Open-source All in One AI agent workspace. Run any agent — Claude Code, Codex — across your tools (100+ integrations + MCP), apps, browser, and files, with shared memory. Built-in models or BYOK.
This report presents the forensic synthetic code analysis of holaboss-ai/holaOS, a TypeScript project with 5,469 GitHub stars. SynthScan v2.0 examined 507,157 lines of code across 1441 source files, recording 2663 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 5.4 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2663 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 677 | export function attachmentDocumentRootNodeId(treeId: string): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 681 | function attachmentDocumentChunkNodeId(treeId: string, index: number): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 689 | function toolResultDocumentRootNodeId(treeId: string): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 693 | function toolResultDocumentChunkNodeId(treeId: string, index: number): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 705 | function outputDocumentChunkNodeId(treeId: string, index: number): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 713 | function imageUrlDocumentRootNodeId(treeId: string): string { | CODE |
| LOW⚡ | runtime/api-server/src/workspace-attachment-memory.ts | 717 | function imageUrlDocumentChunkNodeId(treeId: string, index: number): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 108 | export function workspaceArtifactBackfillStateToken(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 201 | function workspaceRelatedEntityResolver(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 259 | function outputArtifactContextDescriptorPriority(descriptor: WorkspaceOutputDocumentTreeDescriptor): number { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 266 | function compareOutputArtifactContextDescriptors( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 277 | function compareToolResultArtifactContextDescriptors( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 291 | function compareAttachmentArtifactContextDescriptors( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 303 | function compareImageUrlArtifactContextDescriptors( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 352 | function artifactRelatedExtractionContent(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 370 | async function extractArtifactDocumentRelatedInfo(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 398 | function artifactDocumentRelations(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 454 | function artifactDocumentRelationsFromStoredPath(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 504 | function syncStoredArtifactRootDocument(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 605 | function chunkExcerptsForArtifactTree(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 758 | function imageExtensionForMimeType(value: string | null | undefined): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 815 | function detectInlineImageMimeType(bytes: Uint8Array): string | null { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 921 | function hasExtractableAttachmentContent(attachment: TurnInputAttachment): boolean { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 976 | function normalizeAttachmentTextContent(rawText: string, attachment: TurnInputAttachment): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 983 | function hasExtractableOutputContent(output: OutputRecord): boolean { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1031 | function sourceTurnInputAttachmentPosition(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1056 | function sourceTurnInputImageUrlPosition(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1212 | async function resolveReferencedImageUrlSource(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1246 | function resolveReferencedImageUrlSourceSync(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1276 | function normalizeOutputTextContent(rawText: string, output: OutputRecord): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1311 | function extractImageTextContentWithMacOsVision(absolutePath: string): string | null { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1331 | function extractImageTextContentWithMacOsVisionBytes(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1350 | function normalizeImageVisionModelText(payload: Record<string, unknown> | null): string | null { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1391 | function visionCapableImageMimeType(value: string | null | undefined): string | null { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1405 | async function extractImageTextContentWithModel(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1492 | function normalizeExtractedDocumentText(value: string): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1501 | function normalizeWorkbookCellText(value: unknown): string { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1561 | function workbookRowsFromWorksheet(worksheet: ExcelJSWorksheet): string[][] { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1653 | async function extractSpreadsheetTextContent(buffer: Buffer, fileName: string): Promise<string | null> { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1695 | async function readAttachmentTextContent(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1800 | function readOutputTextContentForBackfill(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1834 | async function readReferencedImageUrlTextContent(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1861 | function splitAttachmentTextIntoChunks(value: string): AttachmentChunk[] { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1917 | function attachmentDocumentRootBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1958 | function attachmentDocumentChunkBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 1978 | function toolResultDocumentRootBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2020 | function toolResultDocumentChunkBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2145 | function imageUrlDocumentChunkBody(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2185 | async function syncAttachmentNodeEmbedding(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2277 | async function syncToolResultNodeEmbedding(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2329 | async function syncImageUrlNodeEmbedding(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2456 | function attachmentDescriptorFromRootNode( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2495 | function toolResultDescriptorFromRootNode( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2533 | function outputDescriptorFromRootNode( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2568 | function outputArtifactSourceContext(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2611 | function imageUrlDescriptorFromRootNode( | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2641 | function forwardedOutputRelationTarget(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2676 | export function resolveWorkspaceArtifactRelationIdentity(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2739 | function outputArtifactRelationsForDescriptor(params: { | CODE |
| LOW | runtime/api-server/src/workspace-attachment-memory.ts | 2937 | function syncWorkspaceOutputArtifactRelations(params: { | CODE |
| 2169 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | runtime/api-server/src/app.test.ts | 14755 | // ── archive_url tests ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/app.ts | 8936 | // ─── Workspace projects ─────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/integration-store-catalog.ts | 55 | // ───── Hero ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/integration-store-catalog.ts | 73 | // ───── Supported: tech ───────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/integration-store-catalog.ts | 103 | // ───── Supported: marketing ──────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-skill-import.test.ts | 17 | // ─── parseGithubSkillRef ────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-skill-import.test.ts | 47 | // ─── slugifySkillId ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-skill-import.test.ts | 57 | // ─── mapSkillFrontmatter ────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-skill-import.test.ts | 86 | // ─── importSkillFromGithub (full path, stubbed fetch) ───────────────── | COMMENT |
| MEDIUM | runtime/deploy/package_macos_runtime.sh | 40 | # ─── Incremental cache gate ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 3 | // ─── Bridge ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 32 | // ─── Transport contract ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 46 | // ─── Provider Registry ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 72 | // ─── Type helpers: schema → row type vending ─────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 101 | // ─── Resource ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 132 | // ─── Action ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 196 | // ─── Sync ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 221 | // ─── DbView ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 245 | // ─── App ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 306 | // ─── Internal runtime state ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 364 | // ─── State backend contract ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …er-sdk/sdk-package/src/runtime/state-backend-sqlite.ts | 178 | // ─── private ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/app-builder-sdk/sdk-package/src/runtime/mcp-server.ts | 171 | // ─── Tool registration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/app-builder-sdk/sdk-package/src/runtime/mcp-server.ts | 337 | // ─── Tool handlers extracted for clarity / unit reuse ────────────────────── | COMMENT |
| MEDIUM | …/app-builder-sdk/sdk-package/src/runtime/mcp-server.ts | 434 | // ─── Helpers ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp-builder-sdk/reference/slack-messaging/e2e-bearer.ts | 46 | // ─── SUT ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp-builder-sdk/reference/slack-messaging/e2e-bearer.ts | 53 | // ─── Scenario ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 20 | // ─── Env ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 33 | // ─── Auto-discover: Composio Slack connection ────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 71 | // ─── Build SUT ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 78 | // ─── Auto-discover: own Slack user_id for DM-to-self ─────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 95 | // ─── Minimal BDD harness ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 151 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 153 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 301 | // ─── Summary ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 24 | // ─── Env ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 37 | // ─── Auto-discover: Composio Calendar connection ─────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 75 | // ─── Build SUT ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 84 | // ─── Minimal BDD harness ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 143 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 145 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 275 | // ─── Summary ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ls/app-builder-sdk/reference/telegram-messaging/e2e.ts | 22 | // ─── Env ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/state-store/src/store.ts | 1952 | // ─── Workspace projects ───────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 120 | // ── JSON-RPC dispatch state ───────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 159 | // ── Streaming state ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 427 | // ── Stdout reader ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 462 | // ── Handshake → turn ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 600 | // ── Graceful shutdown ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/channel-gateway/src/connectors/wecom.ts | 58 | // ── Structural slices of @wecom/aibot-node-sdk (lazily imported) ───────────── | COMMENT |
| MEDIUM | runtime/channel-gateway/src/connectors/wecom.ts | 261 | // ── Streaming (editMessages path) ────────────────────────────────────────── | COMMENT |
| MEDIUM | runtime/channel-gateway/src/connectors/qq.ts | 42 | // ── Structural slices of qq-official-bot (lazily imported) ─────────────────── | COMMENT |
| MEDIUM | runtime/channel-gateway/src/connectors/discord.ts | 58 | // ── Structural slices of discord.js (lazily imported) ──────────────────────── | COMMENT |
| MEDIUM | docs/proposals.md | 243 | │ 📄 Q3 launch #2 │ ┌──── Artifact ─────────────┐ │ | CODE |
| MEDIUM | docs/plans/2026-06-27-holaapp-bundles-prd.md | 161 | # ── what the user SEES ─────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/plans/2026-06-27-holaapp-bundles-prd.md | 171 | # ── the hidden COPILOT layer (NEVER surfaced to the user) ───────── | COMMENT |
| MEDIUM | docs/plans/2026-06-27-holaapp-bundles-prd.md | 188 | # ── connections the app needs (optional) ───────────────────────── | COMMENT |
| MEDIUM | packages/app-builder-sdk/test/slack.test.ts | 134 | // ─── Regression: real-Slack bugs found by E2E ──────────────────────────── | COMMENT |
| MEDIUM | …/app-builder-sdk/test/manifest-and-entry-point.test.ts | 161 | // ─── helpers ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp-builder-sdk/reference/slack-messaging/e2e-bearer.ts | 46 | // ─── SUT ──────────────────────────────────────────────────────────────────── | COMMENT |
| 87 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | runtime/api-server/src/composio-minimal-example.ts | 344 | // Step 1: Create managed connect link (get OAuth redirect URL) | COMMENT |
| LOW | runtime/api-server/src/composio-minimal-example.ts | 356 | // Step 2: Wait for connected account to become ACTIVE | COMMENT |
| LOW | runtime/api-server/src/composio-minimal-example.ts | 369 | // Step 3: Make a proxy request to verify the token works | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 258 | // Step 1: Create connect link | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 278 | // Step 2: Open OAuth popup + poll status | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 341 | // Step 3: Proxy request | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 43 | ### Step 1: Write failing Composio service tests | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 179 | ### Step 2: Run tests to verify they fail | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 189 | ### Step 3: Implement ComposioService | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 439 | ### Step 4: Run tests to verify they pass | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 449 | ### Step 5: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 466 | ### Step 1: Write failing broker test for Composio token resolution | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 572 | ### Step 2: Run tests to verify they fail | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 582 | ### Step 3: Extend IntegrationBrokerService | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 641 | ### Step 4: Run tests to verify they pass | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 651 | ### Step 5: Run all existing integration tests to verify no regression | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 662 | ### Step 6: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 678 | ### Step 1: Add Composio service construction and routes | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 700 | ### Step 2: Add the connect routes | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 793 | ### Step 3: Add the provider-to-toolkit mapping constant | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 807 | ### Step 4: Run existing tests to verify no regression | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 818 | ### Step 5: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 836 | ### Step 1: Add Composio connect types | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 865 | ### Step 2: Add preload IPC methods | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 878 | ### Step 3: Add main process IPC handlers | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 936 | ### Step 4: Verify desktop typecheck | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 946 | ### Step 5: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 962 | ### Step 1: Read the current pane code | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 966 | ### Step 2: Add Composio connect state and handler | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1029 | ### Step 3: Add the Managed Connect button | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1046 | ### Step 4: Verify desktop typecheck | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1056 | ### Step 5: Commit | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1069 | ### Step 1: Run all runtime tests | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1086 | ### Step 2: Verify desktop build | COMMENT |
| LOW | …ans/2026-03-31-composio-phase-4-implementation-plan.md | 1096 | ### Step 3: Manual E2E verification (requires COMPOSIO_API_KEY) | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 65 | ### Step 1: Write failing broker service tests | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 367 | ### Step 2: Run tests to verify they fail | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 377 | ### Step 3: Implement the broker service | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 509 | ### Step 4: Run tests to verify they pass | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 519 | ### Step 5: Commit | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 535 | ### Step 1: Write failing route test | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 622 | ### Step 2: Run tests to verify the route test fails | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 632 | ### Step 3: Register the broker route in app.ts | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 675 | ### Step 4: Run tests to verify they pass | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 685 | ### Step 5: Verify existing tests still pass | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 696 | ### Step 6: Commit | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 716 | ### Step 1: Create the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 782 | ### Step 2: Update google-api.ts to use the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 846 | ### Step 3: Update app.runtime.yaml env_contract | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 870 | ### Step 4: Verify the module builds | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 880 | ### Step 5: Commit | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 901 | ### Step 1: Create the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 967 | ### Step 2: Update google-api.ts to use the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 996 | ### Step 3: Update app.runtime.yaml env_contract | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1020 | ### Step 4: Verify the module builds | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1030 | ### Step 5: Commit | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1051 | ### Step 1: Create the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1117 | ### Step 2: Update github-api.ts to use the integration client | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1177 | ### Step 3: Update app.runtime.yaml env_contract | COMMENT |
| LOW | …2026-03-30-integrations-phase-2-implementation-plan.md | 1201 | ### Step 4: Verify the module builds | COMMENT |
| 57 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | runtime/api-server/src/ts-runner.ts | 2121 | // harness's resume model: | COMMENT |
| LOW | runtime/api-server/src/claimed-input-executor.ts | 3861 | // immutable, so it must win over binding state. The binding | COMMENT |
| LOW | runtime/api-server/src/image-generation-model.ts | 561 | COMMENT | |
| LOW | runtime/api-server/src/app-lifecycle-worker.ts | 501 | }): Promise<AppSetupLogResult | null> { | COMMENT |
| LOW | runtime/api-server/src/composio-api-client.ts | 1 | // Server-side client for Composio's curated API surface, used by the | COMMENT |
| LOW | runtime/api-server/src/runtime-tools-mcp.ts | 61 | // Integration connect/config. propose_connect returns its "Connect" card | COMMENT |
| LOW | runtime/api-server/src/app.ts | 3741 | COMMENT | |
| LOW | runtime/api-server/src/app.ts | 4061 | appId, | COMMENT |
| LOW | runtime/api-server/src/app.ts | 4521 | const appId = typeof entry.app_id === "string" ? entry.app_id : ""; | COMMENT |
| LOW | runtime/api-server/src/app.ts | 9901 | // Serialize concurrent installs for the same (workspaceId, appId). | COMMENT |
| LOW | runtime/api-server/src/runner-worker.ts | 861 | // TTFT dissection line (greppable in runtime.log via stdout). The harness | COMMENT |
| LOW | runtime/api-server/src/runtime-agent-tools.ts | 8821 | workspaceDir, | COMMENT |
| LOW | runtime/api-server/src/runtime-agent-tools.ts | 8841 | // the caller is the App Builder subagent itself, queue the follow-up | COMMENT |
| LOW | runtime/api-server/src/active-account-resolver.ts | 1 | // Account resolution for "which of the user's N connected accounts | COMMENT |
| LOW | runtime/api-server/src/workspace-app-host-lint.ts | 1 | // Reject app source that hardcodes upstream API hosts for toolkits we | COMMENT |
| LOW | runtime/api-server/src/integration-proposal-gate.ts | 1 | // Gate logic for "agent proposed N integration Connect cards; user has | COMMENT |
| LOW | runtime/api-server/src/workspace-app-ui-lint.ts | 1 | // Dashboard-app UI integrity lints, fired at workspace_apps_register | COMMENT |
| LOW | runtime/api-server/src/workspace-app-ui-lint.ts | 21 | // the design system becomes purely advisory. | COMMENT |
| LOW | runtime/api-server/src/workspace-app-ui-lint.ts | 61 | ".cache", | COMMENT |
| LOW | …bedded-skills/app-builder-sdk/sdk-package/src/types.ts | 361 | derivedTools: DerivedTool[] | COMMENT |
| LOW | …dk/sdk-package/src/bridge-transports/runtime-broker.ts | 1 | // Runtime-broker transport — production path inside the Holaboss runtime. | COMMENT |
| LOW | …uilder-sdk/sdk-package/src/bridge-transports/bearer.ts | 1 | // Generic OAuth bearer-token transport. | COMMENT |
| LOW | …/app-builder-sdk/sdk-package/src/runtime/mcp-server.ts | 1 | // MCP server boot — exposes SDK app's derived tools as a real MCP server | COMMENT |
| LOW | …lder-sdk/sdk-package/src/runtime/integration-status.ts | 1 | // Integration readiness probe — the canonical way for an SDK app to ask | COMMENT |
| LOW | …kills/app-builder-sdk/reference/slack-messaging/app.ts | 1 | // SDK REFERENCE — NOT a production module. | COMMENT |
| LOW | …kills/app-builder-sdk/reference/slack-messaging/e2e.ts | 1 | // Real E2E for the Slack app — BDD-style scenarios against a live Slack workspace. | COMMENT |
| LOW | …ls/app-builder-sdk/reference/slack-messaging/server.ts | 1 | // Production entry point for the Slack v2 app module. | COMMENT |
| LOW | …ills/app-builder-sdk/reference/gcalendar-events/app.ts | 1 | // SDK REFERENCE — NOT a production module. | COMMENT |
| LOW | …ills/app-builder-sdk/reference/gcalendar-events/e2e.ts | 1 | // Real E2E for the Google Calendar app — BDD scenarios against your live calendar. | COMMENT |
| LOW | …ls/app-builder-sdk/reference/telegram-messaging/app.ts | 1 | // SDK REFERENCE — NOT a production module. | COMMENT |
| LOW | …ls/app-builder-sdk/reference/telegram-messaging/app.ts | 21 | // { ok: false, description, error_code } in the body. SDK's BridgeClient only | COMMENT |
| LOW | …ls/app-builder-sdk/reference/telegram-messaging/e2e.ts | 1 | // Real E2E for the Telegram app — BDD-style scenarios against a live bot. | COMMENT |
| LOW | runtime/state-store/src/store.test.ts | 481 | assert.equal(path.resolve(err.workspacePath ?? ""), path.resolve(customPath)); | COMMENT |
| LOW | runtime/state-store/src/store.ts | 1581 | #db: Database.Database | null = null; | COMMENT |
| LOW | runtime/state-store/src/store.ts | 5701 | params.createdAt ?? utcNowIso() | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14121 | })(); | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14161 | // collisions — the INSERT OR IGNOREs above ran first), fold the legacy | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14221 | // No monolith file on disk → nothing to fold. Check BEFORE this.db(), which | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14241 | // would block a real fold if data ever appears. Only a monolith that carried | COMMENT |
| LOW | runtime/state-store/src/store.ts | 14481 | } | COMMENT |
| LOW | runtime/harness-host/src/tool-image-cap.ts | 1 | // Cap the images a TOOL returns before they re-enter the model context. | COMMENT |
| LOW | runtime/harness-host/src/upstream-error-capture.ts | 1 | // LLM provider HTTP errors get normalized to a one-line `errorMessage` by | COMMENT |
| LOW | runtime/harness-host/src/upstream-error-capture.ts | 141 | // fresh `globalThis.fetch` stub. Production code never needs this — the | COMMENT |
| LOW | runtime/harness-host/src/claude-code.ts | 221 | const rl = createInterface({ input: child.stdout, crlfDelay: Infinity }); | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 2941 | ...(composioInline.tools as unknown as ToolDefinition[]), | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 3301 | // overflow compaction (_runAutoCompaction("overflow") → agent.continue). | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 3861 | thinkingValue: request.thinking_value ?? null, | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 3901 | // resolve before that setTimeout fires, which would tear down | COMMENT |
| LOW | runtime/harness-host/src/pi.ts | 4001 | ? error.name | COMMENT |
| LOW | runtime/harness-host/src/codex.ts | 181 | finalStatus = "failed"; | COMMENT |
| LOW | …ans/2026-05-22-interface-design-skill-noop-forensic.md | 61 | #47 workspace_apps_register | COMMENT |
| LOW | scripts/runtime-logs.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …ges/app-builder-sdk/test/workspace-integration.test.ts | 1 | // Workspace integration smoke test. | COMMENT |
| LOW | …kages/app-builder-sdk/reference/slack-messaging/app.ts | 1 | // SDK REFERENCE — NOT a production module. | COMMENT |
| LOW | …kages/app-builder-sdk/reference/slack-messaging/e2e.ts | 1 | // Real E2E for the Slack app — BDD-style scenarios against a live Slack workspace. | COMMENT |
| LOW | …es/app-builder-sdk/reference/slack-messaging/server.ts | 1 | // Production entry point for the Slack v2 app module. | COMMENT |
| LOW | …gagement-inbox/src/client/components/thread-detail.tsx | 61 | // │ │ REPLYING TO │ │ ← context callout | COMMENT |
| LOW | …ages/app-builder-sdk/reference/gcalendar-events/app.ts | 1 | // SDK REFERENCE — NOT a production module. | COMMENT |
| LOW | …ages/app-builder-sdk/reference/gcalendar-events/e2e.ts | 1 | // Real E2E for the Google Calendar app — BDD scenarios against your live calendar. | COMMENT |
| LOW | …es/app-builder-sdk/reference/telegram-messaging/app.ts | 1 | // SDK REFERENCE — NOT a production module. | COMMENT |
| 59 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | runtime/api-server/src/app.test.ts | 1013 | // single-tenant: scaffold created the app under the root workspace dir | COMMENT |
| MEDIUM | runtime/api-server/src/app.test.ts | 1141 | // single-tenant: scaffold created the app under the root workspace dir | COMMENT |
| MEDIUM | runtime/api-server/src/runtime-agent-tools.test.ts | 2630 | // No src/client; the scaffold default is integration-only. Register | COMMENT |
| MEDIUM | runtime/api-server/src/workspace-runtime-plan.ts | 160 | // floor (the session picker overrides it) and matches the runner-prep scaffold default. | COMMENT |
| MEDIUM | …harnesses/src/embedded-skills/app-builder-sdk/SKILL.md | 156 | ### Multi-step orchestration belongs in workflows | COMMENT |
| MEDIUM | runtime/harness-host/src/codex.ts | 1016 | "# Holaboss-managed: codex native multi-agent + auto-memory are", | CODE |
| MEDIUM | …ans/2026-05-22-interface-design-skill-noop-forensic.md | 41 | ### Pre-scaffold gate | COMMENT |
| MEDIUM | …ans/2026-05-22-interface-design-skill-noop-forensic.md | 53 | Total tool calls in the child (build) session: **71**. Skill invocations: **2** — `app-builder-sdk` (call #3, before sca | CODE |
| MEDIUM | …ans/2026-05-22-interface-design-skill-noop-forensic.md | 58 | #3 skill(app-builder-sdk) ← pre-scaffold gate ✓ | COMMENT |
| MEDIUM | docs/plans/2026-05-25-memory-rag-implementation-plan.md | 13 | # Memory RAG implementation plan | COMMENT |
| MEDIUM | docs/plans/2026-05-25-memory-rag-implementation-plan.md | 143 | ## Phase 0: Lock the RAG contract | COMMENT |
| MEDIUM | docs/plans/2026-05-25-memory-rag-implementation-plan.md | 308 | ## Phase 2: Add an LLM-based RAG-grade reranker | COMMENT |
| MEDIUM | docs/plans/2026-06-27-capability-design-final.md | 47 | ## 2. What a capability is NOT (guardrails — these were tried and removed) | COMMENT |
| MEDIUM | …ges/app-builder-sdk/test/workspace-integration.test.ts | 49 | // package name. In a real workspace the app-builder skill / scaffold | COMMENT |
| MEDIUM⚡ | apps/desktop/electron/main.ts | 22375 | // still return their root so those guardrails keep applying. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | runtime/api-server/src/composio-minimal-example.ts | 344 | // Step 1: Create managed connect link (get OAuth redirect URL) | COMMENT |
| LOW | runtime/api-server/src/composio-minimal-example.ts | 356 | // Step 2: Wait for connected account to become ACTIVE | COMMENT |
| LOW | runtime/api-server/src/composio-minimal-example.ts | 369 | // Step 3: Make a proxy request to verify the token works | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 258 | // Step 1: Create connect link | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 278 | // Step 2: Open OAuth popup + poll status | COMMENT |
| LOW | runtime/api-server/src/composio-test-server.ts | 341 | // Step 3: Proxy request | COMMENT |
| LOW⚡ | …ges/app-builder-sdk/test/workspace-integration.test.ts | 66 | // Step 1: lifecycle.setup | COMMENT |
| LOW⚡ | …ges/app-builder-sdk/test/workspace-integration.test.ts | 74 | // Step 2: lifecycle.start | COMMENT |
| LOW | …ges/app-builder-sdk/test/workspace-integration.test.ts | 102 | // Step 3: verify /mcp/health | COMMENT |
| LOW⚡ | …ges/app-builder-sdk/test/workspace-integration.test.ts | 118 | // Step 4: verify Slack-specific tools registered (proves SDK derivedTools() | COMMENT |
| LOW⚡ | …ges/app-builder-sdk/test/workspace-integration.test.ts | 126 | // Step 5: clean shutdown | COMMENT |
| LOW | apps/desktop/src/components/publish/PublishScreen.tsx | 742 | // Step 1: About — name, description, category, tags, cover, screenshots | COMMENT |
| LOW | apps/desktop/src/components/publish/PublishScreen.tsx | 893 | // Step 2: Bundle — pick apps. The schematic illustration lives on the right. | COMMENT |
| LOW | apps/desktop/src/components/publish/PublishScreen.tsx | 1017 | // Step 3: Docs — README + onboarding (with prominent AI generate) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | docs/superpowers/plans/2026-06-16-geo-plugin.md | 1454 | GEO_PLUGIN_TEMPLATE_DEFINITION.payload.onboarding.fixed_structure.objects.map( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | runtime/channel-gateway/src/connectors/wechat.ts | 43 | // a downloadable file — robust across formats). | COMMENT |
| MEDIUM | packages/editor/src/extensions/BubbleToolbar.tsx | 82 | // Restoring this snapshot before applying makes the action robust. | COMMENT |
| MEDIUM | apps/desktop/electron/main.ts | 4041 | // name via app.getName()) makes this robust to the product name — including | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ntime/api-server/src/integration-proposal-gate.test.ts | 294 | accountLabel: "user@example.com", | CODE |
| LOW | …ntime/api-server/src/integration-proposal-gate.test.ts | 366 | accountLabel: "user@example.com", | CODE |
| LOW | …ntime/api-server/src/integration-proposal-gate.test.ts | 419 | accountLabel: "user@example.com", | CODE |
| LOW | runtime/api-server/src/runtime-agent-tools.test.ts | 3478 | accountLabel: "user@example.com", | CODE |
| LOW | runtime/api-server/src/desktop-browser-tools.ts | 1485 | "placeholder" in element ? String(element.placeholder || "") : "", | CODE |
| LOW | runtime/api-server/src/desktop-browser-tools.ts | 1491 | const placeholderText = (element) => "placeholder" in element ? String(element.placeholder || "") : ""; | CODE |
| LOW | runtime/api-server/src/desktop-browser-tools.ts | 2244 | "placeholder" in element ? String(element.placeholder || "") : "", | CODE |
| LOW | runtime/api-server/src/desktop-browser-tools.ts | 2410 | "placeholder" in element ? String(element.placeholder || "") : "", | CODE |
| LOW | …harnesses/src/embedded-skills/app-builder-sdk/SKILL.md | 295 | - **Hardcoded user identity in code** — usernames, email addresses, account ids, workspace names. These are mutable + pe | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ps/desktop/src/components/publish/LivePreviewPanel.tsx | 422 | // Tabs let the user switch. AI-generated content sometimes arrives wrapped in | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | runtime/api-server/src/workspace-attachment-memory.ts | 104 | print(recognized.joined(separator: "\n")) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …uilder-sdk/sdk-package/src/runtime/local-action-api.ts | 106 | async function handleRequest(request: Request): Promise<Response> { | CODE |
| LOW | runtime/state-store/src/cli.ts | 222 | export function handleRequest(operation: string, envelope: RequestEnvelope): JsonValue { | CODE |
| LOW | …ckages/app-builder-sdk/src/runtime/local-action-api.ts | 109 | async function handleRequest(request: Request): Promise<Response> { | CODE |
| LOW | apps/desktop/electron/browser-pane/http-service.ts | 397 | async function handleRequest( | CODE |
| LOW | apps/docs/app/entry.server.tsx | 9 | export default async function handleRequest( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/publish-macos-intel-desktop.yml | 195 | except Exception as exc: | CODE |
| LOW | .github/workflows/ci.yml | 390 | except Exception as exc: | CODE |