Turn Windsurf / Devin Desktop's 100+ AI models (Claude, GPT, Gemini, DeepSeek, Kimi, GLM, SWE) into OpenAI-, Anthropic- & Gemini-compatible APIs. Zero-dependency self-hosted reverse proxy for Claude Code, Cline & Cursor. 把 Windsurf/Devin 云端 100+ 模型变成三套兼容 API。
This report presents the forensic synthetic code analysis of dwgx/WindsurfAPI, a JavaScript project with 2,955 GitHub stars. SynthScan v2.0 examined 178,121 lines of code across 696 source files, recording 1088 pattern matches distributed across 12 syntactic categories. The overall adjusted score of 8.7 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1088 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install-ls.sh | 70 | # ─── Platform detection ──────────────────────────────── | COMMENT |
| MEDIUM | test/devin-connect.test.js | 1481 | // ── Fault tolerance: response-side ChatToolCall structure (NW1 §2) ────────── | COMMENT |
| MEDIUM | test/devin-connect.test.js | 2099 | // ── Top-level combinator stripping (P4, ported from kiro.rs) ────────────── | COMMENT |
| MEDIUM | test/zero-content-stream-death.test.js | 35 | // ─── helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/zero-content-stream-death.test.js | 133 | // ─── Anthropic egress ─────────────────────────────────────────── | COMMENT |
| MEDIUM | test/zero-content-stream-death.test.js | 196 | // ─── Gemini egress ────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/zero-content-stream-death.test.js | 250 | // ─── three-way parity ─────────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 12 | // ─── helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 49 | // ─── request translation ──────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 208 | // ─── non-stream response translation ──────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 257 | // ─── error mapping (transient-first) ──────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 294 | // ─── path parsing ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 310 | // ─── main entry: non-stream ───────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 349 | // ─── main entry: streaming ────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 561 | // ─── translator direct unit (array mode empties) ──────────────── | COMMENT |
| MEDIUM⚡ | test/gemini.test.js | 573 | // ════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/gemini.test.js | 575 | // ════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/gemini.test.js | 577 | // ─── request translation: remaining part / config shapes ──────── | COMMENT |
| MEDIUM | test/gemini.test.js | 677 | // ─── non-stream response: finish + usage edge cases ───────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 797 | // ─── path parsing: edge cases ─────────────────────────────────── | COMMENT |
| MEDIUM | test/connect.test.js | 9 | // ─── CONN-1: decompression output must be bounded ───────────────────────── | COMMENT |
| MEDIUM | test/tool-preamble-budget.test.js | 125 | // ─── nativeStructured (hybrid mode) regression tests ───────────────────────── | COMMENT |
| MEDIUM | test/cascade-think-reroute.test.js | 330 | // ── emulateTools + failure: the accThinking hole ────────────────────────── | COMMENT |
| MEDIUM | test/default-on-switch-registry.test.js | 44 | // ── the ledger ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/connect-error-blame.test.js | 99 | // ─── 结构守卫 ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/cascade-native-bridge.test.js | 807 | // ─── v2.0.66 (#115) — partition mode + codex CLI mapping ────────────── | COMMENT |
| MEDIUM | test/cascade-native-bridge.test.js | 807 | // ─── v2.0.66 (#115) — partition mode + codex CLI mapping ────────────── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 138 | // ───── #100 follow-up: bare-path fallback when no <env> block ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 138 | // ───── #100 follow-up: bare-path fallback when no <env> block ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 219 | // ───── #100 follow-up #2 (yunduobaba): Claude Code <system-reminder> wrappers ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 219 | // ───── #100 follow-up #2 (yunduobaba): Claude Code <system-reminder> wrappers ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 270 | // ───── #106 / #107 (zhangzhang-bit): adjective-prefixed cwd + bullet fallback ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 270 | // ───── #106 / #107 (zhangzhang-bit): adjective-prefixed cwd + bullet fallback ───── | COMMENT |
| MEDIUM | examples/proxy-user-inject.js | 109 | // ═══════════════ CONFIGURE THESE ═══════════════ | COMMENT |
| MEDIUM | examples/proxy-user-inject.js | 115 | // ════════════════════════════════════════════════ | COMMENT |
| MEDIUM | scripts/cli-agent-sim.js | 140 | // ── Test Scenarios ────────────────────────────────── | COMMENT |
| MEDIUM | scripts/cli-agent-sim.js | 300 | // ── Main ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/client.js | 344 | // ── Fake workspace scaffold ──────────────────────────────── | COMMENT |
| MEDIUM | src/client.js | 421 | // ─── WindsurfClient ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/client.js | 435 | // ─── Short-lived user JWT (env-gated) ──────────────────── | COMMENT |
| MEDIUM | src/client.js | 448 | // ─── Legacy: RawGetChatMessage (streaming) ─────────────── | COMMENT |
| MEDIUM | src/client.js | 610 | // ─── Cascade flow ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/client.js | 1414 | // ─── Register user (Connect-RPC primary, legacy REST fallback) ───── | COMMENT |
| MEDIUM | src/client.js | 1426 | // ── GetUserStatus ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/devin-acp.js | 41 | // ── Zero-billable proactive availability probe (AC1 gap-e / §4) ────────────── | COMMENT |
| MEDIUM | src/devin-acp.js | 157 | // ── Transient-first ACP error classification ──────────────────────────────── | COMMENT |
| MEDIUM | src/devin-connect-openai.js | 62 | // ── retry-on-empty (fable capacity-jitter self-heal) ──────────────────────── | COMMENT |
| MEDIUM | src/devin-connect-catalog.js | 430 | // ─── AssignModel — router-model resolution ────────────────────────────────── | COMMENT |
| MEDIUM | src/server.js | 311 | // ─── Dashboard ───────────────────────────────────────── | COMMENT |
| MEDIUM | src/server.js | 365 | // ─── Dashboard i18n locale files ──────────────────────── | COMMENT |
| MEDIUM | src/server.js | 382 | // ─── Dashboard data files (contributors, etc.) ────────── | COMMENT |
| MEDIUM | src/server.js | 401 | // ─── API endpoints (require API key) ──────────────────── | COMMENT |
| MEDIUM | src/server.js | 480 | // ── bind proxy to account ────────────────────── | COMMENT |
| MEDIUM | src/conversation-pool.js | 125 | // ─── temporal / identifier tokens ──────────────────────────── | COMMENT |
| MEDIUM | src/conversation-pool.js | 158 | // ─── git status / recent commits block (Claude Code 2.x) ───── | COMMENT |
| MEDIUM | src/conversation-pool.js | 204 | // ─── git short hashes ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 51 | // ─── Account pool ────────────────────────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 404 | // ─── C5: per-account rolling health window (persisted) ────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 819 | // ─── Dynamic model catalog from cloud ───────────────────── | COMMENT |
| MEDIUM | src/auth.js | 1320 | // ─── Account management ─────────────────────────────────── | COMMENT |
| 171 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README.en.md | 181 | COMMENT | |
| LOW | README.en.md | 201 | # Windows: %APPDATA%\Windsurf\bin\language_server_windows_x64.exe | COMMENT |
| LOW | README.md | 201 | COMMENT | |
| LOW | README.md | 221 | # | COMMENT |
| LOW | update.sh | 381 | echo "=== [1/5] Pull latest ===" | COMMENT |
| LOW | install-ls.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | docker-compose.yml | 21 | # required:false so a fresh clone (which ships only .env.example, never | COMMENT |
| LOW | docker-compose.yml | 41 | # one global bucket. Exactly one trusted hop here. | COMMENT |
| LOW | docker-compose.yml | 61 | volumes: | COMMENT |
| LOW | test/mutate-verify-harness.test.js | 1 | // The mutation harness's own verdict logic, which nothing covered until now. | COMMENT |
| LOW | test/mutate-verify-harness.test.js | 301 | COMMENT | |
| LOW | test/model-access-backend-coverage.test.js | 1 | // Model-access policy must gate EVERY backend, not just the one it happens to | COMMENT |
| LOW | test/models-live-catalog.test.js | 1 | // audit 2026-07-12 (v3.2.4 regression fix): after v3.2.3 made resolveConnectSelector | COMMENT |
| LOW | test/sticky-exclude-keys.test.js | 1 | // Sticky fast path vs. excludeKeys (failover regression). | COMMENT |
| LOW | test/route-error-parity-behaviour.test.js | 1 | // The route-parity guard checks SOURCE SHAPE, and shape is escapable. | COMMENT |
| LOW | test/neutralize-rewrite-visibility.test.js | 1 | // Item 14 — the neutralize pass silently rewrote caller content, and the guard | COMMENT |
| LOW | test/neutralize-rewrite-visibility.test.js | 21 | // | COMMENT |
| LOW | test/neutralize-rewrite-visibility.test.js | 121 | // several times is one event, not two, and reporting it twice would make the | COMMENT |
| LOW | test/dashboard-escape-callsites.test.js | 1 | // The escape helpers were tested; their CALL SITES were not. | COMMENT |
| LOW | test/v2088-audit-fixes.test.js | 1 | // v2.0.88 — strict audit follow-up: 4 HIGH + 3 MED/LOW from | COMMENT |
| LOW | test/terminal-event-guard.test.js | 1 | // After a terminal event, a stream translator must stop writing. | COMMENT |
| LOW | test/v2078-audit-fixes.test.js | 1 | // v2.0.78 — strict audit follow-up (4 HIGH). | COMMENT |
| LOW | test/prompt-cache-options.test.js | 1 | // Explicit prompt caching — GetChatMessageRequest #13 system_prompt_cache_options. | COMMENT |
| LOW | test/sticky-no-fallback-wedge.test.js | 1 | // stickyNoFallback could wedge a caller permanently. | COMMENT |
| LOW | test/devin-connect.test.js | 801 | // `response.incomplete` (a whole-turn hard failure for Codex-style clients), | COMMENT |
| LOW | test/response-store-byte-budget.test.js | 1 | // Response store: the byte budget. | COMMENT |
| LOW | test/response-store-byte-budget.test.js | 161 | // loop. Under any byte-bound workload the writer's entry count stays far below | COMMENT |
| LOW | test/scatter-attribution.test.js | 1 | // Why an UNBOUND caller's sequential turns move between accounts. | COMMENT |
| LOW | test/scatter-attribution.test.js | 21 | // ------------------------------------------------------------------ | COMMENT |
| LOW | test/scatter-attribution.test.js | 41 | // that account's ratio, so it sorts last next turn). LRU alone yields one swap and | COMMENT |
| LOW | test/retry-rescue-budget-split.test.js | 1 | // #240 — retry-on-empty and the thinking-only rescue are two speculative arms with two | COMMENT |
| LOW | test/retry-rescue-budget-split.test.js | 181 | // What follows pins the operator-visible NUMBER, and only that. Be precise about the | COMMENT |
| LOW | test/v2079-audit-followup.test.js | 1 | // v2.0.79 — strict audit follow-up (3 MED + 2 LOW + 1 close-out). | COMMENT |
| LOW | test/sticky-tenant-quota.test.js | 1 | // Sticky binding table: per-tenant fair share + LRU ordering. | COMMENT |
| LOW | test/rate-limit.test.js | 121 | assert.equal(result.body.error.type, 'rate_limit_exceeded'); | COMMENT |
| LOW | test/rate-limit.test.js | 141 | // Tolerance, not equality. Every candidate feeding this branch is wall-clock | COMMENT |
| LOW | test/xff-client-ip-consistency.test.js | 1 | // audit S4 — the "trusted client IP" (X-Forwarded-For hop counting) logic used | COMMENT |
| LOW | test/responses-stream-done-sentinel.test.js | 1 | // The /v1/responses SSE stream must close with the `data: [DONE]` sentinel. | COMMENT |
| LOW | test/retry-after-route-parity.test.js | 1 | // `Retry-After` must survive every egress route, on the NON-STREAM branch too. | COMMENT |
| LOW | test/zero-content-stream-death.test.js | 1 | // A stream that died having produced ZERO content must not be reported as a | COMMENT |
| LOW | test/probe-lock-per-account.test.js | 1 | // Probe lock per-account de-duplication. | COMMENT |
| LOW | test/web-search-exposure.test.js | 1 | // Web search exposure — POST /dashboard/api/accounts/:id/web-search. | COMMENT |
| LOW | test/responses-post-tool-text-item.test.js | 1 | // Item 16 — text arriving AFTER a tool call was merged back into the FIRST | COMMENT |
| LOW | test/completion-config-max-tokens-tag.test.js | 1 | import { describe, it } from 'node:test'; | COMMENT |
| LOW | test/models-injection-eviction.test.js | 1 | // A deleted account's models stayed advertised forever. | COMMENT |
| LOW | test/proto-codec-hardening.test.js | 1 | // Protobuf codec hardening — src/proto.js. | COMMENT |
| LOW | test/stream-cache-policy.test.js | 1 | // Regression for issues #82 and #83 — `cachePolicy is not defined`. | COMMENT |
| LOW | test/responses-retrieve-contract.test.js | 1 | // What GET /v1/responses/{id} is allowed to say. | COMMENT |
| LOW | test/responses-retrieve-contract.test.js | 121 | // and must not be logged. https-proxy.js:20 prints the full URL verbatim, so a | COMMENT |
| LOW | test/reasoning-dedup.test.js | 1 | // Unit tests for the incremental reasoning/content duplicate suppression module | COMMENT |
| LOW | test/response-store-entry-cap-array.test.js | 1 | // The per-entry byte ceiling could not see ARRAY content — which is the default | COMMENT |
| LOW | test/response-store-entry-cap-array.test.js | 141 | assert.ok(store.getResponseStoreStats().bytes <= MAX_ENTRY_BYTES); | COMMENT |
| LOW | test/drought-connect-namespace.test.js | 1 | // #234 — the drought gate must judge Connect selectors in the Connect namespace. | COMMENT |
| LOW | test/dashboard-models-connect-parity.test.js | 1 | // Dashboard /models and /v1/models must answer the SAME question about the Connect | COMMENT |
| LOW | test/devin-connect-breaker.test.js | 1 | // RB2 — three resilience enhancements on the account pool (src/auth.js): | COMMENT |
| LOW | test/sticky-transient-blip-tradeoff.test.js | 1 | // What a transient blip does to a pinned conversation — and why the obvious fix is wrong. | COMMENT |
| LOW | test/sticky-transient-blip-tradeoff.test.js | 21 | // | COMMENT |
| LOW | test/self-update-gate.test.js | 21 | import { isolatedGitEnv, REAL_GIT, SAFE_TMP_ROOT } from './git-fixture-env.js'; | COMMENT |
| LOW | test/sticky-selector-dimension.test.js | 1 | // Sticky bindings need a SELECTOR dimension, not just (caller, modelKey). | COMMENT |
| LOW | test/gemini-schema-type-normalize.test.js | 1 | // Gemini declares Schema.type as an UPPERCASE enum; everything downstream compares | COMMENT |
| 451 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/self-update-gate.test.js | 193 | function assertSafeDashboardFixture(fixture) { | CODE |
| LOW | test/devin-connect-login-host-fallback.test.js | 176 | const idx = LOGIN_SRC.indexOf('async function windsurfLoginViaDevinHost('); | CODE |
| LOW | test/tool-call-from-thinking.test.js | 18 | function liftToolCallsFromThinking(accThinking, declaredTools, { modelKey = 'claude-opus-4-8-xhigh', provider = 'anthrop | CODE |
| LOW | test/client-panel-retry.test.js | 113 | function pendingReadUrlStepResponse() { | CODE |
| LOW | test/client-panel-retry.test.js | 131 | function readUrlContentDoneStepResponse() { | CODE |
| LOW | test/client-panel-retry.test.js | 151 | function readUrlContentDoneWithEchoStepResponse() { | CODE |
| LOW | test/client-panel-retry.test.js | 212 | async function countPendingReadUrlApprovals({ nativeAllowlist = ['read_url_content'] } = {}) { | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 43 | function assertContainmentPredicate(source, label) { | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 62 | function assertTemporaryOriginSetup(source, executor, prefix, label) { | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 73 | function assertEveryPushHasExplicitTemporaryTarget(source, executor, minimum, label) { | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 168 | const guard = section(DASHBOARD, 'function assertSafeDashboardFixture(fixture) {', '\n}\n\nfunction makeDashboardTag | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 187 | const guard = section(DASHBOARD, 'function assertSafeDashboardFixture(fixture) {', '\n}\n\nfunction makeDashboardTag | CODE |
| LOW | test/default-on-switch-registry.test.js | 230 | function discoverDefaultOnSwitches() { | CODE |
| LOW | test/connect-dimension-behaviour.test.js | 74 | function assertNotNormallySelected(picked, what) { | CODE |
| LOW | test/mutations/tool-choice-passthrough.json | 10 | "anchor": "export function isToolChoicePassthroughEnabled(env = process.env) {\n return String(env.DEVIN_CONNECT_ | CODE |
| LOW | test/mutations/tool-choice-passthrough.json | 11 | "replacement": "export function isToolChoicePassthroughEnabled(env = process.env) {\n return !!String(env.DEVIN_C | CODE |
| LOW | test/mutations/prompt-cache-options.json | 16 | "anchor": "export function buildSystemPromptCacheOptions(systemPrompt, env = process.env) {\n if (!isPromptCacheE | CODE |
| LOW | test/mutations/prompt-cache-options.json | 17 | "replacement": "export function buildSystemPromptCacheOptions(systemPrompt, env = process.env) {\n if (false) ret | CODE |
| LOW | test/_research/responses-cache-hit-seq.test.js | 101 | return async function handleChatCompletionsMock(body) { | CODE |
| LOW | docs/releases/RELEASE_NOTES_2.0.36.md | 41 | -export function shouldFallbackThinkingToText({ routingModelKey, body, ... }) { | CODE |
| LOW | docs/releases/RELEASE_NOTES_2.0.36.md | 42 | +export function shouldFallbackThinkingToText({ routingModelKey, wantThinking, ... }) { | CODE |
| LOW | docs/releases/RELEASE_NOTES_2.0.71.md | 15 | export function detectFabricatedToolResult(text, { lastUserText }) { | CODE |
| LOW | src/client.js | 61 | function markCascadeTransportError(err) { | CODE |
| LOW | src/client.js | 69 | function resetCascadeTransportState(port) { | CODE |
| LOW | src/client.js | 103 | export function isReadUrlAutoApproveAllowed(url, origin) { | CODE |
| LOW | src/client.js | 168 | function neutralizeIdentityForCascade(sysText) { | CODE |
| LOW | src/client.js | 191 | function extractCompactSystemFacts(sysText) { | CODE |
| LOW | src/client.js | 212 | export function compactSystemPromptForCascade(sysText) { | CODE |
| LOW | src/client.js | 303 | function isCompletedReadUrlNativeResult(tc) { | CODE |
| LOW | src/devin-acp.js | 254 | function collectAcpTextFromNotification(obj, buffers, onChunk) { | CODE |
| LOW | src/special-agent.js | 775 | export async function handleSpecialAgentChatCompletion(body, route, deps = {}) { | CODE |
| LOW | src/devin-connect-catalog.js | 505 | export function decodeAssignModelResponse(raw, tags = ASSIGN_TAGS_DEFAULT) { | CODE |
| LOW | src/server.js | 175 | function nativeBridgeCallerKeyForRequest(req, token, body, callerKey = '') { | CODE |
| LOW | src/server.js | 481 | async function parseAndValidateAccountProxy(proxyStr) { | CODE |
| LOW | src/conversation-pool.js | 123 | function normalizeSystemPromptForHash(s) { | CODE |
| LOW | src/conversation-pool.js | 287 | function projectAssistantToolCalls(m) { | CODE |
| LOW | src/auth.js | 85 | function shouldSkipBusyBackgroundMaintenance() { | CODE |
| LOW | src/auth.js | 236 | export function setDroughtRestrictResolver(fn) { | CODE |
| LOW | src/auth.js | 283 | export function isConnectSelectorBlockedByDrought(selector) { | CODE |
| LOW | src/auth.js | 300 | export function getCurrentlyFreeConnectSelectors() { | CODE |
| LOW | src/auth.js | 329 | export function isConnectSelectorCurrentlyFree(selector) { | CODE |
| LOW | src/auth.js | 883 | function scheduleModelCatalogRetry(accountId, apiKey) { | CODE |
| LOW | src/auth.js | 930 | function activeModelCatalogAccounts() { | CODE |
| LOW | src/auth.js | 934 | function reconcileModelCatalogAccounts() { | CODE |
| LOW | src/auth.js | 972 | function invalidateModelCatalogForAccount(accountId) { | CODE |
| LOW | src/auth.js | 1006 | function publishConnectCatalogUnion(activeAccounts = activeModelCatalogAccounts()) { | CODE |
| LOW | src/auth.js | 1043 | function connectCatalogRetryJitterBasisPoints(accountId, apiKey) { | CODE |
| LOW | src/auth.js | 1062 | function connectCatalogRetryDelayMs(failureCount, accountId, apiKey) { | CODE |
| LOW | src/auth.js | 1074 | function recordConnectCatalogRetryFailure(accountId, apiKey) { | CODE |
| LOW | src/auth.js | 1086 | function isCurrentConnectCatalogAttempt(accountId, apiKey, attempt) { | CODE |
| LOW | src/auth.js | 1169 | function forgetConnectCatalogForAccount(accountId) { | CODE |
| LOW | src/auth.js | 1181 | async function fetchAndMergeModelCatalog(accountId, apiKey) { | CODE |
| LOW | src/auth.js | 1557 | export function isConnectSelectorAllowedForAccount(account, selector) { | CODE |
| LOW | src/auth.js | 1587 | export function hasConnectEntitledAccount(selector) { | CODE |
| LOW | src/auth.js | 1592 | export function getAvailableModelsForAccount(account) { | CODE |
| LOW | src/auth.js | 1864 | export async function probeAndRecoverConnectAccount(id, { signal } = {}) { | CODE |
| LOW | src/auth.js | 2849 | function newAccountBaselineEnabled() { return getBreakerTunable('newAccountBaseline'); } | CODE |
| LOW | src/auth.js | 3388 | export function isAllTemporarilyUnavailable(modelKey, connectSelector = null) { | CODE |
| LOW | src/reasoning-dedup.js | 91 | export function createStreamReasoningDedup({ wantThinking = false } = {}) { | CODE |
| LOW | src/native-bridge-stats.js | 96 | export function recordNativeBridgeDecision(decision = {}) { | CODE |
| 181 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docker-compose.yml | 32 | # protocol reliably in agentic clients (Claude Code/Cline/Codex). With it | COMMENT |
| MEDIUM | test/completion-config-max-tokens-tag.test.js | 71 | // Pre-fix, #2 was always the context window, so the encoded max_tokens was | COMMENT |
| MEDIUM | test/sticky-transient-blip-tradeoff.test.js | 23 | // caller returns to the account holding the longest prefix. RPM windows are 60s and agentic | COMMENT |
| MEDIUM | test/workspace-stub-108.test.js | 12 | // register (closes a fingerprint gap). Old scaffold seeded a | COMMENT |
| MEDIUM | test/workspace-stub-108.test.js | 31 | // - client.js: rebrand the scaffold so every file is unmistakably a | COMMENT |
| MEDIUM | test/mutations/completion-config-max-tokens-tag.json | 8 | "name": "the original swap restored — #2 carries the context window, so max_tokens is effectively uncapped", | CODE |
| MEDIUM | docs/HISTORY-LEDGER-PRS.md | 72 | | 242 | warelik | 08-05→08-09 | DEVIN_CONNECT 会话保真，两个 opt-in 特性（DEVIN_CONNECT_SESSION_REUSE 主门控）：① 稳定 ModelConfig（#15.1 | CODE |
| MEDIUM | docs/HISTORY-LEDGER-PRS.md | 142 | **#242（S）—— 会话保真地基**：DEVIN_CONNECT_SESSION_REUSE 主门控下两个 opt-in 特性：① 稳定 ModelConfig（#15.1 会话内恒定、#15.2 单调递增，对齐 devin.exe，不 | CODE |
| MEDIUM | docs/HISTORY-LEDGER-2026-05-bridge.md | 11 | - 素材缺 **4 条 5-01 的 commit**（在切片起点之前、v2.0.45~48 时代）：`b4a9ebf`（v2.0.45 #106/#107 Claude Code 2.x cwd 提取）、`222526b`（v2.0.46 | CODE |
| MEDIUM | docs/HISTORY-LEDGER.md | 159 | **关键修复**：`b6e7dc9` 四出口 11 缺陷、`6d1f087` response-store 四条「注释对、实现只盖一个特例」、`129682f` intent-extractor 从反例说明伪造工具调用、`7bca624` | CODE |
| MEDIUM | docs/HISTORY-LEDGER.md | 212 | | #238→#241（PR 链） | swe-1-7 agentic 死循环 → rescue nudge 演化 | 793ed79 → 0f5a57b + digest 钳三连（#238/#241 是 warelik 的 PR，#239 | CODE |
| MEDIUM⚡ | docs/HISTORY-LEDGER-VIZ.html | 757 | const D_GIT = {"t0":1775727718,"t1":1787897322,"anchors":[{"h":"395311f2","t":1775727718,"a":"dwgx","s":"Initial commit: | CODE |
| MEDIUM⚡ | docs/HISTORY-LEDGER-VIZ.html | 757 | const D_GIT = {"t0":1775727718,"t1":1787897322,"anchors":[{"h":"395311f2","t":1775727718,"a":"dwgx","s":"Initial commit: | CODE |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.32.md | 77 | ### Multi-stage codex orchestration (本次) | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.105.md | 1 | ## v2.0.105 - native bridge real-smoke guardrails | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.33.md | 86 | ### Multi-stage codex orchestration 流程 | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_3.9.7.md | 97 | ### swe-1-7 在 agentic 循环里停滞:声明了工具意图却不发出 tool call(#238,@warelik) | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.138.md | 1 | # v2.0.138 - release gate, dashboard pagination, and memory guardrails | COMMENT |
| MEDIUM | docs/dashboard/data/contributors.json | 353 | "summary": "两个耦合的根因修复，把 native tool-def 路从\"一批工具被上游拒\"救回来。① MCP-gate:上游 server.codeium.com 会对工具描述做指纹匹配(#10 顶层 desc | CODE |
| MEDIUM⚡ | src/client.js | 344 | // ── Fake workspace scaffold ──────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/client.js | 350 | // gap. The scaffold is created once per account and persists. | COMMENT |
| MEDIUM⚡ | src/client.js | 353 | // Detects an old (pre-#108) scaffold that named the placeholder | COMMENT |
| MEDIUM⚡ | src/client.js | 353 | // Detects an old (pre-#108) scaffold that named the placeholder | COMMENT |
| MEDIUM⚡ | src/client.js | 400 | // #108: prior scaffold seeded a `package.json` named "my-project" plus a | COMMENT |
| MEDIUM⚡ | src/client.js | 400 | // #108: prior scaffold seeded a `package.json` named "my-project" plus a | COMMENT |
| MEDIUM⚡ | src/client.js | 405 | // Node template the user has never seen. Keep the scaffold real enough | COMMENT |
| MEDIUM | src/dashboard/data/contributors.json | 353 | "summary": "两个耦合的根因修复，把 native tool-def 路从\"一批工具被上游拒\"救回来。① MCP-gate:上游 server.codeium.com 会对工具描述做指纹匹配(#10 顶层 desc | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/v2078-audit-fixes.test.js | 41 | assert.ok(!out.includes('foo@bar.com')); | CODE |
| LOW | test/retry-after-route-parity.test.js | 90 | const key = `fake-key-${LABEL_PREFIX}${label}`; | CODE |
| LOW | test/request-id-body.test.js | 116 | const acct = addAccountByKey('fake-key-f4', 'f4-chat'); | CODE |
| LOW | test/request-id-body.test.js | 143 | const acct = addAccountByKey('fake-key-f4', 'f4-msg'); | CODE |
| LOW | test/email-otp-login.test.js | 112 | () => registerUserWithOtp('test@example.com', '999999', 'fake-token', '', '', null), | CODE |
| LOW | test/devin-connect-credentials.test.js | 39 | assert.equal(getCredential('user@example.com', env), 's3cret-pw!', 'email is case-insensitive'); | CODE |
| LOW | test/devin-connect-credentials.test.js | 41 | assert.deepEqual(listCredentialEmails(env), ['user@example.com']); | CODE |
| LOW | test/responses-retrieve-route.test.js | 76 | const acct = addAccountByKey('fake-key-resp-route', `resp-route-${label}`); | CODE |
| LOW | test/caller-environment.test.js | 303 | const filler = 'lorem ipsum dolor sit amet '.repeat(200); // ~5 KB filler | CODE |
| LOW | test/caller-environment.test.js | 303 | const filler = 'lorem ipsum dolor sit amet '.repeat(200); // ~5 KB filler | CODE |
| LOW | src/dashboard/check-i18n.js | 390 | ['placeholder', 'data-i18n-placeholder'], | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 471 | "placeholder": "your-email@example.com" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 475 | "placeholder": "••••••••" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 485 | "placeholder": "proxy.example.com" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 489 | "placeholder": "8080" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 493 | "placeholder": "可选" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 497 | "placeholder": "可选" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 501 | "placeholder": "粘贴 Auth Token（从 windsurf.com/show-auth-token 获取）" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 505 | "placeholder": "可选" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 509 | "placeholder": "http://proxy:8080 或 socks5://user:pass@host:port（可选）", | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 521 | "placeholder": "留空=使用全局" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 528 | "placeholder": "代理认证用户名" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 531 | "placeholder": "代理认证密码" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 534 | "placeholder": "搜索提供商..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 538 | "placeholder": "搜索..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 542 | "placeholder": "输入模型名称筛选..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 546 | "placeholder": "留空则拒绝清单外请求", | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 556 | "placeholder": "搜索提供商..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 564 | "placeholder": "John" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 572 | "placeholder": "Doe" | CODE |
| LOW | src/dashboard/i18n/zh-CN.json | 284 | "placeholder": "devin-session-token$... 或 show-auth-token 链接 或 email----password 每行一个,可混合", | CODE |
| LOW | src/dashboard/i18n/zh-CN.json | 1391 | "placeholder": { | CODE |
| LOW | src/dashboard/i18n/zh-CN.json | 1516 | "placeholder": "筛选设置…", | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 489 | "placeholder": "Enter model name to filter..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 493 | "placeholder": "Leave blank to reject out-of-list requests", | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 497 | "placeholder": "Proxy auth username" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 500 | "placeholder": "Proxy auth password" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 503 | "placeholder": "Search providers..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 507 | "placeholder": "proxy.example.com" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 511 | "placeholder": "8080" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 515 | "placeholder": "Optional" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 519 | "placeholder": "Optional" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 523 | "placeholder": "Paste Auth Token" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 527 | "placeholder": "Optional" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 531 | "placeholder": "http://proxy:8080 or socks5://user:pass@host:port (optional)", | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 543 | "placeholder": "Leave empty = use global" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 552 | "placeholder": "Search providers..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 556 | "placeholder": "Search..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 564 | "placeholder": "John" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 572 | "placeholder": "Doe" | CODE |
| LOW | src/dashboard/i18n/en.json | 284 | "placeholder": "devin-session-token$... or show-auth-token URL or email----password — one per line, mixable", | CODE |
| LOW | src/dashboard/i18n/en.json | 471 | "placeholder": "your-email@example.com" | CODE |
| LOW | src/dashboard/i18n/en.json | 475 | "placeholder": "••••••••" | CODE |
| LOW | src/dashboard/i18n/en.json | 1391 | "placeholder": { | CODE |
| LOW | src/dashboard/i18n/en.json | 1516 | "placeholder": "Filter settings...", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | README.en.md | 269 | client = OpenAI(base_url="http://YOUR_IP:3003/v1", api_key="YOUR_API_KEY") | CODE |
| HIGH | README.en.md | 281 | export ANTHROPIC_API_KEY=YOUR_API_KEY | CODE |
| HIGH | README.en.md | 297 | - API Key: YOUR_API_KEY | CODE |
| HIGH | examples/proxy-user-inject.js | 85 | * -H "Authorization: Bearer YOUR_API_KEY" \ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/client.js | 666 | // Step 1: Start cascade — with retry on panel-state-not-found | COMMENT |
| LOW | src/client.js | 805 | // Step 2: Send message. Retry up to MAX_PANEL_RETRIES on | COMMENT |
| LOW | src/client.js | 910 | // Step 3: Poll for response. | COMMENT |
| LOW | src/socks.js | 38 | // Step 1: greeting — offer auth methods | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 439 | // Step 1: Send verification email | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 442 | // Step 2: Poll Gmail for OTP code | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 450 | // Step 3: Register user with OTP | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/client.js | 666 | // Step 1: Start cascade — with retry on panel-state-not-found | COMMENT |
| LOW | src/client.js | 805 | // Step 2: Send message. Retry up to MAX_PANEL_RETRIES on | COMMENT |
| LOW | src/client.js | 910 | // Step 3: Poll for response. | COMMENT |
| LOW | src/socks.js | 38 | // Step 1: greeting — offer auth methods | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 439 | // Step 1: Send verification email | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 442 | // Step 2: Poll Gmail for OTP code | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 450 | // Step 3: Register user with OTP | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | docs/HISTORY-LEDGER-VIZ.html | 757 | const D_GIT = {"t0":1775727718,"t1":1787897322,"anchors":[{"h":"395311f2","t":1775727718,"a":"dwgx","s":"Initial commit: | CODE |
| MEDIUM | src/conversation-pool.js | 41 | // reuse robust against fingerprint drift (system-prompt changes, tool-list | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/update-script-release-target.test.js | 359 | elif [ -r "$pid_file" ]; then cat "$pid_file"; fi | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/tool-emulation-allowlist.test.js | 54 | const raw = 'Sure, here you go:\n```json\n{"name":"Bash","arguments":{"command":"id"}}\n```\nLet me know if you need | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install-ls.sh | 4 | # Usage: | COMMENT |