Open-source agentic workspace enterprises can make their own. Connect the systems you already run — 100+ integrations, MCP, chat tools, apps, browser, local files — with shared memory. Any agent (Claude Code, Codex), any model, or BYOK. Set up in clicks, not months. Local-first: your data never leaves your machines.
This report summarizes scanner evidence for holaboss-ai/holaOS, a TypeScript project with 11,450 GitHub stars. SynthScan examined 523,429 lines of code across 1509 source files, recording 2706 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 5.3 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 2546 finding(s).
Are imports declared and package/API names verified? 11 finding(s).
Are wrappers, guards, and repeated structures necessary? 2403 finding(s).
Which changes need focused human review? 2706 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2706 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 677 | export function attachmentDocumentRootNodeId(treeId: string): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 681 | function attachmentDocumentChunkNodeId(treeId: string, index: number): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 689 | function toolResultDocumentRootNodeId(treeId: string): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 693 | function toolResultDocumentChunkNodeId(treeId: string, index: number): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 705 | function outputDocumentChunkNodeId(treeId: string, index: number): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 713 | function imageUrlDocumentRootNodeId(treeId: string): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 717 | function imageUrlDocumentChunkNodeId(treeId: string, index: number): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 108 | export function workspaceArtifactBackfillStateToken(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 201 | function workspaceRelatedEntityResolver(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 259 | function outputArtifactContextDescriptorPriority(descriptor: WorkspaceOutputDocumentTreeDescriptor): number { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 266 | function compareOutputArtifactContextDescriptors( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 277 | function compareToolResultArtifactContextDescriptors( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 291 | function compareAttachmentArtifactContextDescriptors( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 303 | function compareImageUrlArtifactContextDescriptors( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 352 | function artifactRelatedExtractionContent(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 370 | async function extractArtifactDocumentRelatedInfo(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 398 | function artifactDocumentRelations(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 454 | function artifactDocumentRelationsFromStoredPath(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 504 | function syncStoredArtifactRootDocument(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 605 | function chunkExcerptsForArtifactTree(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 758 | function imageExtensionForMimeType(value: string | null | undefined): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 815 | function detectInlineImageMimeType(bytes: Uint8Array): string | null { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 921 | function hasExtractableAttachmentContent(attachment: TurnInputAttachment): boolean { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 976 | function normalizeAttachmentTextContent(rawText: string, attachment: TurnInputAttachment): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 983 | function hasExtractableOutputContent(output: OutputRecord): boolean { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1031 | function sourceTurnInputAttachmentPosition(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1056 | function sourceTurnInputImageUrlPosition(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1212 | async function resolveReferencedImageUrlSource(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1246 | function resolveReferencedImageUrlSourceSync(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1276 | function normalizeOutputTextContent(rawText: string, output: OutputRecord): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1311 | function extractImageTextContentWithMacOsVision(absolutePath: string): string | null { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1331 | function extractImageTextContentWithMacOsVisionBytes(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1350 | function normalizeImageVisionModelText(payload: Record<string, unknown> | null): string | null { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1391 | function visionCapableImageMimeType(value: string | null | undefined): string | null { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1405 | async function extractImageTextContentWithModel(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1492 | function normalizeExtractedDocumentText(value: string): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1501 | function normalizeWorkbookCellText(value: unknown): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1561 | function workbookRowsFromWorksheet(worksheet: ExcelJSWorksheet): string[][] { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1653 | async function extractSpreadsheetTextContent(buffer: Buffer, fileName: string): Promise<string | null> { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1695 | async function readAttachmentTextContent(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1800 | function readOutputTextContentForBackfill(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1834 | async function readReferencedImageUrlTextContent(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1879 | export function splitAttachmentTextIntoChunks(value: string): AttachmentChunk[] { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1943 | function attachmentDocumentRootBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1984 | function attachmentDocumentChunkBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2004 | function toolResultDocumentRootBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2046 | function toolResultDocumentChunkBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2171 | function imageUrlDocumentChunkBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2211 | async function syncAttachmentNodeEmbedding(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2304 | async function syncToolResultNodeEmbedding(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2357 | async function syncImageUrlNodeEmbedding(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2486 | function attachmentDescriptorFromRootNode( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2525 | function toolResultDescriptorFromRootNode( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2563 | function outputDescriptorFromRootNode( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2598 | function outputArtifactSourceContext(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2641 | function imageUrlDescriptorFromRootNode( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2671 | function forwardedOutputRelationTarget(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2706 | export function resolveWorkspaceArtifactRelationIdentity(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2769 | function outputArtifactRelationsForDescriptor(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2967 | function syncWorkspaceOutputArtifactRelations(params: { | CODE |
| 2194 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | runtime/api-server/src/app.test.ts | 14037 | // ── archive_url tests ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/app.ts | 9205 | // ─── Workspace projects ─────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/integration-store-catalog.ts | 55 | // ───── Hero ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/integration-store-catalog.ts | 73 | // ───── Supported: tech ───────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/integration-store-catalog.ts | 103 | // ───── Supported: marketing ──────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-skill-import.test.ts | 17 | // ─── parseGithubSkillRef ────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-skill-import.test.ts | 47 | // ─── slugifySkillId ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-skill-import.test.ts | 57 | // ─── mapSkillFrontmatter ────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-skill-import.test.ts | 86 | // ─── importSkillFromGithub (full path, stubbed fetch) ───────────────── | COMMENT |
| MEDIUM | runtime/deploy/package_macos_runtime.sh | 40 | # ─── Incremental cache gate ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 3 | // ─── Bridge ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 32 | // ─── Transport contract ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 46 | // ─── Provider Registry ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 72 | // ─── Type helpers: schema → row type vending ─────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 101 | // ─── Resource ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 132 | // ─── Action ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 196 | // ─── Sync ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 221 | // ─── DbView ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 245 | // ─── App ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 306 | // ─── Internal runtime state ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 364 | // ─── State backend contract ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …er-sdk/sdk-package/src/runtime/state-backend-sqlite.ts | 178 | // ─── private ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/app-builder-sdk/sdk-package/src/runtime/mcp-server.ts | 171 | // ─── Tool registration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/app-builder-sdk/sdk-package/src/runtime/mcp-server.ts | 337 | // ─── Tool handlers extracted for clarity / unit reuse ────────────────────── | COMMENT |
| MEDIUM | …/app-builder-sdk/sdk-package/src/runtime/mcp-server.ts | 434 | // ─── Helpers ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp-builder-sdk/reference/slack-messaging/e2e-bearer.ts | 46 | // ─── SUT ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp-builder-sdk/reference/slack-messaging/e2e-bearer.ts | 53 | // ─── Scenario ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 20 | // ─── Env ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 33 | // ─── Auto-discover: Composio Slack connection ────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 71 | // ─── Build SUT ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 78 | // ─── Auto-discover: own Slack user_id for DM-to-self ─────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 95 | // ─── Minimal BDD harness ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 151 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 153 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 301 | // ─── Summary ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 24 | // ─── Env ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 37 | // ─── Auto-discover: Composio Calendar connection ─────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 75 | // ─── Build SUT ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 84 | // ─── Minimal BDD harness ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 143 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 145 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 275 | // ─── Summary ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ls/app-builder-sdk/reference/telegram-messaging/e2e.ts | 22 | // ─── Env ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/state-store/src/store.ts | 2096 | // ─── Workspace projects ───────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 120 | // ── JSON-RPC dispatch state ───────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 159 | // ── Streaming state ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 427 | // ── Stdout reader ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 462 | // ── Handshake → turn ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 600 | // ── Graceful shutdown ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/channel-gateway/src/connectors/wecom.ts | 58 | // ── Structural slices of @wecom/aibot-node-sdk (lazily imported) ───────────── | COMMENT |
| MEDIUM | runtime/channel-gateway/src/connectors/wecom.ts | 261 | // ── Streaming (editMessages path) ────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/channel-gateway/src/connectors/qq.ts | 42 | // ── Structural slices of qq-official-bot (lazily imported) ─────────────────── | COMMENT |
| MEDIUM | runtime/channel-gateway/src/connectors/discord.ts | 58 | // ── Structural slices of discord.js (lazily imported) ──────────────────────── | COMMENT |
| MEDIUM | docs/proposals.md | 243 | │ 📄 Q3 launch #2 │ ┌──── Artifact ─────────────┐ │ | CODE |
| MEDIUM | docs/plans/2026-06-27-holaapp-bundles-prd.md | 161 | # ── what the user SEES ─────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/plans/2026-06-27-holaapp-bundles-prd.md | 171 | # ── the hidden COPILOT layer (NEVER surfaced to the user) ───────── | COMMENT |
| MEDIUM | docs/plans/2026-06-27-holaapp-bundles-prd.md | 188 | # ── connections the app needs (optional) ───────────────────────── | COMMENT |
| MEDIUM | packages/app-builder-sdk/test/slack.test.ts | 134 | // ─── Regression: real-Slack bugs found by E2E ──────────────────────────── | COMMENT |
| MEDIUM | …/app-builder-sdk/test/manifest-and-entry-point.test.ts | 161 | // ─── helpers ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp-builder-sdk/reference/slack-messaging/e2e-bearer.ts | 46 | // ─── SUT ──────────────────────────────────────────────────────────────────── | COMMENT |
| 87 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | runtime/api-server/src/composio-minimal-example.ts | 344 | // Step 1: Create managed connect link (get OAuth redirect URL) | COMMENT |
| LOW | runtime/api-server/src/composio-minimal-example.ts | 356 | // Step 2: Wait for connected account to become ACTIVE | COMMENT |
| LOW | runtime/api-server/src/composio-minimal-example.ts | 369 | // Step 3: Make a proxy request to verify the token works | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 258 | // Step 1: Create connect link | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 278 | // Step 2: Open OAuth popup + poll status | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 341 | // Step 3: Proxy request | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 43 | ### Step 1: Write failing Composio service tests | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 179 | ### Step 2: Run tests to verify they fail | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 189 | ### Step 3: Implement ComposioService | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 439 | ### Step 4: Run tests to verify they pass | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 449 | ### Step 5: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 466 | ### Step 1: Write failing broker test for Composio token resolution | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 572 | ### Step 2: Run tests to verify they fail | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 582 | ### Step 3: Extend IntegrationBrokerService | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 641 | ### Step 4: Run tests to verify they pass | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 651 | ### Step 5: Run all existing integration tests to verify no regression | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 662 | ### Step 6: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 678 | ### Step 1: Add Composio service construction and routes | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 700 | ### Step 2: Add the connect routes | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 793 | ### Step 3: Add the provider-to-toolkit mapping constant | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 807 | ### Step 4: Run existing tests to verify no regression | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 818 | ### Step 5: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 836 | ### Step 1: Add Composio connect types | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 865 | ### Step 2: Add preload IPC methods | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 878 | ### Step 3: Add main process IPC handlers | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 936 | ### Step 4: Verify desktop typecheck | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 946 | ### Step 5: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 962 | ### Step 1: Read the current pane code | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 966 | ### Step 2: Add Composio connect state and handler | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1029 | ### Step 3: Add the Managed Connect button | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1046 | ### Step 4: Verify desktop typecheck | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1056 | ### Step 5: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1069 | ### Step 1: Run all runtime tests | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1086 | ### Step 2: Verify desktop build | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1096 | ### Step 3: Manual E2E verification (requires COMPOSIO_API_KEY) | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 65 | ### Step 1: Write failing broker service tests | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 367 | ### Step 2: Run tests to verify they fail | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 377 | ### Step 3: Implement the broker service | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 509 | ### Step 4: Run tests to verify they pass | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 519 | ### Step 5: Commit | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 535 | ### Step 1: Write failing route test | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 622 | ### Step 2: Run tests to verify the route test fails | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 632 | ### Step 3: Register the broker route in app.ts | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 675 | ### Step 4: Run tests to verify they pass | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 685 | ### Step 5: Verify existing tests still pass | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 696 | ### Step 6: Commit | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 716 | ### Step 1: Create the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 782 | ### Step 2: Update google-api.ts to use the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 846 | ### Step 3: Update app.runtime.yaml env_contract | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 870 | ### Step 4: Verify the module builds | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 880 | ### Step 5: Commit | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 901 | ### Step 1: Create the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 967 | ### Step 2: Update google-api.ts to use the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 996 | ### Step 3: Update app.runtime.yaml env_contract | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1020 | ### Step 4: Verify the module builds | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1030 | ### Step 5: Commit | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1051 | ### Step 1: Create the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1117 | ### Step 2: Update github-api.ts to use the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1177 | ### Step 3: Update app.runtime.yaml env_contract | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1201 | ### Step 4: Verify the module builds | COMMENT |
| 57 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | runtime/api-server/src/ts-runner.ts | 201 | // Temporarily hidden runtime tools. | COMMENT |
| LOW | runtime/api-server/src/ts-runner.ts | 2421 | logger, | COMMENT |
| LOW | runtime/api-server/src/claimed-input-executor.ts | 3881 | heartbeatAt: null, | COMMENT |
| LOW | runtime/api-server/src/image-generation-model.ts | 561 | COMMENT | |
| LOW | runtime/api-server/src/app-lifecycle-worker.ts | 501 | }): Promise<AppSetupLogResult | null> { | COMMENT |
| LOW | runtime/api-server/src/composio-api-client.ts | 1 | // Server-side client for Composio's curated API surface, used by the | COMMENT |
| LOW | runtime/api-server/src/runtime-tools-mcp.ts | 61 | // Integration connect/config. propose_connect returns its "Connect" card | COMMENT |
| LOW | runtime/api-server/src/app.ts | 3041 | // capabilityWorkspaceId() readers — which prefer this header over any | COMMENT |
| LOW | runtime/api-server/src/app.ts | 9001 | COMMENT | |
| LOW | runtime/api-server/src/runner-worker.ts | 781 | const abortChild = () => { | COMMENT |
| LOW | runtime/api-server/src/runtime-agent-tools.ts | 7661 | COMMENT | |
| LOW | runtime/api-server/src/runtime-agent-tools.ts | 8841 | pendingIntegrations, | COMMENT |
| LOW | runtime/api-server/src/runtime-agent-tools.ts | 8861 | // onto that same child session so the polish stays inside the same | COMMENT |
| LOW | runtime/api-server/src/active-account-resolver.ts | 1 | // Account resolution for "which of the user's N connected accounts | COMMENT |
| LOW | runtime/api-server/src/workspace-app-host-lint.ts | 1 | // Reject app source that hardcodes upstream API hosts for toolkits we | COMMENT |
| LOW | runtime/api-server/src/integration-proposal-gate.ts | 1 | // Gate logic for "agent proposed N integration Connect cards; user has | COMMENT |
| LOW | runtime/api-server/src/in-process-termination.test.ts | 201 | } finally { | COMMENT |
| LOW | runtime/api-server/src/workspace-app-ui-lint.ts | 1 | // Dashboard-app UI integrity lints, fired at workspace_apps_register | COMMENT |
| LOW | runtime/api-server/src/workspace-app-ui-lint.ts | 21 | // the design system becomes purely advisory. | COMMENT |
| LOW | runtime/api-server/src/workspace-app-ui-lint.ts | 61 | ".cache", | COMMENT |
| LOW | runtime/api-server/src/db-maintenance.ts | 261 | // Publish the heavy/estimate verdict immediately so the desktop sees it even | COMMENT |
| LOW | runtime/harnesses/src/composio-inline-tools.ts | 241 | connected_toolkits?: unknown; | COMMENT |
| LOW | runtime/harnesses/src/composio-inline-tools.ts | 261 | : `composio-search failed (status ${response.status})`; | COMMENT |
| LOW | runtime/harnesses/src/claude-code.ts | 21 | requiresBackend: false, | COMMENT |
| LOW | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 361 | derivedTools: DerivedTool[] | COMMENT |
| LOW | …dk/sdk-package/src/bridge-transports/runtime-broker.ts | 1 | // Runtime-broker transport — production path inside the Holaboss runtime. | COMMENT |
| LOW | …uilder-sdk/sdk-package/src/bridge-transports/bearer.ts | 1 | // Generic OAuth bearer-token transport. | COMMENT |
| LOW | …/app-builder-sdk/sdk-package/src/runtime/mcp-server.ts | 1 | // MCP server boot — exposes SDK app's derived tools as a real MCP server | COMMENT |
| LOW | …lder-sdk/sdk-package/src/runtime/integration-status.ts | 1 | // Integration readiness probe — the canonical way for an SDK app to ask | COMMENT |
| LOW | …kills/app-builder-sdk/reference/slack-messaging/app.ts | 1 | // SDK REFERENCE — NOT a production module. | COMMENT |
| LOW | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 1 | // Real E2E for the Slack app — BDD-style scenarios against a live Slack workspace. | COMMENT |
| LOW | …ls/app-builder-sdk/reference/slack-messaging/server.ts | 1 | // Production entry point for the Slack v2 app module. | COMMENT |
| LOW | …ills/app-builder-sdk/reference/gcalendar-events/app.ts | 1 | // SDK REFERENCE — NOT a production module. | COMMENT |
| LOW | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 1 | // Real E2E for the Google Calendar app — BDD scenarios against your live calendar. | COMMENT |
| LOW | …ls/app-builder-sdk/reference/telegram-messaging/app.ts | 1 | // SDK REFERENCE — NOT a production module. | COMMENT |
| LOW | …ls/app-builder-sdk/reference/telegram-messaging/app.ts | 21 | // { ok: false, description, error_code } in the body. SDK's BridgeClient only | COMMENT |
| LOW | …ls/app-builder-sdk/reference/telegram-messaging/e2e.ts | 1 | // Real E2E for the Telegram app — BDD-style scenarios against a live bot. | COMMENT |
| LOW | runtime/state-store/src/store.test.ts | 481 | assert.equal(path.resolve(err.workspacePath ?? ""), path.resolve(customPath)); | COMMENT |
| LOW | runtime/state-store/src/store.ts | 41 | // resurrecting projects the user has since deleted. | COMMENT |
| LOW | runtime/state-store/src/store.ts | 1641 | // difference between smooth token streaming and 20-bursts/sec jerkiness. The | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14341 | // Times the WHOLE open, not just the connection: compaction, the integrity | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14621 | // Skip ONLY this workspace — its rows stay in the per-workspace backup db | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14641 | // did not. Defensive: a failure here must not abort consolidation. | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14701 | return 0; | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14961 | // one-per-workspace would hand back the SAME handle N times and make every | COMMENT |
| LOW | runtime/harness-host/src/tool-image-cap.ts | 1 | // Cap the images a TOOL returns before they re-enter the model context. | COMMENT |
| LOW | runtime/harness-host/src/upstream-error-capture.ts | 1 | // LLM provider HTTP errors get normalized to a one-line `errorMessage` by | COMMENT |
| LOW | runtime/harness-host/src/upstream-error-capture.ts | 141 | // fresh `globalThis.fetch` stub. Production code never needs this — the | COMMENT |
| LOW | runtime/harness-host/src/claude-code.ts | 221 | const rl = createInterface({ input: child.stdout, crlfDelay: Infinity }); | COMMENT |
| LOW | runtime/harness-host/src/pi-ui-affordance-tools.test.ts | 21 | const UI_AFFORDANCE_TOOLS = [ | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 341 | // run proceed without MCP rather than hang forever. | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 1761 | COMMENT | |
| LOW | runtime/harness-host/src/pi.ts | 3081 | if (persistedSessionFile) { | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 3181 | // on every other turn. Grouped so promoting one brings its siblings (an MCP | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 3261 | ...(browserTools as unknown as ToolDefinition[]), | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 3321 | ] | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 3641 | // overflow compaction (_runAutoCompaction("overflow") → agent.continue). | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 4221 | await retryable.waitForRetry(); | COMMENT |
| LOW | runtime/harness-host/src/codex.ts | 181 | finalStatus = "failed"; | COMMENT |
| LOW | …ans/2026-05-22-interface-design-skill-noop-forensic.md | 61 | #47 workspace_apps_register | COMMENT |
| 76 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | runtime/api-server/src/app.test.ts | 1014 | // single-tenant: scaffold created the app under the root workspace dir | COMMENT |
| MEDIUM | runtime/api-server/src/app.test.ts | 1142 | // single-tenant: scaffold created the app under the root workspace dir | COMMENT |
| MEDIUM | runtime/api-server/src/runtime-agent-tools.test.ts | 2630 | // No src/client; the scaffold default is integration-only. Register | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-runtime-plan.ts | 160 | // floor (the session picker overrides it) and matches the runner-prep scaffold default. | COMMENT |
| MEDIUM | …harnesses/src/embedded-skills/app-builder-sdk/SKILL.md | 156 | ### Multi-step orchestration belongs in workflows | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 1016 | "# Holaboss-managed: codex native multi-agent + auto-memory are", | CODE |
| MEDIUM | …ans/2026-05-22-interface-design-skill-noop-forensic.md | 41 | ### Pre-scaffold gate | COMMENT |
| MEDIUM | …ans/2026-05-22-interface-design-skill-noop-forensic.md | 53 | Total tool calls in the child (build) session: **71**. Skill invocations: **2** — `app-builder-sdk` (call #3, before sca | CODE |
| MEDIUM | …ans/2026-05-22-interface-design-skill-noop-forensic.md | 58 | #3 skill(app-builder-sdk) ← pre-scaffold gate ✓ | COMMENT |
| MEDIUM | docs/plans/2026-05-25-memory-rag-implementation-plan.md | 13 | # Memory RAG implementation plan | COMMENT |
| MEDIUM | docs/plans/2026-05-25-memory-rag-implementation-plan.md | 143 | ## Phase 0: Lock the RAG contract | COMMENT |
| MEDIUM | docs/plans/2026-05-25-memory-rag-implementation-plan.md | 308 | ## Phase 2: Add an LLM-based RAG-grade reranker | COMMENT |
| MEDIUM | docs/plans/2026-06-27-capability-design-final.md | 47 | ## 2. What a capability is NOT (guardrails — these were tried and removed) | COMMENT |
| MEDIUM | …ges/app-builder-sdk/test/workspace-integration.test.ts | 49 | // package name. In a real workspace the app-builder skill / scaffold | COMMENT |
| MEDIUM⚡ | apps/desktop/electron/main.ts | 23025 | // still return their root so those guardrails keep applying. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | runtime/api-server/src/composio-minimal-example.ts | 344 | // Step 1: Create managed connect link (get OAuth redirect URL) | COMMENT |
| LOW | runtime/api-server/src/composio-minimal-example.ts | 356 | // Step 2: Wait for connected account to become ACTIVE | COMMENT |
| LOW | runtime/api-server/src/composio-minimal-example.ts | 369 | // Step 3: Make a proxy request to verify the token works | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 258 | // Step 1: Create connect link | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 278 | // Step 2: Open OAuth popup + poll status | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 341 | // Step 3: Proxy request | COMMENT |
| LOW⚡ | …ges/app-builder-sdk/test/workspace-integration.test.ts | 66 | // Step 1: lifecycle.setup | COMMENT |
| LOW⚡ | …ges/app-builder-sdk/test/workspace-integration.test.ts | 74 | // Step 2: lifecycle.start | COMMENT |
| LOW | …ges/app-builder-sdk/test/workspace-integration.test.ts | 102 | // Step 3: verify /mcp/health | COMMENT |
| LOW⚡ | …ges/app-builder-sdk/test/workspace-integration.test.ts | 118 | // Step 4: verify Slack-specific tools registered (proves SDK derivedTools() | COMMENT |
| LOW⚡ | …ges/app-builder-sdk/test/workspace-integration.test.ts | 126 | // Step 5: clean shutdown | COMMENT |
| LOW | apps/desktop/src/components/publish/PublishScreen.tsx | 742 | // Step 1: About — name, description, category, tags, cover, screenshots | COMMENT |
| LOW | apps/desktop/src/components/publish/PublishScreen.tsx | 893 | // Step 2: Bundle — pick apps. The schematic illustration lives on the right. | COMMENT |
| LOW | apps/desktop/src/components/publish/PublishScreen.tsx | 1017 | // Step 3: Docs — README + onboarding (with prominent AI generate) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | runtime/channel-gateway/src/connectors/wechat.ts | 43 | // a downloadable file — robust across formats). | COMMENT |
| MEDIUM | packages/editor/src/extensions/BubbleToolbar.tsx | 82 | // Restoring this snapshot before applying makes the action robust. | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 227 | # so harness-host's tsc errors went unnoticed on main. | COMMENT |
| MEDIUM | apps/desktop/electron/main.ts | 4327 | // name via app.getName()) makes this robust to the product name — including | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | docs/superpowers/plans/2026-06-16-geo-plugin.md | 1454 | GEO_PLUGIN_TEMPLATE_DEFINITION.payload.onboarding.fixed_structure.objects.map( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ntime/api-server/src/integration-proposal-gate.test.ts | 294 | accountLabel: "user@example.com", | CODE |
| LOW | …ntime/api-server/src/integration-proposal-gate.test.ts | 366 | accountLabel: "user@example.com", | CODE |
| LOW | …ntime/api-server/src/integration-proposal-gate.test.ts | 419 | accountLabel: "user@example.com", | CODE |
| LOW | runtime/api-server/src/runtime-agent-tools.test.ts | 3478 | accountLabel: "user@example.com", | CODE |
| LOW | runtime/api-server/src/desktop-browser-tools.ts | 1485 | "placeholder" in element ? String(element.placeholder || "") : "", | CODE |
| LOW | runtime/api-server/src/desktop-browser-tools.ts | 1491 | const placeholderText = (element) => "placeholder" in element ? String(element.placeholder || "") : ""; | CODE |
| LOW | runtime/api-server/src/desktop-browser-tools.ts | 2244 | "placeholder" in element ? String(element.placeholder || "") : "", | CODE |
| LOW | runtime/api-server/src/desktop-browser-tools.ts | 2410 | "placeholder" in element ? String(element.placeholder || "") : "", | CODE |
| LOW | …harnesses/src/embedded-skills/app-builder-sdk/SKILL.md | 295 | - **Hardcoded user identity in code** — usernames, email addresses, account ids, workspace names. These are mutable + pe | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ps/desktop/src/components/publish/LivePreviewPanel.tsx | 422 | // Tabs let the user switch. AI-generated content sometimes arrives wrapped in | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | runtime/api-server/src/workspace-attachment-memory.ts | 104 | print(recognized.joined(separator: "\n")) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …uilder-sdk/sdk-package/src/runtime/local-action-api.ts | 106 | async function handleRequest(request: Request): Promise<Response> { | CODE |
| LOW | runtime/state-store/src/cli.ts | 222 | export function handleRequest(operation: string, envelope: RequestEnvelope): JsonValue { | CODE |
| LOW | …ckages/app-builder-sdk/src/runtime/local-action-api.ts | 109 | async function handleRequest(request: Request): Promise<Response> { | CODE |
| LOW | apps/desktop/electron/browser-pane/http-service.ts | 397 | async function handleRequest( | CODE |
| LOW | apps/docs/app/entry.server.tsx | 9 | export default async function handleRequest( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/publish-macos-intel-desktop.yml | 195 | except Exception as exc: | CODE |
| LOW | .github/workflows/ci.yml | 525 | except Exception as exc: | CODE |