Codex2API 是一个基于 Go + Gin + React/Vite 的 Codex 反向代理与管理后台项目
This report summarizes scanner evidence for james-6-23/codex2api, a Go project with 2,329 GitHub stars. SynthScan examined 661,743 lines of code across 1668 source files, recording 436 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 0.9 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 302 finding(s).
Are imports declared and package/API names verified? 114 finding(s).
Are wrappers, guards, and repeated structures necessary? 204 finding(s).
Which changes need focused human review? 436 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 436 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | frontend/src/api.ts | 375 | async function requestImageStudioPortalBlob(path: string, apiKey: string, options: RequestInit = {}): Promise<Blob> { | CODE |
| LOW | frontend/src/api.ts | 397 | function parseContentDispositionFilename(header: string | null): string { | CODE |
| LOW | frontend/src/api.ts | 472 | function buildOpsErrorSearchParams(params: { | CODE |
| LOW | frontend/src/api.ts | 524 | export function buildUsageLogSearchParams(params: UsageLogQueryParams) { | CODE |
| LOW | frontend/src/types.ts | 3014 | export function parseAdvancedConfigDocument(raw: string): AdvancedConfigDocument { | CODE |
| LOW | frontend/src/types.ts | 3044 | export function patchAdvancedConfigDocument( | CODE |
| LOW | frontend/src/components/AccountStateOverlay.tsx | 227 | export function renderAccountStateOverlay( | CODE |
| LOW | frontend/src/components/AccountStateOverlay.tsx | 259 | export function renderDisabledAccountOverlay( | CODE |
| LOW | …tend/src/components/APIKeyModelRequestLimitsEditor.tsx | 8 | export default function APIKeyModelRequestLimitsEditor({ | CODE |
| LOW | frontend/src/components/RouteErrorBoundary.tsx | 25 | async function clearRuntimeCachesAndReload() { | CODE |
| LOW | frontend/src/components/RequestCountPills.tsx | 282 | function formatAverageFirstTokenMs(value: number): string { | CODE |
| LOW | frontend/src/components/APIKeyModelRequestUsage.tsx | 6 | export default function APIKeyModelRequestUsageCard({ | CODE |
| LOW | frontend/src/components/ClaudeConnectionTestModal.tsx | 17 | export default function ClaudeConnectionTestModal({ account, onClose, onSettled }: { | CODE |
| LOW | …ntend/src/components/AccountRateLimitRecoveryChart.tsx | 74 | export default function AccountRateLimitRecoveryChart({ analysis, className = '', compact = false }: AccountRateLimitRec | CODE |
| LOW | frontend/src/components/PromptFilterNewAPIBindings.tsx | 165 | export default function PromptFilterNewAPIBindings() { | CODE |
| LOW | frontend/src/components/AccountIntelligenceBar.tsx | 21 | export function AccountIntelligenceActions({ bar, accountID, accountName }: AccountIntelligenceProps) { | CODE |
| LOW | …ntend/src/components/AccountQuotaDistributionChart.tsx | 72 | export default function AccountQuotaDistributionChart({ | CODE |
| LOW | frontend/src/components/ChannelMonitorConfigDialog.tsx | 21 | export default function ChannelMonitorConfigDialog({ | CODE |
| LOW | …nd/src/components/AccountIntelligenceHistoryDialog.tsx | 20 | export default function AccountIntelligenceHistoryDialog({ accountID, accountName, onClose }: { | CODE |
| LOW | frontend/src/components/AccountGroupFilterSelect.tsx | 25 | export function isAccountGroupFilterEmpty( | CODE |
| LOW | frontend/src/components/AccountGroupFilterSelect.tsx | 33 | export function accountMatchesGroupFilter( | CODE |
| LOW | frontend/src/components/ui/sheet.tsx | 18 | function isInteractivePortalTarget(target: EventTarget | null) { | CODE |
| LOW | frontend/src/components/ui/dialog.tsx | 18 | function isInteractivePortalTarget(target: EventTarget | null) { | CODE |
| LOW | …src/components/image-studio/StudioCollectionChrome.tsx | 55 | export function StudioCollectionPagination({ page, pageSize, total, loading, onChange }: { page: number; pageSize: numbe | CODE |
| LOW | frontend/src/hooks/useShowFullUsageNumbers.ts | 10 | function fetchShowFullUsageNumbers(): Promise<boolean> { | CODE |
| LOW | frontend/src/lib/qualityTestSVG.ts | 124 | function installQualityTestSVGBridge(previewID: string, capture: (limit: number) => string, limit: number) { | CODE |
| LOW | frontend/src/lib/qualityTestSVG.ts | 153 | export function qualityTestSVGExportScript(previewID: string): string { | CODE |
| LOW | frontend/src/lib/claudeConnectionTest.ts | 42 | export function createClaudeTestEventParser(onEvent: (event: ClaudeTestEvent) => void) { | CODE |
| LOW | frontend/src/lib/accountListPreferences.ts | 96 | export function normalizeAccountAutoRefreshSeconds( | CODE |
| LOW | frontend/src/lib/accountListPreferences.ts | 105 | export function readAccountAutoRefreshSeconds( | CODE |
| LOW | frontend/src/lib/accountListPreferences.ts | 118 | export function writeAccountAutoRefreshSeconds( | CODE |
| LOW | frontend/src/lib/visibleChannels.ts | 31 | export function readCachedVisibleChannels(): UpstreamChannel[] { | CODE |
| LOW | frontend/src/lib/visibleChannels.ts | 41 | export function writeCachedVisibleChannels(channels: readonly UpstreamChannel[]) { | CODE |
| LOW | frontend/src/lib/usageFormat.ts | 4 | export function formatLongUsageWindowLabel(account: { | CODE |
| LOW | frontend/src/lib/usageFormat.ts | 116 | export function getAccountStatusBadgeStatus(account: AccountStatusSource): string { | CODE |
| LOW | frontend/src/lib/usageFormat.ts | 129 | export function isOfficialCostHiddenAccount(account: { | CODE |
| LOW | frontend/src/lib/usageFormat.ts | 197 | export function officialUsdFromDailyItems( | CODE |
| LOW | frontend/src/lib/usageFormat.ts | 236 | export function isWorkspaceCreditHardStop(account: { | CODE |
| LOW | frontend/src/lib/inviteAccountSelection.ts | 25 | export function mergeInviteRecipientIndex( | CODE |
| LOW⚡ | frontend/src/lib/inviteAccountSelection.ts | 60 | export function isInviteAccountSelectable(account: AccountRow): boolean { | CODE |
| LOW⚡ | frontend/src/lib/inviteAccountSelection.ts | 69 | export function isCodexInviteSenderCandidate(account: AccountRow): boolean { | CODE |
| LOW⚡ | frontend/src/lib/inviteAccountSelection.ts | 76 | export function inviteRecipientCandidates( | CODE |
| LOW | frontend/src/lib/responseCacheMetrics.ts | 32 | export function validateResponseCacheBudget( | CODE |
| LOW | frontend/src/lib/responseCacheMetrics.ts | 59 | export function buildResponseCacheBudgetPatch( | CODE |
| LOW | frontend/src/lib/responseCacheMetrics.ts | 73 | export function mergeResponseCacheGeneration( | CODE |
| LOW | frontend/src/lib/intelligenceCheck.ts | 40 | export function intelligenceTargetConflict(error: unknown): IntelligenceTargetConflict | null { | CODE |
| LOW | frontend/src/lib/accountListSort.ts | 15 | export function resolveDisabledAccountSorts( | CODE |
| LOW | frontend/src/lib/codexConnectionTest.ts | 87 | export function isFinalCodexTestDiagnostics(diagnostics?: CodexTestDiagnostics | null): boolean { | CODE |
| LOW | frontend/src/lib/promptFilterScore.ts | 3 | export function normalizePromptFilterScore(score: number): number { | CODE |
| LOW | frontend/src/lib/poolRunway.ts | 342 | export function pressureForecastFromAnalysis( | CODE |
| LOW | frontend/src/lib/poolRunway.ts | 366 | export function selectPoolRunwayFromAnalysis( | CODE |
| LOW | frontend/src/lib/poolRunway.ts | 510 | function estimateSupplyPressurePoint( | CODE |
| LOW | frontend/src/lib/requestErrorStatus.ts | 35 | export function buildErrorStatusBreakdown( | CODE |
| LOW | frontend/src/lib/workspaceRoute.ts | 3 | export function workspaceRouteFromHeaders( | CODE |
| LOW | frontend/src/lib/workspaceRoute.ts | 14 | export function applyWorkspaceRouteHeader( | CODE |
| LOW | frontend/src/lib/workspaceRoute.ts | 33 | export function applyOptionalWorkspaceRouteHeader( | CODE |
| LOW | frontend/src/lib/imageStudioModels.ts | 20 | export function normalizeImageQualityForModel(quality: string, model: string): string { | CODE |
| LOW | frontend/src/lib/apiKeyModelRequests.ts | 26 | export function modelRequestLimitsFromAPIKey(rules?: APIKeyModelRequestLimit[]): ModelRequestLimitFormState[] { | CODE |
| LOW | frontend/src/lib/apiKeyModelRequests.ts | 37 | export function modelRequestLimitsToPayload( | CODE |
| LOW | frontend/src/lib/accountProxyBinding.ts | 128 | export function isManagedProxyUnavailable( | CODE |
| 124 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | frontend/src/locales/zh.json | 6053 | "claudeCodeNote": "其中 YOUR_API_KEY 是你在 API 密钥页面中创建的 API Key。模型映射可在系统设置中配置。", | CODE |
| HIGH | frontend/src/locales/zh.json | 6494 | "curlDesc": "用以下命令验证端点是否可用,YOUR_API_KEY 会自动填充为第一个 API Key。", | CODE |
| HIGH | frontend/src/locales/en.json | 6054 | "claudeCodeNote": "Replace YOUR_API_KEY with the API Key created on the API Keys page. Model mapping can be configur | CODE |
| HIGH | frontend/src/locales/en.json | 6495 | "curlDesc": "Use these commands to verify your endpoints. YOUR_API_KEY auto-fills with your first API key.", | CODE |
| HIGH | frontend/src/pages/Guide.tsx | 157 | const key = activeKey || 'YOUR_API_KEY' | CODE |
| HIGH | frontend/src/pages/Guide.tsx | 297 | const keyForSnippet = activeKey || 'YOUR_API_KEY' | CODE |
| HIGH⚡ | frontend/src/pages/Docs.tsx | 836 | apiKeyExample: "YOUR_API_KEY", | CODE |
| HIGH⚡ | frontend/src/pages/Docs.tsx | 842 | content: codexAuthJson.split(activeKey).join("YOUR_API_KEY"), | CODE |
| HIGH⚡ | frontend/src/pages/Docs.tsx | 847 | content: claudeSettingsJson.split(activeKey).join("YOUR_API_KEY"), | CODE |
| HIGH | frontend/src/pages/Docs.tsx | 885 | const activeKey = selectedKey || firstKey || "YOUR_API_KEY"; | CODE |
| HIGH | frontend/src/pages/docs/docsContent.ts | 314 | -H 'Authorization: Bearer YOUR_API_KEY' \\ | CODE |
| HIGH | frontend/src/pages/docs/docsGuides.ts | 75 | "Authorization: Bearer YOUR_API_KEY", | CODE |
| HIGH | frontend/src/pages/docs/docsGuides.ts | 460 | content: `curl "${base}/v1/models" \\\n -H "Authorization: Bearer YOUR_API_KEY"`, | CODE |
| HIGH | frontend/src/pages/docs/endpointDetails.ts | 273 | `curl --request POST '${baseUrl}${path}' \\\n --header 'Authorization: Bearer YOUR_API_KEY' \\\n --header 'Content | CODE |
| HIGH | frontend/src/pages/docs/endpointDetails.ts | 275 | `curl '${baseUrl}${path}' \\\n --header 'Authorization: Bearer YOUR_API_KEY'`; | CODE |
| HIGH | frontend/src/pages/docs/endpointDetails.ts | 614 | curl: `# WebSocket URL: ${baseUrl.replace(/^http/, "ws")}/v1/responses\n# Header: Authorization: Bearer YOUR_API_K | CODE |
| HIGH | docs/API.md | 288 | `GET /api/image-studio/quota` 使用 `Authorization: Bearer YOUR_API_KEY` 查询当前 Key 的累计美元额度。只受生图门户开关控制,不依赖公开用量页开关,也不接受通过查询参数指 | CODE |
| HIGH | docs/API.md | 435 | --header 'Authorization: Bearer YOUR_API_KEY' | CODE |
| HIGH | docs/API.md | 2889 | 公开自助接口 `GET /api/key-usage/summary` 与别名 `GET /api/key-usage/me` 在原有 `key`、`range`、`usage` 之外增加相同结构的顶层 `model_request_usa | CODE |
| HIGH | docs/USAGE.md | 24 | | 普通 API | `Authorization: Bearer YOUR_API_KEY`;Messages 也接受 `x-api-key` | | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/claude_login/main.go | 1 | // 独立的 Claude Code OAuth 登录自测工具(非交互、两步式)。 | COMMENT |
| LOW | database/billing.go | 321 | // custom / synced 覆盖:以代码默认为底,合并非 0 字段(部分覆盖)。 | COMMENT |
| LOW | database/antigravity_quota_source.go | 1 | package database | COMMENT |
| LOW | database/postgres.go | 1861 | TokenLimit5h int64 `json:"token_limit_5h,omitempty"` | COMMENT |
| LOW | database/postgres.go | 1881 | AllowLive bool `json:"allow_live,omitempty"` | COMMENT |
| LOW | database/credential_crypto.go | 1 | package database | COMMENT |
| LOW | database/data_migrations.go | 121 | return nil | COMMENT |
| LOW | proxy/handler.go | 201 | COMMENT | |
| LOW | proxy/handler.go | 8981 | // persistUsageSnapshot=false keeps the in-memory/scheduler update but skips | COMMENT |
| LOW | proxy/usage_wham_daily.go | 21 | // 接入时只回 7 天)。稳态同步仍只滚动回补最近 WhamDailyUsageRetentionDays 天, | COMMENT |
| LOW | proxy/egress.go | 21 | // 优先级固定为 Resin > 代理 > 直连,且 Resin 是整层覆盖:一旦启用,Codex 渠道 | COMMENT |
| LOW | proxy/codex_fingerprint.go | 21 | // | COMMENT |
| LOW | proxy/codex_fingerprint.go | 61 | // deriveStableCodexUUID 从种子确定性派生一个 UUIDv4 格式的字符串:同一种子恒定返回 | COMMENT |
| LOW | proxy/codex_fingerprint.go | 121 | sum := sha256.Sum256([]byte("codex2api:codex-identity-ts:v1:" + seed)) | COMMENT |
| LOW | proxy/codex_fingerprint.go | 461 | } | COMMENT |
| LOW | proxy/codex_fingerprint.go | 521 | func convergeCodexLineageValue(accountID int64, key, original string) string { | COMMENT |
| LOW | proxy/utls_transport.go | 21 | COMMENT | |
| LOW | proxy/utls_transport.go | 41 | // 与标准 transport 的 IdleConnTimeout 对齐。到点由 h2 自身的空闲定时器 | COMMENT |
| LOW | proxy/stream_flush_writer.go | 41 | // Small buffers are reused across token events; an exceptional large event | COMMENT |
| LOW | proxy/runtime_config.go | 121 | OverflowAutoCompact bool | COMMENT |
| LOW | proxy/grok_upstream.go | 741 | } | COMMENT |
| LOW | proxy/antigravity_quota.go | 41 | // delay this long is really a quota window, not a burst limit. | COMMENT |
| LOW | proxy/upstream_drain.go | 1 | package proxy | COMMENT |
| LOW | proxy/handler_anthropic.go | 561 | // 验证 JSON | COMMENT |
| LOW | proxy/prompt_preupstream_lock_test.go | 21 | // 必须被会话锁拦下,而不是被放行到上游。 | COMMENT |
| LOW | proxy/overflow_compact.go | 21 | // 上游不接受 truncation/context_management 参数(实测 400 Unsupported parameter), | COMMENT |
| LOW | proxy/content_session_seed.go | 1 | package proxy | COMMENT |
| LOW | proxy/content_session_seed.go | 21 | // 只会让身份与载荷对同一段对话给出两种答案。 | COMMENT |
| LOW | proxy/antigravity_stream_errors.go | 21 | // | COMMENT |
| LOW | proxy/claude_upstream.go | 1 | package proxy | COMMENT |
| LOW | proxy/apikey_scope_budget.go | 1 | // Package proxy: API Key × 账号分组/账号 维度的用量预算(issue #439)。 | COMMENT |
| LOW | proxy/anthropic.go | 1861 | // server_tool_use(客户端据此展示「正在检索」)+ web_search_tool_result。 | COMMENT |
| LOW | proxy/grok_media.go | 21 | COMMENT | |
| LOW | proxy/images.go | 701 | } | COMMENT |
| LOW | proxy/images.go | 921 | "turn this image", | COMMENT |
| LOW | proxy/newapi_policy.go | 821 | COMMENT | |
| LOW | proxy/maintenance_client.go | 21 | // 修复:维护请求复用按 (用途 + 账号 + 代理 + transport 模式) 隔离的 Client。 | COMMENT |
| LOW | proxy/payload_rules.go | 21 | // 典型用途:覆盖/追加 instructions(系统提示词)、覆盖 service_tier、 | COMMENT |
| LOW | proxy/payload_rules.go | 41 | // "api_key_names": ["fast*"], // 下游 API Key 名称通配 | COMMENT |
| LOW | proxy/prompt_guard_test_evaluation.go | 21 | } | COMMENT |
| LOW | proxy/antigravity_json_mode.go | 61 | // answer (a generateContent body or one streamed data payload) into the answer | COMMENT |
| LOW | proxy/apikey_limits.go | 1 | // Package proxy: API Key 级别的细粒度限流与配额校验。 | COMMENT |
| LOW | proxy/codex_multi_agent_v2.go | 21 | // encrypted_content;第三方子模型无法读取。Codex 只在 function_call 带有 | COMMENT |
| LOW | proxy/codex_request_compression.go | 21 | // 请求体却 100% 明文」构成一个每请求都在、零噪声的区分特征:上游只要按 | COMMENT |
| LOW | proxy/codex_request_compression.go | 61 | if err != nil { | COMMENT |
| LOW | proxy/codex_session_headers.go | 41 | return codexSessionHeaderModeLegacy | COMMENT |
| LOW | proxy/codex_session_headers.go | 81 | // ApplyCodexSessionHeaders 写出站会话标识头。 | COMMENT |
| LOW | proxy/client_scaffolding.go | 1 | package proxy | COMMENT |
| LOW | proxy/client_scaffolding.go | 21 | // turns and would otherwise invalidate the cached prefix. It also stabilises the | COMMENT |
| LOW | proxy/executor.go | 21 | "github.com/codex2api/auth" | COMMENT |
| LOW | proxy/executor.go | 481 | COMMENT | |
| LOW | proxy/executor.go | 1461 | // 3. Header: Conversation_id | COMMENT |
| LOW | proxy/grok_protocol.go | 1901 | } | COMMENT |
| LOW | proxy/model_registry.go | 81 | modelInfoForID("gpt-5.6-sol", ModelSourceBuiltin), | COMMENT |
| LOW | proxy/continuity.go | 81 | return nil | COMMENT |
| LOW | proxy/codex_ws_transport_lane.go | 21 | // 前三种与用户 turn 是同一条连接或同一段顺序动作,必须同道;未声明的视同 turn。 | COMMENT |
| LOW | proxy/antigravity_ws_selection_test.go | 1 | package proxy | COMMENT |
| LOW | proxy/apikey_scope_concurrency.go | 1 | // Package proxy: 「该 Key × 某分组/账号」的并发上限(issue #439 v2)。 | COMMENT |
| LOW | proxy/codex_alpha_search.go | 21 | // Codex CLI 开启 web_search = "live"(或 --search)后会调用 | COMMENT |
| LOW | proxy/wsrelay/busy_policy.go | 1 | package wsrelay | COMMENT |
| 42 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | database/sqlite_test.go | 350 | "email": "user@example.com", | CODE |
| LOW | database/sqlite_test.go | 356 | got, err = db.FindActiveAccountByOAuthIdentity(ctx, "user@example.com", "workspace-identity", id) | CODE |
| LOW | database/sqlite_test.go | 370 | if _, err := db.FindActiveAccountByOAuthIdentity(ctx, "user@example.com", "workspace-identity"); err == nil { | CODE |
| LOW | database/sqlite_test.go | 389 | "email": "user@example.com", | CODE |
| LOW | database/sqlite_test.go | 397 | "email": "user@example.com", | CODE |
| LOW | database/sqlite_test.go | 415 | got, err = db.FindActiveAccountByOAuthRouteIdentity(ctx, "user@example.com", "team-workspace") | CODE |
| LOW | database/sqlite_test.go | 423 | if _, err := db.FindActiveAccountByOAuthRouteIdentity(ctx, "user@example.com", "other-workspace"); err != sql.ErrNoRows | CODE |
| LOW | database/sqlite_test.go | 565 | "email": "user@example.com", | CODE |
| LOW | database/sqlite_test.go | 585 | "email": "user@example.com", | CODE |
| LOW | database/sqlite_test.go | 610 | "email": "user@example.com", | CODE |
| LOW | database/sqlite_test.go | 689 | "email": "user@example.com", | CODE |
| LOW | database/workspace_identity_test.go | 40 | "id_token": workspaceIdentityJWT(t, "user@example.com", "workspace-1"), | CODE |
| LOW | database/workspace_identity_test.go | 47 | "email": "user@example.com", | CODE |
| LOW | database/workspace_identity_test.go | 87 | "email": "user@example.com", | CODE |
| LOW | database/credential_crypto_test.go | 19 | "email": "user@example.com", | CODE |
| LOW | database/credential_crypto_test.go | 30 | if enc["email"] != "user@example.com" || enc["upstream_type"] != "claude" { | CODE |
| LOW | proxy/newapi_policy_test.go | 919 | if !normalizeVerifiedNewAPIPolicyMeta(&meta) || meta.UserName != "示例平台用户" || meta.UserEmail != "user@example.com" || me | CODE |
| LOW | frontend/src/locales/zh.json | 852 | "placeholder": "输入管理密钥…", | CODE |
| LOW | frontend/src/locales/zh.json | 6446 | "placeholder": "点击发送请求开始调试", | CODE |
| LOW | frontend/src/locales/en.json | 852 | "placeholder": "Enter admin secret…", | CODE |
| LOW | frontend/src/locales/en.json | 6447 | "placeholder": "Click Send to make a request", | CODE |
| LOW | frontend/src/pages/ApiReference.tsx | 1226 | "email": "user@example.com", | CODE |
| LOW | frontend/src/pages/ApiReference.tsx | 1274 | "email": "user@example.com", | CODE |
| LOW | frontend/src/pages/ApiReference.tsx | 1356 | "email": "user@example.com" | CODE |
| LOW | frontend/src/pages/ApiReference.tsx | 1396 | "email": "user@example.com" | CODE |
| LOW | frontend/src/pages/ApiReference.tsx | 1417 | "email": "user@example.com", | CODE |
| LOW | frontend/src/pages/ApiReference.tsx | 1441 | "email": "user@example.com" | CODE |
| LOW | frontend/src/pages/ApiReference.tsx | 1509 | "email": "user@example.com", | CODE |
| LOW | frontend/src/pages/docs/docsContent.ts | 592 | "email": "user@example.com", | CODE |
| LOW | security/validator_test.go | 126 | {"user@example.com", "us****@example.com"}, | CODE |
| LOW | security/promptfilter/match_context_test.go | 85 | "sk-live123456", "hunter2", "sk-testabcdef", "admin@example.com", | CODE |
| LOW | auth/antigravity_client_test.go | 314 | _, _ = io.WriteString(w, `{"id":"google-subject","email":"user@example.com","verified_email":true,"name":"User Name", | CODE |
| LOW | auth/antigravity_client_test.go | 360 | if result.Profile.ID != "google-subject" || result.Profile.Email != "user@example.com" { | CODE |
| LOW | auth/antigravity_client_test.go | 514 | _, _ = io.WriteString(w, `{"id":"subject","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_client_test.go | 537 | if result.Credential.AccessToken != "access-new" || result.Credential.RefreshToken != "refresh-rotated" || result.Profi | CODE |
| LOW | auth/antigravity_client_test.go | 550 | _, _ = io.WriteString(w, `{"id":"subject","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_client_test.go | 596 | _, _ = io.WriteString(w, `{"id":"subject","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_client_test.go | 635 | _, _ = io.WriteString(w, `{"id":"subject","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_client_test.go | 780 | _, _ = io.WriteString(w, `{"id":"google-subject","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_refresh_safety_test.go | 52 | "email": "user@example.com", "verified_email": true, | CODE |
| LOW | auth/antigravity_refresh_safety_test.go | 88 | _, _ = io.WriteString(w, `{"id":"subject-1","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_refresh_safety_test.go | 149 | _, _ = io.WriteString(w, `{"id":"subject-1","email":"user@example.com","verified_email":true,"name":"User"}`) | CODE |
| LOW | auth/antigravity_refresh_safety_test.go | 226 | _, _ = io.WriteString(w, `{"id":"subject-1","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_refresh_safety_test.go | 276 | _, _ = io.WriteString(w, `{"id":"subject-1","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_refresh_safety_test.go | 331 | _, _ = io.WriteString(w, `{"id":"subject-1","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_refresh_safety_test.go | 551 | _, _ = io.WriteString(w, `{"id":"subject-1","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/antigravity_refresh_safety_test.go | 622 | _, _ = io.WriteString(w, `{"id":"subject-1","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/token_parse_test.go | 24 | "email": "user@example.com", | CODE |
| LOW⚡ | auth/token_parse_test.go | 35 | if info.Email != "user@example.com" { | CODE |
| LOW⚡ | auth/token_parse_test.go | 36 | t.Fatalf("Email = %q, want %q", info.Email, "user@example.com") | CODE |
| LOW⚡ | auth/token_parse_test.go | 42 | "email": "user@example.com", | CODE |
| LOW | auth/antigravity_quota_summary_test.go | 381 | _, _ = io.WriteString(w, `{"id":"subject-1","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | auth/workspace_route_refresh_test.go | 37 | "email": "user@example.com", | CODE |
| LOW | auth/workspace_route_refresh_test.go | 47 | "email": "user@example.com", | CODE |
| LOW | auth/workspace_route_refresh_test.go | 73 | source.Email = "user@example.com" | CODE |
| LOW | auth/workspace_route_refresh_test.go | 87 | "email": "user@example.com", | CODE |
| LOW | auth/antigravity_store_admin_sync_test.go | 54 | _, _ = io.WriteString(w, `{"id":"subject-1","email":"user@example.com","verified_email":true}`) | CODE |
| LOW | admin/antigravity_account_list_test.go | 52 | "refresh_token": "rt-tight", "email": "tight@example.org", "antigravity_quota": antigravityQuotaJSON(t, 0.2), | CODE |
| LOW | admin/antigravity_account_list_test.go | 55 | "refresh_token": "rt-loose", "email": "loose@example.org", "antigravity_quota": antigravityQuotaJSON(t, 0.9), | CODE |
| LOW | admin/token_credentials_test.go | 77 | "email": "user@example.com", | CODE |
| 33 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | deploy.sh | 2 | # ============================================================ | COMMENT |
| MEDIUM | deploy.sh | 5 | # ============================================================ | COMMENT |
| MEDIUM | deploy.sh | 474 | # ============================ | COMMENT |
| MEDIUM | deploy.sh | 477 | # ============================ | COMMENT |
| MEDIUM | deploy.sh | 500 | # ============================ | COMMENT |
| MEDIUM | deploy.sh | 503 | # ============================ | COMMENT |
| MEDIUM | proxy/claude_upstream.go | 1116 | // ── Claude 统一限流头 → 账号用量快照 ───────────────────────────────────────── | COMMENT |
| MEDIUM | frontend/src/pages/ClaudeAccounts.tsx | 1168 | // ── 账号操作 ────────────────────────────────────────────── | COMMENT |
| MEDIUM | frontend/src/pages/ClaudeAccounts.tsx | 1267 | // ── 批量操作 ────────────────────────────────────────────── | COMMENT |
| MEDIUM | frontend/src/pages/ClaudeAccounts.tsx | 1366 | // ── 派生 UI 数据 ────────────────────────────────────────── | COMMENT |
| MEDIUM | frontend/src/pages/ClaudeAccounts.tsx | 2866 | // ── 账号分组指派弹窗 ────────────────────────────────────── | COMMENT |
| MEDIUM | frontend/src/pages/ClaudeAccounts.tsx | 2954 | // ── 账号编辑弹窗:仅 Claude 账号真实可调的字段 ───────────── | COMMENT |
| MEDIUM | frontend/src/pages/ClaudeAccounts.tsx | 3485 | // ── 添加账号弹窗:网页授权(OAuth / Setup Token) / 粘贴 Setup Token / sessionKey 登录 / 导入凭据 JSON ────── | COMMENT |
| MEDIUM | docs/CONFIGURATION.md | 511 | # ============================================================ | COMMENT |
| MEDIUM | docs/CONFIGURATION.md | 513 | # ============================================================ | COMMENT |
| MEDIUM | docs/CONFIGURATION.md | 545 | # ============================================================ | COMMENT |
| MEDIUM | docs/CONFIGURATION.md | 547 | # ============================================================ | COMMENT |
| MEDIUM | docs/CONFIGURATION.md | 568 | # ============================================================ | COMMENT |
| MEDIUM | docs/CONFIGURATION.md | 570 | # ============================================================ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | CHANGELOG.md | 401 | - **Ultra mode is recorded and filterable in usage logs (#669, reported by @yy1105384898).** Codex clients that select a | CODE |
| MEDIUM | CHANGELOG.md | 497 | - **Antigravity catalog refresh, Gemini 3.8 Flash and folded reasoning tiers (#646, @dundunge).** Gemini 3.8 Flash is ro | CODE |
| MEDIUM | CHANGELOG.md | 1094 | - **Context-window overflow auto-compaction (#415).** When an upstream turn overflows the model's context window, the ga | CODE |
| MEDIUM | CHANGELOG.md | 1211 | - **Continue-thinking no longer inflates the context window until it overflows (#353).** The continue-thinking fold stac | CODE |
| MEDIUM | CHANGELOG.md | 1226 | - **Reserved `collaboration.*` tools pass through untouched — gpt-5.6 multi-agent no longer 400s (#342).** GPT-5.6 multi | CODE |
| MEDIUM | CHANGELOG.md | 1238 | - **`agent_message` input items no longer 400 (#341).** Newer Codex CLI / Desktop (multi-agent v2) replay `agent_message | CODE |
| MEDIUM | proxy/translator_test.go | 4061 | // issue #342: gpt-5.6 multi-agent 保留工具 collaboration.* 必须原样透传, | COMMENT |
| MEDIUM | docs/CODEX_MULTI_AGENT_V2_COMPAT.md | 222 | - [PR #26210](https://github.com/openai/codex/pull/26210):Encrypt multi-agent v2 message payloads | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | README.md | 413 | # Step 1: Generate an authorization URL | COMMENT |
| LOW⚡ | README.md | 419 | # Step 2: Open the returned auth_url in a browser, complete authorization | COMMENT |
| LOW⚡ | README.md | 420 | # Step 3: Exchange the authorization code for a token (auto-creates account) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | CHANGELOG.md | 805 | - **Local prompt-guard blocks now kill risky prompts before they reach upstream, with strike accrual and an operator-con | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | api/middleware.go | 355 | // For a more robust solution, use http.TimeoutHandler at the server level. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/repro-codex-multi-agent-v2.py | 73 | CODE | |
| LOW | scripts/repro-codex-multi-agent-v2.py | 80 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/build-release.sh | 7 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/repro-codex-multi-agent-v2.py | 86 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/repro-codex-multi-agent-v2.py | 27 | CODE |