Use Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA
This report presents the forensic synthetic code analysis of garrytan/gstack, a TypeScript project with 130,177 GitHub stars. SynthScan v2.0 examined 297,340 lines of code across 1127 source files, recording 1624 pattern matches distributed across 14 syntactic categories. The overall adjusted score of 11.5 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1624 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | design/test/serve.test.ts | 50 | // ─── Serve as HTTP module (not subprocess) ──────────────────────── | COMMENT |
| MEDIUM | design/test/serve.test.ts | 280 | // ─── Path traversal protection in /api/reload ───────────────────── | COMMENT |
| MEDIUM | design/test/serve.test.ts | 413 | // ─── Full lifecycle: regeneration round-trip ────────────────────── | COMMENT |
| MEDIUM | design/test/feedback-roundtrip-daemon.test.ts | 63 | // ─── Submit round-trip ─────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/feedback-roundtrip-daemon.test.ts | 141 | // ─── Regenerate + reload round-trip ────────────────────────────── | COMMENT |
| MEDIUM | design/test/feedback-roundtrip-daemon.test.ts | 214 | // ─── Two-board, one-daemon attach behavior ─────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 44 | // ─── /health ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 67 | // ─── POST /api/boards (publish) ───────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 147 | // ─── GET /boards/<id> trailing-slash redirect ──────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 176 | // ─── POST /boards/<id>/api/feedback ────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 257 | // ─── POST /boards/<id>/api/reload ──────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 311 | // ─── GET / (index) ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 346 | // ─── /shutdown ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 389 | // ─── LRU + non-done protection ─────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 449 | // ─── Idle + meaningful activity ────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 467 | // ─── Malformed body negatives ──────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 533 | // ─── Unknown routes ────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/feedback-roundtrip.test.ts | 145 | // ─── The critical test: browser click → file on disk ───────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 71 | // ─── healthCheck + readStateFile basics ────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 100 | // ─── ensureDaemon ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 287 | // ─── publishBoard ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 318 | // ─── shutdownDaemon / daemonStatus ─────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 506 | // ─── Concurrent ensureDaemon race (one wins the lock) ─────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 546 | // ─── Stale-lock reclaim ────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 42 | // ─── Tunables (env overrides for tests) ────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 62 | // ─── Per-board state ───────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 108 | // ─── Helpers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 192 | // ─── Shutdown ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 232 | // ─── Handlers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 467 | // ─── Router ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 525 | // ─── Startup ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon-client.ts | 216 | // ─── Internals ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extension/sidepanel.js | 85 | // ─── Chat path ripped ──────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extension/sidepanel.js | 91 | // ─── Reload Sidebar ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extension/sidepanel.js | 96 | // ─── Copy Cookies ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 32 | // ─── Connection State Machine ───────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 111 | // ─── Debug Tabs ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 154 | // ─── Activity Feed ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 243 | // ─── SSE Connection ───────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 294 | // ─── Memory Footer Readout ────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 390 | // ─── Tab guardrail toast (D5 + Codex single-tab flag) ─────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 582 | // ─── Refs Tab ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 618 | // ─── Inspector Tab ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 725 | // ─── Box Model Rendering ──────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 771 | // ─── Matched Rules Rendering ──────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 862 | // ─── Computed Styles Rendering ────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 887 | // ─── Quick Edit ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 961 | // ─── Send to Agent ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1017 | // ─── Quick Action Helpers (toolbar buttons) ────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1097 | // ─── Section Toggles ──────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1112 | // ─── Inspector SSE ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1144 | // ─── Server Discovery ─────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1194 | // ─── Port Configuration ───────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1223 | // ─── Reconnect / Copy Buttons ──────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1346 | // ─── Message Listener ─────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1406 | // ─── v1.44 pagehide: explicit PTY dispose on sidebar close ────────── | COMMENT |
| MEDIUM | extension/background.js | 22 | // ─── Port Discovery ──────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/background.js | 39 | // ─── Auth Token Bootstrap ───────────────────────────────────── | COMMENT |
| MEDIUM | extension/background.js | 71 | // ─── Health Polling ──────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/background.js | 148 | // ─── Command Proxy ───────────────────────────────────────────── | COMMENT |
| 689 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README.md | 47 | ### Step 1: Install on your machine | COMMENT |
| LOW | README.md | 53 | ### Step 2: Team mode — auto-update for shared repos (recommended) | COMMENT |
| LOW | CONTRIBUTING.md | 459 | ### Step 1: Symlink your checkout | COMMENT |
| LOW | CONTRIBUTING.md | 466 | ### Step 2: Run setup to create per-skill symlinks | COMMENT |
| LOW | CONTRIBUTING.md | 480 | ### Step 3: Develop | COMMENT |
| LOW | pair-agent/SKILL.md | 453 | ## Step 1: Check prerequisites | COMMENT |
| LOW | pair-agent/SKILL.md | 467 | ## Step 2: Ask what they want | COMMENT |
| LOW | pair-agent/SKILL.md | 488 | ## Step 3: Local or remote? | COMMENT |
| LOW | pair-agent/SKILL.md | 506 | ## Step 4: Execute pairing | COMMENT |
| LOW | pair-agent/SKILL.md | 655 | ## Step 5: Verify connection | COMMENT |
| LOW | design-html/SKILL.md | 503 | ## Step 0: Input Detection | COMMENT |
| LOW | design-html/SKILL.md | 603 | ## Step 1: Design Analysis | COMMENT |
| LOW | design-html/SKILL.md | 634 | ## Step 2: Smart Pretext API Routing | COMMENT |
| LOW | design-html/SKILL.md | 674 | ## Step 3: Generate Pretext-Native HTML | COMMENT |
| LOW | design-html/SKILL.md | 772 | ## Step 4: Preview + Refinement Loop | COMMENT |
| LOW | design-html/SKILL.md | 831 | ## Step 5: Save & Next Steps | COMMENT |
| LOW | plan-tune/SKILL.md | 418 | ## Step 0: Detect what the user wants | COMMENT |
| LOW | design-shotgun/SKILL.md | 477 | ## Step 0: Session Detection | COMMENT |
| LOW | design-shotgun/SKILL.md | 509 | ## Step 1: Context Gathering | COMMENT |
| LOW | design-shotgun/SKILL.md | 563 | ## Step 2: Taste Memory | COMMENT |
| LOW | design-shotgun/SKILL.md | 629 | ## Step 3: Generate Variants | COMMENT |
| LOW | design-shotgun/SKILL.md | 758 | ## Step 4: Comparison Board + Feedback Loop | COMMENT |
| LOW | design-shotgun/SKILL.md | 874 | ## Step 5: Feedback Confirmation | COMMENT |
| LOW | design-shotgun/SKILL.md | 890 | ## Step 6: Save & Next Steps | COMMENT |
| LOW | plan-design-review/SKILL.md | 411 | ## Step 0: Detect platform and base branch | COMMENT |
| LOW | plan-design-review/SKILL.md | 755 | ## Step 0: Design Scope Assessment | COMMENT |
| LOW⚡ | design/test/serve.test.ts | 462 | // Step 1: User clicks regenerate | COMMENT |
| LOW⚡ | design/test/serve.test.ts | 472 | // Step 2: Progress shows regenerating | COMMENT |
| LOW⚡ | design/test/serve.test.ts | 476 | // Step 3: Agent generates new variants and reloads | COMMENT |
| LOW⚡ | design/test/serve.test.ts | 487 | // Step 4: Progress shows serving (board would auto-refresh) | COMMENT |
| LOW⚡ | design/test/serve.test.ts | 491 | // Step 5: User submits on round 2 | COMMENT |
| LOW | design/test/feedback-roundtrip.test.ts | 311 | // Step 1: User clicks Regenerate | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 327 | // Step 2: Agent generates new variants and creates a new board | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 336 | // Step 3: Agent POSTs /api/reload to swap the board | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 346 | // Step 4: Board auto-refreshes (simulated by navigating again) | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 355 | // Step 5: User picks variant C on round 2 and submits | COMMENT |
| LOW⚡ | design/src/evolve.ts | 36 | // Step 1: Analyze current screenshot | COMMENT |
| LOW⚡ | design/src/evolve.ts | 40 | // Step 2: Generate evolved version using analysis + brief | COMMENT |
| LOW | autoplan/SKILL.md | 416 | ## Step 0: Detect platform and base branch | COMMENT |
| LOW | autoplan/SKILL.md | 665 | ### Step 1: Capture restore point | COMMENT |
| LOW | autoplan/SKILL.md | 692 | ### Step 2: Read context | COMMENT |
| LOW | autoplan/SKILL.md | 708 | ### Step 3: Load skill files from disk | COMMENT |
| LOW⚡ | extension/sidepanel.js | 1279 | // Step 2: If background says connected + has token, use that | COMMENT |
| LOW⚡ | extension/sidepanel.js | 1289 | // Step 3: Background not connected yet. Try hitting /health directly. | COMMENT |
| LOW | extension/sidepanel.js | 1257 | // Step 1: Ask background for the port | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 19 | ## Step 1: Install and run Tailscale | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 35 | ## Step 2: Set up the daemon's ACL | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 75 | ## Step 3: Mint a session token for a remote agent | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 91 | ## Step 4: Tighten the Tailscale ACL (defense in depth) | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 122 | ## Step 5: Audit trail | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 152 | // Step 1: pick a device | COMMENT |
| LOW⚡ | ios-qa/daemon/src/tunnel-bootstrap.ts | 208 | // Step 2: launch app (idempotent — devicectl returns success if already running) | COMMENT |
| LOW⚡ | ios-qa/daemon/src/tunnel-bootstrap.ts | 216 | // Step 3: resolve tunnel IPv6. Try devicectl `info details` first (most | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 235 | // Step 4: wait for StateServer to become reachable, then scrape boot token. | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 310 | // Step 5: rotate the boot token to a fresh in-memory-only one. | COMMENT |
| LOW⚡ | test/skill-e2e-ship-docsync.test.ts | 154 | const start = skeleton.indexOf('## Step 17: Push'); | CODE |
| LOW⚡ | test/skill-e2e-ship-docsync.test.ts | 155 | const end = skeleton.indexOf('## Step 20: Persist ship metrics'); | CODE |
| LOW⚡ | test/skill-e2e-ship-docsync.test.ts | 234 | !/## Step 19: Create PR\/MR|Parent processing:/.test(input) | CODE |
| LOW | test/skill-validation.test.ts | 1326 | // Headings like "## Step 7: Test Coverage Audit" — NOT sub-steps like "## Step 8.1:" | COMMENT |
| LOW | test/skill-validation.test.ts | 1425 | expect(skeleton).toContain('## Step 1: Detect mode'); | CODE |
| 258 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bunfig.toml | 1 | [test] | COMMENT |
| LOW | test-setup.ts | 21 | // pollution class where one test sets `process.env.PATH = '/test/bin:/usr/bin'` | COMMENT |
| LOW | .osv-scanner.toml | 1 | # OSV-Scanner configuration. | COMMENT |
| LOW | design/test/image-gen-pairing.test.ts | 1 | import { describe, test, expect } from "bun:test"; | COMMENT |
| LOW | design/test/daemon-discovery.test.ts | 361 | await publishBoard({ port: d.port, html: makeBoardHtml(workDir) }); | COMMENT |
| LOW | freeze/bin/check-freeze.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | extension/sidepanel.js | 381 | } | COMMENT |
| LOW | extension/sidepanel.js | 1401 | detail: { active: msg.active, tabs: msg.tabs, reason: msg.reason }, | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 1 | // Bootstrap the CoreDevice tunnel to a connected iPhone running the iOS app | COMMENT |
| LOW | ios-qa/daemon/src/index.ts | 1 | // gstack-ios-qa-daemon entrypoint. | COMMENT |
| LOW | ios-qa/scripts/gen-accessors.ts | 1 | #!/usr/bin/env bun | COMMENT |
| LOW | ios-qa/scripts/gen-accessors-tool/Package.swift | 1 | // swift-tools-version:5.9 | COMMENT |
| LOW | careful/bin/hook-extract.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | careful/bin/check-careful.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | careful/bin/check-careful.sh | 21 | _HOOK_HELPER="$_HOOK_DIR/hook-extract.sh" | COMMENT |
| LOW | careful/bin/check-careful.sh | 61 | _careful_log_fire() { gstack_hook_log_fire careful "$1"; } | COMMENT |
| LOW | careful/bin/check-careful.sh | 81 | fi | COMMENT |
| LOW | careful/bin/check-careful.sh | 181 | # --- Check for safe exceptions (one standalone rm of build artifacts) --- | COMMENT |
| LOW | test/setup-windows-fallback.test.ts | 61 | const hookEnd = SETUP_SRC.indexOf('\nif [ "$TEAM_MODE" -eq 1 ]', hookStart); | COMMENT |
| LOW | test/brain-sync-windows-paths.test.ts | 1 | import { describe, test, expect } from 'bun:test'; | COMMENT |
| LOW | test/brain-sync-windows-paths.test.ts | 21 | // nothing and the drain silently stages/commits nothing. | COMMENT |
| LOW | test/skill-llm-eval-spec.test.ts | 21 | const describeEval = evalsEnabled ? describe : describe.skip; | COMMENT |
| LOW | test/gbrain-detect-install.test.ts | 21 | const DETECT = path.join(ROOT, 'bin', 'gstack-gbrain-detect'); | COMMENT |
| LOW | test/skill-size-budget.test.ts | 161 | * skill is added to SECTIONS_EXTRACTED; its union is guarded instead by the | COMMENT |
| LOW | test/skill-validation.test.ts | 1621 | COMMENT | |
| LOW | test/skill-validation.test.ts | 1661 | // Pre-#1209, the bare `codex review --base` path stripped the filesystem | COMMENT |
| LOW | test/llm-judge-recommendation.test.ts | 101 | B) Client-side | COMMENT |
| LOW | test/skill-e2e-setup-gbrain-path4-local-pglite.test.ts | 1 | // E2E: /setup-gbrain Path 4 with Step 4.5 "Yes" — local PGLite for code search. | COMMENT |
| LOW | test/skill-e2e-setup-gbrain-path4-local-pglite.test.ts | 221 | // Smoke test contract (codex #12: AgentSDK is non-deterministic, so this | COMMENT |
| LOW | test/codex-hardening.test.ts | 421 | // Skip prose lines that just discuss codex review. Only inspect lines | COMMENT |
| LOW | test/codex-hardening.test.ts | 501 | // call first and the exit-124 branch below it becomes dead code. | COMMENT |
| LOW | test/touchfiles-facade.test.ts | 21 | const DATA_PATH = path.join(import.meta.dir, 'helpers', 'touchfiles-data.ts'); | COMMENT |
| LOW | test/skill-e2e-ios-swift-build.test.ts | 1 | // Swift-build invariant tests. Runs against the fixture iOS app at | COMMENT |
| LOW | test/setup-gbrain-bin-invocation-paths.test.ts | 1 | // setup-gbrain bin invocation path lint. | COMMENT |
| LOW | test/skill-e2e-ios.test.ts | 1 | // High-level E2E for /ios-qa skill flow. | COMMENT |
| LOW | test/skill-e2e-review-army.test.ts | 21 | run('git', ['config', 'user.email', 'test@test.com']); | COMMENT |
| LOW | test/gstack-next-version.test.ts | 381 | // Integration smoke — only runs if gh is available and authenticated. Confirms | COMMENT |
| LOW | test/skill-e2e-ios-device.test.ts | 1 | // Real-device tests. The lightweight CoreDevice checks run with | COMMENT |
| LOW | test/e2e-tier-alignment.test.ts | 101 | // HARD invariant (C6): the paid sharded runner skips a skill-e2e shard when | COMMENT |
| LOW | test/skill-e2e-autoplan-dual-voice.test.ts | 101 | timeout: 600_000, // 10 min | COMMENT |
| LOW | test/evidence.test.ts | 321 | // spawned command inherits them. That leaks production credentials into a child | COMMENT |
| LOW | test/tracker-guard-wiring.test.ts | 21 | // Tracker-TEXT read shapes. Field-list/state-routing fetches (e.g. | COMMENT |
| LOW | test/uninstall-windows-copies.test.ts | 201 | // match is anchored: gstack/*|*/gstack/*; keeping the stricter | COMMENT |
| LOW | test/post-rename-doc-regen.test.ts | 1 | // Post-rename doc-regen regression: after `bun run gen:skill-docs`, no | COMMENT |
| LOW | test/run-in-background-guidance.test.ts | 1 | import { describe, test, expect } from 'bun:test'; | COMMENT |
| LOW | test/setup-gbrain-path4-structure.test.ts | 1 | // setup-gbrain Path 4 structural lint. | COMMENT |
| LOW | test/redact-engine.test.ts | 101 | // bare 32-hex with no SID nearby should NOT flag as twilio | COMMENT |
| LOW | test/redact-engine.test.ts | 121 | expect(ids("postgres://user:$DB_PASSWORD@host/app")).not.toContain("db.url_with_password"); | COMMENT |
| LOW | test/skill-e2e-setup-gbrain-remote.test.ts | 1 | // E2E: /setup-gbrain Path 4 (Remote MCP) happy path via Agent SDK. | COMMENT |
| LOW | test/skill-e2e-setup-gbrain-remote.test.ts | 221 | } | COMMENT |
| LOW | test/skill-e2e-plan-format.test.ts | 41 | // `Recommendation: <choice> because <reason>`, where <choice> is the bare | COMMENT |
| LOW | test/gstack-memory-ingest.test.ts | 521 | expect(r.exitCode).toBe(0); | COMMENT |
| LOW | test/plan-tune.test.ts | 361 | // that don't appear to map to any registry entry. | COMMENT |
| LOW | test/ios-debug-bridge-release-guard.test.ts | 1 | import { describe, test, expect } from 'bun:test'; | COMMENT |
| LOW | test/skill-e2e-setup-gbrain-bad-token.test.ts | 1 | // E2E: /setup-gbrain Path 4 with a bad bearer token via Agent SDK. | COMMENT |
| LOW | test/gen-skill-docs.test.ts | 421 | path: path.join(ROOT, 'plan-eng-review', 'SKILL.md'), | COMMENT |
| LOW | test/helpers/agent-sdk-runner.ts | 301 | const queryImpl: QueryProvider = opts.queryProvider ?? query; | COMMENT |
| LOW | test/helpers/touchfiles-data.ts | 81 | 'plan-eng-review': ['plan-eng-review/**'], | COMMENT |
| LOW | test/helpers/touchfiles-data.ts | 101 | // sequential ~+10min a local read suggests. | COMMENT |
| LOW | test/helpers/touchfiles-data.ts | 401 | // Swift StateServer implementation (loopback bind, boot token rotation, | COMMENT |
| 141 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | design/test/serve.test.ts | 462 | // Step 1: User clicks regenerate | COMMENT |
| LOW⚡ | design/test/serve.test.ts | 472 | // Step 2: Progress shows regenerating | COMMENT |
| LOW⚡ | design/test/serve.test.ts | 476 | // Step 3: Agent generates new variants and reloads | COMMENT |
| LOW⚡ | design/test/serve.test.ts | 487 | // Step 4: Progress shows serving (board would auto-refresh) | COMMENT |
| LOW⚡ | design/test/serve.test.ts | 491 | // Step 5: User submits on round 2 | COMMENT |
| LOW | design/test/feedback-roundtrip.test.ts | 311 | // Step 1: User clicks Regenerate | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 327 | // Step 2: Agent generates new variants and creates a new board | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 336 | // Step 3: Agent POSTs /api/reload to swap the board | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 346 | // Step 4: Board auto-refreshes (simulated by navigating again) | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 355 | // Step 5: User picks variant C on round 2 and submits | COMMENT |
| LOW⚡ | design/src/evolve.ts | 36 | // Step 1: Analyze current screenshot | COMMENT |
| LOW⚡ | design/src/evolve.ts | 40 | // Step 2: Generate evolved version using analysis + brief | COMMENT |
| LOW⚡ | extension/sidepanel.js | 1279 | // Step 2: If background says connected + has token, use that | COMMENT |
| LOW⚡ | extension/sidepanel.js | 1289 | // Step 3: Background not connected yet. Try hitting /health directly. | COMMENT |
| LOW | extension/sidepanel.js | 1257 | // Step 1: Ask background for the port | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 152 | // Step 1: pick a device | COMMENT |
| LOW⚡ | ios-qa/daemon/src/tunnel-bootstrap.ts | 208 | // Step 2: launch app (idempotent — devicectl returns success if already running) | COMMENT |
| LOW⚡ | ios-qa/daemon/src/tunnel-bootstrap.ts | 216 | // Step 3: resolve tunnel IPv6. Try devicectl `info details` first (most | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 235 | // Step 4: wait for StateServer to become reachable, then scrape boot token. | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 310 | // Step 5: rotate the boot token to a fresh in-memory-only one. | COMMENT |
| LOW⚡ | test/skill-e2e-ship-docsync.test.ts | 154 | const start = skeleton.indexOf('## Step 17: Push'); | CODE |
| LOW⚡ | test/skill-e2e-ship-docsync.test.ts | 155 | const end = skeleton.indexOf('## Step 20: Persist ship metrics'); | CODE |
| LOW⚡ | test/skill-e2e-ship-docsync.test.ts | 234 | !/## Step 19: Create PR\/MR|Parent processing:/.test(input) | CODE |
| LOW | test/skill-validation.test.ts | 1326 | // Headings like "## Step 7: Test Coverage Audit" — NOT sub-steps like "## Step 8.1:" | COMMENT |
| LOW | test/skill-validation.test.ts | 1425 | expect(skeleton).toContain('## Step 1: Detect mode'); | CODE |
| LOW⚡ | test/regression-1624-retro-stale-base.test.ts | 44 | const step1 = body.indexOf("### Step 1: Gather"); | CODE |
| LOW⚡ | test/regression-1624-retro-stale-base.test.ts | 53 | const step2 = body.indexOf("### Step 2: Compute Metrics"); | CODE |
| LOW | test/skill-llm-eval.test.ts | 692 | startMarker: '## Step 0: Nuclear Scope Challenge', | CODE |
| LOW | test/skill-llm-eval.test.ts | 761 | startMarker: '## Step 1: Pre-flight', | CODE |
| LOW | test/skill-llm-eval.test.ts | 797 | startMarker: '### Step 2: Detect platform', | CODE |
| LOW | test/skill-e2e-ios-swift-build.test.ts | 353 | // Step 1: clean + release build (Core only — UI/Touch can't build on macOS) | COMMENT |
| LOW | test/skill-e2e-ios-swift-build.test.ts | 365 | // Step 2: locate the built object file(s). SwiftPM puts .build artifacts | COMMENT |
| LOW | test/evidence.test.ts | 185 | // Step 15: commit the exact same content. HEAD tree changes; working-tree | COMMENT |
| LOW⚡ | test/carve-guards-negative.test.ts | 37 | `# ${skill}\n## Step 0: Setup\nstays here\n## Section index\n| When | Read |\n${stopLine}${leak}## EXIT PLAN MODE GA | CODE |
| LOW⚡ | test/carve-guards-negative.test.ts | 47 | mustStayInSkeleton: ['## Step 0: Setup'], | CODE |
| LOW⚡ | test/skill-fixture.test.ts | 162 | expect(out).toContain('## Step 4: Critical pass (core review)'); | CODE |
| LOW⚡ | test/skill-fixture.test.ts | 166 | expect(out).not.toContain('## Step 5: Fix-First Review'); | CODE |
| LOW⚡ | test/skill-fixture.test.ts | 207 | expect(out).toContain('### Step 1: Gather'); | CODE |
| LOW⚡ | test/skill-fixture.test.ts | 208 | expect(out).toContain('### Step 14: Write the Narrative'); | CODE |
| LOW | test/skill-fixture.test.ts | 222 | expect(out).toContain('## Step 4: Critical pass (core review)'); | CODE |
| LOW | test/setup-gbrain-path4-structure.test.ts | 58 | expect(skeleton).toContain('## Step 2: Pick a path (AskUserQuestion)'); | CODE |
| LOW | test/skill-ceo-section-ordering.test.ts | 37 | const STEP0 = '## Step 0: Nuclear Scope Challenge + Mode Selection'; | CODE |
| LOW | test/ship-document-release-dispatch.test.ts | 51 | '## Step 18: Documentation sync (via subagent, before PR creation)' | CODE |
| LOW | test/ship-document-release-dispatch.test.ts | 70 | expect(content).toContain('## Step 19: Create PR/MR'); | CODE |
| LOW⚡ | test/ship-document-release-dispatch.test.ts | 127 | '## Step 18: Documentation sync (via subagent, before PR creation)' | CODE |
| LOW⚡ | test/ship-document-release-dispatch.test.ts | 129 | const step19 = content.indexOf('## Step 19: Create PR/MR'); | CODE |
| LOW | test/gen-skill-docs.test.ts | 418 | markers: ['# Mega Plan Review Mode', '## Step 0: Detect platform and base branch'], | CODE |
| LOW⚡ | test/skill-e2e-review-attribution.test.ts | 53 | const step0Start = full.indexOf('## Step 0: Detect platform and base branch'); | CODE |
| LOW⚡ | test/skill-e2e-review-attribution.test.ts | 54 | const step1Start = full.indexOf('## Step 1: Check branch'); | CODE |
| LOW⚡ | test/skill-e2e-review-attribution.test.ts | 110 | const step0Start = fullShipSkill.indexOf('## Step 0: Detect platform and base branch'); | CODE |
| LOW⚡ | test/skill-e2e-review-attribution.test.ts | 111 | const step0End = fullShipSkill.indexOf('## Step 1: Pre-flight'); | CODE |
| LOW⚡ | test/helpers/carve-guards.ts | 310 | mustStayInSkeleton: ['## Step 1: Pre-flight', '## Step 1.5: Coverage Map'], | CODE |
| LOW⚡ | test/helpers/carve-guards.ts | 311 | mustMoveToSection: ['## Step 2: Per-File Documentation Audit', '## Step 5: CHANGELOG Voice Polish'], | CODE |
| LOW⚡ | test/helpers/carve-guards.ts | 408 | '## Step 0: Detect platform and base branch', | CODE |
| LOW⚡ | test/helpers/carve-guards.ts | 409 | '## Step 1: Check branch', | CODE |
| LOW⚡ | test/helpers/carve-guards.ts | 411 | '## Step 4: Critical pass (core review)', | CODE |
| LOW⚡ | test/helpers/carve-guards.ts | 413 | '## Step 5: Fix-First Review', | CODE |
| LOW⚡ | test/helpers/carve-guards.ts | 417 | mustPrecedeStop: ['## Step 0: Detect platform and base branch'], | CODE |
| LOW⚡ | test/helpers/carve-guards.ts | 439 | '## Step 1: Detect mode', | CODE |
| LOW⚡ | test/helpers/carve-guards.ts | 445 | mustPrecedeStop: ['## Step 1: Detect mode', '## Filesystem Boundary'], | CODE |
| 29 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | design-html/SKILL.md | 624 | on the plan or user description (never lorem ipsum). | CODE |
| LOW | design-html/SKILL.md | 726 | - Real content extracted from the mockup (never lorem ipsum) | CODE |
| LOW | design-html/SKILL.md | 899 | user's description. Never use "Lorem ipsum", "Your text here", or placeholder content. | CODE |
| LOW | design/test/variants-retry-after.test.ts | 68 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 90 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 105 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 121 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 136 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 185 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design-consultation/sections/proposal-and-preview.md | 297 | 3. **Shows the product name** (not "Lorem Ipsum") as the hero heading | CODE |
| LOW | ios-qa/daemon/test/session-tokens.test.ts | 15 | identity: 'user@example.com', | CODE |
| LOW | ios-qa/daemon/test/session-tokens.test.ts | 20 | identity: 'user@example.com', | CODE |
| LOW | ios-qa/daemon/test/tailscale-localapi.test.ts | 20 | UserProfile: { LoginName: 'admin@example.com' }, | CODE |
| LOW⚡ | ios-qa/daemon/test/allowlist.test.ts | 33 | entries: [{ identity: 'user@example.com', capabilities: ['observe'], expires_at: null }], | CODE |
| LOW⚡ | ios-qa/daemon/test/allowlist.test.ts | 37 | expect(JSON.parse(raw).entries[0].identity).toBe('user@example.com'); | CODE |
| LOW⚡ | ios-qa/daemon/test/allowlist.test.ts | 43 | entries: [{ identity: 'user@example.com', capabilities: ['mutate' as const], expires_at: null }], | CODE |
| LOW⚡ | ios-qa/daemon/test/allowlist.test.ts | 45 | expect(findEntry(list, 'user@example.com')?.identity).toBe('user@example.com'); | CODE |
| LOW | ios-qa/daemon/src/types.ts | 58 | identity: string; // canonicalized: "user@example.com" or "tag:<name>" or "node:<key>" | CODE |
| LOW | ios-qa/daemon/src/tailscale-localapi.ts | 91 | * "UserProfile": { "LoginName": "user@example.com", ... }, | COMMENT |
| LOW | test/skill-e2e-ship-docsync.test.ts | 124 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-session-intelligence.test.ts | 36 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-autoplan-chain.test.ts | 60 | gitRun(['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/gbrain-supabase-provision.test.ts | 123 | { id: 'deprec-1', slug: 'acme', name: 'Acme Inc' }, | CODE |
| LOW | test/gbrain-supabase-provision.test.ts | 134 | { slug: 'acme', name: 'Acme Inc' }, | CODE |
| LOW | test/gbrain-supabase-provision.test.ts | 716 | return jsonResp([{ id: 'x', slug: 'acme', name: 'Acme Inc' }]); | CODE |
| LOW | test/gbrain-supabase-provision.test.ts | 740 | expect(JSON.parse(stdout.trim())).toEqual({ orgs: [{ slug: 'acme', name: 'Acme Inc' }] }); | CODE |
| LOW | test/skill-e2e-bws.test.ts | 195 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-bws.test.ts | 298 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 29 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 120 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 205 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 287 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 384 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 524 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 592 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 653 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 790 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-office-hours.test.ts | 39 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-office-hours.test.ts | 111 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan-tune.test.ts | 36 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-review.test.ts | 30 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-review.test.ts | 107 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-review.test.ts | 182 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 27 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 102 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 184 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 263 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 324 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 389 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-context-skills.test.ts | 40 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-office-hours-phase4.test.ts | 58 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan-prosons.test.ts | 118 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-ship-idempotency.test.ts | 84 | sh('git config user.email "test@test.com"', workTree); | CODE |
| LOW | test/touchfiles.test.ts | 202 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/codex-e2e-plan-format.test.ts | 133 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/audit-compliance.test.ts | 33 | expect(tmpl).not.toContain('"test@test.com"'); | CODE |
| LOW | test/skill-e2e-review-army.test.ts | 21 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-skillify.test.ts | 73 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-design.test.ts | 57 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-design.test.ts | 348 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| 48 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | design/src/daemon.ts | 179 | function findActiveBoardForSourceDir(sourceDir: string): Board | null { | CODE |
| LOW | design/src/design-to-code.ts | 23 | export async function generateDesignToCodePrompt( | CODE |
| LOW | design/src/daemon-client.ts | 315 | async function gracefulShutdownExistingDaemon(port: number): Promise<void> { | CODE |
| LOW | design/src/variants.ts | 237 | async function generateResponsiveVariants( | CODE |
| LOW | test/skill-e2e-plan-ceo-mode-routing.test.ts | 68 | async function navigateToModeAskUserQuestion( | CODE |
| LOW | test/skill-e2e-skillify.test.ts | 134 | function installBundledHackernewsSkill(workDir: string) { | CODE |
| LOW | test/redact-prepush-scan-range.test.ts | 86 | function setUpRemoteWithForeignFixture(): void { | CODE |
| LOW | test/redact-prepush-scan-range.test.ts | 194 | function buildSecretOnSecondRemote(): { originTip: string } { | CODE |
| LOW | test/extension-pty-inject-invariant.test.ts | 70 | function findEnclosingFunctionStart(content: string, callerPos: number): number { | CODE |
| LOW | test/tasks-section-jq.test.ts | 33 | function extractBranchCommitFilter(): string { | CODE |
| LOW | test/gbrain-source-worktree-advance.test.ts | 44 | function makeArtifactsRepoWithWorktree(): { head: string } { | CODE |
| LOW | test/gen-skill-docs.test.ts | 85 | function extractPreambleBeforeWorkflow(content: string, workflowMarkers: string[]): string { | CODE |
| LOW | test/helpers/agent-sdk-runner.ts | 145 | export function passThroughNonAskUserQuestion( | CODE |
| LOW | test/helpers/skill-parser.ts | 145 | export function extractRemoteSlugPatterns(rootDir: string, subdirs: string[]): Map<string, string[]> { | CODE |
| LOW | test/helpers/e2e-helpers.ts | 228 | export async function assertRecommendationQuality(opts: { | CODE |
| LOW | test/helpers/claude-pty-runner.ts | 250 | export function planFileHasDecisionsSection(planFile: string): boolean { | CODE |
| LOW | test/helpers/claude-pty-runner.ts | 288 | export function isPermissionDialogVisible(visible: string): boolean { | CODE |
| LOW | test/helpers/claude-pty-runner.ts | 320 | export function isNumberedOptionListVisible(visible: string): boolean { | CODE |
| LOW | test/helpers/claude-pty-runner.ts | 660 | export function isScopeGateQuestionVisible(visible: string): boolean { | CODE |
| LOW | test/helpers/claude-pty-runner.ts | 678 | export function isScopeGateAutoSelectVisible(visible: string): boolean { | CODE |
| LOW | test/helpers/claude-pty-runner.ts | 1167 | export function assertReviewReportAtBottom( | CODE |
| LOW | test/helpers/claude-pty-runner.ts | 1204 | export function assertReportAtBottomIfPlanWritten( | CODE |
| LOW | bin/gstack-gbrain-sync.ts | 440 | export function derivePathOnlyHashLegacyId(repoPath: string): string { | CODE |
| LOW | bin/gstack-gbrain-sync.ts | 467 | function gbrainSupportsSourcesRename(env?: NodeJS.ProcessEnv): boolean { | CODE |
| LOW | bin/gstack-gbrain-sync.ts | 533 | export function planHostnameFoldMigration( | CODE |
| LOW | bin/gstack-gbrain-sync.ts | 1186 | export function ensureGbrainSourceGitignored(root: string): void { | CODE |
| LOW | bin/gstack-memory-ingest.ts | 1532 | function makePersistentTranscriptDir(): string { | CODE |
| LOW | bin/gstack-memory-ingest.ts | 1708 | function failedOnUnknownIncludeGitignored(status: number | null, stderr: string): boolean { | CODE |
| LOW | scripts/resolve-codex-generation-model.ts | 33 | export function resolveCodexGenerationModel(opts: { | CODE |
| LOW | scripts/test-free-shards.ts | 1258 | function spawnSyncGitStatusGenerated(): string[] { | CODE |
| LOW | scripts/test-paid-shards.ts | 289 | export function partitionShardsByDiffSelection( | CODE |
| LOW | scripts/gstack-schema-pack.ts | 261 | export function getSchemaPackMutationPayload(): { | CODE |
| LOW | scripts/gen-skill-docs.ts | 68 | function effectiveSuppressedResolvers(hostConfig: HostConfig): Set<string> { | CODE |
| LOW | scripts/gen-skill-docs.ts | 200 | function extractNameAndDescription(content: string): { name: string; description: string } { | CODE |
| LOW | scripts/gen-skill-docs.ts | 492 | function condenseOpenAIShortDescription(description: string): string { | CODE |
| LOW | scripts/psychographic-signals.ts | 253 | export function validateRegistrySignalKeys(): { | CODE |
| LOW | scripts/psychographic-signals.ts | 285 | export function normalizeToDimensionValue(total: number): number { | CODE |
| LOW | scripts/test-strict-output.ts | 91 | export function installChildSignalForwarding( | CODE |
| LOW | scripts/test-strict-output.ts | 191 | export function classifyBunTestOutputLine(rawLine: string): BunTestOutputFinding | null { | CODE |
| LOW | scripts/test-strict-output.ts | 198 | export function parseBunTerminalSummaryLine(rawLine: string): number | null { | CODE |
| LOW⚡ | scripts/resolvers/testing.ts | 213 | function generateTestCoverageAuditInner(mode: CoverageAuditMode): string { | CODE |
| LOW | scripts/resolvers/testing.ts | 577 | export function generateTestCoverageAuditPlan(_ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/testing.ts | 581 | export function generateTestCoverageAuditShip(_ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/review-army.ts | 14 | function generateSpecialistSelection(ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/review-army.ts | 85 | function generateSpecialistDispatch(ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/gbrain.ts | 55 | export function generateGBrainContextLoad(ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/gbrain.ts | 75 | export function generateGBrainSaveResults(ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/gbrain.ts | 195 | export function generateBrainCacheRefresh(ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/design-doc-discovery.ts | 47 | export function generateDesignDocDiscovery(_ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/review.ts | 77 | export function generatePlanFileReviewReport(_ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/review.ts | 207 | export function generateAntiShortcutClause(_ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/review.ts | 322 | export function generateCodexSecondOpinion(ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/review.ts | 851 | function generatePlanFileDiscovery(): string { | CODE |
| LOW | scripts/resolvers/review.ts | 887 | function generatePlanCompletionAuditInner(mode: PlanCompletionMode): string { | CODE |
| LOW⚡ | scripts/resolvers/review.ts | 1124 | export function generatePlanCompletionAuditShip(_ctx: TemplateContext): string { | CODE |
| LOW⚡ | scripts/resolvers/review.ts | 1128 | export function generatePlanCompletionAuditReview(_ctx: TemplateContext): string { | CODE |
| LOW⚡ | scripts/resolvers/review.ts | 1134 | export function generatePlanVerificationExec(_ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/third-party-actions.ts | 19 | export function generateThirdPartyActions(_ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/design.ts | 69 | export function generateDesignMethodology(_ctx: TemplateContext): string { | CODE |
| LOW | scripts/resolvers/design.ts | 541 | export function generateDesignOutsideVoices(ctx: TemplateContext): string { | CODE |
| 50 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | TODOS.md | 2692 | ### Swarm primitive — reusable multi-agent dispatch | COMMENT |
| MEDIUM | TODOS.md | 2786 | **Why:** Multi-week initiatives often span 3-5 specs that share context but ship sequentially. Today `/spec --epic` woul | CODE |
| MEDIUM | CLAUDE.md | 349 | ## Community PR guardrails | COMMENT |
| MEDIUM | autoplan/SKILL.md | 752 | # including autoplan's own dual-voice orchestration. Honor it before probing. | COMMENT |
| MEDIUM⚡ | test/skill-e2e-ship-docsync.test.ts | 228 | // zero contain scaffold strings. | COMMENT |
| MEDIUM | test/benchmark-runner.test.ts | 52 | // Gemini has very limited agentic surface | COMMENT |
| MEDIUM | test/preamble-first-task-scaffold.test.ts | 7 | // P4 first-run scaffold (activation lift). Two surfaces under test: | COMMENT |
| MEDIUM | test/preamble-first-task-scaffold.test.ts | 155 | // and the scaffold telemetry all live in bin/gstack-skill-start; the tips | COMMENT |
| MEDIUM | test/preamble-first-task-scaffold.test.ts | 170 | // P4 scaffold branch (first-ever run) … | COMMENT |
| MEDIUM | test/gen-skill-docs.test.ts | 3141 | // This does NOT apply to `codex exec`, which is agentic and really does run | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 33 | // P4 first-run scaffold (activation lift) — the detection binary end-to-end | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 463 | // P4 first-run scaffold — periodic (onboarding, non-safety, model-touched marker) | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 475 | // Review — gate for functional/guardrails, periodic for quality | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 661 | // CSO — gate for security guardrails, periodic for quality | COMMENT |
| MEDIUM | test/helpers/tool-map.ts | 58 | // Shell access depends on flags; most agentic tools are not exposed. | COMMENT |
| MEDIUM | context-restore/SKILL.md | 475 | # Cap at 20: a user with 10k saved files shouldn't blow the context window. | COMMENT |
| MEDIUM⚡ | docs/skills.md | 51 | | [`/careful`](#safety--guardrails) | **Safety Guardrails** | Warns before destructive commands (rm -rf, DROP TABLE, for | CODE |
| MEDIUM⚡ | docs/skills.md | 52 | | [`/freeze`](#safety--guardrails) | **Edit Lock** | Restrict all file edits to a single directory. Blocks Edit and Writ | CODE |
| MEDIUM⚡ | docs/skills.md | 53 | | [`/guard`](#safety--guardrails) | **Full Safety** | Combines /careful + /freeze in one command. Maximum safety for pro | CODE |
| MEDIUM⚡ | docs/skills.md | 54 | | [`/unfreeze`](#safety--guardrails) | **Unlock** | Remove the /freeze boundary, allowing edits everywhere again. | | CODE |
| MEDIUM | docs/designs/SESSION_INTELLIGENCE.md | 134 | - [CodeScene: Agentic AI coding best practices](https://codescene.com/blog/agentic-ai-coding-best-practice-patterns-for- | CODE |
| MEDIUM | docs/designs/ML_PROMPT_INJECTION_KILLER.md | 88 | - [npm](https://www.npmjs.com/package/@openai/guardrails) | CODE |
| MEDIUM | supabase/functions/telemetry-ingest/index.ts | 74 | // scaffold), handoff (P1 office-hours → next skill), route (gstack router). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/setup-gbrain-path4-structure.test.ts | 139 | expect(skeleton).toMatch(/<YOUR_TOKEN>/); | CODE |
| HIGH | test/setup-gbrain-path4-structure.test.ts | 180 | // - <bearer>, <YOUR_TOKEN>, <TOKEN> (placeholder) | COMMENT |
| HIGH | test/setup-gbrain-path4-structure.test.ts | 186 | expect(line).toMatch(/Bearer (\$GBRAIN_MCP_TOKEN|<bearer>|<YOUR_TOKEN>|<TOKEN>|\.\.\."?)/); | CODE |
| HIGH | test/redact-engine.test.ts | 390 | expect(isPlaceholderSpan("your_api_key")).toBe(true); | CODE |
| HIGH⚡ | test/helpers/carve-guards.ts | 561 | '<YOUR_TOKEN>', | CODE |
| HIGH | setup-gbrain/SKILL.md | 827 | -H 'Authorization: Bearer <YOUR_TOKEN>' \ | CODE |
| HIGH | setup-gbrain/SKILL.md | 833 | `<YOUR_TOKEN>` so the snippet is safe to copy into chat / share. | CODE |
| HIGH | lib/redact-patterns.ts | 639 | // recipe as env.kv to kill Bearer YOUR_TOKEN_HERE placeholders. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/ship-version-sync.test.ts | 49 | elif command -v bun >/dev/null 2>&1; then | CODE |
| HIGH | scripts/resolvers/design.ts | 959 | elif [ -f "$_DESIGN_DIR/feedback-pending.json" ]; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 127 | elif [ "\${GSTACK_FORCE_CODEX_REVIEW:-0}" != "1" ] && { [ -n "\${CODEX_THREAD_ID:-}" ] || [ -n "\${CODEX_SANDBOX:-}" ]; | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 129 | elif ! command -v codex >/dev/null 2>&1; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 131 | elif ! _gstack_codex_auth_probe >/dev/null 2>&1; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 133 | elif ! _gstack_codex_model_probe; then | CODE |
| HIGH | scripts/resolvers/confidence.ts | 47 | would live. If "dict.get() might return None", quote the dict initialization. | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/skill-e2e-setup-gbrain-path4-local-pglite.test.ts | 15 | // Periodic-tier (codex #12: AgentSDK harness is non-deterministic; gate-tier | COMMENT |
| MEDIUM | test/skill-e2e-office-hours-brain-writeback.test.ts | 160 | // Set up the fake gbrain CLI with robust argv quoting + payload capture. | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 127 | // Real-PTY E2E batch (#6 new tests on the harness). | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 181 | // Periodic-tier per codex #12 (AgentSDK harness is non-deterministic). | COMMENT |
| MEDIUM | scripts/resolvers/testing.ts | 71 | ### B2. Research best practices | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bin/gstack-gbrain-lib.sh | 3 | # This file is NOT executable; source it: | COMMENT |
| MEDIUM | bin/gstack-egress-lib.sh | 3 | # This file is NOT executable; source it: | COMMENT |
| MEDIUM | scripts/build-app.sh | 191 | # Create a temporary directory for DMG contents | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/build-app.sh | 12 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/skill-routing-e2e.test.ts | 378 | fs.writeFileSync(path.join(tmpDir, 'waitlist.ts'), 'export class WaitlistService {\n async addParty(name: string, | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup-gbrain/SKILL.md | 765 | except Exception: | CODE |