Turn Windsurf / Devin Desktop's 100+ AI models (Claude, GPT, Gemini, DeepSeek, Kimi, GLM, SWE) into OpenAI-, Anthropic- & Gemini-compatible APIs. Zero-dependency self-hosted reverse proxy for Claude Code, Cline & Cursor. 把 Windsurf/Devin 云端 100+ 模型变成三套兼容 API。
This report summarizes scanner evidence for dwgx/WindsurfAPI, a JavaScript project with 3,079 GitHub stars. SynthScan examined 198,488 lines of code across 839 source files, recording 1194 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 8.7 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 879 finding(s).
Are imports declared and package/API names verified? 61 finding(s).
Are wrappers, guards, and repeated structures necessary? 504 finding(s).
Which changes need focused human review? 1194 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1194 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install-ls.sh | 70 | # ─── Platform detection ──────────────────────────────── | COMMENT |
| MEDIUM | test/devin-connect.test.js | 1628 | // ── Fault tolerance: response-side ChatToolCall structure (NW1 §2) ────────── | COMMENT |
| MEDIUM | test/devin-connect.test.js | 2246 | // ── Top-level combinator stripping (P4, ported from kiro.rs) ────────────── | COMMENT |
| MEDIUM | test/tool-emulation.test.js | 1158 | // structured path ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/tool-emulation.test.js | 1225 | // ─── The wire the upstream actually receives ───────────────────────────────── | COMMENT |
| MEDIUM | test/zero-content-stream-death.test.js | 35 | // ─── helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/zero-content-stream-death.test.js | 133 | // ─── Anthropic egress ─────────────────────────────────────────── | COMMENT |
| MEDIUM | test/zero-content-stream-death.test.js | 196 | // ─── Gemini egress ────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/zero-content-stream-death.test.js | 250 | // ─── three-way parity ─────────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 12 | // ─── helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 49 | // ─── request translation ──────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 208 | // ─── non-stream response translation ──────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 257 | // ─── error mapping (transient-first) ──────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 294 | // ─── path parsing ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 310 | // ─── main entry: non-stream ───────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 349 | // ─── main entry: streaming ────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 561 | // ─── translator direct unit (array mode empties) ──────────────── | COMMENT |
| MEDIUM⚡ | test/gemini.test.js | 573 | // ════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/gemini.test.js | 575 | // ════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/gemini.test.js | 577 | // ─── request translation: remaining part / config shapes ──────── | COMMENT |
| MEDIUM | test/gemini.test.js | 677 | // ─── non-stream response: finish + usage edge cases ───────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 797 | // ─── path parsing: edge cases ─────────────────────────────────── | COMMENT |
| MEDIUM | test/connect.test.js | 9 | // ─── CONN-1: decompression output must be bounded ───────────────────────── | COMMENT |
| MEDIUM | test/tool-preamble-budget.test.js | 125 | // ─── nativeStructured (hybrid mode) regression tests ───────────────────────── | COMMENT |
| MEDIUM | test/tool-preamble-strip-equivalence.test.js | 41 | // ─── shape battery ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/tool-preamble-strip-equivalence.test.js | 275 | // ─── golden ladder results, captured from master 4cbd029 ─────────────────── | COMMENT |
| MEDIUM | test/tool-preamble-strip-equivalence.test.js | 412 | // ─── the bounded walk must not be observable at all ──────────────────────── | COMMENT |
| MEDIUM | test/tool-preamble-strip-equivalence.test.js | 584 | // ─── the optimization must still be present (revert/erode detection) ─────── | COMMENT |
| MEDIUM | test/cred-store-lock-reclaim.test.js | 88 | // ─── The sentinel path ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/cred-store-lock-reclaim.test.js | 115 | // ─── Pre-v2 directories: migrated in place, or refused ───────────────────── | COMMENT |
| MEDIUM | test/cred-store-lock-reclaim.test.js | 295 | // ─── Claim instances ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/cred-store-lock-reclaim.test.js | 327 | // ─── The F1 interleaving and the publish fences ──────────────────────────── | COMMENT |
| MEDIUM | test/cred-store-lock-reclaim.test.js | 406 | // ─── Failure injection: nothing fences, the original error survives ──────── | COMMENT |
| MEDIUM | test/cred-store-lock-reclaim.test.js | 475 | // ─── Real processes, real read-modify-write ──────────────────────────────── | COMMENT |
| MEDIUM | test/cascade-think-reroute.test.js | 330 | // ── emulateTools + failure: the accThinking hole ────────────────────────── | COMMENT |
| MEDIUM | test/default-on-switch-registry.test.js | 44 | // ── the ledger ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/connect-error-blame.test.js | 99 | // ─── 结构守卫 ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/cascade-native-bridge.test.js | 807 | // ─── v2.0.66 (#115) — partition mode + codex CLI mapping ────────────── | COMMENT |
| MEDIUM | test/cascade-native-bridge.test.js | 807 | // ─── v2.0.66 (#115) — partition mode + codex CLI mapping ────────────── | COMMENT |
| MEDIUM | test/dashboard-error-envelope.test.js | 51 | // ── source extraction ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/dashboard-error-envelope.test.js | 121 | // ── DOM / App stubs ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/dashboard-error-envelope.test.js | 188 | // ── 1. json() stamps non-2xx envelopes only ───────────────────────────────── | COMMENT |
| MEDIUM | test/dashboard-error-envelope.test.js | 221 | // ── 2. the property survives the real handler ─────────────────────────────── | COMMENT |
| MEDIUM | test/dashboard-error-envelope.test.js | 276 | // ── 3. both skins synthesize the envelope for non-2xx ─────────────────────── | COMMENT |
| MEDIUM | test/dashboard-error-envelope.test.js | 327 | // ── 4. loaders keep the last good panel when the read fails ───────────────── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 138 | // ───── #100 follow-up: bare-path fallback when no <env> block ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 138 | // ───── #100 follow-up: bare-path fallback when no <env> block ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 219 | // ───── #100 follow-up #2 (yunduobaba): Claude Code <system-reminder> wrappers ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 219 | // ───── #100 follow-up #2 (yunduobaba): Claude Code <system-reminder> wrappers ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 270 | // ───── #106 / #107 (zhangzhang-bit): adjective-prefixed cwd + bullet fallback ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 270 | // ───── #106 / #107 (zhangzhang-bit): adjective-prefixed cwd + bullet fallback ───── | COMMENT |
| MEDIUM | test/account-dirty-retry.test.js | 43 | // ─── fs boundary: real functions, wrapped, scoped to this test's paths ─────── | COMMENT |
| MEDIUM | test/account-dirty-retry.test.js | 96 | // ─── observation helpers (all read the real on-disk file) ─────────────────── | COMMENT |
| MEDIUM | examples/proxy-user-inject.js | 109 | // ═══════════════ CONFIGURE THESE ═══════════════ | COMMENT |
| MEDIUM | examples/proxy-user-inject.js | 115 | // ════════════════════════════════════════════════ | COMMENT |
| MEDIUM | scripts/cli-agent-sim.js | 140 | // ── Test Scenarios ────────────────────────────────── | COMMENT |
| MEDIUM | scripts/cli-agent-sim.js | 300 | // ── Main ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/client.js | 345 | // ── Fake workspace scaffold ──────────────────────────────── | COMMENT |
| MEDIUM | src/client.js | 434 | // ─── WindsurfClient ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/client.js | 448 | // ─── Short-lived user JWT (env-gated) ──────────────────── | COMMENT |
| 194 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README.en.md | 181 | COMMENT | |
| LOW | README.en.md | 201 | # Windows: %APPDATA%\Windsurf\bin\language_server_windows_x64.exe | COMMENT |
| LOW | README.md | 221 | # 下载链：WindsurfAPI release → 公开 LS mirror | COMMENT |
| LOW | README.md | 241 | # macOS: "$HOME/Library/Application Support/Windsurf/resources/app/extensions/windsurf/bin/language_server_macos_arm | COMMENT |
| LOW | update.sh | 381 | echo "=== [1/5] Pull latest ===" | COMMENT |
| LOW | install-ls.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | docker-compose.yml | 21 | # required:false so a fresh clone (which ships only .env.example, never | COMMENT |
| LOW | docker-compose.yml | 41 | # one global bucket. Exactly one trusted hop here. | COMMENT |
| LOW | docker-compose.yml | 61 | volumes: | COMMENT |
| LOW | test/mutate-verify-harness.test.js | 1 | // The mutation harness's own verdict logic, which nothing covered until now. | COMMENT |
| LOW | test/mutate-verify-harness.test.js | 321 | // a node-22 run reported `pass=99 fail=0 cancelled=95` (the event loop drained before the | COMMENT |
| LOW | test/mutate-verify-harness.test.js | 441 | // with "baseline is not green" while the suite was in fact perfectly green. | COMMENT |
| LOW | test/model-access-backend-coverage.test.js | 1 | // Model-access policy must gate EVERY backend, not just the one it happens to | COMMENT |
| LOW | test/models-live-catalog.test.js | 1 | // audit 2026-07-12 (v3.2.4 regression fix): after v3.2.3 made resolveConnectSelector | COMMENT |
| LOW | test/sticky-exclude-keys.test.js | 1 | // Sticky fast path vs. excludeKeys (failover regression). | COMMENT |
| LOW | test/route-error-parity-behaviour.test.js | 1 | // The route-parity guard checks SOURCE SHAPE, and shape is escapable. | COMMENT |
| LOW | test/neutralize-rewrite-visibility.test.js | 1 | // Item 14 — the neutralize pass silently rewrote caller content, and the guard | COMMENT |
| LOW | test/neutralize-rewrite-visibility.test.js | 21 | // | COMMENT |
| LOW | test/neutralize-rewrite-visibility.test.js | 121 | // several times is one event, not two, and reporting it twice would make the | COMMENT |
| LOW | test/dashboard-escape-callsites.test.js | 1 | // The escape helpers were tested; their CALL SITES were not. | COMMENT |
| LOW | test/v2088-audit-fixes.test.js | 1 | // v2.0.88 — strict audit follow-up: 4 HIGH + 3 MED/LOW from | COMMENT |
| LOW | test/terminal-event-guard.test.js | 1 | // After a terminal event, a stream translator must stop writing. | COMMENT |
| LOW | test/v2078-audit-fixes.test.js | 1 | // v2.0.78 — strict audit follow-up (4 HIGH). | COMMENT |
| LOW | test/prompt-cache-options.test.js | 1 | // Explicit prompt caching — GetChatMessageRequest #13 system_prompt_cache_options. | COMMENT |
| LOW | test/sticky-no-fallback-wedge.test.js | 1 | // stickyNoFallback could wedge a caller permanently. | COMMENT |
| LOW | test/response-store-byte-budget.test.js | 1 | // Response store: the byte budget. | COMMENT |
| LOW | test/response-store-byte-budget.test.js | 161 | // loop. Under any byte-bound workload the writer's entry count stays far below | COMMENT |
| LOW | test/scatter-attribution.test.js | 1 | // Why an UNBOUND caller's sequential turns move between accounts. | COMMENT |
| LOW | test/scatter-attribution.test.js | 21 | // ------------------------------------------------------------------ | COMMENT |
| LOW | test/scatter-attribution.test.js | 41 | // that account's ratio, so it sorts last next turn). LRU alone yields one swap and | COMMENT |
| LOW | test/retry-rescue-budget-split.test.js | 1 | // #240 — retry-on-empty and the thinking-only rescue are two speculative arms with two | COMMENT |
| LOW | test/retry-rescue-budget-split.test.js | 181 | // What follows pins the operator-visible NUMBER, and only that. Be precise about the | COMMENT |
| LOW | test/image-jpeg-deep-sof.test.js | 1 | // E3-SOF: a JPEG whose SOF sits beyond the 256 KiB header read must still obey | COMMENT |
| LOW | test/v2079-audit-followup.test.js | 1 | // v2.0.79 — strict audit follow-up (3 MED + 2 LOW + 1 close-out). | COMMENT |
| LOW | test/sticky-tenant-quota.test.js | 1 | // Sticky binding table: per-tenant fair share + LRU ordering. | COMMENT |
| LOW | test/rate-limit.test.js | 121 | assert.equal(result.body.error.type, 'rate_limit_exceeded'); | COMMENT |
| LOW | test/rate-limit.test.js | 141 | // Tolerance, not equality. Every candidate feeding this branch is wall-clock | COMMENT |
| LOW | test/tool-emulation.test.js | 1161 | // | COMMENT |
| LOW | test/xff-client-ip-consistency.test.js | 1 | // audit S4 — the "trusted client IP" (X-Forwarded-For hop counting) logic used | COMMENT |
| LOW | test/responses-stream-done-sentinel.test.js | 1 | // The /v1/responses SSE stream must close with the `data: [DONE]` sentinel. | COMMENT |
| LOW | test/retry-after-route-parity.test.js | 1 | // `Retry-After` must survive every egress route, on the NON-STREAM branch too. | COMMENT |
| LOW | test/zero-content-stream-death.test.js | 1 | // A stream that died having produced ZERO content must not be reported as a | COMMENT |
| LOW | test/probe-lock-per-account.test.js | 1 | // Probe lock per-account de-duplication. | COMMENT |
| LOW | test/web-search-exposure.test.js | 1 | // Web search exposure — POST /dashboard/api/accounts/:id/web-search. | COMMENT |
| LOW | test/responses-post-tool-text-item.test.js | 1 | // Item 16 — text arriving AFTER a tool call was merged back into the FIRST | COMMENT |
| LOW | test/completion-config-max-tokens-tag.test.js | 1 | import { describe, it } from 'node:test'; | COMMENT |
| LOW | test/models-injection-eviction.test.js | 1 | // A deleted account's models stayed advertised forever. | COMMENT |
| LOW | test/proto-codec-hardening.test.js | 1 | // Protobuf codec hardening — src/proto.js. | COMMENT |
| LOW | test/stream-cache-policy.test.js | 1 | // Regression for issues #82 and #83 — `cachePolicy is not defined`. | COMMENT |
| LOW | test/responses-retrieve-contract.test.js | 1 | // What GET /v1/responses/{id} is allowed to say. | COMMENT |
| LOW | test/responses-retrieve-contract.test.js | 121 | // and must not be logged. https-proxy.js:20 prints the full URL verbatim, so a | COMMENT |
| LOW | test/reasoning-dedup.test.js | 1 | // Unit tests for the incremental reasoning/content duplicate suppression module | COMMENT |
| LOW | test/reasoning-dedup.test.js | 181 | // | COMMENT |
| LOW | test/reasoning-dedup.test.js | 261 | // `.env` with a bare `WINDSURFAPI_REASONING_DEDUP=` must not silently | COMMENT |
| LOW | test/wire-provenance.js | 1 | // WHY THIS HELPER EXISTS. test/wire-byte-identity.test.js compares the protobuf request | COMMENT |
| LOW | test/response-store-entry-cap-array.test.js | 1 | // The per-entry byte ceiling could not see ARRAY content — which is the default | COMMENT |
| LOW | test/response-store-entry-cap-array.test.js | 141 | assert.ok(store.getResponseStoreStats().bytes <= MAX_ENTRY_BYTES); | COMMENT |
| LOW | test/test-network-guard.test.js | 1 | // D-TEST-EGRESS: the default test preload must deny unmocked external requests. | COMMENT |
| LOW | test/s1-p1-cache-key-error-path.test.js | 1 | // WHY THIS FILE EXISTS. Gating the cache key on an actual consumer changes one | COMMENT |
| LOW | test/drought-connect-namespace.test.js | 1 | // #234 — the drought gate must judge Connect selectors in the Connect namespace. | COMMENT |
| 510 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/self-update-gate.test.js | 193 | function assertSafeDashboardFixture(fixture) { | CODE |
| LOW | test/https-proxy-policy.test.js | 31 | const fakeCertReadFileSync = function readFileSyncWithFakeCerts(path, ...rest) { | CODE |
| LOW | test/s1-p2-token-pass.test.js | 40 | const MESSAGES_014204F_FUNCTIONS = "function cacheToolTokens(t) {\n if (!t || typeof t !== 'object') return 0;\n let n | CODE |
| LOW | test/devin-connect-login-host-fallback.test.js | 176 | const idx = LOGIN_SRC.indexOf('async function windsurfLoginViaDevinHost('); | CODE |
| LOW | test/tool-call-from-thinking.test.js | 18 | function liftToolCallsFromThinking(accThinking, declaredTools, { modelKey = 'claude-opus-4-8-xhigh', provider = 'anthrop | CODE |
| LOW | test/client-panel-retry.test.js | 113 | function pendingReadUrlStepResponse() { | CODE |
| LOW | test/client-panel-retry.test.js | 131 | function readUrlContentDoneStepResponse() { | CODE |
| LOW | test/client-panel-retry.test.js | 151 | function readUrlContentDoneWithEchoStepResponse() { | CODE |
| LOW | test/client-panel-retry.test.js | 212 | async function countPendingReadUrlApprovals({ nativeAllowlist = ['read_url_content'] } = {}) { | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 43 | function assertContainmentPredicate(source, label) { | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 62 | function assertTemporaryOriginSetup(source, executor, prefix, label) { | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 73 | function assertEveryPushHasExplicitTemporaryTarget(source, executor, minimum, label) { | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 168 | const guard = section(DASHBOARD, 'function assertSafeDashboardFixture(fixture) {', '\n}\n\nfunction makeDashboardTag | CODE |
| LOW | test/ota-fixture-containment-static.test.js | 187 | const guard = section(DASHBOARD, 'function assertSafeDashboardFixture(fixture) {', '\n}\n\nfunction makeDashboardTag | CODE |
| LOW | test/default-on-switch-registry.test.js | 230 | function discoverDefaultOnSwitches() { | CODE |
| LOW | test/s4-r4.test.js | 26 | function finishPartialStreamAfterError({ id, created, model, send, res, internalRoute }) { | CODE |
| LOW | test/connect-dimension-behaviour.test.js | 74 | function assertNotNormallySelected(picked, what) { | CODE |
| LOW | test/mutations/tool-choice-passthrough.json | 10 | "anchor": "export function isToolChoicePassthroughEnabled(env = process.env) {\n return String(env.DEVIN_CONNECT_ | CODE |
| LOW | test/mutations/tool-choice-passthrough.json | 11 | "replacement": "export function isToolChoicePassthroughEnabled(env = process.env) {\n return !!String(env.DEVIN_C | CODE |
| LOW | test/mutations/prompt-cache-options.json | 16 | "anchor": "export function buildSystemPromptCacheOptions(systemPrompt, env = process.env) {\n if (!isPromptCacheE | CODE |
| LOW | test/mutations/prompt-cache-options.json | 17 | "replacement": "export function buildSystemPromptCacheOptions(systemPrompt, env = process.env) {\n if (false) ret | CODE |
| LOW | test/_research/responses-cache-hit-seq.test.js | 108 | return async function handleChatCompletionsMock(body) { | CODE |
| LOW | docs/releases/RELEASE_NOTES_2.0.36.md | 41 | -export function shouldFallbackThinkingToText({ routingModelKey, body, ... }) { | CODE |
| LOW | docs/releases/RELEASE_NOTES_2.0.36.md | 42 | +export function shouldFallbackThinkingToText({ routingModelKey, wantThinking, ... }) { | CODE |
| LOW | docs/releases/RELEASE_NOTES_2.0.71.md | 15 | export function detectFabricatedToolResult(text, { lastUserText }) { | CODE |
| LOW | src/client.js | 62 | function markCascadeTransportError(err) { | CODE |
| LOW | src/client.js | 70 | function resetCascadeTransportState(port) { | CODE |
| LOW | src/client.js | 104 | export function isReadUrlAutoApproveAllowed(url, origin) { | CODE |
| LOW | src/client.js | 169 | function neutralizeIdentityForCascade(sysText) { | CODE |
| LOW | src/client.js | 192 | function extractCompactSystemFacts(sysText) { | CODE |
| LOW | src/client.js | 213 | export function compactSystemPromptForCascade(sysText) { | CODE |
| LOW | src/client.js | 304 | function isCompletedReadUrlNativeResult(tc) { | CODE |
| LOW | src/devin-acp.js | 254 | function collectAcpTextFromNotification(obj, buffers, onChunk) { | CODE |
| LOW | src/pdf.js | 160 | function skipWhitespaceAndComments(buf, from, limit) { | CODE |
| LOW | src/pdf.js | 200 | function onlyWhitespaceAndComments(buf, from, to) { | CODE |
| LOW | src/special-agent.js | 784 | export async function handleSpecialAgentChatCompletion(body, route, deps = {}) { | CODE |
| LOW | src/devin-connect-catalog.js | 528 | export function decodeAssignModelResponse(raw, tags = ASSIGN_TAGS_DEFAULT) { | CODE |
| LOW | src/server.js | 175 | function nativeBridgeCallerKeyForRequest(req, token, body, callerKey = '') { | CODE |
| LOW | src/server.js | 493 | async function parseAndValidateAccountProxy(proxyStr) { | CODE |
| LOW | src/conversation-pool.js | 123 | function normalizeSystemPromptForHash(s) { | CODE |
| LOW | src/conversation-pool.js | 287 | function projectAssistantToolCalls(m) { | CODE |
| LOW | src/auth.js | 85 | function shouldSkipBusyBackgroundMaintenance() { | CODE |
| LOW | src/auth.js | 236 | export function setDroughtRestrictResolver(fn) { | CODE |
| LOW | src/auth.js | 283 | export function isConnectSelectorBlockedByDrought(selector) { | CODE |
| LOW | src/auth.js | 300 | export function getCurrentlyFreeConnectSelectors() { | CODE |
| LOW | src/auth.js | 329 | export function isConnectSelectorCurrentlyFree(selector) { | CODE |
| LOW | src/auth.js | 899 | function scheduleModelCatalogRetry(accountId, apiKey) { | CODE |
| LOW | src/auth.js | 946 | function activeModelCatalogAccounts() { | CODE |
| LOW | src/auth.js | 950 | function reconcileModelCatalogAccounts() { | CODE |
| LOW | src/auth.js | 988 | function invalidateModelCatalogForAccount(accountId) { | CODE |
| LOW | src/auth.js | 1022 | function publishConnectCatalogUnion(activeAccounts = activeModelCatalogAccounts()) { | CODE |
| LOW | src/auth.js | 1059 | function connectCatalogRetryJitterBasisPoints(accountId, apiKey) { | CODE |
| LOW | src/auth.js | 1078 | function connectCatalogRetryDelayMs(failureCount, accountId, apiKey) { | CODE |
| LOW | src/auth.js | 1090 | function recordConnectCatalogRetryFailure(accountId, apiKey) { | CODE |
| LOW | src/auth.js | 1102 | function isCurrentConnectCatalogAttempt(accountId, apiKey, attempt) { | CODE |
| LOW | src/auth.js | 1185 | function forgetConnectCatalogForAccount(accountId) { | CODE |
| LOW | src/auth.js | 1197 | async function fetchAndMergeModelCatalog(accountId, apiKey) { | CODE |
| LOW | src/auth.js | 1573 | export function isConnectSelectorAllowedForAccount(account, selector) { | CODE |
| LOW | src/auth.js | 1603 | export function hasConnectEntitledAccount(selector) { | CODE |
| LOW | src/auth.js | 1608 | export function getAvailableModelsForAccount(account) { | CODE |
| 190 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docker-compose.yml | 32 | # protocol reliably in agentic clients (Claude Code/Cline/Codex). With it | COMMENT |
| MEDIUM | test/completion-config-max-tokens-tag.test.js | 71 | // Pre-fix, #2 was always the context window, so the encoded max_tokens was | COMMENT |
| MEDIUM | test/sticky-transient-blip-tradeoff.test.js | 23 | // caller returns to the account holding the longest prefix. RPM windows are 60s and agentic | COMMENT |
| MEDIUM | test/workspace-stub-108.test.js | 12 | // register (closes a fingerprint gap). Old scaffold seeded a | COMMENT |
| MEDIUM | test/workspace-stub-108.test.js | 31 | // - client.js: rebrand the scaffold so every file is unmistakably a | COMMENT |
| MEDIUM | test/workspace-stub-108.test.js | 117 | // The "legacy-scaffold migration is wired up" test that stood here asserted the | COMMENT |
| MEDIUM | test/workspace-stub-108.test.js | 122 | // test/workspace-scaffold-ownership.test.js, which calls the real helper. | COMMENT |
| MEDIUM | test/workspace-scaffold-ownership.test.js | 1 | // GPT-01 (independent audit, 2026-09-22): the workspace scaffold migration destroyed | COMMENT |
| MEDIUM | test/workspace-scaffold-ownership.test.js | 97 | // keep the directory byte-identical. Without it the scaffold seeds three files into | COMMENT |
| MEDIUM | test/mutations/completion-config-max-tokens-tag.json | 8 | "name": "the original swap restored — #2 carries the context window, so max_tokens is effectively uncapped", | CODE |
| MEDIUM | docs/HISTORY-LEDGER-PRS.md | 72 | | 242 | warelik | 08-05→08-09 | DEVIN_CONNECT 会话保真，两个 opt-in 特性（DEVIN_CONNECT_SESSION_REUSE 主门控）：① 稳定 ModelConfig（#15.1 | CODE |
| MEDIUM | docs/HISTORY-LEDGER-PRS.md | 142 | **#242（S）—— 会话保真地基**：DEVIN_CONNECT_SESSION_REUSE 主门控下两个 opt-in 特性：① 稳定 ModelConfig（#15.1 会话内恒定、#15.2 单调递增，对齐 devin.exe，不 | CODE |
| MEDIUM | docs/HISTORY-LEDGER-2026-05-bridge.md | 11 | - 素材缺 **4 条 5-01 的 commit**（在切片起点之前、v2.0.45~48 时代）：`b4a9ebf`（v2.0.45 #106/#107 Claude Code 2.x cwd 提取）、`222526b`（v2.0.46 | CODE |
| MEDIUM | docs/HISTORY-LEDGER.md | 159 | **关键修复**：`b6e7dc9` 四出口 11 缺陷、`6d1f087` response-store 四条「注释对、实现只盖一个特例」、`129682f` intent-extractor 从反例说明伪造工具调用、`7bca624` | CODE |
| MEDIUM | docs/HISTORY-LEDGER.md | 212 | | #238→#241（PR 链） | swe-1-7 agentic 死循环 → rescue nudge 演化 | 793ed79 → 0f5a57b + digest 钳三连（#238/#241 是 warelik 的 PR，#239 | CODE |
| MEDIUM⚡ | docs/HISTORY-LEDGER-VIZ.html | 766 | const D_GIT = {"t0":1775727718,"t1":1789432557,"anchors":[{"h":"395311f2","t":1775727718,"a":"dwgx","s":"Initial commit: | CODE |
| MEDIUM⚡ | docs/HISTORY-LEDGER-VIZ.html | 766 | const D_GIT = {"t0":1775727718,"t1":1789432557,"anchors":[{"h":"395311f2","t":1775727718,"a":"dwgx","s":"Initial commit: | CODE |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.32.md | 77 | ### Multi-stage codex orchestration (本次) | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.105.md | 1 | ## v2.0.105 - native bridge real-smoke guardrails | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.33.md | 86 | ### Multi-stage codex orchestration 流程 | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_3.9.7.md | 97 | ### swe-1-7 在 agentic 循环里停滞:声明了工具意图却不发出 tool call(#238,@warelik) | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.138.md | 1 | # v2.0.138 - release gate, dashboard pagination, and memory guardrails | COMMENT |
| MEDIUM | docs/dashboard/data/contributors.json | 353 | "summary": "两个耦合的根因修复，把 native tool-def 路从\"一批工具被上游拒\"救回来。① MCP-gate:上游 server.codeium.com 会对工具描述做指纹匹配(#10 顶层 desc | CODE |
| MEDIUM⚡ | src/client.js | 345 | // ── Fake workspace scaffold ──────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/client.js | 351 | // gap. The scaffold is created once per account and persists. | COMMENT |
| MEDIUM⚡ | src/client.js | 354 | // Detects an old (pre-#108) scaffold that named the placeholder | COMMENT |
| MEDIUM⚡ | src/client.js | 354 | // Detects an old (pre-#108) scaffold that named the placeholder | COMMENT |
| MEDIUM⚡ | src/client.js | 365 | // test/workspace-scaffold-ownership.test.js and docs/releases/RELEASE_NOTES_3.9.38.md. | COMMENT |
| MEDIUM⚡ | src/client.js | 375 | // What used to be here was a "legacy scaffold migration": any package.json whose | COMMENT |
| MEDIUM⚡ | src/client.js | 379 | // path — or our own old scaffold after the user edited one file — lost data. | COMMENT |
| MEDIUM⚡ | src/client.js | 408 | // #108: prior scaffold seeded a `package.json` named "my-project" plus a | COMMENT |
| MEDIUM⚡ | src/client.js | 408 | // #108: prior scaffold seeded a `package.json` named "my-project" plus a | COMMENT |
| MEDIUM⚡ | src/client.js | 413 | // Node template the user has never seen. Keep the scaffold real enough | COMMENT |
| MEDIUM | src/dashboard/data/contributors.json | 353 | "summary": "两个耦合的根因修复，把 native tool-def 路从\"一批工具被上游拒\"救回来。① MCP-gate:上游 server.codeium.com 会对工具描述做指纹匹配(#10 顶层 desc | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/v2078-audit-fixes.test.js | 41 | assert.ok(!out.includes('foo@bar.com')); | CODE |
| LOW | test/retry-after-route-parity.test.js | 90 | const key = `fake-key-${LABEL_PREFIX}${label}`; | CODE |
| LOW | test/request-id-body.test.js | 125 | const acct = addAccountByKey('fake-key-f4', 'f4-exits'); | CODE |
| LOW | test/request-id-body.test.js | 190 | const acct = addAccountByKey('fake-key-f4', 'f4-chat'); | CODE |
| LOW | test/request-id-body.test.js | 217 | const acct = addAccountByKey('fake-key-f4', 'f4-msg'); | CODE |
| LOW | test/email-otp-login.test.js | 112 | () => registerUserWithOtp('test@example.com', '999999', 'fake-token', '', '', null), | CODE |
| LOW | test/devin-connect-credentials.test.js | 39 | assert.equal(getCredential('user@example.com', env), 's3cret-pw!', 'email is case-insensitive'); | CODE |
| LOW | test/devin-connect-credentials.test.js | 41 | assert.deepEqual(listCredentialEmails(env), ['user@example.com']); | CODE |
| LOW | test/responses-retrieve-route.test.js | 76 | const acct = addAccountByKey('fake-key-resp-route', `resp-route-${label}`); | CODE |
| LOW | test/caller-environment.test.js | 303 | const filler = 'lorem ipsum dolor sit amet '.repeat(200); // ~5 KB filler | CODE |
| LOW | test/caller-environment.test.js | 303 | const filler = 'lorem ipsum dolor sit amet '.repeat(200); // ~5 KB filler | CODE |
| LOW | src/dashboard/check-i18n.js | 390 | ['placeholder', 'data-i18n-placeholder'], | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 471 | "placeholder": "your-email@example.com" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 475 | "placeholder": "••••••••" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 485 | "placeholder": "proxy.example.com" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 489 | "placeholder": "8080" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 493 | "placeholder": "可选" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 497 | "placeholder": "可选" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 501 | "placeholder": "粘贴 Auth Token（从 windsurf.com/show-auth-token 获取）" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 505 | "placeholder": "可选" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 509 | "placeholder": "http://proxy:8080 或 socks5://user:pass@host:port（可选）", | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 521 | "placeholder": "留空=使用全局" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 528 | "placeholder": "代理认证用户名" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 531 | "placeholder": "代理认证密码" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 534 | "placeholder": "搜索提供商..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 538 | "placeholder": "搜索..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 542 | "placeholder": "输入模型名称筛选..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 546 | "placeholder": "留空则拒绝清单外请求", | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 556 | "placeholder": "搜索提供商..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 564 | "placeholder": "John" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 572 | "placeholder": "Doe" | CODE |
| LOW | src/dashboard/i18n/zh-CN.json | 284 | "placeholder": "devin-session-token$... 或 show-auth-token 链接 或 email----password 每行一个,可混合", | CODE |
| LOW | src/dashboard/i18n/zh-CN.json | 1392 | "placeholder": { | CODE |
| LOW | src/dashboard/i18n/zh-CN.json | 1517 | "placeholder": "筛选设置…", | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 489 | "placeholder": "Enter model name to filter..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 493 | "placeholder": "Leave blank to reject out-of-list requests", | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 497 | "placeholder": "Proxy auth username" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 500 | "placeholder": "Proxy auth password" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 503 | "placeholder": "Search providers..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 507 | "placeholder": "proxy.example.com" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 511 | "placeholder": "8080" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 515 | "placeholder": "Optional" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 519 | "placeholder": "Optional" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 523 | "placeholder": "Paste Auth Token" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 527 | "placeholder": "Optional" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 531 | "placeholder": "http://proxy:8080 or socks5://user:pass@host:port (optional)", | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 543 | "placeholder": "Leave empty = use global" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 552 | "placeholder": "Search providers..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 556 | "placeholder": "Search..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 564 | "placeholder": "John" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 572 | "placeholder": "Doe" | CODE |
| LOW | src/dashboard/i18n/en.json | 284 | "placeholder": "devin-session-token$... or show-auth-token URL or email----password — one per line, mixable", | CODE |
| LOW | src/dashboard/i18n/en.json | 471 | "placeholder": "your-email@example.com" | CODE |
| LOW | src/dashboard/i18n/en.json | 475 | "placeholder": "••••••••" | CODE |
| LOW | src/dashboard/i18n/en.json | 1392 | "placeholder": { | CODE |
| LOW | src/dashboard/i18n/en.json | 1517 | "placeholder": "Filter settings...", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | README.en.md | 269 | client = OpenAI(base_url="http://YOUR_IP:3003/v1", api_key="YOUR_API_KEY") | CODE |
| HIGH | README.en.md | 281 | export ANTHROPIC_API_KEY=YOUR_API_KEY | CODE |
| HIGH | README.en.md | 297 | - API Key: YOUR_API_KEY | CODE |
| HIGH | examples/proxy-user-inject.js | 85 | * -H "Authorization: Bearer YOUR_API_KEY" \ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/mutations/cascade-native-bridge-gates.json | 2 | "_baseline_provenance": "MEASURED 2026-09-13 on the author's Windows box, Node v24.19.0, worktree .claude/worktrees/gu | CODE |
| MEDIUM | test/mutations/client-invariants.json | 2 | "_baseline_provenance": "MEASURED 2026-09-13 on the author's Windows box, Node v24.19.0, worktree .claude/worktrees/gu | CODE |
| MEDIUM | …st/mutations/conversation-pool-fingerprint-guards.json | 2 | "_baseline_provenance": "MEASURED 2026-09-13 on the author's Windows box, Node v24.19.0, worktree .claude/worktrees/gu | CODE |
| MEDIUM | test/mutations/request-tail-contract.json | 2 | "_baseline_provenance": "MEASURED 2026-10-07 on the author's Windows box, Node v24.19.0, worktree .claude/worktrees/ta | CODE |
| MEDIUM | test/mutations/langserver-invariants.json | 2 | "_baseline_provenance": "MEASURED 2026-09-13 on the author's Windows box, Node v24.19.0, worktree .claude/worktrees/gu | CODE |
| MEDIUM | test/mutations/langserver-invariants.json | 3 | "_scope_note": "src/langserver.js (65 KB) had zero mutation specs before this file. Its existing assertions are split | CODE |
| MEDIUM⚡ | docs/HISTORY-LEDGER-VIZ.html | 766 | const D_GIT = {"t0":1775727718,"t1":1789432557,"anchors":[{"h":"395311f2","t":1775727718,"a":"dwgx","s":"Initial commit: | CODE |
| MEDIUM | .github/workflows/ci.yml | 30 | # fetch-depth 0: the mutation harness materializes its workspace with | COMMENT |
| MEDIUM | src/conversation-pool.js | 41 | // reuse robust against fingerprint drift (system-prompt changes, tool-list | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/client.js | 679 | // Step 1: Start cascade — with retry on panel-state-not-found | COMMENT |
| LOW | src/client.js | 827 | // Step 2: Send message. Retry up to MAX_PANEL_RETRIES on | COMMENT |
| LOW | src/client.js | 931 | // Step 3: Poll for response. | COMMENT |
| LOW | src/socks.js | 38 | // Step 1: greeting — offer auth methods | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 439 | // Step 1: Send verification email | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 442 | // Step 2: Poll Gmail for OTP code | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 450 | // Step 3: Register user with OTP | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/client.js | 679 | // Step 1: Start cascade — with retry on panel-state-not-found | COMMENT |
| LOW | src/client.js | 827 | // Step 2: Send message. Retry up to MAX_PANEL_RETRIES on | COMMENT |
| LOW | src/client.js | 931 | // Step 3: Poll for response. | COMMENT |
| LOW | src/socks.js | 38 | // Step 1: greeting — offer auth methods | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 439 | // Step 1: Send verification email | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 442 | // Step 2: Poll Gmail for OTP code | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 450 | // Step 3: Register user with OTP | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/update-script-release-target.test.js | 362 | elif [ -r "$pid_file" ]; then cat "$pid_file"; fi | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/tool-emulation-allowlist.test.js | 54 | const raw = 'Sure, here you go:\n```json\n{"name":"Bash","arguments":{"command":"id"}}\n```\nLet me know if you need | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install-ls.sh | 4 | # Usage: | COMMENT |