Use Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA
This report summarizes scanner evidence for garrytan/gstack, a TypeScript project with 135,820 GitHub stars. SynthScan examined 608,487 lines of code across 2261 source files, recording 2284 pattern matches distributed across 16 syntactic categories. The legacy adjusted pattern signal is 7.4 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1322 finding(s).
Are imports declared and package/API names verified? 164 finding(s).
Are wrappers, guards, and repeated structures necessary? 1260 finding(s).
Which changes need focused human review? 2284 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2284 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | design/test/feedback-roundtrip-daemon.test.ts | 63 | // ─── Submit round-trip ─────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/feedback-roundtrip-daemon.test.ts | 141 | // ─── Regenerate + reload round-trip ────────────────────────────── | COMMENT |
| MEDIUM | design/test/feedback-roundtrip-daemon.test.ts | 214 | // ─── Two-board, one-daemon attach behavior ─────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 47 | // ─── /health ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 70 | // ─── POST /api/boards (publish) ───────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 150 | // ─── GET /boards/<id> trailing-slash redirect ──────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 179 | // ─── POST /boards/<id>/api/feedback ────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 260 | // ─── POST /boards/<id>/api/reload ──────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 314 | // ─── GET / (index) ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 349 | // ─── /shutdown ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 398 | // ─── LRU + non-done protection ─────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 458 | // ─── Idle + meaningful activity ────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 476 | // ─── Malformed body negatives ──────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 542 | // ─── Daemon log ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon.test.ts | 566 | // ─── Unknown routes ────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/feedback-roundtrip.test.ts | 176 | // ─── The critical test: browser click → file on disk ───────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 74 | // ─── healthCheck + readStateFile basics ────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 119 | // ─── ensureDaemon ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 306 | // ─── publishBoard ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 337 | // ─── shutdownDaemon / daemonStatus ─────────────────────────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 525 | // ─── Concurrent ensureDaemon race (one wins the lock) ─────────── | COMMENT |
| MEDIUM | design/test/daemon-discovery.test.ts | 565 | // ─── Stale-lock reclaim ────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 42 | // ─── Tunables (env overrides for tests) ────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 62 | // ─── Per-board state ───────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 113 | // ─── Helpers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 197 | // ─── Shutdown ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 237 | // ─── Handlers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 472 | // ─── Router ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon.ts | 530 | // ─── Startup ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | design/src/daemon-client.ts | 216 | // ─── Internals ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extension/sidepanel.js | 85 | // ─── Chat path ripped ──────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extension/sidepanel.js | 91 | // ─── Reload Sidebar ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extension/sidepanel.js | 96 | // ─── Copy Cookies ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 32 | // ─── Connection State Machine ───────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 111 | // ─── Debug Tabs ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 154 | // ─── Activity Feed ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 243 | // ─── SSE Connection ───────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 294 | // ─── Memory Footer Readout ────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 390 | // ─── Tab guardrail toast (D5 + Codex single-tab flag) ─────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 582 | // ─── Refs Tab ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 618 | // ─── Inspector Tab ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 725 | // ─── Box Model Rendering ──────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 771 | // ─── Matched Rules Rendering ──────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 862 | // ─── Computed Styles Rendering ────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 887 | // ─── Quick Edit ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 961 | // ─── Send to Agent ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1017 | // ─── Quick Action Helpers (toolbar buttons) ────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1097 | // ─── Section Toggles ──────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1112 | // ─── Inspector SSE ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1144 | // ─── Server Discovery ─────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1194 | // ─── Port Configuration ───────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1223 | // ─── Reconnect / Copy Buttons ──────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1346 | // ─── Message Listener ─────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/sidepanel.js | 1406 | // ─── v1.44 pagehide: explicit PTY dispose on sidebar close ────────── | COMMENT |
| MEDIUM | extension/background.js | 22 | // ─── Port Discovery ──────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/background.js | 39 | // ─── Auth Token Bootstrap ───────────────────────────────────── | COMMENT |
| MEDIUM | extension/background.js | 71 | // ─── Health Polling ──────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/background.js | 148 | // ─── Command Proxy ───────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/background.js | 173 | // ─── Refs Relay ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | extension/background.js | 203 | // ─── Inspector ────────────────────────────────────────────────── | COMMENT |
| 735 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README.md | 51 | ### Step 1: Install on your machine | COMMENT |
| LOW | README.md | 57 | ### Step 2: Team mode — auto-update for shared repos (recommended) | COMMENT |
| LOW | CONTRIBUTING.md | 841 | ### Step 1: Symlink your checkout | COMMENT |
| LOW | CONTRIBUTING.md | 848 | ### Step 2: Run setup to create per-skill symlinks | COMMENT |
| LOW | CONTRIBUTING.md | 862 | ### Step 3: Develop | COMMENT |
| LOW | pair-agent/SKILL.md | 420 | ## Step 1: Check prerequisites | COMMENT |
| LOW | pair-agent/SKILL.md | 434 | ## Step 2: Ask what they want | COMMENT |
| LOW | pair-agent/SKILL.md | 455 | ## Step 3: Local or remote? | COMMENT |
| LOW | pair-agent/SKILL.md | 473 | ## Step 4: Execute pairing | COMMENT |
| LOW | pair-agent/SKILL.md | 622 | ## Step 5: Verify connection | COMMENT |
| LOW | design-html/SKILL.md | 443 | ## Step 0: Input Detection | COMMENT |
| LOW | design-html/SKILL.md | 544 | ## Step 1: Design Analysis | COMMENT |
| LOW | design-html/SKILL.md | 575 | ## Step 2: Smart Pretext API Routing | COMMENT |
| LOW | design-html/SKILL.md | 615 | ## Step 3: Generate Pretext-Native HTML | COMMENT |
| LOW | design-html/SKILL.md | 725 | ## Step 4: Preview + Refinement Loop | COMMENT |
| LOW | design-html/SKILL.md | 801 | ## Step 5: Save & Next Steps | COMMENT |
| LOW | plan-tune/SKILL.md | 381 | ## Step 0: Detect what the user wants | COMMENT |
| LOW | design-shotgun/SKILL.md | 441 | ## Step 0: Session Detection | COMMENT |
| LOW | design-shotgun/SKILL.md | 474 | ## Step 1: Context Gathering | COMMENT |
| LOW | design-shotgun/SKILL.md | 535 | ## Step 2: Taste Memory | COMMENT |
| LOW | design-shotgun/SKILL.md | 607 | ## Step 3: Generate Variants | COMMENT |
| LOW | design-shotgun/SKILL.md | 738 | ## Step 4: Comparison Board + Feedback Loop | COMMENT |
| LOW | design-shotgun/SKILL.md | 866 | ## Step 5: Feedback Confirmation | COMMENT |
| LOW | design-shotgun/SKILL.md | 882 | ## Step 6: Save & Next Steps | COMMENT |
| LOW | plan-design-review/SKILL.md | 410 | ## Step 0: Detect platform and base branch | COMMENT |
| LOW | plan-design-review/SKILL.md | 728 | ## Step 0: Design Scope Assessment | COMMENT |
| LOW | design/test/feedback-roundtrip.test.ts | 342 | // Step 1: User clicks Regenerate | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 358 | // Step 2: Agent generates new variants and creates a new board | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 367 | // Step 3: Agent POSTs /api/reload to swap the board | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 388 | // Step 4: Board auto-refreshes (simulated by navigating again) | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 397 | // Step 5: User picks variant C on round 2 and submits | COMMENT |
| LOW⚡ | design/src/evolve.ts | 41 | // Step 1: Analyze current screenshot | COMMENT |
| LOW⚡ | design/src/evolve.ts | 45 | // Step 2: Generate evolved version using analysis + brief | COMMENT |
| LOW | autoplan/SKILL.md | 401 | ## Step 0: Detect platform and base branch | COMMENT |
| LOW | autoplan/SKILL.md | 667 | ### Step 1: Capture restore point | COMMENT |
| LOW | autoplan/SKILL.md | 701 | ### Step 2: Read context | COMMENT |
| LOW | autoplan/SKILL.md | 720 | ### Step 3: Locate review skills; load each at phase entry | COMMENT |
| LOW⚡ | extension/sidepanel.js | 1279 | // Step 2: If background says connected + has token, use that | COMMENT |
| LOW⚡ | extension/sidepanel.js | 1289 | // Step 3: Background not connected yet. Try hitting /health directly. | COMMENT |
| LOW | extension/sidepanel.js | 1257 | // Step 1: Ask background for the port | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 19 | ## Step 1: Install and run Tailscale | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 35 | ## Step 2: Set up the daemon's ACL | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 75 | ## Step 3: Mint a session token for a remote agent | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 91 | ## Step 4: Tighten the Tailscale ACL (defense in depth) | COMMENT |
| LOW | ios-qa/docs/tailscale-acl-example.md | 122 | ## Step 5: Audit trail | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 208 | // Step 1: pick a device | COMMENT |
| LOW⚡ | ios-qa/daemon/src/tunnel-bootstrap.ts | 234 | // Step 2: launch app (idempotent — devicectl returns success if already running) | COMMENT |
| LOW⚡ | ios-qa/daemon/src/tunnel-bootstrap.ts | 242 | // Step 3: resolve tunnel IPv6. Try devicectl `info details` first (most | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 261 | // Step 4: wait for StateServer to become reachable, then scrape boot token. | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 347 | // Step 5: rotate the boot token to a fresh in-memory-only one. | COMMENT |
| LOW | test/autoplan-phase-order.test.ts | 343 | const intake = flat(read('autoplan/SKILL.md.tmpl').split('### Step 2: Read context')[1]?.split('### Step 3:')[0] ?? | CODE |
| LOW | test/devex-finding-fixture.test.ts | 25 | content.indexOf('## Step 0: DX Investigation', audit)); | CODE |
| LOW | test/workflow-excerpt.test.ts | 194 | const ceo = readWorkflowExcerpt('plan-ceo-review/SKILL.md', '## Step 0: Nuclear Scope Challenge', '## Review Section | CODE |
| LOW | test/workflow-excerpt.test.ts | 209 | const ceo = readWorkflowExcerpt('plan-ceo-review/SKILL.md', '## Step 0: Nuclear Scope Challenge', '## Review Section | CODE |
| LOW | test/docsync-report-interface.test.ts | 80 | expect(phase).not.toContain('## Step 15: Commit'); | CODE |
| LOW | test/workflow-judge-input.test.ts | 194 | expect(input.text).toContain('## Step 5: Fix-First Review'); | CODE |
| LOW | test/workflow-judge-input.test.ts | 300 | expect(entrypoint?.content).toContain('## Step 0: Detect platform and base branch'); | CODE |
| LOW | test/workflow-judge-input.test.ts | 325 | expect(entrypoint.content.indexOf('## Scope gate')).toBeLessThan(entrypoint.content.indexOf('### Step 0: Scope Chall | CODE |
| LOW | test/skill-validation.test.ts | 1405 | // Headings like "## Step 7: Test Coverage Audit" — NOT sub-steps like "## Step 8.1:" | COMMENT |
| LOW | test/skill-validation.test.ts | 1507 | expect(skeleton).toContain('## Step 1: Detect mode'); | CODE |
| 326 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | design/src/daemon.ts | 184 | function findActiveBoardForSourceDir(sourceDir: string): Board | null { | CODE |
| LOW | design/src/design-to-code.ts | 24 | export async function generateDesignToCodePrompt( | CODE |
| LOW | design/src/daemon-client.ts | 315 | async function gracefulShutdownExistingDaemon(port: number): Promise<void> { | CODE |
| LOW | design/src/variants.ts | 512 | async function generateResponsiveVariants( | CODE |
| LOW | autoplan/bin/phase-publication-hook.ts | 218 | export function boundAutoplanPhaseConsumption(events: Event[], use: Use, cwd: string, root: string): Consumer | undefine | CODE |
| LOW | test/workflow-excerpt.test.ts | 9 | function expectOutsideReviewControlFlow(text: string, promptHeading: string): void { | CODE |
| LOW | test/plan-skill-questions.test.ts | 2350 | function capturedQuestionValidation() { | CODE |
| LOW | test/skill-e2e-plan-ceo-review-section-loading.test.ts | 99 | function assertSectionLoadingReport(capture: Awaited<ReturnType<typeof captureSectionReads>>): void { | CODE |
| LOW | test/cso-eval.test.ts | 59 | function syntheticInstallationIdentity(seed = '1', catalogSeed = seed): ProducerInstallationIdentity { | CODE |
| LOW | test/cso-eval.test.ts | 73 | function syntheticProviderIdentity(family: Family = 'gpt', seed = '1'): ProducerProviderIdentity { | CODE |
| LOW | test/cso-eval.test.ts | 80 | function syntheticArtifactInventory(): ProducerArtifactInventory { | CODE |
| LOW | test/skill-e2e-plan-ceo-mode-routing.test.ts | 105 | async function navigateToModeAskUserQuestion( | CODE |
| LOW | test/cso-git-hardening.test.ts | 21 | function replaceWithSymlinkAfterLstat(target:string,replacement:string,occurrence=1){ | CODE |
| LOW | test/plan-count-completion.test.ts | 871 | function completedHandoffTranscript(f: ReturnType<typeof fixture>): PlanCountTranscript { | CODE |
| LOW | test/codex-e2e-sol-scope.test.ts | 30 | function codexSupportsIgnoreUserConfig(): boolean { | CODE |
| LOW | test/ship-hook-windows-paths.test.ts | 59 | function expectInstalledFromWorktree() { | CODE |
| LOW | test/cso-stack-cold-integration.test.ts | 85 | def test_dependency_and_control(self): | CODE |
| LOW | test/skill-e2e-skillify.test.ts | 134 | function installBundledHackernewsSkill(workDir: string) { | CODE |
| LOW | test/redact-prepush-scan-range.test.ts | 86 | function setUpRemoteWithForeignFixture(): void { | CODE |
| LOW | test/redact-prepush-scan-range.test.ts | 195 | function buildSecretOnSecondRemote(): { originTip: string } { | CODE |
| LOW | test/skill-e2e-design.test.ts | 799 | function commandRunsInstallOrOverride(command: string): boolean { | CODE |
| LOW | test/cso-contracts.test.ts | 21 | function authenticatedBundleFixture(certified:ReturnType<typeof certify>,params:any,outcomes?:Record<'before'|'after',{e | CODE |
| LOW | test/autoplan-artifact-windows-argv.test.ts | 28 | const start=source.indexOf('export function createAutoplanArtifactRecorder('); | CODE |
| LOW | test/run-in-background-guidance.test.ts | 186 | function hasBoundedOutsideVoiceWait(content: string): boolean { | CODE |
| LOW | test/extension-pty-inject-invariant.test.ts | 70 | function findEnclosingFunctionStart(content: string, callerPos: number): number { | CODE |
| LOW | test/qa-caller-authority.test.ts | 38 | function assertSharedBrowserAuthority(body: string): void { | CODE |
| LOW | test/tasks-section-jq.test.ts | 33 | function extractBranchCommitFilter(): string { | CODE |
| LOW | test/gbrain-source-worktree-advance.test.ts | 45 | function makeArtifactsRepoWithWorktree(): { head: string } { | CODE |
| LOW | test/skill-e2e-plan-format.test.ts | 120 | function approachQuestionInstruction(outFile: string): string { | CODE |
| LOW | test/outside-voice-failure-policy.test.ts | 105 | const start = lines.findIndex((l) => l.startsWith('export function outsideVoiceFailurePolicy(')); | CODE |
| LOW | test/qa-checkpoint-evidence.test.ts | 172 | function functionalCheckpointVerdict(input: ReturnType<typeof regressionCheckpoint>) { | CODE |
| LOW | test/office-hours-writeback-env.test.ts | 10 | async function probeWritebackEnvironment(option: 'env' | 'extraEnv') { | CODE |
| LOW | test/skill-e2e-diagram.test.ts | 91 | function expectRenderedViaGstackRender(result: SkillTestResult): void { | CODE |
| LOW | test/gen-skill-docs.test.ts | 105 | function extractPreambleBeforeWorkflow(content: string, workflowMarkers: string[]): string { | CODE |
| LOW | test/helpers/cso-ntfs-fixture.ts | 4 | export function createPrecisionLossCandidate( | CODE |
| LOW | test/helpers/overlay-attempt.ts | 124 | export function captureOverlayQueryAttempts(directory: string, stem: string, provider: QueryProvider): QueryProvider { | CODE |
| LOW | test/helpers/agent-sdk-runner.ts | 154 | export function passThroughNonAskUserQuestion( | CODE |
| LOW | test/helpers/shared-libs-eval-fixture.ts | 492 | export function isInternalClaudeGitRequest(request: SourceRequest, commands: string[]): boolean { | CODE |
| LOW | test/helpers/shared-libs-eval-fixture.ts | 814 | export function reviewLifecycleInstructions(f: SharedLibsFixture): string { | CODE |
| LOW | test/helpers/shared-libs-eval-fixture.ts | 1058 | export function prCoverageRequestViolations(endpoints: string[]): string[] { | CODE |
| LOW | test/helpers/shared-libs-eval-fixture.ts | 1191 | export function createSharedInteractiveToolHandler(choose: 'approve' | 'skip' | SharedQuestionSelector, hooks: { | CODE |
| LOW | test/helpers/autoplan-artifact-permission.ts | 40 | export function hasPendingAutoplanArtifactHistory( | CODE |
| LOW | test/helpers/auq-sdk-capture.ts | 389 | export function validateCeoReviewCompletion(capture: { | CODE |
| LOW | test/helpers/qa-functional-fixture.ts | 204 | export function createQAFunctionalFixture(family: QAFamily, options: { healthy?: boolean; parent?: string; deadlineAt?: | CODE |
| LOW | test/helpers/plan-scope-selection.ts | 54 | export function nativeSeededPlanSelection( | CODE |
| LOW | test/helpers/skill-parser.ts | 161 | export function extractRemoteSlugPatterns(rootDir: string, subdirs: string[]): Map<string, string[]> { | CODE |
| LOW | test/helpers/bootstrap-retention.ts | 146 | export function createBootstrapRetentionScope(temporaryRoot: string, durableRoot: string, runId: string) { | CODE |
| LOW | test/helpers/bootstrap-retention.ts | 177 | export function registerBootstrapRetention(root: string, runId: string, options: { deadline: number; env?: NodeJS.Proces | CODE |
| LOW | test/helpers/bootstrap-retention.ts | 324 | async function cleanupBootstrapRetentions(scope: Scope, deadline: number) { | CODE |
| LOW | test/helpers/ceo-split-question-policy.ts | 57 | export function pickCeoSplitCountQuestion( | CODE |
| LOW | test/helpers/ceo-split-question-policy.ts | 75 | export function ceoSplitDecisionFingerprints( | CODE |
| LOW | test/helpers/ceo-split-question-policy.ts | 104 | export function isCeoSplitCollectionComplete( | CODE |
| LOW | test/helpers/eval-store.ts | 751 | export function isFinalizedEvalResultFile(relPath: string): boolean { | CODE |
| LOW | test/helpers/manual-judge-review-fixture.ts | 40 | export function approvedCookieWorkflowSource(source: string): string { | CODE |
| LOW | test/helpers/plan-review-decisions.ts | 194 | export function buildPlanReviewDecisionPrompt(input: PlanReviewDecisionInput): string { | CODE |
| LOW | test/helpers/plan-review-decisions.ts | 224 | export function validatePlanReviewDecisionResponse(input: PlanReviewDecisionInput, raw: unknown) { | CODE |
| LOW | test/helpers/plan-review-decisions.ts | 360 | export async function evaluatePlanReviewDecisions(input: PlanReviewDecisionInput, judge: PlanReviewJudge = callJudge<unk | CODE |
| LOW | test/helpers/outside-voice-receipt.ts | 61 | export function createOutsideReceiptRuntime(runtimeRoot: string, fixtureRoot: string, cwd: string) { | CODE |
| LOW | test/helpers/setup-gbrain-fixture.ts | 122 | export function chooseLocalPgliteFixtureAnswer(question: { | CODE |
| LOW | test/helpers/auq-native-capture.ts | 122 | function clippedElidedNativeAuqIdentity(screen: string, call: NativePlanQuestionCall): | CODE |
| 402 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | design/test/feedback-roundtrip.test.ts | 342 | // Step 1: User clicks Regenerate | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 358 | // Step 2: Agent generates new variants and creates a new board | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 367 | // Step 3: Agent POSTs /api/reload to swap the board | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 388 | // Step 4: Board auto-refreshes (simulated by navigating again) | COMMENT |
| LOW⚡ | design/test/feedback-roundtrip.test.ts | 397 | // Step 5: User picks variant C on round 2 and submits | COMMENT |
| LOW⚡ | design/src/evolve.ts | 41 | // Step 1: Analyze current screenshot | COMMENT |
| LOW⚡ | design/src/evolve.ts | 45 | // Step 2: Generate evolved version using analysis + brief | COMMENT |
| LOW⚡ | extension/sidepanel.js | 1279 | // Step 2: If background says connected + has token, use that | COMMENT |
| LOW⚡ | extension/sidepanel.js | 1289 | // Step 3: Background not connected yet. Try hitting /health directly. | COMMENT |
| LOW | extension/sidepanel.js | 1257 | // Step 1: Ask background for the port | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 208 | // Step 1: pick a device | COMMENT |
| LOW⚡ | ios-qa/daemon/src/tunnel-bootstrap.ts | 234 | // Step 2: launch app (idempotent — devicectl returns success if already running) | COMMENT |
| LOW⚡ | ios-qa/daemon/src/tunnel-bootstrap.ts | 242 | // Step 3: resolve tunnel IPv6. Try devicectl `info details` first (most | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 261 | // Step 4: wait for StateServer to become reachable, then scrape boot token. | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 347 | // Step 5: rotate the boot token to a fresh in-memory-only one. | COMMENT |
| LOW | test/autoplan-phase-order.test.ts | 121 | const phase0 = skill.slice(skill.indexOf('### Step 3:'), skill.indexOf('## Phase 1:')); | CODE |
| LOW | test/autoplan-phase-order.test.ts | 166 | const intake = flat(tmpl.split('### Step 3:')[1]?.split('## Phase 0.5:')[0] ?? ''); | CODE |
| LOW | test/autoplan-phase-order.test.ts | 330 | const intake = flat(read('autoplan/SKILL.md.tmpl').split('## Phase 0: Intake')[1]?.split('### Step 2:')[0] ?? ''); | CODE |
| LOW | test/autoplan-phase-order.test.ts | 343 | const intake = flat(read('autoplan/SKILL.md.tmpl').split('### Step 2: Read context')[1]?.split('### Step 3:')[0] ?? | CODE |
| LOW | test/devex-finding-fixture.test.ts | 25 | content.indexOf('## Step 0: DX Investigation', audit)); | CODE |
| LOW | test/workflow-excerpt.test.ts | 52 | const headings = ['## Step 3:', '## Step 4:', '## Step 7:', '## Step 8:', '## Step 9:', '## Step 10:', '## Step 11:' | CODE |
| LOW | test/workflow-excerpt.test.ts | 62 | const reviewAndTriage = text.slice(text.indexOf('## Step 9:'), text.indexOf('## Step 11:')); | CODE |
| LOW | test/workflow-excerpt.test.ts | 81 | const audit = text.slice(text.indexOf('## Step 7:'), text.indexOf('## Step 8:')); | CODE |
| LOW | test/workflow-excerpt.test.ts | 108 | const publish = text.slice(text.indexOf('## Step 19:'), text.indexOf('## Step 20:')); | CODE |
| LOW | test/workflow-excerpt.test.ts | 119 | const review = text.slice(text.indexOf('## Step 9:'), text.indexOf('## Step 10:')); | CODE |
| LOW⚡ | test/workflow-excerpt.test.ts | 146 | expect(text).toContain('## Step 2:'); | CODE |
| LOW⚡ | test/workflow-excerpt.test.ts | 147 | expect(text).toContain('## Step 9:'); | CODE |
| LOW⚡ | test/workflow-excerpt.test.ts | 154 | const commit = text.indexOf('## Step 9:'); | CODE |
| LOW | test/workflow-excerpt.test.ts | 194 | const ceo = readWorkflowExcerpt('plan-ceo-review/SKILL.md', '## Step 0: Nuclear Scope Challenge', '## Review Section | CODE |
| LOW | test/workflow-excerpt.test.ts | 209 | const ceo = readWorkflowExcerpt('plan-ceo-review/SKILL.md', '## Step 0: Nuclear Scope Challenge', '## Review Section | CODE |
| LOW | test/workflow-excerpt.test.ts | 309 | expect(text.indexOf('## Capture Learnings')).toBeGreaterThan(text.indexOf('### Step 14:')); | CODE |
| LOW | test/workflow-excerpt.test.ts | 331 | const commit = text.slice(text.indexOf('## Step 15:'), text.indexOf('## Step 16:')); | CODE |
| LOW | test/ship-control-flow.test.ts | 21 | const gate = compact(entry.slice(entry.indexOf('## Step 16:'), entry.indexOf('## Step 17:'))); | CODE |
| LOW | test/ship-control-flow.test.ts | 65 | const distribution = compact(entry.slice(entry.indexOf('## Step 2:'), entry.indexOf('## Step 3:'))); | CODE |
| LOW | test/ship-control-flow.test.ts | 72 | const version = compact(entry.slice(entry.indexOf('## Step 12:'), entry.indexOf('{{SECTION:changelog}}'))); | CODE |
| LOW | test/ship-control-flow.test.ts | 92 | const nudge = entry.slice(entry.indexOf('## Step 21:'), entry.indexOf('## Section self-check')); | CODE |
| LOW | test/ship-control-flow.test.ts | 186 | const text = compact(entry.slice(entry.indexOf('## Step 11.5:'), entry.indexOf('## Step 12:'))); | CODE |
| LOW | test/ship-control-flow.test.ts | 196 | const text = compact(entry.slice(entry.indexOf('## Step 16:'), entry.indexOf('## Step 17:'))); | CODE |
| LOW | test/ship-control-flow.test.ts | 220 | const merge = compact(entry.slice(entry.indexOf('## Step 3:'), entry.indexOf('{{SECTION:tests}}'))); | CODE |
| LOW | test/ship-control-flow.test.ts | 289 | expect(bindingStart).toBeLessThan(entry.indexOf('## Step 12:')); | CODE |
| LOW | test/ship-control-flow.test.ts | 290 | const binding = compact(entry.slice(bindingStart, entry.indexOf('## Step 12:'))); | CODE |
| LOW | test/ship-control-flow.test.ts | 329 | const push = compact(entry.slice(entry.indexOf('## Step 17:'), entry.indexOf('## Step 18:'))); | CODE |
| LOW | test/docsync-report-interface.test.ts | 80 | expect(phase).not.toContain('## Step 15: Commit'); | CODE |
| LOW | test/workflow-judge-input.test.ts | 194 | expect(input.text).toContain('## Step 5: Fix-First Review'); | CODE |
| LOW | test/workflow-judge-input.test.ts | 300 | expect(entrypoint?.content).toContain('## Step 0: Detect platform and base branch'); | CODE |
| LOW | test/workflow-judge-input.test.ts | 325 | expect(entrypoint.content.indexOf('## Scope gate')).toBeLessThan(entrypoint.content.indexOf('### Step 0: Scope Chall | CODE |
| LOW | test/skill-validation.test.ts | 1405 | // Headings like "## Step 7: Test Coverage Audit" — NOT sub-steps like "## Step 8.1:" | COMMENT |
| LOW | test/skill-validation.test.ts | 1507 | expect(skeleton).toContain('## Step 1: Detect mode'); | CODE |
| LOW⚡ | test/regression-1624-retro-stale-base.test.ts | 44 | const step1 = body.indexOf("### Step 1: Gather"); | CODE |
| LOW⚡ | test/regression-1624-retro-stale-base.test.ts | 53 | const step2 = body.indexOf("### Step 2: Compute Metrics"); | CODE |
| LOW | test/skill-e2e-ship-measure-loop.test.ts | 59 | fs.writeFileSync(path.join(root, 'ship-step6.md'), local(sliceBetween(tests, '## Step 6: Eval Suites', '\n---\n'))); | CODE |
| LOW | test/ship-version-sync.test.ts | 120 | const version = ship.slice(ship.indexOf('## Step 12:'), ship.indexOf('## Step 14:')).replace(/\s+/g, ' '); | CODE |
| LOW | test/ship-version-sync.test.ts | 264 | const step12 = ship.slice(ship.indexOf("## Step 12:"), ship.indexOf("## Step 14:")).replace(/\s+/g, " "); | CODE |
| LOW | test/ship-version-sync.test.ts | 266 | const step18 = prBody.slice(prBody.indexOf("### Prepare the title (Step 18)"), prBody.indexOf("## Step 19:")).replace( | CODE |
| LOW | test/skill-llm-eval.test.ts | 535 | startMarker: '## Step 0: Nuclear Scope Challenge', | CODE |
| LOW | test/skill-llm-eval.test.ts | 609 | startMarker: '## Step 1: Pre-flight', | CODE |
| LOW | test/skill-llm-eval.test.ts | 648 | startMarker: '### Step 2: Detect platform', | CODE |
| LOW | test/skill-llm-eval.test.ts | 666 | startMarker: '## Step 0: Detect platform and base branch', | CODE |
| LOW | test/skill-llm-eval.test.ts | 686 | startMarker: '## Step 4: Refresh', | CODE |
| LOW | test/sync-gbrain-source-probe.test.ts | 57 | const pages = f.run('## Step 3: Code-index health check'); | CODE |
| 143 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/ship-version-sync.test.ts | 50 | elif command -v bun >/dev/null 2>&1; then | CODE |
| HIGH | test/aside-render.test.ts | 291 | elif [ "$expr" = "document.title" ]; then echo "Fake Title" | CODE |
| HIGH⚡ | test/land-and-deploy-ci-gate.test.ts | 24 | elif [ "$1 $2" = "pr merge" ]; then printf '%s\\n' "$*" >> "$D/merges.log"; exit 0 | CODE |
| HIGH⚡ | test/land-and-deploy-ci-gate.test.ts | 25 | elif [ "$1 $2" = "pr view" ]; then kind=head | CODE |
| HIGH⚡ | test/land-and-deploy-ci-gate.test.ts | 26 | elif [ "$1 $2" = "pr checks" ]; then case " $* " in *" --required "*) kind=required ;; *) kind=all ;; esac | CODE |
| HIGH | scripts/resolvers/testing.ts | 237 | elif [ "$rc" -eq 124 ]; then echo "BASE_CONTROL: unavailable (budget)" | CODE |
| HIGH | scripts/resolvers/aside.ts | 97 | elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; } | CODE |
| HIGH | scripts/resolvers/design.ts | 249 | elif [ "$(wc -c < "$_D")" -gt ${DETECT_LIMITS.domDumpBytes} ]; then echo "${SENTINEL.DOM_DUMP_TOO_LARGE}: {page} $(wc -c | CODE |
| HIGH | scripts/resolvers/design.ts | 250 | elif ${toShellPath(ctx.paths.binDir)}/gstack-redact --from-file "$_D" --max-bytes ${DETECT_LIMITS.domDumpBytes} >/dev/nu | CODE |
| HIGH | scripts/resolvers/design.ts | 1133 | elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 10 "$@"; else return 125; fi; } | CODE |
| HIGH | scripts/resolvers/design.ts | 1136 | elif [ ! "$_DC" -nt "$D" ] || [ "$(cat "$_DC")" != "$_DK" ]; then _dt "$D" --version >/dev/null 2>&1 </dev/null || _RC=$ | CODE |
| HIGH | scripts/resolvers/design.ts | 1481 | elif [ -f "$_DESIGN_DIR/feedback-pending.json" ]; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 173 | elif { [ -n "\${CODEX_THREAD_ID:-}" ] || [ -n "\${CODEX_SANDBOX:-}" ] || [ "\${GSTACK_ACTIVE_HOST:-}" = codex ]; }; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 175 | elif ! command -v codex >/dev/null 2>&1; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 177 | elif [ -n "$_gstack_helper_error" ]; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 179 | elif ! "$_CODEX_PROBE" check-auth >/dev/null 2>&1; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 194 | elif [ "$_CODEX_MP" -eq 2 ]; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 196 | elif [ "$_CODEX_MP" -eq 4 ]; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 198 | elif [ "$_CODEX_MP" -ne 0 ]; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 200 | elif [ "$_CODEX_PS" = inconclusive ]; then | CODE |
| HIGH⚡ | scripts/resolvers/constants.ts | 202 | elif [ "$_CODEX_PS" = rate_limited ]; then | CODE |
| HIGH | scripts/resolvers/confidence.ts | 81 | would live. If "dict.get() might return None", quote the dict initialization. | CODE |
| HIGH⚡ | .github/scripts/run-dia-native-qualification.ts | 198 | print(json.dumps({'valid': True, 'members': len(members)})) | CODE |
| HIGH⚡ | .github/scripts/run-dia-native-qualification.ts | 200 | print(json.dumps({'valid': False, 'reason': 'unsafe_source_archive'})) | CODE |
| HIGH | .github/scripts/run-dia-native-qualification.ts | 231 | print(json.dumps(value)) | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1397 | elif shape == 'safe-link': entry('target'); entry('link', tarfile.SYMTYPE, 'target') | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1398 | elif shape == 'traversal': entry('../outside') | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1399 | elif shape == 'absolute': entry('/outside') | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1400 | elif shape == 'escape-link': entry('link', tarfile.SYMTYPE, '../outside') | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1401 | elif shape == 'symlink-parent': entry('link', tarfile.SYMTYPE, 'target'); entry('link/child') | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1402 | elif shape == 'symlink-dotdot': entry('b', tarfile.SYMTYPE, '.'); entry('a/link', tarfile.SYMTYPE, '../b/..') | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1403 | elif shape == 'hardlink': entry('target'); entry('link', tarfile.LNKTYPE, 'target') | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1404 | elif shape == 'case-collision': entry('File'); entry('file') | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1405 | elif shape == 'unicode-collision': entry('Caf' + chr(233)); entry('Cafe' + chr(769)) | CODE |
| HIGH⚡ | browse/test/dia-macos-qualification.test.ts | 1406 | elif shape == 'device': entry('device', tarfile.CHRTYPE) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bunfig.toml | 1 | [test] | COMMENT |
| LOW | test-setup.ts | 21 | COMMENT | |
| LOW | test-setup.ts | 41 | // the broken `process.env = origEnv` reassignment, then a downstream test | COMMENT |
| LOW | .osv-scanner.toml | 1 | # OSV-Scanner configuration. | COMMENT |
| LOW | .osv-scanner.toml | 21 | # @hono/node-server 1.19.x. Reachable only through @modelcontextprotocol/sdk, | COMMENT |
| LOW | design/test/image-gen-pairing.test.ts | 21 | // command offline (#1771); v1.64.0.0 (#2571) dropped the pin, which made the | COMMENT |
| LOW | design/test/daemon-discovery.test.ts | 381 | const r = await shutdownDaemon({ force: true }); | COMMENT |
| LOW | autoplan/sections/tasks-aggregator.md | 21 | # dedupe by (component, sorted(files), title) — exact match only. | COMMENT |
| LOW | freeze/bin/check-freeze.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | freeze/bin/check-freeze.sh | 41 | # mid-upgrade state), the boundary must fail CLOSED — inline JSON, since the | COMMENT |
| LOW | extension/sidepanel.js | 381 | } | COMMENT |
| LOW | extension/sidepanel.js | 1401 | detail: { active: msg.active, tabs: msg.tabs, reason: msg.reason }, | COMMENT |
| LOW | ios-qa/daemon/test/daemon-integration.test.ts | 1 | // End-to-end daemon integration tests. Starts a real daemon against a stub | COMMENT |
| LOW | ios-qa/daemon/src/tunnel-bootstrap.ts | 1 | // Bootstrap the CoreDevice tunnel to a connected iPhone or iPad running the | COMMENT |
| LOW | ios-qa/daemon/src/index.ts | 1 | // gstack-ios-qa-daemon entrypoint. | COMMENT |
| LOW | ios-qa/scripts/gen-accessors.ts | 1 | #!/usr/bin/env bun | COMMENT |
| LOW | ios-qa/scripts/gen-accessors-tool/Package.swift | 1 | // swift-tools-version:5.9 | COMMENT |
| LOW | careful/bin/hook-extract.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | careful/bin/hook-extract.sh | 161 | # bin/gstack-paths uses (docs/state-root.md). Hooks run on every Edit/Bash | COMMENT |
| LOW | careful/bin/check-careful.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | careful/bin/check-careful.sh | 21 | # install must degrade to an ASK (this is the ask-tier hook), never silence. | COMMENT |
| LOW | careful/bin/check-careful.sh | 81 | # --- Shell-obfuscation tripwire --- | COMMENT |
| LOW | careful/bin/check-careful.sh | 201 | # Two hardenings on top of the anchored shape (#2039 wave): | COMMENT |
| LOW | test/setup-windows-fallback.test.ts | 61 | const hookEnd = SETUP_SRC.indexOf('\nif [ "$TEAM_MODE" -eq 1 ]', hookStart); | COMMENT |
| LOW | test/skill-e2e-session-intelligence.test.ts | 261 | COMMENT | |
| LOW | test/brain-sync-windows-paths.test.ts | 1 | import { describe, test, expect } from 'bun:test'; | COMMENT |
| LOW | test/brain-sync-windows-paths.test.ts | 21 | // nothing and the drain silently stages/commits nothing. | COMMENT |
| LOW | test/gbrain-detect-install.test.ts | 21 | const DETECT = path.join(ROOT, 'bin', 'gstack-gbrain-detect'); | COMMENT |
| LOW | test/skill-size-budget.test.ts | 181 | // Intentional one-off shrinks vs the frozen baseline (each needs a reason): | COMMENT |
| LOW | test/skill-validation.test.ts | 341 | // session, learning, checkpoint, and telemetry PREAMBLE. | COMMENT |
| LOW | test/skill-validation.test.ts | 1701 | // scoped — `codex review --base <base>` with NO prompt argument. The | COMMENT |
| LOW | test/llm-judge-recommendation.test.ts | 121 | // CROSS-MODEL synthesis recommendations: when /codex or the Claude | COMMENT |
| LOW | test/skill-e2e-setup-gbrain-path4-local-pglite.test.ts | 1 | // E2E: /setup-gbrain Path 4 with Step 4d "Yes" — local PGLite for code search. | COMMENT |
| LOW | test/codex-hardening.test.ts | 581 | // Find all lines invoking `codex review` (any prefix wrapper allowed). | COMMENT |
| LOW | test/codex-hardening.test.ts | 681 | // "no [P1] found → PASS" branch as written; | COMMENT |
| LOW | test/resolver-ask-user-format.test.ts | 281 | // to auto-choose; only the preamble's own tool-result STATUS line can. | COMMENT |
| LOW | test/gbrain-repo-policy-client.test.ts | 161 | // the two functions disagree on ANY URL shape, a policy the user set via the | COMMENT |
| LOW | test/setup-gbrain-bin-invocation-paths.test.ts | 1 | // setup-gbrain bin invocation path lint. | COMMENT |
| LOW | test/gstack-next-version.test.ts | 381 | // Integration smoke — only runs if gh is available and authenticated. Confirms | COMMENT |
| LOW | test/skill-e2e-ios-device.test.ts | 1 | // Real-device tests. The lightweight CoreDevice checks run with | COMMENT |
| LOW | test/skill-browse-state-extraction.test.ts | 1 | import { describe, test, expect } from 'bun:test'; | COMMENT |
| LOW | test/ios-qa-swift-build.test.ts | 1 | // Swift-build invariant tests. Runs against the fixture iOS app at | COMMENT |
| LOW | test/gstack-skill-start.test.ts | 281 | // none of the 11 interactive-onboarding blocks may emit (no human is | COMMENT |
| LOW | test/tracker-guard-wiring.test.ts | 21 | // Tracker-TEXT read shapes. Field-list/state-routing fetches (e.g. | COMMENT |
| LOW | test/uninstall-windows-copies.test.ts | 201 | // match is anchored: gstack/*|*/gstack/*; keeping the stricter | COMMENT |
| LOW | test/post-rename-doc-regen.test.ts | 1 | // Post-rename doc-regen regression: after `bun run gen:skill-docs`, no | COMMENT |
| LOW | test/run-in-background-guidance.test.ts | 301 | COMMENT | |
| LOW | test/egress-receipt-wiring.test.ts | 41 | // ── POLARITY TABLE (amendments T3/C8) ────────────────────────────────────── | COMMENT |
| LOW | test/egress-receipt-wiring.test.ts | 81 | // (repo-content) sinks, fail-closed. Registered so a refactor that drops | COMMENT |
| LOW | test/skill-e2e-office-hours-section-loading.test.ts | 21 | COMMENT | |
| LOW | test/gstack-redact-cli.test.ts | 161 | // cannot arrange that: Bun eagerly drains child pipes into parent memory, | COMMENT |
| LOW | test/setup-gbrain-path4-structure.test.ts | 1 | // setup-gbrain Path 4 structural lint. | COMMENT |
| LOW | test/redact-engine.test.ts | 121 | // credential-shaped literal (the prepush guard scans exact pushed bytes). | COMMENT |
| LOW | test/redact-engine.test.ts | 141 | // Structural placeholders still suppress at the URL position. | COMMENT |
| LOW | test/binding-template-drift.test.ts | 161 | expect(body).toContain('banner tripwire clean'); | COMMENT |
| LOW | test/skill-e2e-setup-gbrain-remote.test.ts | 1 | // E2E: /setup-gbrain Path 4 (Remote MCP) happy path via Agent SDK. | COMMENT |
| LOW | test/skill-e2e-plan-format.test.ts | 41 | // Recommendation-line presence + substance is now graded by judgeRecommendation | COMMENT |
| LOW | test/gstack-memory-ingest.test.ts | 1601 | // Write TWO sessions so we can verify one lands and the other doesn't. | COMMENT |
| LOW | test/plan-tune.test.ts | 361 | // that don't appear to map to any registry entry. | COMMENT |
| LOW | test/ios-debug-bridge-release-guard.test.ts | 1 | import { describe, test, expect } from 'bun:test'; | COMMENT |
| 159 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | test/redact-span-binding.test.ts | 10 | const input = `DB_PASSWORD=${secret}\nOTHER_API_KEY="your-api-key-here"`; | CODE |
| HIGH⚡ | test/redact-span-binding.test.ts | 12 | expect(redactFindingSpans(input)).toBe(`DB_PASSWORD=${marker}\nOTHER_API_KEY="your-api-key-here"`); | CODE |
| HIGH⚡ | test/redact-span-binding.test.ts | 16 | const input = `DB_PASSWORD=synthetic-example-secret\nOTHER_API_KEY="your-api-key-here"`; | CODE |
| HIGH | test/redact-span-binding.test.ts | 35 | const input = `DB_PASSWORD=${secret}\nOTHER_API_KEY="your-api-key-here"\nAPI_KEY=${secret}`; | CODE |
| HIGH | test/redact-span-binding.test.ts | 37 | expect(redactFindingSpans(input)).toBe(`DB_PASSWORD=${marker}\nOTHER_API_KEY="your-api-key-here"\nAPI_KEY=${marker}` | CODE |
| HIGH | test/redact-span-binding.test.ts | 52 | const input = `DB_PASSWORD=${value}\nOTHER_API_KEY="your-api-key-here"`; | CODE |
| HIGH | test/redact-span-binding.test.ts | 54 | expect(redactFindingSpans(input)).toBe(`DB_PASSWORD=${marker}\nOTHER_API_KEY="your-api-key-here"`); | CODE |
| HIGH⚡ | test/redact-span-binding.test.ts | 68 | const input = `DB_PASSWORD=${secret}\nOTHER_API_KEY="your-api-key-here"`; | CODE |
| HIGH⚡ | test/redact-span-binding.test.ts | 69 | expect(redact(input)).toBe(`DB_PASSWORD=${marker}\nOTHER_API_KEY="your-api-key-here"`); | CODE |
| HIGH⚡ | test/redact-span-binding.test.ts | 70 | expect(sanitizeForJson({ output: input })).toEqual({ output: `DB_PASSWORD=${marker}\nOTHER_API_KEY="your-api-key-her | CODE |
| HIGH | test/setup-gbrain-path4-structure.test.ts | 139 | expect(skeleton).toMatch(/<YOUR_TOKEN>/); | CODE |
| HIGH | test/setup-gbrain-path4-structure.test.ts | 180 | // - <bearer>, <YOUR_TOKEN>, <TOKEN> (placeholder) | COMMENT |
| HIGH | test/setup-gbrain-path4-structure.test.ts | 186 | expect(line).toMatch(/Bearer (\$GBRAIN_MCP_TOKEN|<bearer>|<YOUR_TOKEN>|<TOKEN>|\.\.\."?)/); | CODE |
| HIGH | test/redact-engine.test.ts | 480 | expect(isPlaceholderSpan("your_api_key")).toBe(true); | CODE |
| HIGH⚡ | test/helpers/carve-guards.ts | 624 | '<YOUR_TOKEN>', | CODE |
| HIGH | setup-gbrain/SKILL.md | 813 | -H 'Authorization: Bearer <YOUR_TOKEN>' \ | CODE |
| HIGH | setup-gbrain/SKILL.md | 819 | `<YOUR_TOKEN>` so the snippet is safe to copy into chat / share. | CODE |
| HIGH | lib/redact-patterns.ts | 910 | // recipe as env.kv to kill Bearer YOUR_TOKEN_HERE placeholders. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | design-html/SKILL.md | 565 | on the plan or user description (never lorem ipsum). | CODE |
| LOW | design-html/SKILL.md | 668 | - Real content extracted from the mockup (never lorem ipsum) | CODE |
| LOW | design-html/SKILL.md | 869 | user's description. Never use "Lorem ipsum", "Your text here", or placeholder content. | CODE |
| LOW | design/test/variants-retry-after.test.ts | 68 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 90 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 105 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 123 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 138 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design/test/variants-retry-after.test.ts | 187 | "fake-key", "prompt", outputPath, "1024x1024", "high", fetchFn, | CODE |
| LOW | design-consultation/sections/proposal-and-preview.md | 426 | 3. **Shows the product name**, not Lorem Ipsum, in the hero. | CODE |
| LOW | ios-qa/daemon/test/session-tokens.test.ts | 15 | identity: 'user@example.com', | CODE |
| LOW | ios-qa/daemon/test/session-tokens.test.ts | 20 | identity: 'user@example.com', | CODE |
| LOW | ios-qa/daemon/test/tailscale-localapi.test.ts | 20 | UserProfile: { LoginName: 'admin@example.com' }, | CODE |
| LOW⚡ | ios-qa/daemon/test/allowlist.test.ts | 33 | entries: [{ identity: 'user@example.com', capabilities: ['observe'], expires_at: null }], | CODE |
| LOW⚡ | ios-qa/daemon/test/allowlist.test.ts | 37 | expect(JSON.parse(raw).entries[0].identity).toBe('user@example.com'); | CODE |
| LOW⚡ | ios-qa/daemon/test/allowlist.test.ts | 43 | entries: [{ identity: 'user@example.com', capabilities: ['mutate' as const], expires_at: null }], | CODE |
| LOW⚡ | ios-qa/daemon/test/allowlist.test.ts | 45 | expect(findEntry(list, 'user@example.com')?.identity).toBe('user@example.com'); | CODE |
| LOW | ios-qa/daemon/src/types.ts | 58 | identity: string; // canonicalized: "user@example.com" or "tag:<name>" or "node:<key>" | CODE |
| LOW | ios-qa/daemon/src/tailscale-localapi.ts | 91 | * "UserProfile": { "LoginName": "user@example.com", ... }, | COMMENT |
| LOW | test/skill-e2e-session-intelligence.test.ts | 37 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/gbrain-supabase-provision.test.ts | 123 | { id: 'deprec-1', slug: 'acme', name: 'Acme Inc' }, | CODE |
| LOW | test/gbrain-supabase-provision.test.ts | 134 | { slug: 'acme', name: 'Acme Inc' }, | CODE |
| LOW | test/gbrain-supabase-provision.test.ts | 716 | return jsonResp([{ id: 'x', slug: 'acme', name: 'Acme Inc' }]); | CODE |
| LOW | test/gbrain-supabase-provision.test.ts | 740 | expect(JSON.parse(stdout.trim())).toEqual({ orgs: [{ slug: 'acme', name: 'Acme Inc' }] }); | CODE |
| LOW | test/skill-e2e-bws.test.ts | 208 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 32 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 123 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 208 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 290 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan.test.ts | 396 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/office-hours-review.test.ts | 354 | expect(updated).not.toContain('placeholder'); | CODE |
| LOW | test/office-hours-review.test.ts | 395 | expect(updated).not.toContain('placeholder'); | CODE |
| LOW | test/skill-e2e-office-hours.test.ts | 43 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-office-hours.test.ts | 124 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan-tune.test.ts | 37 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-review.test.ts | 35 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-review.test.ts | 116 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-review.test.ts | 199 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 28 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 97 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 166 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 237 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 298 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-deploy.test.ts | 363 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-context-skills.test.ts | 43 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-office-hours-phase4.test.ts | 88 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-plan-prosons.test.ts | 120 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/touchfiles.test.ts | 417 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/audit-compliance.test.ts | 36 | expect(src).not.toContain('"test@test.com"'); | CODE |
| LOW | test/skill-e2e-review-army.test.ts | 27 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-skillify.test.ts | 79 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-design.test.ts | 65 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-design.test.ts | 403 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-design.test.ts | 616 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-design.test.ts | 911 | git('config', 'user.email', 'test@test.com'); | CODE |
| LOW | test/skill-e2e-design.test.ts | 1042 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-design.test.ts | 1274 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/skill-e2e-autoplan-dual-voice.test.ts | 76 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| LOW | test/gstack-version-bump.test.ts | 917 | ['semantic-release placeholder', { 'package.json': JSON.stringify({ name: 'a', version: '0.0.0-development' }) }, 'p | CODE |
| LOW | test/diff-scope.test.ts | 25 | run('git', ['config', 'user.email', 'test@test.com']); | CODE |
| 46 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | TODOS.md | 4164 | ### Swarm primitive — reusable multi-agent dispatch | COMMENT |
| MEDIUM | TODOS.md | 4258 | **Why:** Multi-week initiatives often span 3-5 specs that share context but ship sequentially. Today `/spec --epic` woul | CODE |
| MEDIUM | CLAUDE.md | 336 | ## Community PR guardrails | COMMENT |
| MEDIUM | cso/ACKNOWLEDGEMENTS.md | 10 | - [OWASP LLM Top 10 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/) and [Agentic Applications Top 1 | CODE |
| MEDIUM | cso/sections/audit-phases.md | 58 | **Inspected guidance:** [OWASP LLM Top 10 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/) ([artifac | CODE |
| MEDIUM | test/benchmark-runner.test.ts | 71 | // Gemini has very limited agentic surface | COMMENT |
| MEDIUM | test/preamble-first-task-scaffold.test.ts | 7 | // P4 first-run scaffold (activation lift). Two surfaces under test: | COMMENT |
| MEDIUM | test/preamble-first-task-scaffold.test.ts | 155 | // and the scaffold telemetry all live in bin/gstack-skill-start; the tips | COMMENT |
| MEDIUM | test/preamble-first-task-scaffold.test.ts | 170 | // P4 scaffold branch (first-ever run) … | COMMENT |
| MEDIUM | test/gen-skill-docs.test.ts | 4155 | // This does NOT apply to `codex exec`, which is agentic and really does run | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 95 | // P4 first-run scaffold (activation lift) — the detection binary end-to-end | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 1068 | // WS2 arm benchmark — with-skill vs without-skill agentic arms scored on | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 1172 | // P4 first-run scaffold — periodic (onboarding, non-safety, model-touched marker) | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 1192 | // Review — gate for functional/guardrails, periodic for quality | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 1393 | // CSO — gate for security guardrails, periodic for quality | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 1502 | // WS2 arm benchmark — periodic: full build-shaped agentic workflows, paid, | COMMENT |
| MEDIUM | test/helpers/tool-map.ts | 58 | // Shell access depends on flags; most agentic tools are not exposed. | COMMENT |
| MEDIUM | context-restore/SKILL.md | 459 | # Cap at 20: a user with 10k saved files shouldn't blow the context window. | COMMENT |
| MEDIUM⚡ | docs/skills.md | 54 | | [`/careful`](#safety--guardrails) | **Safety Guardrails** | Warns before destructive commands (rm -rf, DROP TABLE, for | CODE |
| MEDIUM⚡ | docs/skills.md | 55 | | [`/freeze`](#safety--guardrails) | **Edit Lock** | Restrict all file edits to a single directory. Blocks Edit, Write a | CODE |
| MEDIUM⚡ | docs/skills.md | 56 | | [`/guard`](#safety--guardrails) | **Full Safety** | Combines /careful + /freeze in one command. Maximum safety for pro | CODE |
| MEDIUM⚡ | docs/skills.md | 57 | | [`/unfreeze`](#safety--guardrails) | **Unlock** | Remove the /freeze boundary, allowing edits everywhere again. | | CODE |
| MEDIUM | docs/designs/SESSION_INTELLIGENCE.md | 134 | - [CodeScene: Agentic AI coding best practices](https://codescene.com/blog/agentic-ai-coding-best-practice-patterns-for- | CODE |
| MEDIUM | docs/designs/ML_PROMPT_INJECTION_KILLER.md | 88 | - [npm](https://www.npmjs.com/package/@openai/guardrails) | CODE |
| MEDIUM⚡ | …ns/fork-port-residual-2026-09/residual-index-lite.json | 1 | [{"id":"s9-skills-trivial-change-fast-path","title":"Trivial-change fast path in every dispatcher (one probe, no modules | CODE |
| MEDIUM⚡ | …ns/fork-port-residual-2026-09/residual-index-lite.json | 1 | [{"id":"s9-skills-trivial-change-fast-path","title":"Trivial-change fast path in every dispatcher (one probe, no modules | CODE |
| MEDIUM | docs/designs/fork-port-residual-2026-09/refuters.json | 89 | "strongest_argument": "Premise re-verified (no '## Review' reader in review/SKILL.md.tmpl or scripts/resolvers/review. | CODE |
| MEDIUM | supabase/functions/telemetry-ingest/index.ts | 74 | // scaffold), handoff (P1 office-hours → next skill), route (gstack router). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | test/coverage-audit-evidence.test.ts | 743 | (s: ReturnType<typeof owned>) => { s.delivered.content = s.row.files.source.content.slice(0, 80); }, | CODE |
| CRITICAL | test/plan-floor-permission.test.ts | 560 | expect(e.saved.observation.transcript.calls.find((c:any)=>c.answered).answers).toEqual({[dxCustom.call.questions[0]!.q | CODE |
| CRITICAL | test/plan-floor-permission.test.ts | 567 | expect(e.saved.observation.transcript.calls.find((c:any)=>c.answered).answers).toEqual({[dxCustom.call.questions[0]!.q | CODE |
| CRITICAL | test/detector-corpus-auto-decide-preserved.test.ts | 51 | const last = () => entry.input.native.transcript.assistantMessages.at(-1); | CODE |
| CRITICAL | test/detector-corpus-auto-decide-preserved.test.ts | 72 | const last = entry.input.native.transcript.assistantMessages.at(-1); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | .osv-scanner.toml | 50 | # which is deliberately exact-pinned (eval-harness stability; the v1.77 wave | COMMENT |
| MEDIUM⚡ | .osv-scanner.toml | 51 | # pinned the whole harness after repeated CLI-drift breakage) and declares | COMMENT |
| MEDIUM⚡ | .osv-scanner.toml | 53 | # without violating the harness pin. 4.8 MEDIUM. Upgrade trigger: the next | COMMENT |
| MEDIUM | test/skill-e2e-setup-gbrain-path4-local-pglite.test.ts | 15 | // Periodic-tier (codex #12: AgentSDK harness is non-deterministic; gate-tier | COMMENT |
| MEDIUM | test/harness-version.test.ts | 42 | 'take the higher version, then rerun', 'docs/TESTING_INTERNALS.md#harness-version']) expect(message).toContain(tex | CODE |
| MEDIUM | test/skill-e2e-office-hours-brain-writeback.test.ts | 163 | // Set up the fake gbrain CLI with robust argv quoting + payload capture. | COMMENT |
| MEDIUM | test/helpers/touchfiles-data.ts | 565 | // Periodic-tier per codex #12 (AgentSDK harness is non-deterministic). | COMMENT |
| MEDIUM | test/helpers/claude-pty-runner.auq.unit.test.ts | 536 | const captured = " real,specificgaps (Visual Hierachy, Spacing, Color, Typography,Motion)\r22-Itpreservesstrongaccessi | CODE |
| MEDIUM⚡ | …ns/fork-port-residual-2026-09/residual-index-lite.json | 1 | [{"id":"s9-skills-trivial-change-fast-path","title":"Trivial-change fast path in every dispatcher (one probe, no modules | CODE |
| MEDIUM⚡ | …ns/fork-port-residual-2026-09/residual-index-lite.json | 1 | [{"id":"s9-skills-trivial-change-fast-path","title":"Trivial-change fast path in every dispatcher (one probe, no modules | CODE |
| MEDIUM | docs/designs/fork-port-residual-2026-09/refuters.json | 89 | "strongest_argument": "Premise re-verified (no '## Review' reader in review/SKILL.md.tmpl or scripts/resolvers/review. | CODE |
| MEDIUM | docs/designs/fork-port-residual-2026-09/refuters.json | 208 | "strongest_argument": "Upstream enforces this property mechanically where attacker text actually enters, and a prose s | CODE |
| MEDIUM | scripts/bump-harness-version.ts | 26 | export const DOC_ANCHOR = 'docs/TESTING_INTERNALS.md#harness-version'; | CODE |
| MEDIUM | scripts/build-cso.sh | 369 | # comprehensive execution unavailable instead of substituting a weaker timer. | COMMENT |
| MEDIUM | scripts/resolvers/outside-voice.ts | 35 | return `# GSTACK_ACTIVE_HOST names the harness, never the model. | CODE |
| MEDIUM | scripts/resolvers/testing.ts | 76 | ### B2. Research best practices | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bin/gstack-gbrain-lib.sh | 3 | # This file is NOT executable; source it: | COMMENT |
| MEDIUM | bin/gstack-egress-lib.sh | 3 | # This file is NOT executable; source it: | COMMENT |
| MEDIUM | bin/gstack-brain-lock.sh | 4 | # This file is NOT executable; source it: | COMMENT |
| MEDIUM | scripts/build-app.sh | 191 | # Create a temporary directory for DMG contents | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/outside-voice-invocation.test.ts | 144 | for (const response of ['A blue palette could be nice.', 'I cannot provide a design proposal.']) { | CODE |
| MEDIUM | lib/outside-review-result.ts | 35 | const REFUSAL = /\b(?:(?:I (?:cannot|can't|won't|will not|am unable to)|I'm unable to)\s+(?:review|analy[sz]e|evaluate|a | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup-gbrain/SKILL.md | 749 | except Exception: | CODE |
| LOW⚡ | .github/scripts/run-dia-native-qualification.ts | 199 | except Exception: | CODE |
| LOW | .github/scripts/run-dia-native-qualification.ts | 232 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/build-app.sh | 12 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/skill-routing-e2e.test.ts | 390 | fs.writeFileSync(path.join(tmpDir, 'waitlist.ts'), 'export class WaitlistService {\n async addParty(name: string, | CODE |