUM | open-sse/executors/uc/toolDialect.ts | 114 | // Split top-level commas (naive but robust for the flat scalar args these calls use). | COMMENT |
| MEDIUM | open-sse/services/githubCopilotModels.ts | 121 | // (rename-robust) rather than an id allowlist: any model the account is entitled | COMMENT |
| MEDIUM | tests/unit/mcp-connect-scope.test.ts | 3 | // Hard Rules #15/#17) — dedicated regression tests, mirroring the harness in | COMMENT |
| MEDIUM | tests/unit/combo-response-validation-failover.test.ts | 4 | * Mirrors the #5085 empty-content failover harness (2 legs, different providers). | COMMENT |
| MEDIUM | …s/unit/gamification/action-count-durable-12546.test.ts | 30 | // well above 1 keeps the discriminant robust: a single fresh event emitted after | COMMENT |
| MEDIUM | tests/unit/combo/comboSort.test.ts | 101 | // Expected order derived from PROVIDER_ORDER (robust to provider precedence). | COMMENT |
| MEDIUM | scripts/i18n/i18n_autotranslate.py | 100 | # A true robust implementation would diff against the English source. | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 381 | # authenticated via GITHUB_TOKEN (5000 req/hr) — robust under load. | COMMENT |
| MEDIUM | src/i18n/messages/pt.json | 6379 | "bai": "Chave de API Bearer para o gateway de LLM compatível com OpenAI da b.ai (distinto de TheB.AI). Crie uma ch | CODE |
| MEDIUM | src/i18n/messages/pt.json | 6405 | "dgrid": "Crie uma chave de API DGrid em https://dgrid.ai e, em seguida, utilize https://api.dgrid.ai/v1 como o UR | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | docker-compose.ollama-local.yml | 8 | # Usage: | COMMENT |
| LOW | docker-compose.yml | 14 | # Usage: | COMMENT |
| LOW⚡ | docker-compose.prod.yml | 8 | # Usage: | COMMENT |
| LOW | scripts/quality/test-scoped.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/ci/resolve-docker-publish-version.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/ci/should-promote-latest.sh | 13 | # Usage: | COMMENT |
| LOW | scripts/release/merge-train.sh | 14 | # Usage: | COMMENT |
| LOW | scripts/i18n/translate-new-keys.sh | 22 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/unit/deepseek-web-v4-dsml.test.ts | 148 | print("hello")</parameter> | CODE |
| HIGH⚡ | …nit/translator-resp-openai-responses-roundtrip.test.ts | 113 | print("Done") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/unit/check-ai-attribution.test.ts | 31 | "generated by ChatGPT", | CODE |
| HIGH | src/lib/providers/validation/audioMiscProviders.ts | 157 | // Use credit check endpoint as requested by user based on Kie.ai docs. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docker/vnc-browser/chromium/cdp-bridge.py | 78 | except OSError: | CODE |
| HIGH | docker/vnc-browser/chromium/cdp-bridge.py | 84 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/i18n/validate_translation.py | 371 | source_str = str(source_val)[:25] if source_val else "(null)" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/i18n/validate_translation.py | 99 | CODE | |
| LOW | scripts/i18n/validate_translation.py | 386 | CODE | |
| LOW | scripts/i18n/validate_translation.py | 581 | CODE | |
| LOW | scripts/sre/tcp-close-analyzer.py | 390 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/i18n/i18n_autotranslate.py | 91 | except Exception as e: | CODE |
| LOW | scripts/sre/tcp-close-analyzer.py | 309 | except Exception: | CODE |
| LOW | scripts/sre/tcp-close-analyzer.py | 321 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/i18n/check_translations.py | 112 | # Check if key matches any full key in en.json | COMMENT |
| LOW | scripts/i18n/validate_translation.py | 598 | # Check if translation file exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/electron-release.yml | 206 | # Create a clean temp profile directory to avoid this. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ts/unit/issue-12949-auggie-quota-exhausted-200.test.ts | 105 | `printf 'Sure — here is how you can check your API usage and quota dashboard in the settings page.'\nexit 0` | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/i18n/i18n_autotranslate.py | 23 | CODE | |
| LOW | scripts/i18n/i18n_autotranslate.py | 24 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/lib/evals/evalRunner/builtinSuites.ts | 578 | "Find and fix the bug: async function getData() { const response = fetch('/api/data'); return response.jso | CODE |