Turn Windsurf / Devin Desktop's 100+ AI models (Claude, GPT, Gemini, DeepSeek, Kimi, GLM, SWE) into OpenAI-, Anthropic- & Gemini-compatible APIs. Zero-dependency self-hosted reverse proxy for Claude Code, Cline & Cursor. 把 Windsurf/Devin 云端 100+ 模型变成三套兼容 API。
This report presents the forensic synthetic code analysis of dwgx/WindsurfAPI, a JavaScript project with 2,890 GitHub stars. SynthScan v2.0 examined 111,859 lines of code across 452 source files, recording 678 pattern matches distributed across 11 syntactic categories. The overall adjusted score of 9.9 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 678 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install-ls.sh | 70 | # ─── Platform detection ──────────────────────────────── | COMMENT |
| MEDIUM | test/devin-connect.test.js | 1129 | // ── Fault tolerance: response-side ChatToolCall structure (NW1 §2) ────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 12 | // ─── helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 49 | // ─── request translation ──────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 168 | // ─── non-stream response translation ──────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 217 | // ─── error mapping (transient-first) ──────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 254 | // ─── path parsing ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 270 | // ─── main entry: non-stream ───────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 309 | // ─── main entry: streaming ────────────────────────────────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 435 | // ─── translator direct unit (array mode empties) ──────────────── | COMMENT |
| MEDIUM⚡ | test/gemini.test.js | 447 | // ════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/gemini.test.js | 449 | // ════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | test/gemini.test.js | 451 | // ─── request translation: remaining part / config shapes ──────── | COMMENT |
| MEDIUM | test/gemini.test.js | 551 | // ─── non-stream response: finish + usage edge cases ───────────── | COMMENT |
| MEDIUM | test/gemini.test.js | 661 | // ─── path parsing: edge cases ─────────────────────────────────── | COMMENT |
| MEDIUM | test/connect.test.js | 9 | // ─── CONN-1: decompression output must be bounded ───────────────────────── | COMMENT |
| MEDIUM | test/cascade-native-bridge.test.js | 722 | // ─── v2.0.66 (#115) — partition mode + codex CLI mapping ────────────── | COMMENT |
| MEDIUM | test/cascade-native-bridge.test.js | 722 | // ─── v2.0.66 (#115) — partition mode + codex CLI mapping ────────────── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 138 | // ───── #100 follow-up: bare-path fallback when no <env> block ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 138 | // ───── #100 follow-up: bare-path fallback when no <env> block ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 219 | // ───── #100 follow-up #2 (yunduobaba): Claude Code <system-reminder> wrappers ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 219 | // ───── #100 follow-up #2 (yunduobaba): Claude Code <system-reminder> wrappers ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 270 | // ───── #106 / #107 (zhangzhang-bit): adjective-prefixed cwd + bullet fallback ───── | COMMENT |
| MEDIUM | test/caller-environment.test.js | 270 | // ───── #106 / #107 (zhangzhang-bit): adjective-prefixed cwd + bullet fallback ───── | COMMENT |
| MEDIUM | examples/proxy-user-inject.js | 109 | // ═══════════════ CONFIGURE THESE ═══════════════ | COMMENT |
| MEDIUM | examples/proxy-user-inject.js | 115 | // ════════════════════════════════════════════════ | COMMENT |
| MEDIUM | scripts/cli-agent-sim.js | 140 | // ── Test Scenarios ────────────────────────────────── | COMMENT |
| MEDIUM | scripts/cli-agent-sim.js | 300 | // ── Main ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/client.js | 332 | // ── Fake workspace scaffold ──────────────────────────────── | COMMENT |
| MEDIUM | src/client.js | 409 | // ─── WindsurfClient ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/client.js | 423 | // ─── Legacy: RawGetChatMessage (streaming) ─────────────── | COMMENT |
| MEDIUM | src/client.js | 579 | // ─── Cascade flow ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/client.js | 1380 | // ─── Register user (Connect-RPC primary, legacy REST fallback) ───── | COMMENT |
| MEDIUM | src/client.js | 1392 | // ── GetUserStatus ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/devin-acp.js | 41 | // ── Zero-billable proactive availability probe (AC1 gap-e / §4) ────────────── | COMMENT |
| MEDIUM | src/devin-acp.js | 157 | // ── Transient-first ACP error classification ──────────────────────────────── | COMMENT |
| MEDIUM | src/devin-connect-openai.js | 34 | // ── retry-on-empty (fable capacity-jitter self-heal) ──────────────────────── | COMMENT |
| MEDIUM | src/devin-connect-catalog.js | 425 | // ─── AssignModel — router-model resolution ────────────────────────────────── | COMMENT |
| MEDIUM | src/server.js | 258 | // ─── Dashboard ───────────────────────────────────────── | COMMENT |
| MEDIUM | src/server.js | 312 | // ─── Dashboard i18n locale files ──────────────────────── | COMMENT |
| MEDIUM | src/server.js | 329 | // ─── Dashboard data files (contributors, etc.) ────────── | COMMENT |
| MEDIUM | src/server.js | 348 | // ─── API endpoints (require API key) ──────────────────── | COMMENT |
| MEDIUM | src/server.js | 427 | // ── bind proxy to account ────────────────────── | COMMENT |
| MEDIUM | src/conversation-pool.js | 125 | // ─── temporal / identifier tokens ──────────────────────────── | COMMENT |
| MEDIUM | src/conversation-pool.js | 158 | // ─── git status / recent commits block (Claude Code 2.x) ───── | COMMENT |
| MEDIUM | src/conversation-pool.js | 204 | // ─── git short hashes ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 32 | // ─── Account pool ────────────────────────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 231 | // ─── C5: per-account rolling health window (persisted) ────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 606 | // ─── Dynamic model catalog from cloud ───────────────────── | COMMENT |
| MEDIUM | src/auth.js | 676 | // ─── Account management ─────────────────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 1181 | // ─── Account selection (tier-weighted RPM) ───────────────── | COMMENT |
| MEDIUM | src/auth.js | 1239 | // ── Sticky session: prefer the account from the last turn ──────── | COMMENT |
| MEDIUM | src/auth.js | 1361 | // ── Tiebreaker: user-aware account sharding ───────────────────── | COMMENT |
| MEDIUM | src/auth.js | 1754 | // ─── RB2/B1: account-level exponential backoff knobs ──────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 1772 | // ─── RB2/T3: new-credential thunderstorm grace window ─────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 1785 | // ─── LB: last-account breaker exemption ───────────────────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 1885 | // ─── RB2/B2: quota-exhaustion closed-loop knobs ───────────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 2300 | // ─── Status ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/auth.js | 3023 | // ─── Incoming request API key validation ─────────────────── | COMMENT |
| MEDIUM | src/auth.js | 3084 | // ─── Brute-force lockout (v2.0.56, CLIProxyAPI-style) ───────────────── | COMMENT |
| 134 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README.en.md | 141 | # Language Server binary — auto-detects Linux/macOS, one-click download + chmod | COMMENT |
| LOW | README.en.md | 161 | # The default download chain now uses the dwgx/windsurf-ls-release public mirror. | COMMENT |
| LOW | README.md | 141 | COMMENT | |
| LOW | install-ls.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | docker-compose.yml | 21 | # required:false so a fresh clone (which ships only .env.example, never | COMMENT |
| LOW | docker-compose.yml | 41 | # one global bucket. Exactly one trusted hop here. | COMMENT |
| LOW | docker-compose.yml | 61 | volumes: | COMMENT |
| LOW | test/models-live-catalog.test.js | 1 | // audit 2026-07-12 (v3.2.4 regression fix): after v3.2.3 made resolveConnectSelector | COMMENT |
| LOW | test/v2088-audit-fixes.test.js | 1 | // v2.0.88 — strict audit follow-up: 4 HIGH + 3 MED/LOW from | COMMENT |
| LOW | test/v2078-audit-fixes.test.js | 1 | // v2.0.78 — strict audit follow-up (4 HIGH). | COMMENT |
| LOW | test/v2079-audit-followup.test.js | 1 | // v2.0.79 — strict audit follow-up (3 MED + 2 LOW + 1 close-out). | COMMENT |
| LOW | test/xff-client-ip-consistency.test.js | 1 | // audit S4 — the "trusted client IP" (X-Forwarded-For hop counting) logic used | COMMENT |
| LOW | test/probe-lock-per-account.test.js | 1 | // Probe lock per-account de-duplication. | COMMENT |
| LOW | test/stream-cache-policy.test.js | 1 | // Regression for issues #82 and #83 — `cachePolicy is not defined`. | COMMENT |
| LOW | test/devin-connect-breaker.test.js | 1 | // RB2 — three resilience enhancements on the account pool (src/auth.js): | COMMENT |
| LOW | test/workspace-stub-108.test.js | 1 | // #108 (nalayahfowlkest-ship-it / zhangzhang-bit): user with a real | COMMENT |
| LOW | test/workspace-stub-108.test.js | 21 | // that says the real cwd is on Windows. | COMMENT |
| LOW | test/model-access-thinking-inheritance.test.js | 1 | // #103 (denvey): allowlist/blocklist must auto-inherit between a base | COMMENT |
| LOW | test/backend-switch-hotswap.test.js | 1 | // Backend-switch hot-swap — env → runtime-config migration (v3.0.2). | COMMENT |
| LOW | test/langserver-binary-update.test.js | 1 | // Dashboard /langserver/binary + /langserver/update endpoints. | COMMENT |
| LOW | test/devin-acp-transient.test.js | 181 | if (msg.method === 'authenticate') { send({ jsonrpc: '2.0', id: msg.id, result: {} }); return; } | COMMENT |
| LOW | test/tool-emulation-end-to-end.test.js | 1 | // End-to-end chain test: raw cascade text → salvage parser → OpenAI | COMMENT |
| LOW | test/image-resize.test.js | 221 | assert.equal(out.images[0].base64_data, png); | COMMENT |
| LOW | test/image-resize.test.js | 301 | }); | COMMENT |
| LOW | test/messages.test.js | 1021 | it('does not contaminate the cascade trajectory across turns (regression for #104)', () => { | COMMENT |
| LOW | test/untrusted-workspace-retry.test.js | 1 | // #107 follow-up (zhangzhang-bit): after the v2.0.45 cwd extraction | COMMENT |
| LOW | test/dashboard-auth-hardening.test.js | 1 | // AUTH-1 + XFF-1 regression coverage for src/dashboard/api.js. | COMMENT |
| LOW | test/report-error-transient-guard.test.js | 1 | // audit #8 — reportError transient guard. | COMMENT |
| LOW | test/report-error-transient-guard.test.js | 81 | // (!isRateLimit && !isInternal && !isTransient — chat.js:4108/5143). Because | COMMENT |
| LOW | test/audit-fixes.test.js | 1 | // Audit-driven hardening (v2.0.42). | COMMENT |
| LOW | test/thinking-fallback-glm.test.js | 1 | // Issue #86 follow-up KLFDan0534: GLM 5.1 in claudecode/openclaw silently | COMMENT |
| LOW | test/devin-connect-login-host-fallback.test.js | 1 | // app.devin.ai second-host login fallback (DEVIN_CONNECT_LOGIN_HOST_FALLBACK). | COMMENT |
| LOW | test/devin-connect-stream-lifecycle.test.js | 161 | }); | COMMENT |
| LOW | test/tool-call-from-thinking.test.js | 1 | // v2.0.146 regression: high-reasoning models (Opus 4.8 xhigh) sometimes | COMMENT |
| LOW | test/v2081-chinese-nlu.test.js | 1 | // v2.0.81 — Chinese NLU recovery + bilingual anti-narrate dialect. | COMMENT |
| LOW | test/v2087-pool-alias-checkin.test.js | 1 | // v2.0.87 — cascade pool alias checkin (#129 wnfilm). | COMMENT |
| LOW | test/devin-connect-relogin-live.test.js | 1 | // devin-connect-relogin-live.test.js — REAL-credential recovery chain. | COMMENT |
| LOW | test/install-ls-atomic-rename.test.js | 1 | // install-ls.sh must do an atomic rename, not in-place overwrite. | COMMENT |
| LOW | test/devin-connect-catalog-drift.test.js | 1 | import { describe, it } from 'node:test'; | COMMENT |
| LOW | test/stream-pool-exhausted-error.test.js | 1 | // Regression for issue #77 — `Stream error after retries:` with EMPTY message. | COMMENT |
| LOW | test/sticky-session.test.js | 1 | // S2 (audit) — sticky-session.js had ZERO test coverage (HIGH-severity gap). | COMMENT |
| LOW | test/cascade-native-bridge.test.js | 1 | // v2.0.65 (#115) — Cascade native tool bridge. | COMMENT |
| LOW | test/issue-203-opus-4-8-catalog.test.js | 1 | import { describe, it } from 'node:test'; | COMMENT |
| LOW | test/addaccount-by-email.test.js | 1 | // addAccountByEmail wiring + CheckUserLoginMethod empty-body fallback. | COMMENT |
| LOW | test/probe-canary-optin.test.js | 1 | // Probe canary is opt-in — a plain probe must never spend prompt credits. | COMMENT |
| LOW | test/caller-environment.test.js | 1 | import { describe, it } from 'node:test'; | COMMENT |
| LOW | test/caller-environment.test.js | 261 | // Cheap-out: if there's no reminder wrapper there's nothing to strip, | COMMENT |
| LOW | test/tool-emulation-salvage.test.js | 1 | // Salvage pass for tool-call shapes the primary parser misses. | COMMENT |
| LOW | test/docker-self-update.test.js | 1 | // Docker self-update endpoint behavior. | COMMENT |
| LOW | test/docker-self-update.test.js | 121 | test('/self-update POST falls back to docker when git is unavailable', () => { | COMMENT |
| LOW | test/docker-self-update.test.js | 141 | // | COMMENT |
| LOW | test/cascade-timeout-invalidation.test.js | 1 | // Issue #101 (nalayahfowlkest-ship-it): claude-opus-4.6-thinking, | COMMENT |
| LOW | .github/workflows/release.yml | 121 | COMMENT | |
| LOW | src/client.js | 161 | // v2.0.91 — sanitize content-policy triggers that Windsurf upstream | COMMENT |
| LOW | src/client.js | 241 | } | COMMENT |
| LOW | src/client.js | 261 | // without giving stuck cascades free time — the cold stall (30s with | COMMENT |
| LOW | src/client.js | 301 | // - tool-active beats thinking beats text-only | COMMENT |
| LOW | src/client.js | 621 | const isPanelMissing = (e) => /panel state not found|not_found.*panel/i.test(e?.message || ''); | COMMENT |
| LOW | src/client.js | 1041 | // Per-step token usage. Overwrite on every poll so the map always | COMMENT |
| LOW | src/client.js | 1141 | // Warm stall: text stopped growing while planner is active. | COMMENT |
| 172 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/devin-connect-login-host-fallback.test.js | 176 | const idx = LOGIN_SRC.indexOf('async function windsurfLoginViaDevinHost('); | CODE |
| LOW | test/tool-call-from-thinking.test.js | 18 | function liftToolCallsFromThinking(accThinking, declaredTools, { modelKey = 'claude-opus-4-8-xhigh', provider = 'anthrop | CODE |
| LOW | test/client-panel-retry.test.js | 113 | function pendingReadUrlStepResponse() { | CODE |
| LOW | test/client-panel-retry.test.js | 131 | function readUrlContentDoneStepResponse() { | CODE |
| LOW | test/client-panel-retry.test.js | 151 | function readUrlContentDoneWithEchoStepResponse() { | CODE |
| LOW | test/client-panel-retry.test.js | 212 | async function countPendingReadUrlApprovals({ nativeAllowlist = ['read_url_content'] } = {}) { | CODE |
| LOW | test/_research/responses-cache-hit-seq.test.js | 101 | return async function handleChatCompletionsMock(body) { | CODE |
| LOW | docs/releases/RELEASE_NOTES_2.0.36.md | 41 | -export function shouldFallbackThinkingToText({ routingModelKey, body, ... }) { | CODE |
| LOW | docs/releases/RELEASE_NOTES_2.0.36.md | 42 | +export function shouldFallbackThinkingToText({ routingModelKey, wantThinking, ... }) { | CODE |
| LOW | docs/releases/RELEASE_NOTES_2.0.71.md | 15 | export function detectFabricatedToolResult(text, { lastUserText }) { | CODE |
| LOW | src/client.js | 52 | function markCascadeTransportError(err) { | CODE |
| LOW | src/client.js | 60 | function resetCascadeTransportState(port) { | CODE |
| LOW | src/client.js | 94 | export function isReadUrlAutoApproveAllowed(url, origin) { | CODE |
| LOW | src/client.js | 159 | function neutralizeIdentityForCascade(sysText) { | CODE |
| LOW | src/client.js | 182 | function extractCompactSystemFacts(sysText) { | CODE |
| LOW | src/client.js | 203 | export function compactSystemPromptForCascade(sysText) { | CODE |
| LOW | src/client.js | 291 | function isCompletedReadUrlNativeResult(tc) { | CODE |
| LOW | src/devin-acp.js | 254 | function collectAcpTextFromNotification(obj, buffers, onChunk) { | CODE |
| LOW | src/special-agent.js | 730 | export async function handleSpecialAgentChatCompletion(body, route, deps = {}) { | CODE |
| LOW | src/devin-connect-catalog.js | 500 | export function decodeAssignModelResponse(raw, tags = ASSIGN_TAGS_DEFAULT) { | CODE |
| LOW | src/server.js | 153 | function nativeBridgeCallerKeyForRequest(req, token, body, callerKey = '') { | CODE |
| LOW | src/server.js | 428 | async function parseAndValidateAccountProxy(proxyStr) { | CODE |
| LOW | src/conversation-pool.js | 123 | function normalizeSystemPromptForHash(s) { | CODE |
| LOW | src/conversation-pool.js | 287 | function projectAssistantToolCalls(m) { | CODE |
| LOW | src/auth.js | 66 | function shouldSkipBusyBackgroundMaintenance() { | CODE |
| LOW | src/auth.js | 176 | export function setDroughtRestrictResolver(fn) { | CODE |
| LOW | src/auth.js | 617 | async function fetchAndMergeModelCatalog() { | CODE |
| LOW | src/auth.js | 867 | export function isConnectSelectorAllowedForAccount(account, selector) { | CODE |
| LOW | src/auth.js | 880 | export function hasConnectEntitledAccount(selector) { | CODE |
| LOW | src/auth.js | 885 | export function getAvailableModelsForAccount(account) { | CODE |
| LOW | src/auth.js | 1133 | export async function probeAndRecoverConnectAccount(id, { signal } = {}) { | CODE |
| LOW | src/auth.js | 1866 | function newAccountBaselineEnabled() { return getBreakerTunable('newAccountBaseline'); } | CODE |
| LOW | src/auth.js | 2336 | export function isAllTemporarilyUnavailable(modelKey, connectSelector = null) { | CODE |
| LOW | src/native-bridge-stats.js | 96 | export function recordNativeBridgeDecision(decision = {}) { | CODE |
| LOW⚡ | src/native-bridge-stats.js | 108 | export function recordNativeBridgeRequest({ mappedTools = [], unmappedTools = [], additionalSteps = 0 } = {}) { | CODE |
| LOW⚡ | src/native-bridge-stats.js | 117 | export function recordNativeBridgeAccountGateReject() { | CODE |
| LOW⚡ | src/native-bridge-stats.js | 121 | export function recordNativeBridgeAccountGateSkip() { | CODE |
| LOW⚡ | src/native-bridge-stats.js | 125 | export function recordNativeBridgeCascadeToolCall(kind) { | CODE |
| LOW⚡ | src/native-bridge-stats.js | 130 | export function recordNativeBridgeEmittedToolCall(name, { source = 'cascade' } = {}) { | CODE |
| LOW⚡ | src/native-bridge-stats.js | 136 | export function recordNativeBridgeUnmappedCascadeToolCall(kind) { | CODE |
| LOW⚡ | src/native-bridge-stats.js | 141 | export function recordNativeBridgeNoToolCallResponse() { | CODE |
| LOW | src/models.js | 598 | export function registerDiscoveredFreeModel(key) { | CODE |
| LOW | src/models.js | 623 | function isSpecialAgentCatalogEnabled() { | CODE |
| LOW | src/runtime-config.js | 238 | export function getDroughtThresholdPercent() { | CODE |
| LOW | src/runtime-config.js | 363 | export function getBackendSwitchOverrides() { | CODE |
| LOW | src/runtime-config.js | 702 | export function setRuntimeDashboardPassword(plain) { | CODE |
| LOW | src/runtime-config.js | 724 | export function getEffectiveDashboardPasswordStored() { | CODE |
| LOW⚡ | src/langserver.js | 485 | function pendingStartReservationCount({ excludeKey = '', beforeSeq = Infinity } = {}) { | CODE |
| LOW⚡ | src/langserver.js | 495 | function poolOccupancyWithPendingReservations(opts = {}) { | CODE |
| LOW⚡ | src/langserver.js | 499 | function activeSpawnReservationCount(opts = {}) { | CODE |
| LOW | src/langserver.js | 86 | export function detectHostMemAvailableBytes(readFile = readFileSync, fallback = freemem()) { | CODE |
| LOW | src/langserver.js | 96 | export function estimateDefaultMaxLsInstances(totalBytes = totalmem(), perInstanceBytes = DEFAULT_LS_RSS_ESTIMATE_BYTES) | CODE |
| LOW | src/langserver.js | 363 | function invalidateEntryForShutdown(entry) { | CODE |
| LOW | src/langserver.js | 445 | async function waitPortReadyOrProcessExit(proc, port, timeoutMs) { | CODE |
| LOW | src/langserver.js | 512 | export function hasLsPoolCapacityForStart(effectiveOccupancy, maxInstances = MAX_LS_INSTANCES, evictableSlots = 0) { | CODE |
| LOW | src/langserver.js | 521 | function getIdleNonDefaultEvictionCandidates() { | CODE |
| LOW | src/langserver.js | 542 | function findIdleNonDefaultEvictionCandidate() { | CODE |
| LOW | src/langserver.js | 546 | function countIdleNonDefaultEvictionCandidates() { | CODE |
| LOW | src/langserver.js | 596 | function hasIdleNonDefaultInstance() { | CODE |
| LOW | src/langserver.js | 618 | function observedLsRssEstimateBytes(now = Date.now()) { | CODE |
| 104 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/v2078-audit-fixes.test.js | 41 | assert.ok(!out.includes('foo@bar.com')); | CODE |
| LOW | test/request-id-body.test.js | 113 | const acct = addAccountByKey('fake-key-f4', 'f4-chat'); | CODE |
| LOW | test/request-id-body.test.js | 140 | const acct = addAccountByKey('fake-key-f4', 'f4-msg'); | CODE |
| LOW | test/email-otp-login.test.js | 112 | () => registerUserWithOtp('test@example.com', '999999', 'fake-token', '', '', null), | CODE |
| LOW | test/devin-connect-credentials.test.js | 39 | assert.equal(getCredential('user@example.com', env), 's3cret-pw!', 'email is case-insensitive'); | CODE |
| LOW | test/devin-connect-credentials.test.js | 41 | assert.deepEqual(listCredentialEmails(env), ['user@example.com']); | CODE |
| LOW | test/caller-environment.test.js | 303 | const filler = 'lorem ipsum dolor sit amet '.repeat(200); // ~5 KB filler | CODE |
| LOW | test/caller-environment.test.js | 303 | const filler = 'lorem ipsum dolor sit amet '.repeat(200); // ~5 KB filler | CODE |
| LOW | src/dashboard/check-i18n.js | 359 | ['placeholder', 'data-i18n-placeholder'], | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 434 | "placeholder": "your-email@example.com" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 438 | "placeholder": "••••••••" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 448 | "placeholder": "proxy.example.com" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 452 | "placeholder": "8080" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 456 | "placeholder": "可选" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 460 | "placeholder": "可选" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 464 | "placeholder": "粘贴 Auth Token（从 windsurf.com/show-auth-token 获取）" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 468 | "placeholder": "可选" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 472 | "placeholder": "http://proxy:8080 或 socks5://user:pass@host:port（可选）", | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 484 | "placeholder": "留空=使用全局" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 491 | "placeholder": "代理认证用户名" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 494 | "placeholder": "代理认证密码" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 497 | "placeholder": "搜索提供商..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 501 | "placeholder": "搜索..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 505 | "placeholder": "输入模型名称筛选..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 509 | "placeholder": "留空则拒绝清单外请求", | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 519 | "placeholder": "搜索提供商..." | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 527 | "placeholder": "John" | CODE |
| LOW⚡ | src/dashboard/i18n/zh-CN.json | 535 | "placeholder": "Doe" | CODE |
| LOW | src/dashboard/i18n/zh-CN.json | 259 | "placeholder": "devin-session-token$... 或 auth1_... 或 email----password 每行一个,可混合", | CODE |
| LOW | src/dashboard/i18n/zh-CN.json | 1307 | "placeholder": { | CODE |
| LOW | src/dashboard/i18n/zh-CN.json | 1428 | "placeholder": "筛选设置…", | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 452 | "placeholder": "Enter model name to filter..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 456 | "placeholder": "Leave blank to reject out-of-list requests", | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 460 | "placeholder": "Proxy auth username" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 463 | "placeholder": "Proxy auth password" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 466 | "placeholder": "Search providers..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 470 | "placeholder": "proxy.example.com" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 474 | "placeholder": "8080" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 478 | "placeholder": "Optional" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 482 | "placeholder": "Optional" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 486 | "placeholder": "Paste Auth Token" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 490 | "placeholder": "Optional" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 494 | "placeholder": "http://proxy:8080 or socks5://user:pass@host:port (optional)", | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 506 | "placeholder": "Leave empty = use global" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 515 | "placeholder": "Search providers..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 519 | "placeholder": "Search..." | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 527 | "placeholder": "John" | CODE |
| LOW⚡ | src/dashboard/i18n/en.json | 535 | "placeholder": "Doe" | CODE |
| LOW | src/dashboard/i18n/en.json | 259 | "placeholder": "devin-session-token$... or auth1_... or email----password — one per line, mixable", | CODE |
| LOW | src/dashboard/i18n/en.json | 434 | "placeholder": "your-email@example.com" | CODE |
| LOW | src/dashboard/i18n/en.json | 438 | "placeholder": "••••••••" | CODE |
| LOW | src/dashboard/i18n/en.json | 1307 | "placeholder": { | CODE |
| LOW | src/dashboard/i18n/en.json | 1428 | "placeholder": "Filter settings...", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docker-compose.yml | 32 | # protocol reliably in agentic clients (Claude Code/Cline/Codex). With it | COMMENT |
| MEDIUM | test/workspace-stub-108.test.js | 12 | // register (closes a fingerprint gap). Old scaffold seeded a | COMMENT |
| MEDIUM | test/workspace-stub-108.test.js | 31 | // - client.js: rebrand the scaffold so every file is unmistakably a | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.32.md | 77 | ### Multi-stage codex orchestration (本次) | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.105.md | 1 | ## v2.0.105 - native bridge real-smoke guardrails | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.33.md | 86 | ### Multi-stage codex orchestration 流程 | COMMENT |
| MEDIUM | docs/releases/RELEASE_NOTES_2.0.138.md | 1 | # v2.0.138 - release gate, dashboard pagination, and memory guardrails | COMMENT |
| MEDIUM⚡ | src/client.js | 332 | // ── Fake workspace scaffold ──────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/client.js | 338 | // gap. The scaffold is created once per account and persists. | COMMENT |
| MEDIUM⚡ | src/client.js | 341 | // Detects an old (pre-#108) scaffold that named the placeholder | COMMENT |
| MEDIUM⚡ | src/client.js | 341 | // Detects an old (pre-#108) scaffold that named the placeholder | COMMENT |
| MEDIUM⚡ | src/client.js | 388 | // #108: prior scaffold seeded a `package.json` named "my-project" plus a | COMMENT |
| MEDIUM⚡ | src/client.js | 388 | // #108: prior scaffold seeded a `package.json` named "my-project" plus a | COMMENT |
| MEDIUM⚡ | src/client.js | 393 | // Node template the user has never seen. Keep the scaffold real enough | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | README.en.md | 229 | client = OpenAI(base_url="http://YOUR_IP:3003/v1", api_key="YOUR_API_KEY") | CODE |
| HIGH | README.en.md | 241 | export ANTHROPIC_API_KEY=YOUR_API_KEY | CODE |
| HIGH | README.en.md | 257 | - API Key: YOUR_API_KEY | CODE |
| HIGH | examples/proxy-user-inject.js | 85 | * -H "Authorization: Bearer YOUR_API_KEY" \ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/client.js | 635 | // Step 1: Start cascade — with retry on panel-state-not-found | COMMENT |
| LOW | src/client.js | 774 | // Step 2: Send message. Retry up to MAX_PANEL_RETRIES on | COMMENT |
| LOW | src/client.js | 876 | // Step 3: Poll for response. | COMMENT |
| LOW | src/socks.js | 38 | // Step 1: greeting — offer auth methods | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 439 | // Step 1: Send verification email | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 442 | // Step 2: Poll Gmail for OTP code | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 450 | // Step 3: Register user with OTP | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/client.js | 635 | // Step 1: Start cascade — with retry on panel-state-not-found | COMMENT |
| LOW | src/client.js | 774 | // Step 2: Send message. Retry up to MAX_PANEL_RETRIES on | COMMENT |
| LOW | src/client.js | 876 | // Step 3: Poll for response. | COMMENT |
| LOW | src/socks.js | 38 | // Step 1: greeting — offer auth methods | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 439 | // Step 1: Send verification email | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 442 | // Step 2: Poll Gmail for OTP code | COMMENT |
| LOW⚡ | src/dashboard/email-otp-login.js | 450 | // Step 3: Register user with OTP | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/conversation-pool.js | 41 | // reuse robust against fingerprint drift (system-prompt changes, tool-list | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/tool-emulation-allowlist.test.js | 54 | const raw = 'Sure, here you go:\n```json\n{"name":"Bash","arguments":{"command":"id"}}\n```\nLet me know if you need | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install-ls.sh | 4 | # Usage: | COMMENT |