Never stop coding. Free MIT AI gateway: one endpoint, 350 providers (90+ free), 1200+ models Kimi, Claude, GPT, Gemini, GLM, DeepSeek, MiniMax. Works with Claude Code, Codex, Cursor, OpenCode, Cline & Copilot. Quota-aware auto-fallback, RTK+Caveman compression saves 15-95% tokens, MCP/A2A, Desktop/PWA. Built by 450+ contributors
This report presents the forensic synthetic code analysis of diegosouzapw/OmniRoute, a TypeScript project with 57,543 GitHub stars. SynthScan v2.0 examined 2,794,870 lines of code across 11687 source files, recording 10633 pattern matches distributed across 20 syntactic categories. The overall adjusted score of 8.2 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 10633 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .zizmor.yml | 29 | # ── Global settings ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .zizmor.yml | 33 | # ── Per-rule ignores ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .gitleaks.toml | 33 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .gitleaks.toml | 36 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .gitleaks.toml | 60 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .gitleaks.toml | 62 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | docker-compose.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 3 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 28 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 69 | # ── Redis (Rate Limiter Backend) ────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 91 | # ── Profile: base (minimal, no CLI tools) ────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 108 | # ── Profile: web (runner-web + Chromium/Playwright) ──────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 157 | # ── Profile: cli (CLIs installed inside container) ───────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 179 | # ── Profile: host (host-mounted CLI binaries, Linux-first) ──────── | COMMENT |
| MEDIUM | docker-compose.yml | 227 | # ── Profile: memory (Qdrant semantic-memory sidecar) ───────────── | COMMENT |
| MEDIUM | docker-compose.yml | 254 | # ── Profile: bifrost (Bifrost Go LLM-router sidecar) ───────────── | COMMENT |
| MEDIUM | docker-compose.yml | 281 | # ── Profile: cliproxyapi (CLIProxyAPI as sidecar) ───────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 306 | # ── Profile: codex-app-server (Codex CLI app-server sidecar) ────────── | COMMENT |
| MEDIUM⚡ | docker-compose.prod.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | docker-compose.prod.yml | 3 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.prod.yml | 27 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.prod.yml | 30 | # ── Redis (Rate Limiter Backend) ────────────────────────────────── | COMMENT |
| MEDIUM | vitest.config.ts | 40 | // ── Pre-existing failures tracked by #8618 ─────────────────────────────── | COMMENT |
| MEDIUM | vitest.config.ts | 40 | // ── Pre-existing failures tracked by #8618 ─────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/fork-features.test.ts | 32 | // ── 1. normaliseFreeLabel ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/fork-features.test.ts | 74 | // ── 2. resolveApiBlock ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/fork-features.test.ts | 153 | // ── 3. debugLog ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/fork-features.test.ts | 243 | // ── Regression tests for the 3 HIGH-priority bot review fixes ─────────────── | COMMENT |
| MEDIUM⚡ | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 52 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 56 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 62 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 64 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 118 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 120 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 182 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 185 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 253 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 256 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 301 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 304 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 380 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 383 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 439 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 441 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 513 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 516 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 635 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 638 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 685 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 687 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 735 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 737 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 783 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/warm-startup.test.ts | 785 | // ──────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/features.test.ts | 51 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/features.test.ts | 53 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/features.test.ts | 111 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/features.test.ts | 113 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/features.test.ts | 180 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | @omniroute/opencode-plugin/tests/features.test.ts | 182 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| 4668 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …oute/opencode-plugin/tests/provider-id-routing.test.ts | 40 | function splitProviderFromDispatchedModel(modelStr: string): string { | CODE |
| LOW | @omniroute/opencode-plugin/tests/config-shim.test.ts | 181 | function throwingEnrichmentFetcher(): OmniRouteEnrichmentFetcher & { callCount: () => number } { | CODE |
| LOW | …mniroute/opencode-plugin/tests/gemini-sanitize.test.ts | 55 | function chatCompletionsWithDollarSchema(): Record<string, unknown> { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 283 | export function resolveEffectiveFeatureFlags( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 320 | export function sanitizeAutoSyncIntervalMs(value: unknown): number { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 355 | export function resolveOmniRoutePluginOptions(opts?: OmniRoutePluginOptions): Required< | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 417 | function trimLeadingOpencodePrefix(rawProviderId: string): string { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 440 | export function parseOmniRoutePluginOptions(opts: unknown): OmniRoutePluginOptions { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 648 | export function invalidateOmniRouteFetchCache( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 672 | export async function resolveOmniRouteRuntimeAuth( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 907 | export function createOmniRouteSyncModelsTool(args: { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 1790 | export function mapAutoComboToStaticEntry( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 2652 | export function formatCompressionPipeline(pipeline: OmniRouteCompressionStep[]): string { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3146 | export function createOmniRouteProviderHook( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3758 | export function createOmniRouteFetchInterceptor(config: { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3880 | function sanitizeToolSchemaContainer(payload: Record<string, unknown>): boolean { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3933 | export function sanitizeGeminiToolSchemas(payload: unknown): unknown { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4009 | export function createGeminiSanitizingFetch(inner: typeof fetch): typeof fetch { | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4805 | function diskSnapshotIdentityFingerprint( | CODE |
| LOW | @omniroute/opencode-plugin/src/index.ts | 5221 | export function createOmniRouteConfigHook( | CODE |
| LOW | @omniroute/opencode-provider/src/index.ts | 314 | export function buildOmniRouteOpenCodeConfig( | CODE |
| LOW | @omniroute/opencode-provider/src/index.ts | 725 | export function createOmniRouteComboConfig( | CODE |
| LOW | @omniroute/opencode-provider/src/index.ts | 835 | export function createOmniRouteAgentBlock( | CODE |
| LOW | @omniroute/opencode-provider/src/index.ts | 896 | export function createOmniRouteModesBlock( | CODE |
| LOW | open-sse/config/searchRegistry.ts | 407 | export function getSearchCredentialFallbacks(providerId: string): string[] { | CODE |
| LOW | open-sse/config/searchRegistry.ts | 464 | export function isUnconfiguredLoopbackSearchProvider( | CODE |
| LOW⚡ | open-sse/config/antigravityUpstream.ts | 17 | export function getAntigravityOnboardUrls(): string[] { | CODE |
| LOW⚡ | open-sse/config/antigravityUpstream.ts | 24 | function buildAntigravityDiscoveryUrls(path: string): string[] { | CODE |
| LOW⚡ | open-sse/config/antigravityUpstream.ts | 28 | export function getAntigravityModelsDiscoveryUrls(): string[] { | CODE |
| LOW⚡ | open-sse/config/antigravityUpstream.ts | 32 | export function getAntigravityFetchAvailableModelsUrls(): string[] { | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 78 | export function setOperatorProviderErrorRules( | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 348 | export function isEgressBucketedLockScope(provider: string | null | undefined): boolean { | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 360 | export function egressBucketedLockProviders(): string[] { | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 387 | export function hasOperatorRuleForProvider(provider: string | null | undefined): boolean { | CODE |
| LOW | open-sse/config/providerErrorRules.ts | 420 | export function getProviderErrorRuleMatch( | CODE |
| LOW | open-sse/config/contextEditing.ts | 48 | export function applyContextEditingToBody( | CODE |
| LOW | open-sse/config/contextEditing.ts | 132 | export function extractContextEditingTelemetry( | CODE |
| LOW | open-sse/config/bedrock.ts | 14 | export function extractBedrockRegionFromBaseUrl(value: string | null | undefined): string | null { | CODE |
| LOW⚡ | open-sse/config/bedrock.ts | 37 | export function buildBedrockControlBaseUrl(region: string): string { | CODE |
| LOW⚡ | open-sse/config/bedrock.ts | 41 | export function buildBedrockRuntimeBaseUrl(region: string): string { | CODE |
| LOW⚡ | open-sse/config/bedrock.ts | 45 | export function buildBedrockNativeModelsUrl(region: string): string { | CODE |
| LOW⚡ | open-sse/config/bedrock.ts | 49 | export function buildBedrockNativeInferenceProfilesUrl( | CODE |
| LOW | open-sse/config/bedrock.ts | 60 | export function buildBedrockNativeConverseUrl(region: string, modelId: string, stream = false) { | CODE |
| LOW | open-sse/config/bedrock.ts | 85 | export function getBedrockKnownModelLimits(modelId: string): { | CODE |
| LOW | open-sse/config/bedrock.ts | 115 | export function normalizeBedrockDiscoveredModels( | CODE |
| LOW | open-sse/config/imageRegistry.ts | 145 | function resolveSameProviderBareAlias(providerId, model) { | CODE |
| LOW | open-sse/config/imageRegistry.ts | 159 | function resolveAliasImageRequired(alias, modelConfig) { | CODE |
| LOW | open-sse/config/imageRegistry.ts | 899 | function imageProviderCatalogEntries( | CODE |
| LOW | open-sse/config/imageRegistry.ts | 990 | export function modalitiesRequireImageInput(inputModalities) { | CODE |
| LOW | open-sse/config/errorConfig.ts | 255 | export function serviceSupervisorCooldown( | CODE |
| LOW | open-sse/config/glmProvider.ts | 273 | function getProviderSpecificString(data: JsonRecord, keys: readonly string[]): string | null { | CODE |
| LOW | open-sse/config/glmProvider.ts | 346 | function stripKnownGlmEndpointSuffix(baseUrl: string): { base: string; suffix: string } { | CODE |
| LOW | open-sse/config/glmProvider.ts | 382 | function stripQueryAndTrailingSlash(baseUrl: string): string { | CODE |
| LOW | open-sse/config/glmProvider.ts | 501 | export function buildGlmAnthropicMessagesUrl( | CODE |
| LOW | open-sse/config/audioRegistry.ts | 640 | export function buildDynamicAudioProvider(node: ProviderNodeRow, audioPath: string): AudioProvider { | CODE |
| LOW | open-sse/config/audioRegistry.ts | 725 | export function audioModelAliasCandidates( | CODE |
| LOW | open-sse/config/audioRegistry.ts | 743 | export function findAlternateAudioProvider( | CODE |
| LOW | open-sse/config/audioRegistry.ts | 763 | export function listAlternateAudioModelIds( | CODE |
| LOW | open-sse/config/audioRegistry.ts | 784 | export function missingAudioProviderCredentialsMessage( | CODE |
| LOW⚡ | open-sse/config/providerPluginManifestRegistry.ts | 8 | export function generateProviderPluginManifest() { | CODE |
| 3919 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | open-sse/mcp-server/README.md | 47 | export OMNIROUTE_API_KEY="your-api-key" | CODE |
| HIGH | docs/guides/USER_GUIDE.md | 992 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/guides/USER_GUIDE.md | 997 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/frameworks/SKILLS.md | 240 | "apiKeyId": "your-api-key-id" | CODE |
| HIGH | docs/i18n/sk/docs/guides/USER_GUIDE.md | 838 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/guides/USER_GUIDE.md | 843 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 29 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 64 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 86 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 109 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 363 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sk/docs/reference/API_REFERENCE.md | 373 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/ur/docs/guides/USER_GUIDE.md | 838 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/guides/USER_GUIDE.md | 843 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 29 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 64 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 86 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 109 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 363 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/ur/docs/reference/API_REFERENCE.md | 373 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sw/docs/guides/USER_GUIDE.md | 838 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/guides/USER_GUIDE.md | 843 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 29 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 64 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 86 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 109 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 363 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sw/docs/reference/API_REFERENCE.md | 373 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/pl/docs/guides/USER_GUIDE.md | 941 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/pl/docs/guides/USER_GUIDE.md | 946 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/pl/docs/frameworks/SKILLS.md | 240 | "apiKeyId": "your-api-key-id" | CODE |
| HIGH | docs/i18n/pl/docs/reference/API_REFERENCE.md | 29 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/pl/docs/reference/API_REFERENCE.md | 64 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/pl/docs/reference/API_REFERENCE.md | 86 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/pl/docs/reference/API_REFERENCE.md | 109 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/pl/docs/reference/API_REFERENCE.md | 363 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/pl/docs/reference/API_REFERENCE.md | 373 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/vi/docs/guides/USER_GUIDE.md | 838 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/vi/docs/guides/USER_GUIDE.md | 843 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/vi/docs/reference/API_REFERENCE.md | 29 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/vi/docs/reference/API_REFERENCE.md | 64 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/vi/docs/reference/API_REFERENCE.md | 86 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/vi/docs/reference/API_REFERENCE.md | 109 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/vi/docs/reference/API_REFERENCE.md | 363 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/vi/docs/reference/API_REFERENCE.md | 373 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sv/docs/guides/USER_GUIDE.md | 838 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sv/docs/guides/USER_GUIDE.md | 843 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/sv/docs/reference/API_REFERENCE.md | 29 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sv/docs/reference/API_REFERENCE.md | 64 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sv/docs/reference/API_REFERENCE.md | 86 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sv/docs/reference/API_REFERENCE.md | 109 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sv/docs/reference/API_REFERENCE.md | 363 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/sv/docs/reference/API_REFERENCE.md | 373 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/he/docs/guides/USER_GUIDE.md | 838 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/he/docs/guides/USER_GUIDE.md | 843 | -H "Authorization: Bearer your-api-key" \ | CODE |
| HIGH | docs/i18n/he/docs/reference/API_REFERENCE.md | 29 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/he/docs/reference/API_REFERENCE.md | 64 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/he/docs/reference/API_REFERENCE.md | 86 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/he/docs/reference/API_REFERENCE.md | 109 | Authorization: Bearer your-api-key | CODE |
| HIGH | docs/i18n/he/docs/reference/API_REFERENCE.md | 363 | Authorization: Bearer your-api-key | CODE |
| 313 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | CONTRIBUTING.md | 345 | ### Step 1: Register Provider Constants | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 349 | ### Step 2: Add Executor (if custom logic needed) | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 353 | ### Step 3: Add Translator (if non-OpenAI format) | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 357 | ### Step 4: Add OAuth Config (if OAuth-based) | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 365 | ### Step 5: Register Models | COMMENT |
| LOW⚡ | CONTRIBUTING.md | 369 | ### Step 6: Add Tests | COMMENT |
| LOW | open-sse/mcp-server/toolCardinality.ts | 137 | // Step 1: filter by scope / explicit allow, then apply deny. | COMMENT |
| LOW | open-sse/mcp-server/toolCardinality.ts | 156 | // Step 2: cap by maxTools. A negative max would silently drop tail entries via | COMMENT |
| LOW | open-sse/translator/index.ts | 457 | // Step 1: source -> openai (if source is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 493 | // Step 2: openai -> target (if target is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 818 | // Step 1: target -> openai (if target is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 831 | // Step 2: openai -> source (if source is not openai) | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1319 | // Step 1: GraphQL warmup initialises the conversation on Meta's side | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1333 | // Step 2: GraphQL mode switch sets the conversation's reasoning level | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1347 | // Step 3: Send message via WebSocket | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 232 | // Step 1: Upload the audio file | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 300 | // Step 1: Upload the audio file (multipart/form-data) | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 708 | // Step 1: submit the job — multipart body with "data_file" (audio) + "config" (JSON) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 249 | // Step 2: Submit transcription request | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 269 | // Step 3: Poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 314 | // Step 2: Submit the pre-recorded transcription job | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 330 | // Step 3: Poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 588 | // Step 1: submit the job — multipart body with "media" (file) + "options" (JSON) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 604 | // Step 2: poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 730 | // Step 2: poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/videoGeneration/dashscopeHandler.ts | 115 | // Step 1: create async task (X-DashScope-Async: enable) | COMMENT |
| LOW | open-sse/handlers/videoGeneration/dashscopeHandler.ts | 138 | // Step 2: poll statusUrl/{task_id} until terminal | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 324 | // Step 1: Build base request | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 327 | // Step 2: Remap tool names | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 334 | // Step 5: Cache control | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 376 | // Step 6: Obfuscation (optional, per-provider setting) | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 381 | // Step 7: Serialize with CCH placeholder (strip internal sentinel fields) | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 385 | // Step 8: Sign with xxHash64 | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 69 | // Step 1: Tool-result compression | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 108 | // Step 2: Progressive aging | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 123 | // Step 3: Fallback summarizer for remaining long messages | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 33 | // Step 1: Open the breaker (failureThreshold: 1 -> one failure opens it) | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 43 | // Step 2: Wait past resetTimeout so _refreshOpenState transitions to HALF_OPEN | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 48 | // Step 3: recordProviderSuccess should close the breaker | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 127 | // Step 3: catalog surfaces capabilities.effort_tiers for synced models. | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 173 | // Step 4: catalog generates `-{effort}` alias ids per declared tier. | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 271 | // Step 5: request-time `<prefix>/<model>-{effort}` alias resolution. | COMMENT |
| LOW⚡ | tests/unit/executor-huggingchat.test.ts | 76 | // Step 1: conversation creation succeeds. | COMMENT |
| LOW⚡ | tests/unit/executor-huggingchat.test.ts | 82 | // Step 2: the parent-message GET fails -> fetchInitialParentMessageId -> null. | COMMENT |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 226 | // Step 1: bootstrap project (what route.ts now does before the models loop). | COMMENT |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 229 | // Step 2: simulate a :models discovery request (what the loop does). | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 22 | // Step 1: Responses API format → Chat Completions format | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 62 | // Step 2: That Chat Completions chunk → Responses API events | COMMENT |
| LOW⚡ | …nit/translator-resp-openai-responses-roundtrip.test.ts | 116 | // Step 1: Responses → OpenAI (Chat Completions) | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 155 | // Step 2: OpenAI → Responses | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 411 | // Step 1: Initial state - track extra keys | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 415 | // Step 2: First request - should get primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 420 | // Step 3: Simulate 401 failure on primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 425 | // Step 4: Retry - should get a valid key (primary is still active, but round-robin may pick extra) | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 432 | // Step 5: Second 401 failure | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 437 | // Step 6: Third 401 failure - now primary becomes invalid | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 442 | // Step 7: Next request - should skip invalid primary and return extra key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 449 | // Step 8: Verify the invalid key count | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 452 | // Step 9: A3 guard check - connection with extra keys should NOT be disabled | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 457 | // Step 10: Success on extra key - mark it as successful | COMMENT |
| 330 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .mergify.yml | 1 | # Mergify merge queue — WS3.4/D5 of the v3.8.49 quality/velocity master plan. | COMMENT |
| LOW | .mergify.yml | 41 | # is intentionally NOT a condition here: the owner-applied `queue` label IS the | COMMENT |
| LOW | .zizmor.yml | 1 | # .zizmor.yml — zizmor security audit configuration | COMMENT |
| LOW | .zizmor.yml | 21 | # This enforces the same stale-enforcement discipline as other allowlists in | COMMENT |
| LOW | .zizmor.yml | 41 | # <zizmor-audit-id>: # e.g. "unpinned-uses", "template-injection" | COMMENT |
| LOW | .zizmor.yml | 61 | # deploy-vps.yml uses `on: workflow_run` (after "Publish to Docker Hub"). | COMMENT |
| LOW | .zizmor.yml | 81 | # | COMMENT |
| LOW | socket.yml | 1 | # Socket.dev / Socket GitHub app configuration. | COMMENT |
| LOW | .gitleaks.toml | 1 | # .gitleaks.toml — Configuração do gitleaks para OmniRoute | COMMENT |
| LOW | .gitleaks.toml | 21 | # automaticamente. Sem esta seção, `gitleaks --config .gitleaks.toml` nunca | COMMENT |
| LOW | .gitleaks.toml | 61 | # Allowlist por-regra (adicionar conforme necessário durante o stale review) | COMMENT |
| LOW | docker-compose.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| LOW | docker-compose.yml | 301 | retries: 3 | COMMENT |
| LOW | docker-compose.prod.yml | 1 | # ────────────────────────────────────────────────────────────────────── | COMMENT |
| LOW | @omniroute/opencode-plugin/tests/provider.test.ts | 161 | // #6859: dynamic-hook catalog keys/ids/providerID use the unprefixed | COMMENT |
| LOW | …oute/opencode-plugin/tests/provider-id-routing.test.ts | 101 | }); | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 581 | typeof (auth as { key?: unknown }).key === "string" && | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3441 | } | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3481 | // nested combo's own `limit.context` is computed below in this same | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 3521 | } | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4121 | // publishes a static block via `config` AND a dynamic one via `provider.models` | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 4641 | entry.reasoning = false; | COMMENT |
| LOW | @omniroute/opencode-plugin/src/index.ts | 5661 | logger | COMMENT |
| LOW | bin/_ops-common.sh | 1 | # bin/_ops-common.sh — shared helpers for the OmniRoute ops runbook scripts. | COMMENT |
| LOW | bin/rollback.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | open-sse/config/providerErrorRules.ts | 81 | operatorProviderErrorRules = {}; | COMMENT |
| LOW | open-sse/config/providerErrorRules.ts | 201 | // Body: "you have used up your daily free allocation of 10,000 neurons, | COMMENT |
| LOW | open-sse/config/providerErrorRules.ts | 241 | // branch, and the restated 429 reaches them via the existing provider-rule | COMMENT |
| LOW | open-sse/config/providerModels.ts | 221 | const bareModelId = prefix ? modelId.slice(prefix.length) : modelId; | COMMENT |
| LOW | open-sse/config/providerFieldStrips.ts | 1 | // Fields that, when literally named in an upstream 400 body, are safe to strip and | COMMENT |
| LOW | open-sse/config/constants.ts | 21 | COMMENT | |
| LOW | open-sse/config/constants.ts | 41 | COMMENT | |
| LOW | open-sse/config/agyModels.ts | 1 | // Antigravity CLI (`agy`) model catalog. | COMMENT |
| LOW | open-sse/config/providers/registry/poe/index.ts | 1 | import type { RegistryEntry } from "../../shared.ts"; | COMMENT |
| LOW | open-sse/config/providers/registry/openrouter/index.ts | 21 | // OpenRouter multiplexes hundreds of independent upstream models behind one | COMMENT |
| LOW | open-sse/config/providers/registry/clinepass/index.ts | 1 | import type { RegistryEntry } from "../../shared.ts"; | COMMENT |
| LOW | open-sse/config/providers/registry/tokenrouter/index.ts | 1 | import type { RegistryEntry } from "../../shared.ts"; | COMMENT |
| LOW | open-sse/config/providers/registry/novita/index.ts | 21 | // advertises `input_modalities: ["text","image"]`, accepts an image part with HTTP 200, | COMMENT |
| LOW | open-sse/config/providers/registry/factory/index.ts | 1 | import type { RegistryEntry } from "../../shared.ts"; | COMMENT |
| LOW | …en-sse/config/providers/registry/opencode/zen/index.ts | 101 | supportsReasoning: true, | COMMENT |
| LOW | open-sse/transformer/responsesTransformer.ts | 401 | }; | COMMENT |
| LOW | open-sse/utils/proxyDispatcher.ts | 61 | keepAliveMaxTimeout: timeouts.fetchKeepAliveTimeoutMs, | COMMENT |
| LOW | open-sse/utils/proxyDispatcher.ts | 101 | // response, forcing a fresh TCP+TLS+CONNECT handshake per request. Proxies | COMMENT |
| LOW | open-sse/utils/responsesCommentaryDrop.ts | 1 | // open-sse/utils/responsesCommentaryDrop.ts | COMMENT |
| LOW | open-sse/utils/cursorAgentProtobuf.ts | 301 | COMMENT | |
| LOW | open-sse/utils/earlyStreamKeepalive.ts | 41 | // id/model stay brand-neutral — these frames go to the client, not upstream. | COMMENT |
| LOW | open-sse/utils/stream.ts | 821 | // the chunks pushed here are the RAW PROVIDER response, whose format is | COMMENT |
| LOW | open-sse/utils/stream.ts | 1661 | // clientPayloadCollector on the common (non-tool-call, non- | COMMENT |
| LOW | open-sse/utils/stream.ts | 1721 | injectedUsage = true; | COMMENT |
| LOW | open-sse/utils/fetchStartTimeoutPolicy.ts | 1 | // #11526: the fetch-start (headers-wait) phase had no ceiling comparable to a | COMMENT |
| LOW | open-sse/utils/aiSdkCompat.ts | 121 | COMMENT | |
| LOW | open-sse/utils/streamHandler.ts | 601 | // all emit a finish_reason chunk, the non-standard executors (kiro, cursor, | COMMENT |
| LOW | open-sse/utils/diagnostics.ts | 221 | // Text block with visible text. `convertOpenAINonStreamingToClaude` emits | COMMENT |
| LOW | open-sse/utils/diagnostics.ts | 241 | // (Previously only a non-empty `thinking` text OR `signature` counted — | COMMENT |
| LOW | open-sse/utils/cacheControlPolicy.ts | 81 | "anthropic", | COMMENT |
| LOW | open-sse/utils/proxyFetch.ts | 21 | } from "@/shared/utils/featureFlags"; | COMMENT |
| LOW | open-sse/utils/proxyFetch.ts | 581 | const runDirect = () => proxyContext.run(DIRECT_PROXY_CONTEXT, fn); | COMMENT |
| LOW | open-sse/utils/proxyFetch.ts | 961 | const mergedHeaders = new Headers(options?.headers); | COMMENT |
| LOW | open-sse/translator/deepseekWebTools.ts | 1 | // DeepSeek-web-specific tool-call translation. | COMMENT |
| LOW | open-sse/translator/index.ts | 761 | } | COMMENT |
| 611 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 228 | <img src="./docs/diagrams/tier-cascade.svg" width="100%" alt="OmniRoute request flow: your IDE or CLI (Claude Code, Curs | CODE |
| MEDIUM | README.md | 1611 | ### 🧠 Memory & RAG | COMMENT |
| MEDIUM | @omniroute/opencode-provider/README.md | 151 | - [OpenCode](https://opencode.ai) — the agentic CLI consumer. | CODE |
| MEDIUM⚡ | config/quality/file-size-baseline.json | 17 | "_rebaseline_2026_07_24_8470_hyperagent_sticky_thread": "PR #8470 (artickc, fix/hyperagent-tool-loop-thread-sticky) ow | CODE |
| MEDIUM⚡ | config/quality/file-size-baseline.json | 18 | "_rebaseline_2026_07_25_8494_capability_filter_fail_closed": "PR #8494 (fix/capability-filters-fail-closed, #8488) own | CODE |
| MEDIUM⚡ | config/quality/file-size-baseline.json | 28 | "_rebaseline_2026_07_21_7301_universal_cooldown_retry": "PR #7301 (ViFigueiredo, feat/universal-cooldown-retry) own gr | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 4 | "_rebaseline_2026_08_20_10574_reasoning_transport_fallback": "PR #10574 (jackjinke, fix/responses-reasoning-transport, | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 119 | "_rebaseline_2026_06_18_4189_combo_token_limits": "PR #4189 (megamen32) own growth: catalog.ts 1440->1463 (+23 at the | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 292 | "_rebaseline_2026_07_08_vb_reroute": "PR #6640 (Vision Bridge reroute) own growth, re-measured post-merge with origin/ | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 313 | "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-ss | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 479 | "_rebaseline_2026_08_24_video_bridge_fu02_fu07_sampler": "PRs #11344 (FU-02 one-frame scene-aware determinism) + #11 | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 487 | "_rebaseline_2026_08_28_mergebatch_v3851_ratchet_bank_reconcile": "/merge-batch 2026-08-28 (v3.8.51): boarding #1170 | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 519 | "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-sse/ | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 648 | "_rebaseline_2026_08_04_9268_gemini_schema_empty_choices": "Feature #9268 own growth: open-sse/utils/stream.ts 2889->2 | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 649 | "_rebaseline_2026_08_09_5696_capability_filter": "PR #9424 own growth: open-sse/handlers/chatCore.ts 5050->5061 (+11). | CODE |
| MEDIUM | config/quality/test-masking-allowlist.json | 154 | "reason": "v3.8.49 #8433: fix(guardrails) Vision Bridge describe-fallback ignora candidatos inalcançáveis — o test | CODE |
| MEDIUM | open-sse/translator/webTools.ts | 4 | // calling — they reply with tool invocations as raw text. To let agentic clients use | COMMENT |
| MEDIUM | open-sse/translator/paramSupport.ts | 87 | // explicit max_tokens to 32000 whenever tools are present, so every agentic | COMMENT |
| MEDIUM | open-sse/translator/request/openai-to-kiro.ts | 196 | // images (the agentic tool-loop case), so the "(empty)" placeholder is only | COMMENT |
| MEDIUM | open-sse/translator/request/openai-to-kiro.ts | 818 | // OmniRoute so Kiro only receives a real upstream model ID. Non-functional agentic and | COMMENT |
| MEDIUM | open-sse/translator/helpers/openaiHelper.ts | 70 | // reasoning blobs inflate context on every subsequent agentic turn (O(n^2)). | COMMENT |
| MEDIUM | open-sse/translator/helpers/geminiHelper.ts | 61 | // #9617: array uniqueness keyword — agentic-CLI tool schemas (JSON-Schema | COMMENT |
| MEDIUM | open-sse/translator/helpers/geminiHelper.ts | 61 | // #9617: array uniqueness keyword — agentic-CLI tool schemas (JSON-Schema | COMMENT |
| MEDIUM | open-sse/executors/base.ts | 765 | // - 0c94c397d (#2743, 2026-05-26): a multi-agent review added a | COMMENT |
| MEDIUM | open-sse/executors/copilot-m365-web.ts | 401 | // exact echo back, or it drops the socket mid-turn on long agentic runs. | COMMENT |
| MEDIUM | open-sse/executors/copilot-m365-web.ts | 693 | // `tool_calls` with finish_reason "tool_calls" (OpenAI agentic-loop shape). | COMMENT |
| MEDIUM | open-sse/executors/kiro.ts | 584 | // the first content token, and on large/agentic contexts the gap before | COMMENT |
| MEDIUM | open-sse/executors/perplexity-web.ts | 584 | // #5927). Without this, streaming requests (the default for agentic | COMMENT |
| MEDIUM | open-sse/executors/perplexity-web.ts | 584 | // #5927). Without this, streaming requests (the default for agentic | COMMENT |
| MEDIUM | open-sse/executors/deepseek-web.ts | 504 | // trajectory instead of only the last user message, so agentic clients that never send | COMMENT |
| MEDIUM | open-sse/executors/deepseek-web.ts | 555 | // information". Fold them into the transcript as plain text, mirroring the agentic | COMMENT |
| MEDIUM | open-sse/executors/deepseek-web.ts | 917 | // Tool (agentic) requests replay the whole trajectory — prior tool calls and their | COMMENT |
| MEDIUM | open-sse/executors/notion-web.ts | 599 | // Optional custom agent (workflowId). Empty → default Notion AI (not agentic-specific). | COMMENT |
| MEDIUM | open-sse/executors/azureParamRules.ts | 69 | // agentic client (Claude Code, Cursor agent) on every turn. | COMMENT |
| MEDIUM | open-sse/executors/conol-web.ts | 134 | // other agentic protocol blocks into the user's text prompt. | COMMENT |
| MEDIUM | open-sse/executors/hyperagent.ts | 245 | // Strip common agentic / user-pin wrappers so the same user task fingerprints | COMMENT |
| MEDIUM | open-sse/executors/hyperagent.ts | 419 | // 2) Root user task (stable across agentic tool_calls reverse-convert + tool loops) | COMMENT |
| MEDIUM | open-sse/executors/promptql/threadSticky.ts | 70 | // system/developer often carry jailbreak/agentic pins that are shared across chats | COMMENT |
| MEDIUM | open-sse/executors/promptql/threadSticky.ts | 93 | // Tool-result follow-up wrappers (WinUI soft PromptQL / generic agentic) | COMMENT |
| MEDIUM | open-sse/services/notionThreadSessions.ts | 176 | // Drop other common agentic preamble fingerprints if the whole pin leaked in. | COMMENT |
| MEDIUM | open-sse/services/fusion.ts | 367 | // with the full, unmodified body (tools/tool_choice intact) so agentic | COMMENT |
| MEDIUM | open-sse/services/reasoningInputPolicy.ts | 405 | // Default to "drop" for single-target requests so multi-turn agentic loops on direct | COMMENT |
| MEDIUM | open-sse/services/contextManager.ts | 23 | // through to 128k and blocking normal agentic tool loops with huge catalogs. | COMMENT |
| MEDIUM | open-sse/services/autoCombo/complexityRouter.ts | 59 | // Tool-using / agentic requests need reliable function calling — floor at "cheap". | COMMENT |
| MEDIUM | open-sse/services/autoCombo/complexityRouter.ts | 97 | // favors function-calling-reliable models for agentic requests. | COMMENT |
| MEDIUM | tests/unit/conversationTracker.test.ts | 476 | // Discovered live: real agentic traffic (a tool-polling loop, "ack"/"poll" | COMMENT |
| MEDIUM | tests/unit/model-capabilities-registry.test.ts | 106 | // #6191: max_input_tokens is a distinct, smaller cap than the context window. | COMMENT |
| MEDIUM | tests/unit/translator-openai-to-kiro.test.ts | 841 | // Regression for the same bug class as upstream decolua/9router#2183: an agentic | COMMENT |
| MEDIUM | tests/unit/translator-openai-to-kiro.test.ts | 841 | // Regression for the same bug class as upstream decolua/9router#2183: an agentic | COMMENT |
| MEDIUM | tests/unit/executor-codex.test.ts | 530 | // with store=false only inflates every subsequent agentic turn (decolua/9router#1599). | COMMENT |
| MEDIUM | tests/unit/perplexity-web-streaming-tools-5927.test.ts | 5 | // requests — the default for agentic coding clients — got the raw <tool> text | COMMENT |
| MEDIUM | tests/unit/executor-hyperagent.test.ts | 184 | // turn2 agentic rewrites assistant as different text → old fingerprint miss → new thread. | COMMENT |
| MEDIUM | tests/unit/executor-hyperagent.test.ts | 193 | // Mutated assistant (what agentic conversion produces on the next request) | COMMENT |
| MEDIUM | tests/unit/deepseek-web-tool-result-prompt-4712.test.ts | 2 | // string, so tool results must be folded into the transcript. The agentic path | COMMENT |
| MEDIUM | tests/unit/vision-bridge-policy-reroute-6640.test.ts | 13 | // tests/unit/guardrails/visionBridge.test.ts) — it always falls through to | COMMENT |
| MEDIUM | tests/unit/vision-bridge-policy-reroute-6640.test.ts | 118 | // description (see VB-CRED-01 in tests/unit/guardrails/visionBridge.test.ts). | COMMENT |
| MEDIUM | tests/unit/deepseek-web-issue-10527-repro.test.ts | 5 | // XML-tool-convention agentic clients) never sends OpenAI-native `tools[]`, so it always | COMMENT |
| MEDIUM | tests/unit/executor-notion-web.test.ts | 519 | // system injects (jailbreak/agentic) and multimodal user turns never | COMMENT |
| MEDIUM | tests/unit/messages-count-tokens-route.test.ts | 200 | // Real agentic conversations carry ~95% of their tokens inside tool_use inputs | COMMENT |
| MEDIUM | tests/unit/deepseek-web-rolling-window-2942.test.ts | 9 | // dropped the original task for agentic clients (Cline) that never send OpenAI-native | COMMENT |
| 91 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | open-sse/mcp-server/toolCardinality.ts | 137 | // Step 1: filter by scope / explicit allow, then apply deny. | COMMENT |
| LOW | open-sse/mcp-server/toolCardinality.ts | 156 | // Step 2: cap by maxTools. A negative max would silently drop tail entries via | COMMENT |
| LOW | open-sse/translator/index.ts | 457 | // Step 1: source -> openai (if source is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 493 | // Step 2: openai -> target (if target is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 818 | // Step 1: target -> openai (if target is not openai) | COMMENT |
| LOW | open-sse/translator/index.ts | 831 | // Step 2: openai -> source (if source is not openai) | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1319 | // Step 1: GraphQL warmup initialises the conversation on Meta's side | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1333 | // Step 2: GraphQL mode switch sets the conversation's reasoning level | COMMENT |
| LOW | open-sse/executors/muse-spark-web.ts | 1347 | // Step 3: Send message via WebSocket | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 232 | // Step 1: Upload the audio file | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 300 | // Step 1: Upload the audio file (multipart/form-data) | COMMENT |
| LOW⚡ | open-sse/handlers/audioTranscription.ts | 708 | // Step 1: submit the job — multipart body with "data_file" (audio) + "config" (JSON) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 249 | // Step 2: Submit transcription request | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 269 | // Step 3: Poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 314 | // Step 2: Submit the pre-recorded transcription job | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 330 | // Step 3: Poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 588 | // Step 1: submit the job — multipart body with "media" (file) + "options" (JSON) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 604 | // Step 2: poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/audioTranscription.ts | 730 | // Step 2: poll for completion (max 120s) | COMMENT |
| LOW | open-sse/handlers/videoGeneration/dashscopeHandler.ts | 115 | // Step 1: create async task (X-DashScope-Async: enable) | COMMENT |
| LOW | open-sse/handlers/videoGeneration/dashscopeHandler.ts | 138 | // Step 2: poll statusUrl/{task_id} until terminal | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 324 | // Step 1: Build base request | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 327 | // Step 2: Remap tool names | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 334 | // Step 5: Cache control | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 376 | // Step 6: Obfuscation (optional, per-provider setting) | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 381 | // Step 7: Serialize with CCH placeholder (strip internal sentinel fields) | COMMENT |
| LOW⚡ | open-sse/services/claudeCodeCompatible.ts | 385 | // Step 8: Sign with xxHash64 | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 69 | // Step 1: Tool-result compression | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 108 | // Step 2: Progressive aging | COMMENT |
| LOW | open-sse/services/compression/aggressive.ts | 123 | // Step 3: Fallback summarizer for remaining long messages | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 33 | // Step 1: Open the breaker (failureThreshold: 1 -> one failure opens it) | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 43 | // Step 2: Wait past resetTimeout so _refreshOpenState transitions to HALF_OPEN | COMMENT |
| LOW⚡ | tests/unit/provider-breaker-halfopen-recovery.test.ts | 48 | // Step 3: recordProviderSuccess should close the breaker | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 127 | // Step 3: catalog surfaces capabilities.effort_tiers for synced models. | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 173 | // Step 4: catalog generates `-{effort}` alias ids per declared tier. | COMMENT |
| LOW | …sts/unit/sync-reasoning-supported-efforts-7694.test.ts | 271 | // Step 5: request-time `<prefix>/<model>-{effort}` alias resolution. | COMMENT |
| LOW⚡ | tests/unit/executor-huggingchat.test.ts | 76 | // Step 1: conversation creation succeeds. | COMMENT |
| LOW⚡ | tests/unit/executor-huggingchat.test.ts | 82 | // Step 2: the parent-message GET fails -> fetchInitialParentMessageId -> null. | COMMENT |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 226 | // Step 1: bootstrap project (what route.ts now does before the models loop). | COMMENT |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 229 | // Step 2: simulate a :models discovery request (what the loop does). | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 22 | // Step 1: Responses API format → Chat Completions format | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 62 | // Step 2: That Chat Completions chunk → Responses API events | COMMENT |
| LOW⚡ | …nit/translator-resp-openai-responses-roundtrip.test.ts | 116 | // Step 1: Responses → OpenAI (Chat Completions) | COMMENT |
| LOW | …nit/translator-resp-openai-responses-roundtrip.test.ts | 155 | // Step 2: OpenAI → Responses | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 411 | // Step 1: Initial state - track extra keys | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 415 | // Step 2: First request - should get primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 420 | // Step 3: Simulate 401 failure on primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 425 | // Step 4: Retry - should get a valid key (primary is still active, but round-robin may pick extra) | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 432 | // Step 5: Second 401 failure | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 437 | // Step 6: Third 401 failure - now primary becomes invalid | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 442 | // Step 7: Next request - should skip invalid primary and return extra key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 449 | // Step 8: Verify the invalid key count | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 452 | // Step 9: A3 guard check - connection with extra keys should NOT be disabled | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 457 | // Step 10: Success on extra key - mark it as successful | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 463 | // Step 11: Recover primary key | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 468 | // Step 12: Next request - can use primary again | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 619 | // Step 1: T07 code in chatCore.ts records key failure | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 622 | // Step 2: A3 guard in chat.ts checks if connection has extra keys | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 627 | // Step 3: With A3 guard, markAccountUnavailable should be skipped | COMMENT |
| LOW⚡ | tests/unit/api-key-rotator-health.test.ts | 630 | // Step 4: Next request should get backup key | COMMENT |
| 74 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | open-sse/mcp-server/__tests__/httpAuthContext.test.ts | 54 | headers: { "x-api-key": "placeholder" }, | CODE |
| LOW | tests/unit/antigravity-weekly-quota-4017.test.ts | 204 | accessToken: "fake-token-weekly-unique", | CODE |
| LOW | tests/unit/antigravity-weekly-quota-4017.test.ts | 249 | accessToken: "fake-token-weekly-unavailable", | CODE |
| LOW | tests/unit/noauth-autocombo-lockout-7623.test.ts | 74 | accessToken: "fake-token-locked", | CODE |
| LOW | tests/unit/noauth-autocombo-lockout-7623.test.ts | 81 | accessToken: "fake-token-healthy", | CODE |
| LOW | tests/unit/claudeAuthFile.test.ts | 250 | const email = "user@example.com"; | CODE |
| LOW | tests/unit/claudeAuthFile.test.ts | 328 | displayName: "John Doe", | CODE |
| LOW | tests/unit/claudeAuthFile.test.ts | 331 | assert.equal(extractClaudeEmail(conn), "John Doe"); | CODE |
| LOW⚡ | tests/unit/codex-import-route.test.ts | 53 | email: "user@example.com", | CODE |
| LOW⚡ | tests/unit/codex-import-route.test.ts | 58 | assert.equal(result.data.email, "user@example.com"); | CODE |
| LOW | tests/unit/antigravity-usage-service.test.ts | 26 | accessToken: "fake-token", | CODE |
| LOW | tests/unit/db-providers-access-token-1290.test.ts | 52 | email: "user@example.com", | CODE |
| LOW | tests/unit/db-providers-access-token-1290.test.ts | 59 | email: "user@example.com", | CODE |
| LOW | tests/unit/antigravity-dynamic-session-id-10443.test.ts | 6 | const credentials = { email: "user@example.com", connectionId: "conn_123" }; | CODE |
| LOW | …nit/antigravity-oauth-postexchange-nonblocking.test.ts | 72 | if (u.includes("userinfo")) return jsonRes({ email: "user@example.com" }); | CODE |
| LOW | …nit/antigravity-oauth-postexchange-nonblocking.test.ts | 187 | if (u.includes("userinfo")) return jsonRes({ email: "user@example.com" }); | CODE |
| LOW | …nit/antigravity-oauth-postexchange-nonblocking.test.ts | 216 | if (u.includes("userinfo")) return jsonRes({ email: "user@example.com" }); | CODE |
| LOW | tests/unit/combo-system-prompt-templates-5501.test.ts | 187 | body: bodyWithSystem("placeholder"), | CODE |
| LOW | tests/unit/combo-system-prompt-templates-5501.test.ts | 221 | body: bodyWithSystem("placeholder"), | CODE |
| LOW | tests/unit/combo-system-prompt-templates-5501.test.ts | 239 | body: bodyWithSystem("placeholder"), | CODE |
| LOW | tests/unit/executor-command-code.test.ts | 52 | credentials: { apiKey: "fake-key" }, | CODE |
| LOW | tests/unit/executor-command-code.test.ts | 115 | credentials: { apiKey: "fake-key" }, | CODE |
| LOW | tests/unit/executor-command-code.test.ts | 183 | credentials: { apiKey: "fake-key" }, | CODE |
| LOW | tests/unit/executor-command-code.test.ts | 194 | assert.equal(headers.Authorization, "Bearer fake-key"); | CODE |
| LOW | tests/unit/openapi-spec-example-body.test.ts | 26 | "user@example.com" | CODE |
| LOW | tests/unit/db-api-key-groups.test.ts | 75 | const result = addKeyToGroup("fake-key-id", group.id); | CODE |
| LOW | tests/unit/codex-connection-edit-6562.test.ts | 78 | email: "user@example.com", | CODE |
| LOW | tests/unit/antigravity-discovery-bootstrap.test.ts | 50 | const projectId = await ensureAntigravityProjectAssigned("fake-token-1", mockFetch); | CODE |
| LOW | tests/unit/antigravity-discovery-bootstrap.test.ts | 56 | getAntigravityProjectFromCache("fake-token-1"), | CODE |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 73 | await ensureAntigravityProjectAssigned("fake-token-2", mockFetch); | CODE |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 74 | await ensureAntigravityProjectAssigned("fake-token-2", mockFetch); | CODE |
| LOW⚡ | tests/unit/antigravity-discovery-bootstrap.test.ts | 75 | await ensureAntigravityProjectAssigned("fake-token-2", mockFetch); | CODE |
| LOW | tests/unit/adobe-firefly-browser-login.test.ts | 36 | Buffer.from(JSON.stringify({ email: "user@example.com", sub: "abc" })).toString("base64url") + | CODE |
| LOW | tests/unit/oauth-connection-test-timeout.test.ts | 52 | accessToken: "fake-token", | CODE |
| LOW | tests/unit/codex-app-server.test.ts | 696 | result: { account: { type: "chatgpt", email: "user@example.com", planType: "pro" }, requiresOpenaiAuth: true }, | CODE |
| LOW | tests/unit/codex-app-server.test.ts | 701 | assert.equal(status.account.email, "user@example.com"); | CODE |
| LOW | tests/unit/antigravity-quota-host-8965.test.ts | 140 | accessToken: "fake-token-host-test-8965", | CODE |
| LOW | tests/unit/antigravity-quota-host-8965.test.ts | 243 | accessToken: "fake-token-host-impact", | CODE |
| LOW | tests/unit/claudeAuthImport.test.ts | 217 | organization_name: "Acme Corp", | CODE |
| LOW | tests/unit/claudeAuthImport.test.ts | 246 | assert.equal(enriched.organizationName, "Acme Corp"); | CODE |
| LOW | tests/unit/codex-finalize-tokens.test.ts | 14 | email: "user@example.com", | CODE |
| LOW | tests/unit/codex-finalize-tokens.test.ts | 35 | assert.equal(tokenData.email, "user@example.com"); | CODE |
| LOW | tests/unit/db-providers-crud.test.ts | 392 | email: "user@example.com", | CODE |
| LOW | tests/unit/oauth-connection-tokenexpiresat-5326.test.ts | 31 | email: "user@example.com", | CODE |
| LOW | tests/unit/deepseek-web.test.ts | 131 | data: { biz_data: { token: "test-access-token-123", email: "test@test.com" } }, | CODE |
| LOW | tests/unit/oidc-callback.test.ts | 104 | email: "admin@example.com", | CODE |
| LOW | tests/unit/oidc-callback.test.ts | 199 | oidcAllowedSubjects: ["user-123", "admin@example.com"], | CODE |
| LOW | tests/unit/oidc-callback.test.ts | 258 | oidcAllowedSubjects: ["admin@example.com"], | CODE |
| LOW | tests/unit/oidc-callback.test.ts | 267 | email: "admin@example.com", | CODE |
| LOW | tests/unit/streamingPiiTransform.test.ts | 98 | assert.ok(!output.includes("beta-user@example.org")); | CODE |
| LOW | tests/unit/streamingPiiTransform.test.ts | 210 | !output.includes("user@example.com"), | CODE |
| LOW | tests/unit/kiro-second-oauth-connection-10815.test.ts | 22 | email: "user@example.com", | CODE |
| LOW | tests/unit/kiro-second-oauth-connection-10815.test.ts | 35 | email: "user@example.com", | CODE |
| LOW⚡ | tests/unit/antigravity-credits.test.ts | 70 | const credentials = { email: "user@example.com", sub: "abc123" }; | CODE |
| LOW⚡ | tests/unit/antigravity-credits.test.ts | 71 | const providerSpecificData = { email: "user@example.com", sub: "abc123" }; | CODE |
| LOW | tests/unit/codex-auth-import-expiry.test.ts | 31 | email: "user@example.com", | CODE |
| LOW | tests/unit/web-session-contract.test.ts | 73 | "placeholder", | CODE |
| LOW | tests/unit/xai-oauth-provider.test.ts | 65 | const idToken = createJwt({ email: "user@example.com", name: "Grok User" }); | CODE |
| LOW | tests/unit/xai-oauth-provider.test.ts | 67 | email: "user@example.com", | CODE |
| LOW | tests/unit/xai-oauth-provider.test.ts | 80 | assert.equal(mapped.email, "user@example.com"); | CODE |
| 96 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/unit/guide-settings-route.test.ts | 125 | assert.ok(content.provider.omniroute.options.apiKey.startsWith("sk-")); | CODE |
| CRITICAL | tests/unit/guide-settings-route.test.ts | 134 | assert.ok(content.providers.omniroute.settings.apiKey.startsWith("sk-")); | CODE |
| CRITICAL | tests/unit/guide-settings-route.test.ts | 203 | assert.ok(content.provider.omniroute.options.apiKey.startsWith("sk-")); | CODE |
| CRITICAL | tests/unit/i18n-cli-namespaces.test.ts | 46 | pt.cliCommon.concept.code.phrase.includes("código"), | CODE |
| CRITICAL | tests/unit/batch_api.test.ts | 452 | !result.response.body.error.message.includes("Unexpected token"), | CODE |
| CRITICAL | tests/unit/translator-openai-to-gemini.test.ts | 153 | assert.deepEqual(cleaned.properties.payload.properties.nested.required.sort(), ["a", "b"]); | CODE |
| CRITICAL | tests/unit/v1-models-catalog-ttl.test.ts | 75 | const parsed = databaseSettingsSchema.shape.cache.shape.modelCatalogCacheTtlMs.safeParse( | CODE |
| CRITICAL | tests/unit/dashboard-localization-contract.test.ts | 80 | assert.ok(messages.featureFlags.definitions.REQUIRE_API_KEY.description.includes("khóa API")); | CODE |
| CRITICAL | tests/unit/dashboard-localization-contract.test.ts | 82 | messages.featureFlags.definitions.OMNIROUTE_AUTO_SYNC_CLAUDE_PROFILES.description.includes( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .mergify.yml | 37 | # anchor check succeeded" — robust to the path-filtered fast-gates (docs-only | COMMENT |
| MEDIUM | config/quality/file-size-baseline.json | 43 | "_rebaseline_2026_07_07_v3846_release_close": "Release v3.8.46 Phase 0 (generate-release) — drift de ciclo absorvido n | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 254 | "_rebaseline_2026_06_13_2743d_skipbreaker": "Re-baseline #2743 gap-d (testar consumer do skipProviderBreaker): combo.t | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 275 | "_rebaseline_2026_07_02_5899_airforce_v1_discovery": "PR #5904 own growth: provider-models-route.test.ts 1628->1752 (+ | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 313 | "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-ss | CODE |
| MEDIUM | config/quality/file-size-baseline.json | 519 | "_rebaseline_2026_06_22_4644_deepseek_web_tools": "PR #4644 (BugsBag/robust deepseek-web tool-call parsing): open-sse/ | CODE |
| LOW | config/quality/file-size-baseline.json | 327 | "_rebaseline_2026_07_02_5816_qoder": "PR #5816 (@AgentKiller45, qoder PAT via qodercli): qoderCli.ts 666->989, new-a | CODE |
| LOW | config/quality/file-size-baseline.json | 368 | "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->10 | CODE |
| LOW | config/quality/file-size-baseline.json | 533 | "_rebaseline_2026_07_02_5816_qoder": "PR #5816 (@AgentKiller45, qoder PAT via qodercli): qoderCli.ts 666->989, new-abo | CODE |
| LOW | config/quality/file-size-baseline.json | 573 | "_rebaseline_pr1043_minimax_tts": "Upstream port decolua/9router#1043 (toanalien) own growth: audioSpeech.ts 965->1061 | CODE |
| MEDIUM | config/quality/test-masking-allowlist.json | 230 | "tests/unit/antigravity-client-profile.test.ts": "v3.8.49 #8013: o modelo de perfil harness/sdk/cli virou ide/cli unif | CODE |
| MEDIUM | open-sse/config/codexInstructions.ts | 33 | ## Codex CLI harness, sandboxing, and approvals | COMMENT |
| MEDIUM | open-sse/services/githubCopilotModels.ts | 92 | // (rename-robust) rather than an id allowlist: any model the account is entitled | COMMENT |
| MEDIUM | tests/unit/mcp-connect-scope.test.ts | 3 | // Hard Rules #15/#17) — dedicated regression tests, mirroring the harness in | COMMENT |
| MEDIUM | tests/unit/combo-response-validation-failover.test.ts | 4 | * Mirrors the #5085 empty-content failover harness (2 legs, different providers). | COMMENT |
| MEDIUM | tests/unit/combo/comboSort.test.ts | 101 | // Expected order derived from PROVIDER_ORDER (robust to provider precedence). | COMMENT |
| MEDIUM | scripts/i18n/i18n_autotranslate.py | 100 | # A true robust implementation would diff against the English source. | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 336 | # authenticated via GITHUB_TOKEN (5000 req/hr) — robust under load. | COMMENT |
| MEDIUM | src/i18n/messages/pt.json | 6098 | "bai": "Chave de API Bearer para o gateway de LLM compatível com OpenAI da b.ai (distinto de TheB.AI). Crie uma ch | CODE |
| MEDIUM | src/i18n/messages/pt.json | 6124 | "dgrid": "Crie uma chave de API DGrid em https://dgrid.ai e, em seguida, utilize https://api.dgrid.ai/v1 como o UR | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.yml | 14 | # Usage: | COMMENT |
| LOW⚡ | docker-compose.prod.yml | 8 | # Usage: | COMMENT |
| LOW | scripts/quality/test-scoped.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/ci/resolve-docker-publish-version.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/ci/should-promote-latest.sh | 13 | # Usage: | COMMENT |
| LOW | scripts/release/merge-train.sh | 14 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | …nit/translator-resp-openai-responses-roundtrip.test.ts | 113 | print("Done") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/lib/providers/validation/audioMiscProviders.ts | 157 | // Use credit check endpoint as requested by user based on Kie.ai docs. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/i18n/validate_translation.py | 371 | source_str = str(source_val)[:25] if source_val else "(null)" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/i18n/validate_translation.py | 99 | CODE | |
| LOW | scripts/i18n/validate_translation.py | 386 | CODE | |
| LOW | scripts/i18n/validate_translation.py | 581 | CODE | |
| LOW | scripts/sre/tcp-close-analyzer.py | 390 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/i18n/i18n_autotranslate.py | 91 | except Exception as e: | CODE |
| LOW | scripts/sre/tcp-close-analyzer.py | 309 | except Exception: | CODE |
| LOW | scripts/sre/tcp-close-analyzer.py | 321 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/i18n/check_translations.py | 112 | # Check if key matches any full key in en.json | COMMENT |
| LOW | scripts/i18n/validate_translation.py | 598 | # Check if translation file exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/electron-release.yml | 181 | # Create a clean temp profile directory to avoid this. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/i18n/i18n_autotranslate.py | 23 | CODE | |
| LOW | scripts/i18n/i18n_autotranslate.py | 24 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/lib/evals/evalRunner/builtinSuites.ts | 578 | "Find and fix the bug: async function getData() { const response = fetch('/api/data'); return response.jso | CODE |