Switch between Claude accounts, Gemini, Copilot, OpenRouter (300+ models) via CLIProxyAPI OAuth proxy. Visual dashboard, remote proxy support, WebSearch fallback. Zero-config to production-ready.
This report summarizes scanner evidence for kaitranntt/ccs, a TypeScript project with 2,886 GitHub stars. SynthScan examined 446,203 lines of code across 1966 source files, recording 1733 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 5.7 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1262 finding(s).
Are imports declared and package/API names verified? 159 finding(s).
Are wrappers, guards, and repeated structures necessary? 1465 finding(s).
Which changes need focused human review? 1733 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1733 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/vite.config.ts | 17 | function rewriteTrustedViteDevOrigin(proxyRequest: ClientRequest, request: IncomingMessage): void { | CODE |
| LOW | ui/tests/unit/components/ui/searchable-select.test.tsx | 45 | function SearchableSelectWithCreateHarness() { | CODE |
| LOW | ui/src/components/shared/code-editor.tsx | 305 | function buildSensitiveDecorations( | CODE |
| LOW | ui/src/components/shared/quota-tooltip-content.tsx | 61 | function getClaudeWindowDisplayLabel( | CODE |
| LOW | ui/src/components/shared/quota-tooltip-content.tsx | 124 | function formatGeminiRemainingAmount( | CODE |
| LOW | ui/src/components/cliproxy/cliproxy-edit-dialog.tsx | 80 | function isDeniedAgyModelForProvider(provider: string, modelId: string | undefined): boolean { | CODE |
| LOW | ui/src/components/cliproxy/cliproxy-edit-dialog.tsx | 84 | function isSingleVariantOnlyTargetChange(variant: Variant, data: SingleProviderFormData): boolean { | CODE |
| LOW | ui/src/components/cliproxy/cliproxy-edit-dialog.tsx | 107 | function isCompositeVariantOnlyTargetChange(variant: Variant, data: CompositeFormData): boolean { | CODE |
| LOW | …src/components/cliproxy/categorized-model-selector.tsx | 124 | export function CategorizedModelSelectorCompact({ | CODE |
| LOW⚡ | ui/src/components/cliproxy/control-panel-embed.tsx | 42 | function seedLocalControlPanelSession(apiBase: string, managementKey: string): void { | CODE |
| LOW⚡ | ui/src/components/cliproxy/control-panel-embed.tsx | 52 | function clearLocalControlPanelSession(): void { | CODE |
| LOW⚡ | ui/src/components/cliproxy/control-panel-embed.tsx | 60 | function clearPersistedLocalControlPanelSecret(): void { | CODE |
| LOW | ui/src/components/cliproxy/cliproxy-dialog.tsx | 83 | function isDeniedAgyModelForProvider(provider: string, modelId: string | undefined): boolean { | CODE |
| LOW | …ts/cliproxy/provider-editor/provider-editor-header.tsx | 28 | function formatSettingsPathBadgeLabel(pathValue: string): string { | CODE |
| LOW | …components/profiles/alibaba-coding-plan-promo-card.tsx | 14 | export function AlibabaCodingPlanPromoCard({ onCreateClick }: AlibabaCodingPlanPromoCardProps) { | CODE |
| LOW | …ents/profiles/editor/image-analysis-status-section.tsx | 156 | export function ImageAnalysisStatusSection({ | CODE |
| LOW | …nents/account/antigravity-responsibility-checklist.tsx | 19 | export function AntigravityResponsibilityChecklist({ | CODE |
| LOW | …onents/account/antigravity-responsibility-constants.ts | 19 | export function isAntigravityRiskChecklistComplete(value: AntigravityRiskChecklistValue): boolean { | CODE |
| LOW | …nents/account/edit-account-shared-resources-dialog.tsx | 30 | export function EditAccountSharedResourcesDialog({ | CODE |
| LOW | …src/components/account/shared/account-surface-card.tsx | 66 | function getCompactAudienceBadgeLabel(audience: AccountAudience, t: (key: string) => string) { | CODE |
| LOW | …src/components/account/shared/account-surface-card.tsx | 73 | function getCompactDetailBadgeClass(audience: AccountAudience) { | CODE |
| LOW | ui/src/components/account/flow-viz/account-card.tsx | 180 | function getVariantCompactDetailLabel( | CODE |
| LOW | ui/src/components/account/flow-viz/account-card.tsx | 245 | function getGroupedVariantSummaryLabel( | CODE |
| LOW | ui/src/components/monitoring/proxy-status-widget.tsx | 91 | function persistCollapsedPreference(collapsed: boolean): void { | CODE |
| LOW | …/compatible-cli/droid-byok-reasoning-controls-card.tsx | 36 | export function DroidByokReasoningControlsCard({ | CODE |
| LOW | …/compatible-cli/droid-settings-quick-controls-card.tsx | 119 | export function DroidSettingsQuickControlsCard({ | CODE |
| LOW | …nents/compatible-cli/codex-top-level-controls-card.tsx | 545 | export function CodexTopLevelControlsCard({ | CODE |
| LOW | ui/src/hooks/use-profiles.ts | 74 | export function useDiscoverProfileOrphans() { | CODE |
| LOW | ui/src/hooks/use-profiles.ts | 80 | export function useRegisterProfileOrphans() { | CODE |
| LOW | ui/src/hooks/use-droid.ts | 88 | function parseDroidRawSettingsText(rawText: string): { | CODE |
| LOW | ui/src/hooks/use-openrouter-models.ts | 59 | export function useRefreshOpenRouterModels() { | CODE |
| LOW | ui/src/hooks/use-cliproxy-stats.ts | 176 | async function fetchCliproxyErrorLogContent(name: string): Promise<string> { | CODE |
| LOW | ui/src/hooks/use-cliproxy-stats.ts | 201 | export function useCliproxyErrorLogContent(name: string | null) { | CODE |
| LOW | ui/src/hooks/use-cliproxy-stats.ts | 337 | function getAccountQuotaQueryOptions(provider: string, accountId: string, enabled = true) { | CODE |
| LOW | ui/src/hooks/use-cliproxy-auth-flow.ts | 55 | function invalidateCliproxyRoutingData(queryClient: ReturnType<typeof useQueryClient>): void { | CODE |
| LOW | ui/src/hooks/use-shared.ts | 63 | function isSharedItemContentPayload(payload: unknown): payload is SharedItemContentPayload { | CODE |
| LOW | ui/src/hooks/use-accounts.ts | 156 | export function useConfirmLegacyAccountPolicies() { | CODE |
| LOW | ui/src/hooks/use-accounts.ts | 211 | export function useUpdateAccountSharedResources() { | CODE |
| LOW | ui/src/hooks/use-cliproxy.ts | 21 | function invalidateCliproxyRoutingQueries(queryClient: ReturnType<typeof useQueryClient>): void { | CODE |
| LOW | ui/src/hooks/use-cliproxy.ts | 27 | function invalidateCliproxyAccountQueries(queryClient: ReturnType<typeof useQueryClient>): void { | CODE |
| LOW | ui/src/hooks/use-cliproxy.ts | 56 | export function useCliproxyRoutingStrategy() { | CODE |
| LOW | ui/src/hooks/use-cliproxy.ts | 63 | export function useUpdateCliproxyRoutingStrategy() { | CODE |
| LOW | ui/src/hooks/use-cliproxy.ts | 81 | export function useCliproxySessionAffinity() { | CODE |
| LOW | ui/src/hooks/use-cliproxy.ts | 88 | export function useUpdateCliproxySessionAffinity() { | CODE |
| LOW | ui/src/hooks/use-cliproxy.ts | 118 | export function useUpdateCliproxyRetryConfig() { | CODE |
| LOW | ui/src/hooks/use-claude-extension.ts | 102 | export function useClaudeExtensionOptions() { | CODE |
| LOW | ui/src/hooks/use-claude-extension.ts | 123 | export function useClaudeExtensionBindings() { | CODE |
| LOW | ui/src/hooks/use-claude-extension.ts | 131 | export function useClaudeExtensionBindingStatus(bindingId?: string) { | CODE |
| LOW | ui/src/hooks/use-claude-extension.ts | 142 | export function useCreateClaudeExtensionBinding() { | CODE |
| LOW | ui/src/hooks/use-claude-extension.ts | 160 | export function useUpdateClaudeExtensionBinding() { | CODE |
| LOW | ui/src/hooks/use-claude-extension.ts | 184 | export function useDeleteClaudeExtensionBinding() { | CODE |
| LOW | ui/src/hooks/use-claude-extension.ts | 201 | function useClaudeExtensionActionMutation(action: 'apply' | 'reset', successMessage: string) { | CODE |
| LOW | ui/src/hooks/use-claude-extension.ts | 222 | export function useApplyClaudeExtensionBinding() { | CODE |
| LOW | ui/src/hooks/use-claude-extension.ts | 227 | export function useResetClaudeExtensionBinding() { | CODE |
| LOW | ui/src/hooks/use-cliproxy-ai-providers.ts | 18 | export function useCreateCliproxyAiProviderEntry() { | CODE |
| LOW | ui/src/hooks/use-cliproxy-ai-providers.ts | 40 | export function useUpdateCliproxyAiProviderEntry() { | CODE |
| LOW | ui/src/hooks/use-cliproxy-ai-providers.ts | 64 | export function useDeleteCliproxyAiProviderEntry() { | CODE |
| LOW | ui/src/lib/support-updates-catalog.ts | 419 | export function getSupportEntriesForNotice(notice: SupportNotice): CliSupportEntry[] { | CODE |
| LOW | ui/src/lib/account-continuity.ts | 36 | export function summarizeAuthAccountContinuity(accounts: Account[]): AuthAccountContinuitySummary { | CODE |
| LOW | ui/src/lib/cliproxy-version-risk.ts | 39 | export function isCliproxyVersionExperimental(version: string, maxStableVersion: string): boolean { | CODE |
| 1093 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …components/compatible-cli/codex-auth-profiles-card.tsx | 30 | // ── Helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …components/compatible-cli/codex-auth-profiles-card.tsx | 69 | // ── Disabled action button with terminal-redirect tooltip ─────────────────── | COMMENT |
| MEDIUM | …components/compatible-cli/codex-auth-profiles-card.tsx | 94 | // ── Profile table row ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …components/compatible-cli/codex-auth-profiles-card.tsx | 143 | // ── Main card ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …components/compatible-cli/codex-auth-profiles-card.tsx | 216 | // ── Active profile highlight banner ───────────────────────────────────────── | COMMENT |
| MEDIUM | …components/compatible-cli/codex-auth-profiles-card.tsx | 256 | // ── Profile table ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/bin/codex-runtime-router.test.ts | 99 | // ── Auth routing ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/bin/codex-runtime-router.test.ts | 135 | // ── Non-auth profile resolution ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/shell-detect.test.ts | 5 | // ── detectShell ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/shell-detect.test.ts | 74 | // ── formatExport ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/show-command.test.ts | 65 | // ── empty list ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/show-command.test.ts | 77 | // ── list with default marker ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/show-command.test.ts | 91 | // ── JSON account metadata ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/show-command.test.ts | 133 | // ── active(missing) row at top (D14) ───────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/show-command.test.ts | 152 | // ── detail view ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/remove-command.test.ts | 57 | // ── non-default removes cleanly ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/remove-command.test.ts | 82 | // ── default with others → refuses without --force ──────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/remove-command.test.ts | 173 | // ── only profile → allows removal ──────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/remove-command.test.ts | 189 | // ── confirmation prompt ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …nit/codex-auth/commands/import-default-command.test.ts | 158 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/use-command.test.ts | 78 | // ── stdout discipline (CRITICAL) ────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/use-command.test.ts | 129 | // ── shell syntax variants ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/unit/codex-auth/commands/use-command.test.ts | 218 | // ── missing profile → stderr only ──────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 34 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 37 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 78 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 80 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/docker/image-size-logic.test.sh | 124 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/docker/image-size-logic.test.sh | 126 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/docker/image-size-logic.test.sh | 130 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 257 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 263 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 310 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 315 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 373 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/image-size-logic.test.sh | 375 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | tests/docker/network-contract.sh | 25 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/docker/network-contract.sh | 27 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/network-contract.sh | 52 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/network-contract.sh | 54 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/network-contract.sh | 62 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/network-contract.sh | 64 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/network-contract.sh | 89 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/network-contract.sh | 91 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/network-contract.sh | 96 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/network-contract.sh | 98 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/docker/network-contract.sh | 117 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/docker/network-contract.sh | 119 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 64 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 66 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 75 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 77 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 86 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 96 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 100 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 102 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 166 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 168 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 176 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/docker/compose-parity.sh | 178 | # --------------------------------------------------------------------------- | COMMENT |
| 252 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …omponents/account/shared/account-surface-card.test.tsx | 48 | accountId="user@example.com" | CODE |
| LOW⚡ | …omponents/account/shared/account-surface-card.test.tsx | 49 | email="user@example.com" | CODE |
| LOW⚡ | …omponents/account/shared/account-surface-card.test.tsx | 50 | displayEmail="user@example.com" | CODE |
| LOW | …omponents/account/shared/account-surface-card.test.tsx | 66 | email="user@example.com" | CODE |
| LOW | …omponents/account/shared/account-surface-card.test.tsx | 67 | displayEmail="user@example.com" | CODE |
| LOW | …omponents/account/shared/account-surface-card.test.tsx | 84 | email="user@example.com" | CODE |
| LOW | …omponents/account/shared/account-surface-card.test.tsx | 85 | displayEmail="user@example.com" | CODE |
| LOW⚡ | …omponents/account/shared/account-surface-card.test.tsx | 102 | accountId="user@example.com" | CODE |
| LOW⚡ | …omponents/account/shared/account-surface-card.test.tsx | 103 | email="user@example.com" | CODE |
| LOW⚡ | …omponents/account/shared/account-surface-card.test.tsx | 104 | displayEmail="user@example.com" | CODE |
| LOW⚡ | …omponents/account/shared/account-surface-card.test.tsx | 119 | accountId="user@example.com" | CODE |
| LOW⚡ | …omponents/account/shared/account-surface-card.test.tsx | 120 | email="user@example.com" | CODE |
| LOW⚡ | …omponents/account/shared/account-surface-card.test.tsx | 121 | displayEmail="user@example.com" | CODE |
| LOW | …omponents/account/shared/account-surface-card.test.tsx | 137 | email="user@example.com" | CODE |
| LOW | …omponents/account/shared/account-surface-card.test.tsx | 138 | displayEmail="user@example.com" | CODE |
| LOW⚡ | ui/tests/unit/ui/lib/account-identity.test.ts | 79 | const presentation = getAccountIdentityPresentation('user@example.com', 'user@example.com'); | CODE |
| LOW⚡ | ui/tests/unit/ui/lib/account-identity.test.ts | 84 | expect(formatAccountDisplayName('user@example.com', 'user@example.com')).toBe( | CODE |
| LOW⚡ | ui/tests/unit/ui/lib/account-identity.test.ts | 85 | 'user@example.com' | CODE |
| LOW | …unit/components/account/flow-viz/account-card.test.tsx | 67 | email: 'user@example.com', | CODE |
| LOW | …unit/components/account/flow-viz/account-card.test.tsx | 76 | email: 'user@example.com', | CODE |
| LOW | …unit/components/account/flow-viz/account-card.test.tsx | 89 | email: 'user@example.com', | CODE |
| LOW | …src/components/cliproxy/categorized-model-selector.tsx | 130 | }: Omit<CategorizedModelSelectorProps, 'placeholder' | 'className'>) { | CODE |
| LOW | tests/unit/targets/droid-config-manager.test.ts | 40 | apiKey: 'dummy-key', | CODE |
| LOW | tests/unit/targets/droid-config-manager.test.ts | 59 | apiKey: 'dummy-key', | CODE |
| LOW | tests/unit/targets/droid-config-manager.test.ts | 282 | apiKey: 'dummy-key', | CODE |
| LOW | tests/unit/targets/droid-config-manager.test.ts | 334 | apiKey: 'dummy-key', | CODE |
| LOW | tests/unit/targets/target-registry.test.ts | 233 | apiKey: 'dummy-key', | CODE |
| LOW | tests/unit/targets/target-registry.test.ts | 255 | apiKey: 'dummy-key', | CODE |
| LOW | tests/unit/targets/target-registry.test.ts | 281 | apiKey: 'dummy-key', | CODE |
| LOW⚡ | tests/unit/cursor/cursor-auth.test.ts | 93 | // JWT: {"email":"user@example.com","sub":"12345","exp":1234567890} | COMMENT |
| LOW⚡ | tests/unit/cursor/cursor-auth.test.ts | 95 | JSON.stringify({ email: 'user@example.com', sub: '12345', exp: 1234567890 }) | CODE |
| LOW⚡ | tests/unit/cursor/cursor-auth.test.ts | 101 | email: 'user@example.com', | CODE |
| LOW⚡ | tests/unit/cursor/cursor-auth.test.ts | 135 | // JWT: {"email":"user@example.com","user_id":"67890"} | COMMENT |
| LOW⚡ | tests/unit/cursor/cursor-auth.test.ts | 137 | JSON.stringify({ email: 'user@example.com', user_id: '67890' }) | CODE |
| LOW⚡ | tests/unit/cursor/cursor-auth.test.ts | 143 | email: 'user@example.com', | CODE |
| LOW | tests/unit/codex-auth/decode-id-token.test.ts | 11 | // Payload (base64url): {"email":"user@example.com","https://api.openai.com/auth":{"chatgpt_plan_type":"pro","chatgpt_ac | COMMENT |
| LOW | tests/unit/codex-auth/decode-id-token.test.ts | 13 | email: 'user@example.com', | CODE |
| LOW⚡ | tests/unit/codex-auth/decode-id-token.test.ts | 37 | email: 'user@example.com', | CODE |
| LOW⚡ | tests/unit/codex-auth/decode-id-token.test.ts | 45 | email: 'user@example.com', | CODE |
| LOW⚡ | tests/unit/codex-auth/decode-id-token.test.ts | 53 | email: 'user@example.com', | CODE |
| LOW | tests/unit/codex-auth/decode-id-token.test.ts | 72 | expect(result.email).toBe('user@example.com'); | CODE |
| LOW⚡ | tests/unit/codex-auth/decode-id-token.test.ts | 103 | expect(result.email).toBe('user@example.com'); | CODE |
| LOW⚡ | tests/unit/codex-auth/decode-id-token.test.ts | 110 | expect(result.email).toBe('user@example.com'); | CODE |
| LOW⚡ | tests/unit/codex-auth/decode-id-token.test.ts | 117 | expect(result.email).toBe('user@example.com'); | CODE |
| LOW | tests/unit/web-server/bar-routes.test.ts | 383 | mockAccounts = [makeAccountInfo({ id: 'user@example.com', provider: 'agy' })]; | CODE |
| LOW | tests/unit/web-server/bar-routes.test.ts | 563 | // but the cost map key is the canonical email "user@example.com" | COMMENT |
| LOW | …sts/unit/web-server/cliproxy-usage-transformer.test.ts | 188 | source: 'user@example.com', | CODE |
| LOW | src/web-server/health/config-checks.ts | 129 | if (validation.error?.includes('placeholder')) { | CODE |
| LOW | src/management/checks/config-check.ts | 167 | } else if (validation.error && validation.error.includes('placeholder')) { | CODE |
| LOW | src/cliproxy/auth/__tests__/auth-utils.test.ts | 13 | const result = sanitizeEmail('user@example.com'); | CODE |
| LOW | src/cliproxy/auth/__tests__/auth-utils.test.ts | 19 | const result = sanitizeEmail('user@example.com'); | CODE |
| LOW | …/accounts/__tests__/account-registry-integrity.test.ts | 128 | JSON.stringify({ type: 'codex', email: 'user@example.com' }), | CODE |
| LOW | …/accounts/__tests__/account-registry-integrity.test.ts | 139 | expect(accounts[0]?.id).toBe('user@example.com'); | CODE |
| LOW | …/accounts/__tests__/account-registry-integrity.test.ts | 141 | expect(registry.providers.codex?.accounts['user@example.com']?.tokenFile).toBe( | CODE |
| LOW⚡ | …/accounts/__tests__/account-registry-integrity.test.ts | 310 | expect(Object.keys(providerAccounts?.accounts ?? {})).toEqual(['user@example.com']); | CODE |
| LOW⚡ | …/accounts/__tests__/account-registry-integrity.test.ts | 311 | expect(providerAccounts?.accounts['user@example.com']?.email).toBe('user@example.com'); | CODE |
| LOW⚡ | …/accounts/__tests__/account-registry-integrity.test.ts | 312 | expect(providerAccounts?.accounts['user@example.com']?.tokenFile).toBe(testCase.tokenFile); | CODE |
| LOW | …/accounts/__tests__/account-registry-integrity.test.ts | 324 | JSON.stringify({ type: 'codex', email: 'user@example.com' }), | CODE |
| LOW | src/cliproxy/accounts/__tests__/account-safety.test.ts | 122 | expect(maskEmail('user@example.com')).toBe('use***@example.com'); | CODE |
| LOW⚡ | src/cliproxy/accounts/__tests__/account-safety.test.ts | 608 | default: 'user@example.com', | CODE |
| 96 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/src/components/config-layout/config-layout.tsx | 81 | // toggling visibility via Tailwind `hidden lg:grid` would mount two copies | COMMENT |
| LOW | docker/compose.yaml | 1 | # Canonical CCS docker-compose. Served at https://ccs.kaitran.ca/docker-compose.yaml. | COMMENT |
| LOW | tests/unit/web-server/native-quota-collector.test.ts | 1821 | expect(deps.claudeFetchCount()).toBe(2); | COMMENT |
| LOW | tests/unit/cliproxy/quota-manager-tier-lock.test.ts | 61 | const HEALTHY_QUOTA = { success: true, models: [{ percentage: 80 }] }; | COMMENT |
| LOW | tests/unit/commands/bar-command.test.ts | 1861 | // 1. Is NOT in the default candidate list (3000, 3001, 3002, 8000, 8080) — otherwise a | COMMENT |
| LOW | tests/unit/commands/bar-command.test.ts | 2081 | // temporarily patching the candidate list via a wrapper that re-implements | COMMENT |
| LOW | tests/unit/commands/bar-command.test.ts | 3221 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | tests/docker/network-contract.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/docker/compose-parity.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/docker/compose-parity.sh | 21 | fail=0 | COMMENT |
| LOW | tests/docker/compose-parity.sh | 81 | grep -E '^[[:space:]]+- [a-z_]+:/' "$file" \ | COMMENT |
| LOW | tests/docker/image-size.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/run-test-bucket.js | 1 | #!/usr/bin/env node | COMMENT |
| LOW | scripts/bump-version.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/workflows/bar-release.yml | 1 | name: Bar Release | COMMENT |
| LOW | .github/workflows/docker-release.yml | 441 | # :latest / :<major> / :<minor> aliases STAY POINTED AT THE PRIOR STABLE | COMMENT |
| LOW | .github/workflows/breaking-change-guard.yml | 1 | name: Breaking Change Guard – Docker Compose Contract | COMMENT |
| LOW | .github/workflows/ci.yml | 161 | - name: Assert compose parity (compose.yaml vs docker-compose.integrated.yml) | COMMENT |
| LOW | .github/workflows/promote-release.yml | 1 | name: Promote Stable Release to Docker Latest | COMMENT |
| LOW | macos-bar/Scripts/package_app.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/Sparkline.swift | 1 | import SwiftUI | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/BarAnalyticsView.swift | 1 | import SwiftUI | COMMENT |
| LOW | …s-bar/Sources/CCSBarApp/SettingsWindowController.swift | 1 | import SwiftUI | COMMENT |
| LOW | …s-bar/Sources/CCSBarApp/SettingsWindowController.swift | 81 | func close() { window?.performClose(nil) } | COMMENT |
| LOW | …cos-bar/Sources/CCSBarApp/WindowAppearanceForcer.swift | 1 | import SwiftUI | COMMENT |
| LOW | …cos-bar/Sources/CCSBarApp/WindowAppearanceForcer.swift | 21 | /// | COMMENT |
| LOW | …cos-bar/Sources/CCSBarApp/WindowAppearanceForcer.swift | 81 | } | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/BarMenuView.swift | 21 | COMMENT | |
| LOW | macos-bar/Sources/CCSBarApp/BarMenuView.swift | 41 | /// Multi-profile carousel: which provider page is currently visible. Resets to | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/BarMenuView.swift | 581 | } | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/BarMenuView.swift | 1001 | .padding(.vertical, 1.5) | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/BarNotifier.swift | 1 | import Foundation | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/BarServerLauncher.swift | 1 | import Foundation | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/BarViewModel.swift | 121 | // MARK: - Update checking | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/BarSubscriptionCard.swift | 1 | import SwiftUI | COMMENT |
| LOW | macos-bar/Sources/CCSBarApp/ScrollerHider.swift | 1 | import SwiftUI | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarSummary.swift | 61 | /// ISO timestamp this account was last used, null if never/unknown. | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarFormatting.swift | 61 | /// "unsupported"/"error" rows are skipped so they can't show "--". | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarFormatting.swift | 161 | return "Last active \(fmt.string(from: date))" | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarChartStyle.swift | 1 | import Foundation | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarVersionDisplay.swift | 1 | import Foundation | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarQuotaGauge.swift | 41 | /// time is at/in the past. Returns nil for nil/unparseable timestamps. | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarQuotaGauge.swift | 61 | /// simplifies to `(100 - usedPercent) * elapsed / usedPercent`. | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarQuotaGauge.swift | 141 | // Only at-risk when we will exhaust BEFORE the window resets. | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarTheme.swift | 1 | import SwiftUI | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarServerProbe.swift | 41 | /// 2. 3000, 3001, 3002, 8000, 8080 | COMMENT |
| LOW | macos-bar/Sources/CCSBarCore/BarAnalytics.swift | 81 | public let allTime: Window | COMMENT |
| LOW | src/cliproxy/config/generator.ts | 781 | session-affinity-ttl: "${poolEnabled ? '1h' : sessionAffinityTtl}"`; | COMMENT |
| LOW | src/cliproxy/config/generator.ts | 801 | # WARNING: Logs can grow to several GB if enabled! | COMMENT |
| LOW | …roxy/executor/__tests__/index-characterization.test.ts | 221 | // TODO: mock triggerOAuth to resolve true | COMMENT |
| LOW | src/cliproxy/routing/pool-opt-in-prompt.ts | 141 | if (accountCountBefore !== 1) { | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/web-server/routes/persist-routes.ts | 237 | // Step 1: Backup current settings for rollback | COMMENT |
| LOW⚡ | src/web-server/routes/persist-routes.ts | 242 | // Step 2: Write validated content to temp file | COMMENT |
| LOW⚡ | src/web-server/routes/persist-routes.ts | 245 | // Step 3: Atomic rename (replaces existing file) | COMMENT |
| LOW⚡ | src/web-server/routes/persist-routes.ts | 248 | // Step 4: Cleanup rollback backup on success | COMMENT |
| LOW | src/cliproxy/proxy/tool-sanitization-proxy.ts | 420 | // Step 1: Sanitize input_schema properties (remove non-standard JSON Schema properties) | COMMENT |
| LOW | src/cliproxy/proxy/tool-sanitization-proxy.ts | 481 | // Step 2: Sanitize tool names (truncate to 64 chars for Gemini) | COMMENT |
| LOW⚡ | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 401 | // Step 1: fresh ensureProviderSettings creates the file and the marker. | COMMENT |
| LOW⚡ | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 407 | // Step 2: simulate 'ccs claude --config' pinning all four tier models. | COMMENT |
| LOW | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 423 | // Step 3: second ensureProviderSettings must NOT strip the user-written pins | COMMENT |
| LOW | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 467 | // Step 1: executor runs ensureProviderSettings BEFORE the --config write. | COMMENT |
| LOW | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 479 | // Step 2: configureProviderModel writes the user's deliberate pick — and the | COMMENT |
| LOW | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 496 | // Step 3: next plain `ccs claude` launch must NOT strip the just-written pin | COMMENT |
| LOW⚡ | src/cliproxy/ai-providers/tool-name-sanitizer.ts | 136 | // Step 1: Always try to remove duplicate segments | COMMENT |
| LOW⚡ | src/cliproxy/ai-providers/tool-name-sanitizer.ts | 140 | // Step 2: Truncate if still too long | COMMENT |
| LOW⚡ | src/cliproxy/ai-providers/tool-name-sanitizer.ts | 145 | // Step 3: If still invalid, fix characters and truncate if needed | COMMENT |
| LOW | src/commands/setup-command.ts | 290 | // Step 1: Local vs Remote mode | COMMENT |
| LOW | src/commands/setup-command.ts | 371 | // Step 2: Ask about API profiles | COMMENT |
| LOW | src/commands/cliproxy/variant-subcommand.ts | 321 | // Step 1: Profile name | COMMENT |
| LOW | src/commands/cliproxy/variant-subcommand.ts | 442 | // Step 2: Provider selection | COMMENT |
| LOW | src/commands/cliproxy/variant-subcommand.ts | 536 | // Step 3: Model selection | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/web-server/routes/persist-routes.ts | 237 | // Step 1: Backup current settings for rollback | COMMENT |
| LOW⚡ | src/web-server/routes/persist-routes.ts | 242 | // Step 2: Write validated content to temp file | COMMENT |
| LOW⚡ | src/web-server/routes/persist-routes.ts | 245 | // Step 3: Atomic rename (replaces existing file) | COMMENT |
| LOW⚡ | src/web-server/routes/persist-routes.ts | 248 | // Step 4: Cleanup rollback backup on success | COMMENT |
| LOW | src/cliproxy/proxy/tool-sanitization-proxy.ts | 420 | // Step 1: Sanitize input_schema properties (remove non-standard JSON Schema properties) | COMMENT |
| LOW | src/cliproxy/proxy/tool-sanitization-proxy.ts | 481 | // Step 2: Sanitize tool names (truncate to 64 chars for Gemini) | COMMENT |
| LOW⚡ | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 401 | // Step 1: fresh ensureProviderSettings creates the file and the marker. | COMMENT |
| LOW⚡ | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 407 | // Step 2: simulate 'ccs claude --config' pinning all four tier models. | COMMENT |
| LOW | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 423 | // Step 3: second ensureProviderSettings must NOT strip the user-written pins | COMMENT |
| LOW | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 467 | // Step 1: executor runs ensureProviderSettings BEFORE the --config write. | COMMENT |
| LOW | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 479 | // Step 2: configureProviderModel writes the user's deliberate pick — and the | COMMENT |
| LOW | …cliproxy/config/__tests__/claude-model-neutral.test.ts | 496 | // Step 3: next plain `ccs claude` launch must NOT strip the just-written pin | COMMENT |
| LOW⚡ | src/cliproxy/ai-providers/tool-name-sanitizer.ts | 136 | // Step 1: Always try to remove duplicate segments | COMMENT |
| LOW⚡ | src/cliproxy/ai-providers/tool-name-sanitizer.ts | 140 | // Step 2: Truncate if still too long | COMMENT |
| LOW⚡ | src/cliproxy/ai-providers/tool-name-sanitizer.ts | 145 | // Step 3: If still invalid, fix characters and truncate if needed | COMMENT |
| LOW | src/commands/setup-command.ts | 290 | // Step 1: Local vs Remote mode | COMMENT |
| LOW | src/commands/setup-command.ts | 371 | // Step 2: Ask about API profiles | COMMENT |
| LOW | src/commands/cliproxy/variant-subcommand.ts | 321 | // Step 1: Profile name | COMMENT |
| LOW | src/commands/cliproxy/variant-subcommand.ts | 442 | // Step 2: Provider selection | COMMENT |
| LOW | src/commands/cliproxy/variant-subcommand.ts | 536 | // Step 3: Model selection | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/integration/z-ai-streaming-test.js | 9 | if (!API_KEY || API_KEY === 'your-api-key-here') { | CODE |
| HIGH | src/utils/api-key-validator.ts | 24 | 'YOUR-API-KEY-HERE', | CODE |
| HIGH | src/utils/delegation-validator.ts | 91 | 'your-api-key-here', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/native/unix/edge-cases.sh | 267 | # Check if ccs is in PATH | COMMENT |
| LOW | tests/integration/ux-integration-test.sh | 486 | # Check if completion is registered | COMMENT |
| LOW | scripts/dev-install.sh | 46 | # Check if installed via bun | COMMENT |
| LOW | scripts/dev-install.sh | 51 | # Check if installed via npm | COMMENT |
| LOW | scripts/dev-symlink.sh | 39 | # Check if dist/ccs.js exists | COMMENT |
| LOW | scripts/dev-symlink.sh | 86 | # Check if already symlinked to our dev version | COMMENT |
| LOW | scripts/dev-release.sh | 90 | # Check if tag already exists (safety check) | COMMENT |
| LOW | lib/prompt.sh | 96 | # Check if running in non-interactive mode | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/native/unix/uninstall.sh | 160 | # Create a dummy skill directory first | COMMENT |
| MEDIUM | tests/native/unix/uninstall.sh | 149 | # Create a dummy command file first | COMMENT |
| MEDIUM | scripts/dev-release.sh | 158 | # This file is read by send-discord-release.cjs for dev releases | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ui/src/lib/openrouter-utils.ts | 62 | isExacto: model.id.includes(':exacto'), // Exacto variants - optimized for agentic/tool use | CODE |
| MEDIUM | tests/unit/cliproxy/session-bridge-bg-keepalive.test.ts | 15 | // No-op: feature scaffold removed per red-team finding on #1340. | COMMENT |
| MEDIUM | src/delegation/delegation-handler.ts | 335 | // Parse --max-turns (limit agentic turns, max 100) | COMMENT |
| MEDIUM | src/delegation/executor/types.ts | 65 | maxTurns?: number; // --max-turns: Limit agentic turns (prevents infinite loops) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/cliproxy/proxy/proxy-detector.ts | 181 | // Definitely not our proxy - port is blocked | COMMENT |
| MEDIUM⚡ | src/cliproxy/config/generator.ts | 842 | # This enables seamless multi-account rotation when rate limited | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | macos-bar/Scripts/package_app.sh | 11 | # Usage: | COMMENT |