kirodotdev/KiroCrew

27.8

Adjusted Score

27.8

Raw Score

100%

Time Factor

2026-08-09

Last Push

2.4K

Stars

Python

Language

1.9M

Lines of Code

4.6K

Files

46.5K

Pattern Hits

2026-08-09

Scan Date

0.09

HC Hit Rate

What These Metrics Mean

Adjusted Score: Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score: The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor: The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits: Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate: High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files: Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 417MEDIUM 3987LOW 42073

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 46477 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Hyper-Verbose Identifiers31830 hits · 27499 pts

Severity	File	Line	Snippet	Context
LOW	conftest.py	318	def _block_host_service_mutation(request, monkeypatch):	CODE
LOW	test/test_queue_during_subagents.py	31	def test_only_user_messages_holds_all(self):	CODE
LOW	test/test_queue_during_subagents.py	52	def test_drains_subagent_completion_holds_user(self):	CODE
LOW	test/test_queue_during_subagents.py	65	def test_drains_cron_holds_user(self):	CODE
LOW	test/test_queue_during_subagents.py	77	def test_subagent_first_drains_first(self):	CODE
LOW	test/test_queue_during_subagents.py	97	async def test_queues_when_subagents_running(self, tmp_path, monkeypatch):	CODE
LOW	test/test_queue_during_subagents.py	121	async def test_not_queued_when_no_subagents_running(self, tmp_path, monkeypatch):	CODE
LOW	test/test_queue_during_subagents.py	154	async def test_flag_true_when_agents_running(self, tmp_path, monkeypatch):	CODE
LOW	test/test_queue_during_subagents.py	167	async def test_flag_false_when_no_agents_running(self, tmp_path, monkeypatch):	CODE
LOW	test/test_stats_race_427.py	15	def test_new_publishes_only_after_init() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	129	def test_success_is_returned_as_an_mcp_result() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	141	def test_unmapped_browser_tool_errors_and_does_not_fall_back() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	179	def test_transport_failure_does_not_mark_presence() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	187	def test_non_browser_tool_is_never_intercepted() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	192	def test_non_tool_call_is_never_intercepted() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	199	def test_refusal_returns_an_mcp_error_and_does_not_fall_back() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	239	def test_undecodable_panel_response_does_not_fall_back() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	246	def test_transport_failure_does_fall_back() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	254	def test_empty_session_key_delegates_resolution_to_gateway_via_host_pid() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	308	def test_unmapped_tool_falls_back_until_a_panel_is_proven() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	319	def test_ref_target_is_translated_to_ref_wire_field() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	336	def test_selector_target_is_refused_not_mis_targeted() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	344	def test_missing_required_target_is_refused() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	351	def test_stray_target_on_non_element_op_is_refused() -> None:	CODE
LOW⚡	test/test_browser_native_routing.py	361	def test_screenshot_result_is_saved_to_a_path() -> None:	CODE
LOW	test/test_browser_native_routing.py	35	def _isolate_native_panel_seen():	CODE
LOW	test/test_browser_native_routing.py	97	def test_every_mapped_op_routes_native() -> None:	CODE
LOW	test/test_browser_native_routing.py	156	def test_unmapped_browser_tool_falls_back_when_no_panel_has_answered() -> None:	CODE
LOW	test/test_browser_native_routing.py	168	def test_a_panel_answer_marks_presence_and_arms_the_refusal() -> None:	CODE
LOW	test/test_browser_native_routing.py	212	def test_only_no_panel_http_statuses_fall_back() -> None:	CODE
LOW	test/test_browser_native_routing.py	277	def test_host_pid_is_sent_even_when_session_key_is_known() -> None:	CODE
LOW	test/test_browser_native_routing.py	294	def test_empty_session_key_still_falls_back_on_no_panel() -> None:	CODE
LOW	test/test_browser_native_routing.py	379	def test_mirror_is_suppressed_only_once_native_routing_is_live() -> None:	CODE
LOW	test/test_browser_native_routing.py	406	def test_native_mode_suppresses_the_dashboard_mirror_frame() -> None:	CODE
LOW⚡	test/test_telegram.py	370	def test_command_with_trailing_args(self) -> None:	CODE
LOW⚡	test/test_telegram.py	373	def test_plain_text_is_not_a_command(self) -> None:	CODE
LOW⚡	test/test_telegram.py	376	def test_unknown_slash_is_not_a_command(self) -> None:	CODE
LOW⚡	test/test_telegram.py	379	def test_mid_turn_override_queue(self) -> None:	CODE
LOW⚡	test/test_telegram.py	382	def test_mid_turn_override_steer(self) -> None:	CODE
LOW⚡	test/test_telegram.py	385	def test_mid_turn_override_case_insensitive_and_leading_space(self) -> None:	CODE
LOW⚡	test/test_telegram.py	388	def test_mid_turn_override_none_for_plain_text(self) -> None:	CODE
LOW⚡	test/test_telegram.py	391	def test_mid_turn_override_none_without_body(self) -> None:	CODE
LOW⚡	test/test_telegram.py	397	def test_gen_starts_at_zero_and_bumps(self) -> None:	CODE
LOW⚡	test/test_telegram.py	403	def test_awaiting_flag_roundtrip(self) -> None:	CODE
LOW⚡	test/test_telegram.py	411	def test_bump_gen_clears_awaiting(self) -> None:	CODE
LOW⚡	test/test_telegram.py	417	def test_maybe_rotate_first_message_no_rotate(self) -> None:	CODE
LOW⚡	test/test_telegram.py	422	def test_maybe_rotate_idle_bumps_gen(self) -> None:	CODE
LOW⚡	test/test_telegram.py	428	def test_maybe_rotate_records_activity_without_rotating(self) -> None:	CODE
LOW⚡	test/test_telegram.py	439	def test_short_text_single_chunk(self) -> None:	CODE
LOW⚡	test/test_telegram.py	442	def test_long_text_chunks_within_limit(self) -> None:	CODE
LOW⚡	test/test_telegram.py	448	def test_no_content_lost_when_hard_split(self) -> None:	CODE
LOW⚡	test/test_telegram.py	454	def test_split_markdown_keeps_fences_balanced_and_escaped(self) -> None:	CODE
LOW⚡	test/test_telegram.py	499	def test_short_text_unchanged(self) -> None:	CODE
LOW⚡	test/test_telegram.py	502	def test_closes_open_tag_left_by_the_cut(self) -> None:	CODE
LOW⚡	test/test_telegram.py	509	def test_never_cuts_inside_a_tag(self) -> None:	CODE
LOW⚡	test/test_telegram.py	518	def test_never_cuts_inside_an_entity(self) -> None:	CODE
LOW⚡	test/test_telegram.py	524	def test_nested_tags_closed_innermost_first(self) -> None:	CODE
LOW⚡	test/test_telegram.py	530	def test_result_always_within_limit(self) -> None:	CODE
LOW⚡	test/test_telegram.py	536	def test_never_emits_unclosed_tags_when_closers_do_not_fit(self) -> None:	CODE
LOW⚡	test/test_telegram.py	547	def test_entity_backoff_cannot_strand_the_cut_inside_a_tag(self) -> None:	CODE
31770 more matches not shown…

Decorative Section Separators3560 hits · 12096 pts

Severity	File	Line	Snippet	Context
MEDIUM	cli.sh	2	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	cli.sh	20	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	minimal_install.sh	2	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	minimal_install.sh	18	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	install.sh	134	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	install.sh	136	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	install.sh	275	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	install.sh	277	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	install.sh	298	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	install.sh	300	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	install.sh	430	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	install.sh	432	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	install.sh	510	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	install.sh	512	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	install.sh	2	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	install.sh	17	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	install.sh	537	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	install.sh	539	# ══════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	cloud-install.sh	2	# ======================================================================	COMMENT
MEDIUM	cloud-install.sh	4	# ======================================================================	COMMENT
MEDIUM	cloud-install.sh	15	# ======================================================================	COMMENT
MEDIUM	packaging/signing/sign.sh	36	# ── Args ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign.sh	51	# ── Env ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign.sh	68	# ── 1. Package ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign.sh	108	# ── 2. Upload ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign.sh	116	# ── 3. Submit signing request ───────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign.sh	159	# ── 4. Poll for completion ──────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign.sh	204	# ── 5. Download signed artifact ─────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign.sh	218	# ── 6. Verify (macOS only) ──────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign-dmg.sh	46	# ── Env ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign-dmg.sh	60	# ── 1. Package ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign-dmg.sh	71	# ── 2. Upload ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign-dmg.sh	78	# ── 3. Submit signing request ───────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign-dmg.sh	135	# ── 4. Poll for completion ──────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign-dmg.sh	177	# ── 5. Download signed DMG ──────────────────────────────────────────────────	COMMENT
MEDIUM	packaging/signing/sign-dmg.sh	201	# ── 6. Fail-closed signature gate ───────────────────────────────────────────	COMMENT
MEDIUM	docker/entrypoint.sh	49	# ── Data-home resolution: ask the PRODUCT, never re-implement ────────────	COMMENT
MEDIUM	docker/entrypoint.sh	68	# ── 1. Credential sync: env -> .env file, then scrub ─────────────────────	COMMENT
MEDIUM	docker/entrypoint.sh	106	# ── 2. Sandbox posture (first run only) ──────────────────────────────────	COMMENT
MEDIUM⚡	test/test_browser_native_routing.py	138	# ── no-split-brain: unmapped browser_* is refused, never forwarded ─────────	COMMENT
MEDIUM⚡	test/test_browser_native_routing.py	196	# ── refusal vs transport ───────────────────────────────────────────────────	COMMENT
MEDIUM⚡	test/test_browser_native_routing.py	316	# ── argument translation: target ref vs selector ──────────────────────────	COMMENT
MEDIUM⚡	test/test_browser_native_routing.py	358	# ── screenshot -> saved to a path ──────────────────────────────────────────	COMMENT
MEDIUM	test/test_browser_native_routing.py	94	# ── mapped ops all route native ───────────────────────────────────────────	COMMENT
MEDIUM	test/test_browser_native_routing.py	376	# ── pump disabled in native mode ───────────────────────────────────────────	COMMENT
MEDIUM⚡	test/test_telegram.py	435	# ── renderer.py helpers ────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	test/test_telegram.py	857	# ── transport.py: deny-by-default auth + capabilities + inbound ─────────────	COMMENT
MEDIUM⚡	test/test_telegram.py	925	# ── renderer.py: streaming + finalization ───────────────────────────────────	COMMENT
MEDIUM	test/test_telegram.py	62	# ── Fakes ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/test_telegram.py	356	# ── commands.py ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/test_telegram.py	1415	# ── renderer.py: interactive approval decider ───────────────────────────────	COMMENT
MEDIUM	test/test_telegram.py	1433	# ── transport_dispatch.py: turn + callback routing ─────────────────────────	COMMENT
MEDIUM	test/test_telegram.py	2441	# ── Forum topics (issue #211): per-topic sessions, single-user ──────────────	COMMENT
MEDIUM⚡	test/test_governance_self_protection.py	73	# ── run-marker exec dir (mint execs its contents unsandboxed) ─────────────────	COMMENT
MEDIUM⚡	test/test_brand_name_gate.py	81	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	test/test_brand_name_gate.py	83	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	test/test_brand_name_gate.py	266	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	test/test_brand_name_gate.py	268	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	test/test_brand_name_gate.py	327	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	test/test_brand_name_gate.py	329	# ---------------------------------------------------------------------------	COMMENT
3500 more matches not shown…

Excessive Try-Catch Wrapping3131 hits · 2701 pts

Severity	File	Line	Snippet	Context
LOW	conftest.py	304	except Exception: # pragma: no cover - a partial checkout must not break collection	CODE
LOW	packaging/signing/generate-manifest.py	112	except Exception:	CODE
LOW	docker/test_sandbox_integration.py	45	except Exception as e:	CODE
MEDIUM	docker/test_sandbox_integration.py	48	print("Error message (first 600 chars):")	CODE
LOW	docker/test_sandbox_integration.py	129	except Exception as e:	CODE
LOW	docker/seccomp/gen_profile.py	102	except Exception as exc:	CODE
LOW	test/conftest.py	241	except Exception:	CODE
LOW	test/conftest.py	728	except Exception: # noqa: BLE001 -- isolation cleanup must never fail a test	CODE
LOW	test/test_app_backend.py	44	except Exception: # noqa: BLE001 — any probe failure => treat as "can't spawn"	CODE
LOW	test/test_app_backend.py	48	except Exception: # noqa: BLE001	CODE
LOW	test/test_app_backend.py	137	except Exception: # noqa: BLE001	CODE
LOW	test/test_config_loader.py	139	except Exception:	CODE
LOW	test/test_config_loader.py	1164	except Exception:	CODE
LOW	test/test_cpp_wiring_enterprise.py	113	except Exception:	CODE
LOW	test/test_slack_render_pipeline.py	99	except Exception:	CODE
LOW	test/test_vector_memory.py	1253	except Exception as exc: # noqa: BLE001 — see docstring	CODE
LOW	test/test_vector_memory.py	1261	except Exception as exc: # noqa: BLE001 — see docstring	CODE
LOW	test/test_vector_memory.py	1378	except Exception: # noqa: BLE001 - writer transients tolerated	CODE
LOW	test/test_mcp_gateway_pool_integ.py	163	except Exception: # noqa: BLE001 - teardown must never mask a failure	CODE
LOW	test/test_history_atomic_rewrite.py	116	except Exception as exc: # noqa: BLE001	CODE
LOW	test/test_history_atomic_rewrite.py	137	except Exception as exc: # noqa: BLE001	CODE
LOW	test/test_knowledge_cross_thread.py	167	except Exception as e: # noqa: BLE001 — recording is the assertion	CODE
LOW	test/test_knowledge_cross_thread.py	180	except Exception as e: # noqa: BLE001	CODE
LOW	test/test_acp_client.py	826	except Exception:	CODE
LOW	test/test_pip_deps_consistency.py	82	except Exception:	CODE
LOW	test/test_sel_prune_streaming.py	242	except Exception as e:	CODE
LOW	test/test_sel_prune_streaming.py	258	except Exception as e:	CODE
MEDIUM	test/test_sel_prune_streaming.py	239	def do_prune():	CODE
LOW	test/test_taskrunner_atomic_persistence.py	140	except Exception as exc: # noqa: BLE001	CODE
MEDIUM	test/test_taskrunner_atomic_persistence.py	136	def worker() -> None:	CODE
LOW	test/test_acp_runtime.py	617	except Exception:	CODE
LOW	test/test_no_blocking_call_on_loop.py	108	except Exception:	CODE
LOW	test/test_persist_off_loop.py	63	except Exception:	CODE
LOW	test/test_md_notebook.py	136	except Exception: # noqa: BLE001 — a non-JSON body is itself the failure	CODE
LOW	test/test_config_schema.py	78	except Exception:	CODE
LOW	test/test_config_schema.py	114	except Exception:	CODE
LOW	test/test_pid_sweep_helpers.py	535	except Exception:	CODE
LOW	test/test_terminal_commands.py	770	except Exception:	CODE
LOW	test/test_gateway_pipe_death.py	38	except Exception:	CODE
LOW	test/test_slack_options_lifecycle.py	522	except Exception:	CODE
LOW	test/test_slack_options_lifecycle.py	549	except Exception:	CODE
LOW	test/test_slack_options_lifecycle.py	598	except Exception:	CODE
LOW	test/test_slack_options_lifecycle.py	732	except Exception:	CODE
LOW	test/test_dashboard_chat.py	11321	except Exception:	CODE
LOW	test/test_mochi_settings.py	445	except Exception as exc: # pragma: no cover - surfaced via assert	CODE
LOW	test/test_cron_dedup.py	289	except Exception as e:	CODE
LOW⚡	test/test_file_explorer_app.py	690	except Exception:	CODE
LOW	test/test_file_explorer_app.py	666	except Exception:	CODE
LOW	test/test_publish_providers.py	303	except Exception as e:	CODE
LOW	test/metrics/test_provider.py	262	except Exception:	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	41	except Exception:	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	147	except Exception:	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	208	except Exception:	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	243	except Exception as exc:	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	271	except Exception:	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	468	except Exception as exc:	CODE
MEDIUM	packages/kirocrew-client-py/kirocrew_client/client.py	267	def ping(self) -> bool:	CODE
LOW	.kiro/specs/subagent-session-cleanup/design.md	140	except Exception:	CODE
LOW	.kiro/specs/app-sdk-gateway-hooks/design.md	526	except Exception:	CODE
LOW	.kiro/specs/app-sdk-gateway-hooks/design.md	556	except Exception:	CODE
3071 more matches not shown…

Unused Imports2866 hits · 2257 pts

Severity	File	Line	Context
LOW	conftest.py	42	CODE
LOW	setup.py	15	CODE
LOW	packaging/signing/cli-manifest.py	10	CODE
LOW	test/test_queue_during_subagents.py	10	CODE
LOW	test/test_stats_race_427.py	8	CODE
LOW	test/test_telegram.py	10	CODE
LOW	test/test_governance_self_protection.py	9	CODE
LOW	test/test_brand_name_gate.py	11	CODE
LOW	test/fake_mcp_app_server.py	20	CODE
LOW	test/test_write_secret_file.py	3	CODE
LOW	test/test_installer_shim_and_cleanup.py	30	CODE
LOW	test/test_workflows_resume.py	16	CODE
LOW	test/test_api_kiro_hooks.py	11	CODE
LOW	test/test_dashboard_cron_folders.py	7	CODE
LOW	test/test_ask_question_roundtrip.py	8	CODE
LOW	test/test_mcp_core_audit_e.py	16	CODE
LOW	test/test_rehydrate_async.py	20	CODE
LOW	test/test_cron_cancel.py	8	CODE
LOW	test/test_dashboard_branding.py	3	CODE
LOW	test/test_messaging_dispatch.py	9	CODE
LOW	test/test_stale_asset_watchdog.py	3	CODE
LOW	test/test_mcp_gateway_transport.py	16	CODE
LOW	test/test_dev_fleet_node_toolchain.py	14	CODE
LOW	test/test_knowledge_namespace.py	3	CODE
LOW	test/test_mcp_gateway_rewriter.py	10	CODE
LOW	test/test_agent_template_skills.py	16	CODE
LOW	test/test_meetings_providers.py	17	CODE
LOW	test/test_meetings_providers.py	31	CODE
LOW	test/test_meetings_providers.py	31	CODE
LOW	test/test_token_auth.py	3	CODE
LOW	test/test_mcp_core_set_project.py	16	CODE
LOW	test/test_acp_provider.py	8	CODE
LOW	test/test_subagent_cost.py	8	CODE
LOW	test/test_acp_liveness.py	9	CODE
LOW	test/test_knowledge_kiroignore.py	3	CODE
LOW	test/test_sandbox_launcher_sweep.py	14	CODE
LOW	test/test_chat_voice.py	3	CODE
LOW	test/test_app_execution.py	3	CODE
LOW	test/test_knowledge_folder_cost_guards.py	10	CODE
LOW	test/test_image_authoring_skill.py	22	CODE
LOW	test/test_injection_timeout.py	11	CODE
LOW	test/test_session_usage.py	5	CODE
LOW	test/test_stt_dictation_panel.py	13	CODE
LOW	test/test_subagent_macos_probe.py	10	CODE
LOW	test/test_mcp_gateway_prewarm.py	9	CODE
LOW	test/test_display_time_redaction.py	23	CODE
LOW	test/test_heartbeat_atomic_merge.py	9	CODE
LOW	test/test_agent_home_isolation.py	13	CODE
LOW	test/test_file_send_channel.py	9	CODE
LOW	test/test_meetings_dictionary.py	12	CODE
LOW	test/test_meetings_dictionary.py	17	CODE
LOW	test/test_skill_discover.py	15	CODE
LOW	test/test_diagnostics.py	12	CODE
LOW	test/test_workflows_invariants.py	19	CODE
LOW	test/test_optimizer.py	3	CODE
LOW	test/test_meetings_store.py	12	CODE
LOW	test/test_meetings_store.py	19	CODE
LOW	test/test_meetings_store.py	19	CODE
LOW	test/test_one_conversation_one_session.py	9	CODE
LOW	test/test_dashboard_slowloris.py	14	CODE
2806 more matches not shown…

Cross-Language Confusion338 hits · 1988 pts

Severity	File	Line	Snippet	Context
HIGH	setup.py	119	" cd website && npm install && npm run build\n"	CODE
HIGH⚡	docker/test_sandbox_integration.py	7	bash -c "pip install -e . -q && python docker/test_sandbox_integration.py step1"	STRING
HIGH⚡	docker/test_sandbox_integration.py	12	bash -c "pip install -e . -q && python docker/test_sandbox_integration.py step2"	STRING
HIGH⚡	docker/test_sandbox_integration.py	17	bash -c "pip install -e . -q && python docker/test_sandbox_integration.py step3"	STRING
HIGH	test/test_api_kiro_hooks.py	150	bundled_cmd = "aim agents publish-metrics \|\| true"	CODE
HIGH⚡	test/test_session_usage.py	573	assert self._run(b'{"email":{"nested":1},"accountType":null}') == {}	CODE
HIGH⚡	test/test_notification_legacy_actions.py	40	bus.push(	CODE
HIGH⚡	test/test_notification_legacy_actions.py	65	bus.push(payload_from_legacy("skills", "t", "b", None, url="https://evil.test"))	CODE
HIGH⚡	test/test_notification_legacy_actions.py	67	bus.push(	CODE
HIGH⚡	test/test_notification_legacy_actions.py	82	bus.push(payload_from_legacy("skills", "t", "b", {"url": "/capabilities"}))	CODE
HIGH⚡	test/test_notification_legacy_actions.py	88	bus.push(payload_from_legacy("cron", "t", "b"))	CODE
HIGH	test/test_notification_legacy_actions.py	114	bus.push(payload_from_legacy("skills", "t", "b", None, **kwargs))	CODE
HIGH⚡	test/test_security.py	1089	cmd = "kill 12345 && cp /tmp/bk/kirocrew.json ~/.kiro/agents/"	CODE
HIGH⚡	test/test_security.py	1116	cmd = "cd /home/user/src/CredentialValidatorServiceCDK && git status"	CODE
HIGH⚡	test/test_security.py	1208	assert is_denied("git stash push && git status") is None	CODE
HIGH⚡	test/test_security.py	1209	assert is_denied("git stash push && git log --oneline -5") is None	CODE
HIGH⚡	test/test_security.py	1214	assert is_denied("git stash push && git checkout main") is None	CODE
HIGH⚡	test/test_security.py	1373	assert is_denied("ssh dev-dsk 'cd /workplace && git status'") is None	CODE
HIGH⚡	test/test_security.py	1380	assert is_denied("ssh host 'cd /repo && git push origin main'") is not None	CODE
HIGH	test/test_security.py	1172	assert is_denied("git stash push && git push origin main") is not None	CODE
HIGH	test/test_security.py	1264	assert is_denied("git stash push && git push origin main") is not None	CODE
HIGH	test/test_security.py	1345	assert is_denied("git push origin feat && git push origin main") is not None	CODE
HIGH	test/test_security.py	1406	result = security_module.is_denied("git stash push && git push origin main")	CODE
HIGH	test/conftest.py	756	# file (/dev/null) means git reads no global or system settings.	COMMENT
HIGH⚡	test/test_trust_reads.py	94	assert is_read_only_bash("git status && git log --oneline -3") is True	CODE
HIGH⚡	test/test_trust_reads.py	116	is_read_only_bash("ls /a 2>/dev/null; grep -r foo /b 2>/dev/null") is True	CODE
HIGH⚡	test/test_trust_reads.py	202	"git status && git log --oneline -3",	CODE
HIGH⚡	test/test_trust_reads.py	145	assert is_read_only_bash("ls && cat file") is True # && still works	STRING
HIGH⚡	test/test_trust_reads.py	176	assert is_read_only_bash("ls -la && python script.py") is False	STRING
HIGH⚡	test/test_cli_desktop.py	183	art.write_text('{"version": 1, "samples": [null]}', encoding="utf-8")	CODE
HIGH	test/test_config_loader.py	2377	), f"archive_retention_days schema must allow null, got {node['type']!r}"	CODE
HIGH	test/test_frontend_dist_resolve.py	776	`npm run build` is `tsc -b && vite build`, so killing only npm leaves vite	STRING
HIGH	test/test_thread_parent_context.py	290	ch.push("C123", "alice", "some context", thread_ts="1234.5678")	CODE
HIGH	test/test_thread_parent_context.py	311	ch.push("C123", "alice", "some context", thread_ts="1234.5678")	CODE
HIGH⚡	test/test_mochi_routes.py	318	runtime.notify_gate.push(	CODE
HIGH⚡	test/test_mcp_cron_security.py	401	{"name": name, "command": "echo hello && date", "every": 120},	CODE
HIGH⚡	test/test_mcp_cron_security.py	408	assert matching[0].command == "echo hello && date"	CODE
HIGH	test/test_mcp_cron_security.py	238	"echo hello && date",	CODE
HIGH⚡	test/test_dashboard.py	168	notification_bus.push() gets its title/body/meta redacted there --	STRING
HIGH⚡	test/test_dashboard.py	178	note = state.notification_bus.push(	CODE
HIGH⚡	test/test_artifact_folders.py	64	raw["folder_id"] = None # explicit JSON null, not a missing key	CODE
HIGH	test/test_dashboard_sessions_memory.py	242	"""A session without shard rows gets credits=null, turns=null — NOT zero."""	STRING
HIGH⚡	test/test_denied_commands_security.py	1984	"kill $(echo x >/dev/null; pgrep {n})",	CODE
HIGH⚡	test/test_denied_commands_security.py	1986	"kill $(true && pgrep {n})",	CODE
HIGH⚡	test/test_denied_commands_security.py	2066	assert _denied_by(f"kill 8123 && cp /tmp/{_NAME}.json ~/") is None	CODE
HIGH⚡	test/test_denied_commands_security.py	2382	f"{_PK} -f other && ls /workplace/alice/{_NAME}-wt-x",	CODE
HIGH⚡	test/test_denied_commands_security.py	2404	f"{_K} 12345 && cp /tmp/bk/{_NAME}.json ~/.kiro/agents/",	CODE
HIGH⚡	test/test_denied_commands_security.py	2721	under_path = f"cd /workplace/x/{_NAME}-wt-y && grep {_TOK}_auth.py"	CODE
HIGH	test/test_denied_commands_security.py	1450	two_step = "printf 'x' > /tmp/s.py && python /tmp/s.py"	CODE
HIGH	test/test_denied_commands_security.py	2530	f'bash -c "cd /workplace/alice/{_NAME}-wt-x && pytest test/test_{_TOK}_auth.py"',	CODE
HIGH	test/test_denied_commands_security.py	2700	f"cd /workplace/x/{_NAME}-wt-y && pytest test/test_{_TOK}_auth.py",	CODE
HIGH	test/test_denied_commands_security.py	2701	f"cd /workplace/x/{_NAME}-wt-y && grep -n mint src/kiro_crew/{_TOK}_auth.py",	CODE
HIGH⚡	test/test_mochi_notification_gate.py	42	gate.push(_notify("hello"), T0)	CODE
HIGH⚡	test/test_mochi_notification_gate.py	49	gate.push(_notify("only"), T0)	CODE
HIGH⚡	test/test_mochi_notification_gate.py	56	gate.push(_notify("first", source="watch"), T0)	CODE
HIGH⚡	test/test_mochi_notification_gate.py	57	gate.push(_notify("second", source="watch"), T0 + 100)	CODE
HIGH⚡	test/test_mochi_notification_gate.py	58	gate.push(_notify("third", source="watch"), T0 + 200)	CODE
HIGH⚡	test/test_mochi_notification_gate.py	70	gate.push(_notify("a"), T0)	CODE
HIGH⚡	test/test_mochi_notification_gate.py	72	gate.push(_notify("b"), T0 + MERGE_WINDOW_MS + 1)	CODE
HIGH⚡	test/test_mochi_notification_gate.py	80	gate.push(notifs[0], T0)	CODE
278 more matches not shown…

Over-Commented Block2453 hits · 1923 pts

Severity	File	Line	Snippet	Context
LOW	setup.sh	1	#!/bin/sh	COMMENT
LOW	cli.sh	1	#!/bin/sh	COMMENT
LOW	cli.sh	21	set -eu	COMMENT
LOW	cli.sh	141	return 1	COMMENT
LOW	cli.sh	381	# copied the whole legacy tree and then deleted it, which for a wheel install	COMMENT
LOW	cli.sh	421	# happens to be named `venv`, whose contents would otherwise be	COMMENT
LOW	minimal_install.sh	1	#!/usr/bin/env bash	COMMENT
LOW	conftest.py	61	#: Deliberately NOT here:	COMMENT
LOW	conftest.py	121	)	COMMENT
LOW	ensure-python.sh	1	#!/bin/bash	COMMENT
LOW	install.sh	1	#!/usr/bin/env bash	COMMENT
LOW	pyproject.toml	41	"mypy==1.14.1",	COMMENT
LOW	ensure-node.sh	1	#!/bin/bash	COMMENT
LOW	setup.py	61	# harness legitimately drives mutators on the loop as a convenience); the	COMMENT
LOW	.woke.yml	101	# source URLs and identifiers we must not rewrite.	COMMENT
LOW	dev-backend.sh	1	#!/bin/bash	COMMENT
LOW	setup.cfg	1	[options]	COMMENT
LOW	setup.cfg	21	# the host silently refuses every internationalized domain.	COMMENT
LOW	setup.cfg	41	# Its only dependency, tzdata, is already declared above.	COMMENT
LOW	setup.cfg	61	# pulls Pillow explicitly (we already ship it transitively via pdfplumber,	COMMENT
LOW	setup.cfg	81	# pip install "kirocrew[otlp]"	COMMENT
LOW	setup.cfg	101	# without them.	COMMENT
LOW	setup.cfg	221	# the run is not going to finish, so surface it loudly and immediately.	COMMENT
LOW	setup.cfg	241	# credential redaction floors — never executed on a pull request at all. Found in review.	COMMENT
LOW	setup.cfg	261	#	COMMENT
LOW	setup.cfg	301		COMMENT
LOW	dev-fullstack.sh	1	#!/bin/bash	COMMENT
LOW	cloud-install.sh	1	#!/usr/bin/env bash	COMMENT
LOW	packaging/build-desktop.sh	1	#!/usr/bin/env bash	COMMENT
LOW	packaging/build-desktop.sh	21	# backend — which cannot be lipo-merged (a whole PBS tree, not one binary) —	COMMENT
LOW	packaging/build-desktop.sh	101		COMMENT
LOW	packaging/build-desktop.sh	121	# output dir in this script is exposed to that race, so route them all through	COMMENT
LOW	packaging/build-desktop.sh	201	# Copies the interpreter, pip-installs kiro_crew (full closure), stages the	COMMENT
LOW	packaging/build-desktop.sh	441	"-c.mac.icon=icon-nightly.png"	COMMENT
LOW	packaging/build-desktop.sh	481		COMMENT
LOW	packaging/resign-macos-libs.sh	1	#!/usr/bin/env bash	COMMENT
LOW	packaging/signing/sign.sh	1	#!/usr/bin/env bash	COMMENT
LOW	packaging/signing/sign.sh	21	# 5. Downloads the signed artifact to signed/ locally	COMMENT
LOW	packaging/signing/generate-manifest.py	41	import sys	COMMENT
LOW	packaging/signing/sign-dmg.sh	1	#!/usr/bin/env bash	COMMENT
LOW	docker/compose.yaml	1	# KiroCrew gateway — compose example.	COMMENT
LOW	docker/compose.yaml	21	# KIROCREW_CORS_ORIGINS) to the address you browse from, ideally a	COMMENT
LOW	docker/compose.yaml	41	TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}	COMMENT
LOW	docker/entrypoint.sh	1	#!/bin/sh	COMMENT
LOW	docker/entrypoint.sh	21	# Linux user-namespace backend works INSIDE a container depends on the	COMMENT
LOW	docker/entrypoint.sh	41	# after minting, so anything found in `docker logs` later is dead.	COMMENT
LOW	test/test_acp_client_capabilities.py	41	# encoding is explicit: read_text() defaults to the locale codec, which	COMMENT
LOW	test/test_brand_name_gate.py	161	)	COMMENT
LOW	test/test_brand_name_gate.py	181	# runner, so real regressions are still caught.	COMMENT
LOW	test/test_mcp_gateway_transport.py	881	transport._install_pipe_factory()	COMMENT
LOW	test/test_display_time_redaction.py	361	loaded_meta = json.dumps([m.get("meta") for m in slot.messages])	COMMENT
LOW	test/test_effort.py	81	# VALID Bedrock fold — passing it through verbatim would crash a CC	COMMENT
LOW	test/test_security.py	1161	assert is_denied("git -C /path stash push") is None	COMMENT
LOW	test/conftest.py	221	import tracemalloc	COMMENT
LOW	test/test_identity_topology.py	201	monkeypatch.setattr(mcp_core, "_get_ppid", topo.parent_lookup(view))	COMMENT
LOW	test/test_app_backend.py	961	@_needs_sandbox_spawn	COMMENT
LOW	test/test_sandbox_argv.py	141	# Inside an existing KiroCrew sandbox, nested unshare is seccomp-denied,	COMMENT
LOW	test/test_app_bridges.py	2001		COMMENT
LOW	test/test_spawn_audit.py	81	# it to ``sandboxed_spawn_argv`` so this indirection cannot weaken the gate.	COMMENT
LOW	test/test_spawn_audit.py	101	"create_subprocess_limited",	COMMENT
2393 more matches not shown…

Modern Structural Boilerplate650 hits · 632 pts

Severity	File	Line	Snippet	Context
LOW	test/test_telegram.py	137	async def set_message_reaction(self, chat_id: int, message_id: int, emoji: str) -> None:	CODE
LOW	test/test_telegram.py	226	async def set_channel(self, key: str, channel: str) -> None:	CODE
LOW	test/test_telegram.py	253	def set_mirror_link(self, key: str, link: Any) -> None:	CODE
LOW⚡	test/test_mcp_gateway_transport.py	993	def set_write_buffer_limits(self, _a: Any, *_kw: Any) -> None:	CODE
LOW	test/test_acp_liveness.py	77	def set_io(self, pid: int, io_bytes: int) -> None:	CODE
LOW	test/test_acp_liveness.py	85	def set_blocked_read(self, pid: int, fd: int, target: str) -> None:	CODE
LOW	test/test_acp_liveness.py	102	def set_net_tcp(self, pid: int, established_inodes: list[str]) -> None:	CODE
LOW	test/windows_sim.py	48	__all__ = [	CODE
LOW	test/test_handlers_taskrunner_coverage.py	1189	def set_result(self, _value: str) -> None:	CODE
LOW	test/test_dashboard_server_coverage.py	50	def set_active(self, active: bool) -> None:	CODE
LOW	test/test_acp_client.py	1244	def _set_io(pid: int, io_bytes: int) -> None:	CODE
LOW	test/test_webex_dispatch.py	82	async def set_channel(self, key, cid) -> None:	CODE
LOW	test/test_webex_dispatch.py	163	def set_title(self, key, title) -> None:	CODE
LOW	test/test_subagent_scale.py	486	async def _settle(predicate, timeout: float = 5.0) -> None:	CODE
LOW	test/test_discord.py	220	async def set_channel(self, key: str, channel: str) -> None:	CODE
LOW	test/test_discord.py	274	def set_origin_link(self, key: str, link: Any) -> None:	CODE
LOW	test/test_dashboard_approval.py	180	def _set_stream(client: AsyncMock, events: list[LLMEvent]) -> None:	CODE
LOW	test/test_discord_sessions.py	126	def set_origin_link(self, key: str, link: ChannelLink) -> None:	CODE
LOW	test/test_discord_sessions.py	169	async def set_channel(self, key: str, channel: str) -> None:	CODE
LOW	test/test_discord_sessions.py	259	def set_title(self, key: str, title: str) -> None:	CODE
LOW	test/test_thread_override_persistence.py	43	def update_metadata(self, key: str, fields: dict) -> None:	CODE
LOW	test/test_teams_dispatch.py	70	async def set_channel(self, key, cid) -> None:	CODE
LOW	test/test_teams_dispatch.py	146	def set_title(self, key, title) -> None:	CODE
LOW	test/test_publish_sync.py	139	async def update_sharing(self, *, external_id, visibility, shared_with) -> None:	CODE
LOW	test/test_link_unfurl.py	537	def _set_enabled(monkeypatch, enabled: bool) -> None:	CODE
LOW	test/test_mcp_gateway_backend_coverage.py	154	async def _settle(backend: Backend) -> None:	CODE
LOW	test/test_slack_golden_transcript.py	53	async def update_message(self, channel, ts, text="", blocks=None) -> None:	CODE
LOW⚡	test/test_slack_golden_transcript.py	97	async def set_thread_status(self, channel, thread_ts, status) -> None:	CODE
LOW⚡	test/test_slack_golden_transcript.py	100	async def set_thread_title(self, channel, thread_ts, title) -> None:	CODE
LOW⚡	test/test_slack_golden_transcript.py	103	async def set_suggested_prompts(self, channel, thread_ts, prompts) -> None:	CODE
LOW	test/test_slack_interactions_coverage.py	122	def _set_owner(monkeypatch: pytest.MonkeyPatch, value: bool) -> None:	CODE
LOW	test/test_wecom_dispatch.py	84	async def set_channel(self, key, cid) -> None:	CODE
LOW	test/test_wecom_dispatch.py	158	def set_title(self, key, title) -> None:	CODE
LOW	test/test_snapshot.py	29	def _setup_fake_kirocrew(d: Path) -> None:	CODE
LOW	test/test_theme_install.py	841	def _setup(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch, text: str) -> None:	CODE
LOW	test/test_knowledge_ingest_guard.py	61	def _set_limit_mb(monkeypatch, mb: float) -> None:	CODE
LOW	test/test_mcp_gateway_bluegreen.py	33	logger = logging.getLogger(__name__)	CODE
LOW	test/test_slack_handler.py	3275	def set_approval_policy(self, key: str, policy: str) -> None:	CODE
LOW	test/test_eval_harness.py	59	def set_workspace(self, path) -> None:	CODE
LOW⚡	test/test_auto_research.py	2722	def _set_cycles(self, cid: str, n: int) -> None:	CODE
LOW	transfer/meshclaw_to_kirocrew/engine.py	29	logger = logging.getLogger(__name__)	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	24	logger = logging.getLogger(__name__)	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	417	async def set_app_config(self, config: dict[str, Any]) -> None:	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	475	def set_default_slot(self, slot_id: str) -> None:	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/__init__.py	15	__all__ = ["KiroCrewClient", "KiroCrewError", "ErrorCode"]	CODE
LOW	src/kiro_crew/vector_memory.py	62	logger = logging.getLogger(__name__)	CODE
LOW	src/kiro_crew/voice_reply.py	41	logger = logging.getLogger(__name__)	CODE
LOW	src/kiro_crew/mcp_cron.py	54	logger = logging.getLogger(__name__)	CODE
LOW	src/kiro_crew/cli_server.py	1340	def _update_wheel(layout) -> None:	CODE
LOW	src/kiro_crew/task_reporter.py	22	logger = logging.getLogger(__name__)	CODE
LOW⚡	src/kiro_crew/cli_setup.py	778	def _setup_timezone() -> None:	CODE
LOW	src/kiro_crew/cli_setup.py	193	def _setup_electron() -> None:	CODE
LOW	src/kiro_crew/cli_setup.py	256	def _setup(agent_only: bool = False, electron_only: bool = False, clean: bool = False) -> None:	CODE
LOW	src/kiro_crew/cli_setup.py	269	def _setup_impl(agent_only: bool = False, electron_only: bool = False, clean: bool = False) -> None:	CODE
LOW	src/kiro_crew/cli_setup.py	430	def _setup_workspace_dir() -> None:	CODE
LOW	src/kiro_crew/cli_setup.py	458	def _setup_slack_tokens() -> None:	CODE
LOW	src/kiro_crew/cli_setup.py	588	def _setup_slash_command() -> None:	CODE
LOW	src/kiro_crew/cli_setup.py	619	def _setup_sandbox_consent() -> None:	CODE
LOW	src/kiro_crew/hooks.py	39	logger = logging.getLogger(__name__)	CODE
LOW	src/kiro_crew/hooks.py	1003	def set_builtin_app_mcp_servers(names: Iterable[str]) -> None:	CODE
590 more matches not shown…

Deep Nesting896 hits · 625 pts

Severity	File	Line	Context
LOW	packaging/signing/generate-manifest.py	157	CODE
LOW	packaging/signing/generate-manifest.py	211	CODE
LOW	test/test_telegram.py	472	CODE
LOW	test/fake_mcp_app_server.py	42	CODE
LOW	test/test_computer_use_unsupported.py	77	CODE
LOW	test/test_chat_turn_timeout_consistency.py	75	CODE
LOW	test/test_config_loader.py	800	CODE
LOW	test/test_config_loader.py	1619	CODE
LOW	test/test_config_loader.py	4031	CODE
LOW	test/test_spawn_audit.py	815	CODE
LOW	test/test_agent.py	644	CODE
LOW	test/test_agent.py	686	CODE
LOW	test/test_agent.py	708	CODE
LOW	test/test_agent.py	744	CODE
LOW	test/test_agent.py	785	CODE
LOW	test/test_pptx_maker_routes.py	581	CODE
LOW	test/test_computer_use_capture.py	535	CODE
LOW	test/test_mochi_pet_events.py	489	CODE
LOW	test/test_compaction_wait_budget.py	120	CODE
LOW	test/test_slack_render_pipeline.py	103	CODE
LOW	test/test_vector_memory.py	589	CODE
LOW	test/test_vector_memory.py	2624	CODE
LOW	test/test_mochi_routes.py	898	CODE
LOW	test/test_vendored_llama_payload.py	192	CODE
LOW	test/test_history_atomic_rewrite.py	98	CODE
LOW	test/test_history_atomic_rewrite.py	120	CODE
LOW	test/test_acp_client.py	2459	CODE
LOW	test/test_papyrus_routes.py	1146	CODE
LOW	test/test_tag_session.py	354	CODE
LOW	test/test_spawn_preexec_guard.py	50	CODE
LOW	test/test_pip_deps_consistency.py	117	CODE
LOW	test/test_pip_deps_consistency.py	260	CODE
LOW	test/test_workflows_architecture.py	78	CODE
LOW	test/test_no_blocking_call_on_loop.py	112	CODE
LOW	test/test_no_blocking_call_on_loop.py	203	CODE
LOW	test/test_persist_off_loop.py	67	CODE
LOW	test/test_runtime_home_write_paths.py	160	CODE
LOW	test/test_workflows_presence.py	44	CODE
LOW	test/test_config_schema.py	53	CODE
LOW	test/test_dashboard_approval.py	78	CODE
LOW	test/test_thread_override_persistence.py	446	CODE
LOW	test/test_teams_transport.py	59	CODE
LOW	test/test_lazy_data_home_paths.py	73	CODE
LOW	test/test_lazy_data_home_paths.py	146	CODE
LOW	test/test_inline_tool_cards_props.py	87	CODE
LOW	test/test_inline_tool_cards_props.py	143	CODE
LOW	test/test_inline_tool_cards_props.py	188	CODE
LOW	test/test_inline_tool_cards_props.py	244	CODE
LOW	test/test_inline_tool_cards_props.py	398	CODE
LOW	test/test_inline_tool_cards_props.py	471	CODE
LOW	test/test_computer_use_overlay.py	1241	CODE
LOW	test/test_context.py	1073	CODE
LOW	test/test_file_explorer_app.py	34	CODE
LOW	test/test_config_rmw_preserves_settings.py	89	CODE
LOW	test/test_config_rmw_preserves_settings.py	174	CODE
LOW	test/test_no_config_dir_in_async.py	36	CODE
LOW	test/test_nightly_version_contract.py	234	CODE
LOW	test/test_mcp_probe_warn_once.py	187	CODE
LOW	test/test_apps_routes_coverage.py	131	CODE
LOW	test/test_dev_fleet_app.py	492	CODE
836 more matches not shown…

Modern AI Meta-Vocabulary106 hits · 351 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/test_telegram.py	1022	# agentic turns show activity instead of a dead typing indicator.	COMMENT
MEDIUM⚡	test/test_config_loader.py	1605	# Feature: multi-agent-orchestration, Property 1: Config load always produces at least one agent with valid default	COMMENT
MEDIUM⚡	test/test_config_loader.py	1605	# Feature: multi-agent-orchestration, Property 1: Config load always produces at least one agent with valid default	COMMENT
MEDIUM⚡	test/test_config_loader.py	1671	# Feature: multi-agent-orchestration, Property 2: Legacy kiro_agent preserved in migrated default	COMMENT
MEDIUM⚡	test/test_config_loader.py	1671	# Feature: multi-agent-orchestration, Property 2: Legacy kiro_agent preserved in migrated default	COMMENT
MEDIUM⚡	test/test_config_loader.py	1798	# Feature: multi-agent-orchestration, Property 5: Agent resolution produces correct workspace and memory store	COMMENT
MEDIUM⚡	test/test_config_loader.py	1798	# Feature: multi-agent-orchestration, Property 5: Agent resolution produces correct workspace and memory store	COMMENT
MEDIUM⚡	test/test_config_loader.py	1801	# the multi-agent-orchestration requirements specifically.	COMMENT
MEDIUM⚡	test/test_config_loader.py	1801	# the multi-agent-orchestration requirements specifically.	COMMENT
MEDIUM⚡	test/test_config_loader.py	1845	# Feature: multi-agent-orchestration, Property 6: Non-KiroCrew agent names resolve via default agent	COMMENT
MEDIUM⚡	test/test_config_loader.py	1845	# Feature: multi-agent-orchestration, Property 6: Non-KiroCrew agent names resolve via default agent	COMMENT
MEDIUM	test/test_config_loader.py	1700	# Feature: multi-agent-orchestration, Property 3: Existing agents preserved on load	COMMENT
MEDIUM	test/test_config_loader.py	1700	# Feature: multi-agent-orchestration, Property 3: Existing agents preserved on load	COMMENT
MEDIUM	test/test_config_loader.py	1744	# Feature: multi-agent-orchestration, Property 4: Backward compatibility — migrated default produces identical resol	COMMENT
MEDIUM	test/test_config_loader.py	1744	# Feature: multi-agent-orchestration, Property 4: Backward compatibility — migrated default produces identical resol	COMMENT
MEDIUM	test/test_config_loader.py	2402	# Canonical scaffold so the one-shot write-back migration (which calls	COMMENT
MEDIUM	test/test_config_loader.py	2419	# _write merges a canonical scaffold so the one-shot write-back migration	COMMENT
MEDIUM	test/test_agent.py	270	# toolsSettings scaffolding is removed entirely.	COMMENT
MEDIUM	test/test_agent.py	3258	# The empty scaffolding is removed entirely.	COMMENT
MEDIUM⚡	test/test_harness.py	473	# ── spawn_feature_gateway: orchestration with mocked Popen ──────────────	COMMENT
MEDIUM	test/test_ai_review_workflows.py	508	# passed via env (not `/dev/zero`/`tr`) so no non-portable input scaffolding.	COMMENT
MEDIUM	test/test_turn_teardown_release.py	38	state.subagents = None # isolate the orchestrating condition of hold_users	CODE
MEDIUM⚡	test/test_config_api.py	245	# Feature: multi-agent-orchestration, Property 8: CRUD create round-trip	COMMENT
MEDIUM⚡	test/test_config_api.py	245	# Feature: multi-agent-orchestration, Property 8: CRUD create round-trip	COMMENT
MEDIUM⚡	test/test_config_api.py	303	# Feature: multi-agent-orchestration, Property 9: CRUD update round-trip	COMMENT
MEDIUM⚡	test/test_config_api.py	303	# Feature: multi-agent-orchestration, Property 9: CRUD update round-trip	COMMENT
MEDIUM	test/test_config_api.py	370	# Feature: multi-agent-orchestration, Property 10: CRUD delete round-trip	COMMENT
MEDIUM	test/test_config_api.py	370	# Feature: multi-agent-orchestration, Property 10: CRUD delete round-trip	COMMENT
MEDIUM⚡	test/test_link_unfurl.py	475	# --- endpoint scaffolding --------------------------------------------------	COMMENT
MEDIUM⚡	test/test_seed.py	411	# Phase 1.B: safety guardrails + --seed-replace. PRD acceptance tests 4, 5, 6.	COMMENT
MEDIUM⚡	test/test_dashboard_chat.py	4425	# ── Runtime wiring tests (multi-agent-orchestration) ──	COMMENT
MEDIUM⚡	test/test_dashboard_chat.py	4425	# ── Runtime wiring tests (multi-agent-orchestration) ──	COMMENT
MEDIUM	test/test_dashboard_chat.py	6686	assert seen == [True, True] # orchestrating for every stage	CODE
MEDIUM⚡	test/test_context.py	35	# Feature: multi-agent-orchestration, Property 7: Memory store parameter overrides workspace for memory lookup	COMMENT
MEDIUM⚡	test/test_context.py	35	# Feature: multi-agent-orchestration, Property 7: Memory store parameter overrides workspace for memory lookup	COMMENT
MEDIUM	website/src/test/ChatPage.responsivePanel.test.tsx	21	// --- Stub child components (same scaffold as ChatPage.embedded test) ---	COMMENT
MEDIUM	website/src/test/SchedulePage.test.tsx	384	// brand-new user sees first, while its guardrails are prompt text rather	COMMENT
MEDIUM	docs/system-specs/modules/memory-skills-hooks.md	1235	#### Dynamic budget scaling (per active model context window)	COMMENT
MEDIUM	docs/system-specs/modules/README.md	36	## Agents and orchestration	COMMENT
MEDIUM	docs/system-specs/modules/subagent.md	297	- Digest hold deadline (straggler escape hatch): both chunk triggers are event-driven — a COUNT trigger (`SUBAGENT_D	CODE
MEDIUM	docs/architecture/overview.md	48	### Why orchestrate agents at all	COMMENT
MEDIUM	…cs/architecture/design-notes/mcp-gateway-claim-push.md	1	# Claim-push: event-driven caller identity for pooled MCP stubs	COMMENT
MEDIUM	.github/workflows/fork-workflow-guard.yml	9	# and free. An LLM gate here would be slower, cost money, and could hallucinate.	COMMENT
MEDIUM	.github/workflows/claude-review.yml	59	# look clean) if the agentic review ever HANGS -- a Bedrock stall or retry	COMMENT
MEDIUM	.github/workflows/claude-review.yml	150	# agentic reviewer's context. This reviewer is CODE-ONLY.	COMMENT
MEDIUM	.github/workflows/ux-review.yml	49	# GITHUB_TOKEN into .git/config, where the agentic reviewer — which reads	COMMENT
MEDIUM	.github/workflows/design-review.yml	38	# GITHUB_TOKEN into .git/config, where the agentic reviewer — which reads	COMMENT
MEDIUM	.github/workflows/codex-review.yml	49	# GITHUB_TOKEN into .git/config, where the read-only agentic reviewer	COMMENT
MEDIUM	.github/workflows/issue-triage.yml	22	# nothing to reach for. (Contrast the agentic PR reviewers, which do get a	COMMENT
MEDIUM	.kiro/specs/pod-cli/tasks.md	3	## 1. Package scaffold	COMMENT
MEDIUM⚡	skills/goal-loop/scaffold.sh	2	# scaffold.sh — goal-loop wrapper around self-nudge-loop/scaffold.sh	COMMENT
MEDIUM⚡	skills/goal-loop/scaffold.sh	6	# <anchor>/LOOP.md (via self-nudge-loop/scaffold.sh)	COMMENT
MEDIUM⚡	skills/goal-loop/scaffold.sh	7	# <anchor>/README.md (via self-nudge-loop/scaffold.sh)	COMMENT
MEDIUM⚡	skills/goal-loop/scaffold.sh	8	# <anchor>/board/ (via self-nudge-loop/scaffold.sh)	COMMENT
MEDIUM⚡	skills/goal-loop/scaffold.sh	11	# scaffold.sh --project <name> --anchor-dir <abs> --goal "<goal>" [--force]	COMMENT
MEDIUM⚡	skills/self-nudge-loop/scaffold.sh	2	# scaffold.sh — generate a hardened AutoNudge loop anchor tree for a project.	COMMENT
MEDIUM⚡	skills/self-nudge-loop/scaffold.sh	5	# scaffold.sh --project <name> --anchor-dir <abs path> [--with-board] [--force]	COMMENT
MEDIUM	skills/llm-council/SKILL.md	56	## Choosing the panel (Chairman orchestrates)	COMMENT
MEDIUM	src/kiro_crew/vector_memory.py	392	# the embedding model was unavailable at gateway boot but landed later, without	COMMENT
MEDIUM	src/kiro_crew/subagent.py	981	# effect for it (WS terminal event, orchestration tracker accounting,	COMMENT
46 more matches not shown…

Cross-File Repetition69 hits · 345 pts

Severity	File	Line	Snippet	Context
HIGH	test/test_config_loader.py	0	write data to a temp config file and load via kirocrewconfig.load().	STRING
HIGH	test/test_teams_config.py	0	write data to a temp config file and load via kirocrewconfig.load().	STRING
HIGH	test/test_agent_default_model.py	0	write data to a temp config file and load via kirocrewconfig.load().	STRING
HIGH	test/test_mochi_pet_events.py	0	start the runtime inside the test's own loop, stop it on exit. an async context manager rather than an ``@pytest_asyncio	STRING
HIGH	test/test_mochi_routes.py	0	start the runtime inside the test's own loop, stop it on exit. an async context manager rather than an ``@pytest_asyncio	STRING
HIGH	test/test_mochi_activity.py	0	start the runtime inside the test's own loop, stop it on exit. an async context manager rather than an ``@pytest_asyncio	STRING
HIGH	test/test_deploy_script_validation.py	0	import a script as a module via importlib (standalone-execution path).	STRING
HIGH	test/test_deploy_round5_fixes.py	0	import a script as a module via importlib (standalone-execution path).	STRING
HIGH	test/test_deploy_round4_fixes.py	0	import a script as a module via importlib (standalone-execution path).	STRING
HIGH	test/test_deploy_round8_fixes.py	0	import a script as a module via importlib (standalone-execution path).	STRING
HIGH	test/test_artifacts_handlers.py	0	make _is_restricted_session read req.app['_restricted_session'].	STRING
HIGH	test/test_remote_artifacts.py	0	make _is_restricted_session read req.app['_restricted_session'].	STRING
HIGH	test/test_artifact_sharing_handlers.py	0	make _is_restricted_session read req.app['_restricted_session'].	STRING
HIGH	test/test_handlers_artifacts_coverage.py	0	make _is_restricted_session read req.app['_restricted_session'].	STRING
HIGH	test/test_webex_config_handlers.py	0	config writes are loopback-only: remote sessions are read-only.	STRING
HIGH	test/test_slack_config_handlers.py	0	config writes are loopback-only: remote sessions are read-only.	STRING
HIGH	test/test_wecom_config_handlers.py	0	config writes are loopback-only: remote sessions are read-only.	STRING
HIGH	test/test_discord_config_handlers.py	0	config writes are loopback-only: remote sessions are read-only.	STRING
HIGH	test/test_telegram_config_handlers.py	0	config writes are loopback-only: remote sessions are read-only.	STRING
HIGH	test/test_computer_use_api.py	0	patch the late-bound ``_sel()`` so sel audit calls are observable.	STRING
HIGH	test/test_trusted_apps_api.py	0	patch the late-bound ``_sel()`` so sel audit calls are observable.	STRING
HIGH	test/test_denied_commands_api.py	0	patch the late-bound ``_sel()`` so sel audit calls are observable.	STRING
HIGH	test/test_slack_config_handlers.py	0	run a save over a real testclient with paths isolated to tmp_path.	STRING
HIGH	test/test_wecom_config_handlers.py	0	run a save over a real testclient with paths isolated to tmp_path.	STRING
HIGH	test/test_discord_config_handlers.py	0	run a save over a real testclient with paths isolated to tmp_path.	STRING
HIGH	test/test_telegram_config_handlers.py	0	run a save over a real testclient with paths isolated to tmp_path.	STRING
HIGH	test/test_slack_config_handlers.py	0	being offline must not block a save — token stored, warning returned.	STRING
HIGH	test/test_discord_config_handlers.py	0	being offline must not block a save — token stored, warning returned.	STRING
HIGH	test/test_telegram_config_handlers.py	0	being offline must not block a save — token stored, warning returned.	STRING
HIGH	src/kiro_crew/session_map.py	0	sessions directory, resolved against the live data home.	STRING
HIGH	src/kiro_crew/dashboard/handlers/usage.py	0	sessions directory, resolved against the live data home.	STRING
HIGH	src/kiro_crew/slack/sessions_view.py	0	sessions directory, resolved against the live data home.	STRING
HIGH	src/kiro_crew/discord/gateway.py	0	resolve the transport approval mode (mirrors the slack/webex path). yolo -> auto-approve; otherwise the cli ``--approval	STRING
HIGH	src/kiro_crew/webex/gateway.py	0	resolve the transport approval mode (mirrors the slack/webex path). yolo -> auto-approve; otherwise the cli ``--approval	STRING
HIGH	src/kiro_crew/telegram/gateway.py	0	resolve the transport approval mode (mirrors the slack/webex path). yolo -> auto-approve; otherwise the cli ``--approval	STRING
HIGH	src/kiro_crew/teams/gateway.py	0	resolve the transport approval mode (mirrors the slack/webex path). yolo -> auto-approve; otherwise the cli ``--approval	STRING
HIGH	src/kiro_crew/discord/gateway.py	0	start the telegram channel if enabled + credentialed; else no-op. returns the running client (so the gateway can ``close	STRING
HIGH	src/kiro_crew/webex/gateway.py	0	start the telegram channel if enabled + credentialed; else no-op. returns the running client (so the gateway can ``close	STRING
HIGH	src/kiro_crew/telegram/gateway.py	0	start the telegram channel if enabled + credentialed; else no-op. returns the running client (so the gateway can ``close	STRING
HIGH	src/kiro_crew/discord/transport.py	0	owner-only, deny-by-default. empty allow-list authorizes nobody.	STRING
HIGH	src/kiro_crew/telegram/transport.py	0	owner-only, deny-by-default. empty allow-list authorizes nobody.	STRING
HIGH	src/kiro_crew/slack/transport.py	0	owner-only, deny-by-default. empty allow-list authorizes nobody.	STRING
HIGH	src/kiro_crew/discord/client.py	0	set/replace the inbound-message handler after construction. lets the gateway wire ``transport.receive`` in once the tran	STRING
HIGH	src/kiro_crew/telegram/client.py	0	set/replace the inbound-message handler after construction. lets the gateway wire ``transport.receive`` in once the tran	STRING
HIGH	src/kiro_crew/webex/client.py	0	set/replace the inbound-message handler after construction. lets the gateway wire ``transport.receive`` in once the tran	STRING
HIGH	src/kiro_crew/wecom/renderer.py	0	idempotent teardown: finalize the turn if it never reached on_done.	STRING
HIGH	src/kiro_crew/webex/renderer.py	0	idempotent teardown: finalize the turn if it never reached on_done.	STRING
HIGH	src/kiro_crew/teams/renderer.py	0	idempotent teardown: finalize the turn if it never reached on_done.	STRING
HIGH	src/kiro_crew/wecom/transport_dispatch.py	0	coordinates teams turns onto the shared ``turndriver``. one instance per gateway lifetime. holds the per-email conversat	STRING
HIGH	src/kiro_crew/weixin/transport_dispatch.py	0	coordinates teams turns onto the shared ``turndriver``. one instance per gateway lifetime. holds the per-email conversat	STRING
HIGH	src/kiro_crew/webex/transport_dispatch.py	0	coordinates teams turns onto the shared ``turndriver``. one instance per gateway lifetime. holds the per-email conversat	STRING
HIGH	src/kiro_crew/teams/transport_dispatch.py	0	coordinates teams turns onto the shared ``turndriver``. one instance per gateway lifetime. holds the per-email conversat	STRING
HIGH	src/kiro_crew/wecom/transport_dispatch.py	0	record the turn to conversation_log (dashboard visibility + restart).	STRING
HIGH	src/kiro_crew/weixin/transport_dispatch.py	0	record the turn to conversation_log (dashboard visibility + restart).	STRING
HIGH	src/kiro_crew/webex/transport_dispatch.py	0	record the turn to conversation_log (dashboard visibility + restart).	STRING
HIGH	src/kiro_crew/telegram/transport_dispatch.py	0	record the turn to conversation_log (dashboard visibility + restart).	STRING
HIGH	src/kiro_crew/teams/transport_dispatch.py	0	record the turn to conversation_log (dashboard visibility + restart).	STRING
HIGH	src/kiro_crew/wecom/transport_dispatch.py	0	in-place acp ``/compact`` on the user's current session.	STRING
HIGH	src/kiro_crew/weixin/transport_dispatch.py	0	in-place acp ``/compact`` on the user's current session.	STRING
HIGH	src/kiro_crew/webex/transport_dispatch.py	0	in-place acp ``/compact`` on the user's current session.	STRING
9 more matches not shown…

Self-Referential Comments92 hits · 289 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	test/test_to_dict_board_fields.py	52	# Create a non-done future to simulate running	COMMENT
MEDIUM⚡	test/test_sandbox_launcher_sweep.py	109	# Create a regular file at the expected dir path to cause makedirs failure	COMMENT
MEDIUM⚡	test/test_deploy_round6_fixes.py	73	# Create a fake PNG (starts with PNG magic bytes, contains null bytes)	COMMENT
MEDIUM	test/test_deploy_round6_fixes.py	103	# Create a binary file — the sensitive-path check happens at the	COMMENT
MEDIUM⚡	test/test_browser_setup.py	926	# Create the config file	COMMENT
MEDIUM⚡	test/test_portability.py	229	# Create a symlink in workspace	COMMENT
MEDIUM⚡	test/test_portability.py	276	# Create a zip without MANIFEST.json	COMMENT
MEDIUM	test/test_portability.py	415	# Create a pre-existing preferences file with different content	COMMENT
MEDIUM	test/test_app_backend.py	83	# Create a minimal backend that starts an HTTP server	COMMENT
MEDIUM	test/test_push_guard.py	78	# Create a bare origin with one commit on main.	COMMENT
MEDIUM	test/test_push_guard.py	87	# Create an initial commit on main.	COMMENT
MEDIUM	test/test_push_guard.py	102	# Create a feature branch with one commit ahead of origin/main.	COMMENT
MEDIUM	test/test_push_guard.py	254	# Create a feature branch from the current origin/main.	COMMENT
MEDIUM	test/test_push_guard.py	286	# Create a feature branch from origin/main.	COMMENT
MEDIUM	test/test_push_guard.py	318	# Create a feature branch with several novel commits.	COMMENT
MEDIUM	test/test_push_guard.py	359	# Create a feature branch from current main (before upstream advance).	COMMENT
MEDIUM	test/test_push_guard.py	391	# Create a feature branch with novel work only.	COMMENT
MEDIUM	test/test_push_guard.py	406	# Create a feature branch from current main (before upstream advance).	COMMENT
MEDIUM	test/test_push_guard.py	547	# Create a feature branch from the CURRENT origin/main (before advance).	COMMENT
MEDIUM	test/test_push_guard.py	598	# Create a squashed feature branch (single commit on origin/main).	COMMENT
MEDIUM	test/test_push_guard.py	680	# Create a feature branch with one commit directly on origin/main.	COMMENT
MEDIUM	test/test_agent.py	655	# Create the fallback binary so _usable() validation passes	COMMENT
MEDIUM	test/test_artifacts_handlers.py	1763	# Create a webapp artifact to tear down	COMMENT
MEDIUM⚡	test/test_deploy_web_handlers.py	1125	# Create a file outside the source tree	COMMENT
MEDIUM⚡	test/test_deploy_web_handlers.py	1131	# Create the source tree with a symlink to outside	COMMENT
MEDIUM⚡	test/test_deploy_web_handlers.py	1301	# Create a normal file and an unreadable one	COMMENT
MEDIUM⚡	test/test_deploy_web_handlers.py	1328	# Create a fake legacy installed app directory	COMMENT
MEDIUM	test/test_deploy_web_handlers.py	655	# Create a minimal artifact namespace with webapp metadata	COMMENT
MEDIUM	test/test_deploy_web_handlers.py	701	# Create a minimal artifact	COMMENT
MEDIUM	test/test_deploy_web_handlers.py	728	# Create a fullstack-layout dir: public/ + api/	COMMENT
MEDIUM	test/test_deploy_web_handlers.py	1342	# Create a data dir that should survive	COMMENT
MEDIUM	test/test_acp_client.py	3619	# Create the session file	COMMENT
MEDIUM⚡	test/test_knowledge.py	1040	# Create a minimal .docx	COMMENT
MEDIUM	test/test_session_cleanup.py	287	# Create a mock session with a provider that has session_id	COMMENT
MEDIUM	test/test_channel_activation.py	378	# Create a long-running task to simulate active execution	COMMENT
MEDIUM⚡	test/test_deploy_round1_fixes.py	93	# Create a symlink inside source pointing outside	COMMENT
MEDIUM	test/test_knowledge_add_source.py	120	# Create a symlink to a sensitive path	COMMENT
MEDIUM	test/test_knowledge_add_source.py	231	# Create a file, then try to access it via ../.. traversal	COMMENT
MEDIUM	test/smoke_gateway.sh	24	# Create a test slot	COMMENT
MEDIUM⚡	test/test_deploy_round15_fixes.py	112	# Create a fake skills root with a SKILL.md	COMMENT
MEDIUM	test/test_thread_override_persistence.py	360	# Create a real agent file so resolution works	COMMENT
MEDIUM	test/test_taskrunner.py	2773	# Create a file and commit	COMMENT
MEDIUM	test/test_gateway_appkit_endpoints.py	59	# Create a test app	COMMENT
MEDIUM	test/test_gateway_appkit_endpoints.py	564	# Create a test app with a secret	COMMENT
MEDIUM	test/test_gateway_appkit_endpoints.py	738	# Create an app without a secret	COMMENT
MEDIUM⚡	test/test_external_registry.py	3466	# Create a target outside sources	COMMENT
MEDIUM⚡	test/test_external_registry.py	3470	# Create a symlink inside sources that looks like a stale checkout	COMMENT
MEDIUM	test/test_external_registry.py	3397	# Create an old .stale-* dir (mtime 30 days ago)	COMMENT
MEDIUM	test/test_cc_agent_resolution.py	277	# Create a kiro agent JSON with same stem	COMMENT
MEDIUM	test/test_dashboard_chat.py	4713	# Create a context builder with mocked build_message	COMMENT
MEDIUM	test/test_dashboard_chat.py	4728	# Create a slot with an agent	COMMENT
MEDIUM	test/test_dashboard_chat.py	7925	# Create a session filed in f1, persist it to history, then drop the active	COMMENT
MEDIUM	test/test_dashboard_static_routes.py	156	# Create a dummy font file with some arbitrary bytes.	COMMENT
MEDIUM	test/test_ephemeral_sessions.py	1062	# Create an empty sessions dir so the path-exists check is meaningful.	COMMENT
MEDIUM	test/test_ephemeral_sessions.py	1100	# Create a literal single-filename entry with an embedded backslash	COMMENT
MEDIUM	test/test_skill_index_app_symlinks.py	25	# Creating a symlink on Windows needs elevation or Developer Mode, which CI	COMMENT
MEDIUM	test/test_deploy_round5_fixes.py	179	# Create a real ClientError class for the mock	COMMENT
MEDIUM⚡	test/test_deploy_round4_fixes.py	59	# Create a real file under a mock HOME that resolves to .aws/credentials	COMMENT
MEDIUM	test/test_cron_session_scope.py	99	# Create a job via CLI so it exists	COMMENT
MEDIUM⚡	test/test_subagent_persistence.py	1110	# Create an old tombstoned folder (8 days)	COMMENT
32 more matches not shown…

AI Slop Vocabulary94 hits · 268 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	setup.py	53	# (not just a dev-only convention). The e2e harness spawns a REAL gateway	COMMENT
MEDIUM⚡	setup.py	61	# harness legitimately drives mutators on the loop as a convenience); the	COMMENT
MEDIUM⚡	setup.py	69	# Folded in: the dashboard Playwright suite boots the same harness	COMMENT
MEDIUM	test/test_app_backend.py	114	# only matters for the test harness.)	COMMENT
MEDIUM	test/test_spawn_audit.py	161	# the TEST harness, not shipped code; the module under test (`ledger_sync._git`)	COMMENT
MEDIUM	test/test_spawn_audit.py	224	# contained; these calls are the harness around it, not the agent's hands.	COMMENT
MEDIUM	test/test_harness.py	98	# Prime the proc as already-exited so the harness's poll() check fires	COMMENT
MEDIUM	test/test_harness.py	121	# selector keeps reporting EOF readiness; the harness keeps looping	COMMENT
MEDIUM	test/test_harness.py	142	# bounded poll, this would hang the harness indefinitely.	COMMENT
MEDIUM	test/test_harness.py	521	assert handle.home.exists() # tmp dir created by harness	CODE
MEDIUM	test/test_dashboard_server_coverage.py	683	# Drive the app through the in-process harness rather than the	COMMENT
MEDIUM	test/test_dashboard_server_coverage.py	722	# In-process harness, not the production listener -- see the sibling	COMMENT
MEDIUM	test/test_channel_model_inheritance.py	25	# ``acp`` explicitly to be robust to future default changes.	COMMENT
MEDIUM⚡	test/test_custom_embedding_model.py	473	# The shared harness sets KIROCREW_SKIP_MODEL_DOWNLOAD=1 so no test can	COMMENT
MEDIUM	test/test_stable_release_gate.py	67	# shell body is a command-injection shape, and it also breaks this harness.	COMMENT
MEDIUM	test/test_redact_meta_snapshot.py	177	# this harness exercises the actual generation-bump logic.	COMMENT
MEDIUM⚡	test/test_acp_stale_recovery.py	457	# ── Probe-ack reclassification (the non-lethal harness) ──────────────────────	COMMENT
MEDIUM	test/test_handlers_mcp_coverage.py	30	# ── harness ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/test_computer_use_snapshot_macos.py	37	# Reuse the harness rather than forking a second set of fakes: a divergent copy	COMMENT
MEDIUM	test/test_computer_use_snapshot_macos.py	41	# The fake-framework harness is shared with ``test_computer_use_ffi`` rather than	COMMENT
MEDIUM	test/test_workflows_authoring_eval.py	129	# The harness must actually REJECT the plausible mistakes (else the rate is fake).	COMMENT
MEDIUM	test/test_kiro_prerequisite.py	273	# The offline E2E harness's fake ACP backend needs no special-case	COMMENT
MEDIUM	test/test_acp_tool_identity.py	123	# gate — not a reimplementation. The harness mirrors	COMMENT
MEDIUM	test/test_computer_use_overlay.py	446	"""Starting a process in order to hide nothing would be absurd."""	STRING
MEDIUM	test/test_playwright_e2e.py	178	# harness gateway inherits os.environ at spawn time.	COMMENT
MEDIUM	test/test_playwright_e2e.py	199	# Explicit ephemeral-harness marker: this gateway runs on an	COMMENT
MEDIUM⚡	test/test_slack_handler.py	2344	# pre-fix (accidentally correct), but the explicit check keeps it robust.	COMMENT
MEDIUM	test/test_handlers_artifacts_coverage.py	835	# ── Remote-artifact provider harness ────────────────────────────────────────	COMMENT
MEDIUM	test/test_session_transfer.py	1312	# Asserting a lower bound (not an exact count) keeps this robust to a future	COMMENT
LOW⚡	test/test_issue_radar_list_probe.py	349	# request — probing would just add a second.	COMMENT
MEDIUM	website/package-lock.json	11720	"resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",	CODE
MEDIUM	website/integration/setup.ts	41	// 200 before any real dial. This is instance-independent and version-robust —	COMMENT
MEDIUM	website/playwright/session-tags-folders.spec.ts	283	// so target it by role + label — robust across both menu contexts.	COMMENT
MEDIUM	website/electron/permission-handler.js	43	// pass. That keeps the camera gated while making the mic robust to absent or	COMMENT
MEDIUM	website/electron/scripts/stage3-autoupdate-test.sh	77	# ad-hoc signatures satisfy Squirrel; that was never true and made this harness	COMMENT
MEDIUM	website/src/test/CrewCompanionBubbleClose.test.tsx	83	// Absolutely positioned over the corner, it sat ON the words of a bubble as	COMMENT
MEDIUM	website/src/test/WindowCalculator.test.ts	311	// Wall-clock micro-benchmarks are noisy, so this test is built to be robust:	COMMENT
MEDIUM	website/src/components/SnipOverlay.tsx	84	// Release = capture (seamless). Sub-threshold drags are discarded as stray clicks.	COMMENT
MEDIUM	website/src/pages/chat/PinnedPrompt.tsx	218	// `visible`→`hidden` at pushUp>0 is seamless: the card has 4px of band	COMMENT
MEDIUM	.github/workflows/claude-review.yml	39	# ("Opus 5 Review", "GPT 5.6 Review") rather than by vendor/harness. Branch	COMMENT
MEDIUM	.github/workflows/claude-review.yml	157	# the same robust pattern design-review.yml and codex-review.yml use.	COMMENT
MEDIUM	.github/workflows/claude-review.yml	375	# (execution_file). No --json-schema, so we parse plain text — robust	COMMENT
MEDIUM	.github/workflows/ux-review.yml	461	# (execution_file). Plain-text parse — robust against claude-code's	COMMENT
MEDIUM	.github/workflows/design-review.yml	95	# header is robust. Automation mode: `prompt` runs on the trigger	COMMENT
MEDIUM	.github/workflows/design-review.yml	292	# (execution_file). No --json-schema, so we parse plain text — robust	COMMENT
MEDIUM	.github/workflows/fork-opus-review.yml	216	# the same robust pattern claude-review.yml and codex-review.yml use.	COMMENT
MEDIUM	.github/workflows/fork-opus-review.yml	445	# (execution_file). No --json-schema, so we parse plain text — robust	COMMENT
MEDIUM	.github/workflows/ci.yml	1107	# The dashboard Playwright specs render the bundled UI the harness	COMMENT
MEDIUM	.github/workflows/fork-ux-review.yml	598	# (execution_file). Plain-text parse — robust against claude-code's	COMMENT
MEDIUM	src/kiro_crew/hooks.py	2727	# tail — e.g. the harness [OPTIONS:] line, past the env var's cap —	COMMENT
MEDIUM	src/kiro_crew/platform_compat.py	2563	# hermetic test harness and load that would time the whoami call out.	COMMENT
LOW	src/kiro_crew/publish_sync.py	552	assert updated.publication is not None # just set above	CODE
MEDIUM	src/kiro_crew/security.py	1749	# verified by exhaustive brute-force + a 40k-input equivalence harness — but	COMMENT
MEDIUM	src/kiro_crew/sandbox.py	240	# A probe child that vanished mid-handshake is a harness failure, not a kernel	COMMENT
MEDIUM	src/kiro_crew/sandbox.py	273	# failure identifies no mechanism — a harness failure, a non-Linux host, or a	COMMENT
MEDIUM	src/kiro_crew/cli.py	1114	# eval (benchmark harness)	STRING
MEDIUM	src/kiro_crew/kiro_prerequisite.py	139	# Marker the offline E2E harness sets on the gateway it spawns. It grants NO	COMMENT
MEDIUM	src/kiro_crew/kiro_prerequisite.py	142	# is a test rig" signal for the harness contract (test/test_harness.py).	COMMENT
MEDIUM	src/kiro_crew/_vendor/llama_cpp/llama_cpp.py	2998	# // NOTE: this is a helper function to facilitate transition to the new batch API - avoid using it	COMMENT
LOW	src/kiro_crew/dashboard/chat_mirror.py	241	# outcome and must land in the SEL trail, not just return a bare 409.	COMMENT
34 more matches not shown…

Structural Annotation Overuse71 hits · 119 pts

Severity	File	Line	Snippet	Context
LOW⚡	install.sh	135	# Step 1: Dependencies	COMMENT
LOW⚡	install.sh	276	# Step 2: Agent Backend (claude-agent-acp)	COMMENT
LOW⚡	install.sh	299	# Step 3: Build	COMMENT
LOW⚡	install.sh	431	# Step 4: PATH & Shell Config	COMMENT
LOW⚡	install.sh	511	# Step 5: Agent Config	COMMENT
LOW⚡	test/test_token_auth.py	1938	# Step 1: query-param auth sets cookie	COMMENT
LOW⚡	test/test_token_auth.py	1949	# Step 2: cookie-based auth on subsequent request uses the EXCHANGED cookie	COMMENT
LOW⚡	test/test_shutdown_event.py	91	# Step 1: make sure there's a default loop on the main thread	COMMENT
LOW⚡	test/test_shutdown_event.py	99	# Step 2: reset the proxy's cached Event so it has to rebuild	COMMENT
LOW⚡	test/test_mcp_artifacts.py	618	# Step 1: GET the target version	COMMENT
LOW⚡	test/test_mcp_artifacts.py	620	# Step 2: PATCH with reverted event metadata	COMMENT
LOW⚡	test/test_taskrunner_v2_scenarios.py	372	# Step 1: create foo.py	COMMENT
LOW⚡	test/test_taskrunner_v2_scenarios.py	378	# Step 2: create bar.py	COMMENT
LOW⚡	test/test_taskrunner_v2_scenarios.py	973	# Step 1: succeeds	COMMENT
LOW⚡	test/test_taskrunner_v2_scenarios.py	980	# Step 2: commits then fails (simulating commit before review catches issue)	COMMENT
LOW⚡	test/test_scenarios_v2.py	69	# Step 1: Create models.py	COMMENT
LOW⚡	test/test_scenarios_v2.py	76	# Step 2: Create routes.py	COMMENT
LOW⚡	test/test_scenarios_v2.py	84	# Step 3: Create tests	COMMENT
LOW⚡	test/test_scenarios_v2.py	355	# Step 1: no-op	COMMENT
LOW⚡	test/test_scenarios_v2.py	359	# Step 2: real change	COMMENT
LOW⚡	test/test_scenarios_v2.py	364	# Step 3: no-op	COMMENT
LOW⚡	test/test_scenarios_v2.py	448	# Step 1: Create 5 files	COMMENT
LOW⚡	test/test_scenarios_v2.py	456	# Step 2: Modify 3 of them	COMMENT
LOW⚡	website/src/test/useDashboardHealthProbe.test.tsx	130	// Step 1: still disconnected on initial load -- probe must NOT fire	COMMENT
LOW⚡	website/src/test/useDashboardHealthProbe.test.tsx	133	// Step 2: simulate WS connect -> connected=true	COMMENT
LOW⚡	website/src/test/useDashboardHealthProbe.test.tsx	139	// Step 3: simulate WS drop -> connected=false; probe SHOULD now fire	COMMENT
LOW	website/src/apps/design-critique/DesignCritiquePage.tsx	405	// Step 2: critique only what was picked, in the picked order, reusing the same slot.	COMMENT
LOW	docs/app-kit/migration-guide.md	35	### Step 1: Import the hooks	COMMENT
LOW	docs/app-kit/migration-guide.md	41	### Step 2: Create the client	COMMENT
LOW	docs/app-kit/migration-guide.md	55	### Step 2: Declare permissions	COMMENT
LOW	docs/app-kit/migration-guide.md	68	### Step 3: Replace HTTP calls	COMMENT
LOW	docs/app-kit/migration-guide.md	81	### Step 4: Replace WebSocket code	COMMENT
LOW⚡	docs/app-kit/migration-guide.md	101	### Step 5: Delete old auth + wrapper code	COMMENT
LOW⚡	docs/app-kit/migration-guide.md	109	### Step 1: Install	COMMENT
LOW⚡	docs/app-kit/migration-guide.md	115	### Step 2: Replace sync calls with async	COMMENT
LOW	skills/browser-auth/SKILL.md	16	## Step 1: Check / Refresh Auth Credentials	COMMENT
LOW	skills/browser-auth/SKILL.md	31	## Step 2: Navigate	COMMENT
LOW	skills/browser-auth/SKILL.md	83	## Step 3: Handle Auth Failures	COMMENT
LOW⚡	src/kiro_crew/mcp_core.py	5119	# Step 1: read the target version's content. Using the API endpoint	COMMENT
LOW⚡	src/kiro_crew/mcp_core.py	5126	# Step 2: PATCH the artifact with the target's content + reverted	COMMENT
LOW⚡	src/kiro_crew/sandbox.py	1191	# Step 1: enter user namespace	COMMENT
LOW⚡	src/kiro_crew/sandbox.py	1199	# Step 2: enter mount namespace (now we have a mapped UID)	COMMENT
LOW⚡	src/kiro_crew/session_pid.py	659	# Step 1: Read file under lock (fast I/O only)	COMMENT
LOW⚡	src/kiro_crew/session_pid.py	664	# Step 2: Process outside lock (slow: os.kill, _get_child_pids, SIGKILL)	COMMENT
LOW	src/kiro_crew/session_pid.py	677	# Step 3: Re-read and write under lock — only remove handled entries,	COMMENT
LOW	…n_skills/kirocrew-dev/prepare-pr/scripts/push_guard.py	296	# Step 1: get patch-ids for ahead-commits (origin/<base>..HEAD).	COMMENT
LOW	…n_skills/kirocrew-dev/prepare-pr/scripts/push_guard.py	353	# Step 2: get patch-ids for bounded base history.	COMMENT
LOW	…n_skills/kirocrew-dev/prepare-pr/scripts/push_guard.py	411	# Step 3: find matches.	COMMENT
LOW	src/kiro_crew/_vendor/llama_cpp/llama_types.py	300	# NOTE: The following type names are not part of the OpenAI OpenAPI specification	COMMENT
LOW	src/kiro_crew/_vendor/llama_cpp/llama_cpp.py	4138	# /// NOTE: This function does not use a jinja parser. It only support a pre-defined list of template. See more: https:/	COMMENT
LOW	src/kiro_crew/config/prompt-orchestrator.md	37	### Step 1: Plan (one-time, before execution starts)	COMMENT
LOW	src/kiro_crew/config/prompt-orchestrator.md	86	### Step 2: Execute	COMMENT
LOW	src/kiro_crew/config/prompt-orchestrator.md	97	### Step 3: Checkpoint Between Stages	COMMENT
LOW⚡	src/kiro_crew/config/loader.py	5966	# Step 1: explicit agent_name	COMMENT
LOW⚡	src/kiro_crew/config/loader.py	5971	# Step 2: default_agent (guaranteed valid by load())	COMMENT
LOW	src/kiro_crew/apps/registry.py	2979	# Step 1: Clone the app repo and build it (npm/pip auto-detected).	COMMENT
LOW	src/kiro_crew/apps/registry.py	3105	# Step 2: Run install script	COMMENT
LOW	src/kiro_crew/apps/registry.py	3273	# Step 3: Resolve dependencies (if declared in manifest)	COMMENT
LOW	src/kiro_crew/apps/registry.py	3290	# Step 4: Register with KiroCrew	COMMENT
LOW⚡	src/kiro_crew/apps/routes.py	872	# Step 2: Run onUninstall script. Reached only once cron cleanup has	COMMENT
11 more matches not shown…

Dead Code56 hits · 104 pts

Severity	File	Line	Context
MEDIUM	test/test_chat_voice.py	328	CODE
MEDIUM	test/test_run_bg_oneliner.py	292	CODE
MEDIUM	test/test_llm_helpers.py	441	CODE
MEDIUM	test/test_llm_helpers.py	464	CODE
MEDIUM	test/test_llm_helpers.py	511	CODE
MEDIUM	test/test_session_sharing.py	90	CODE
MEDIUM	test/test_acp_client.py	5281	CODE
MEDIUM	test/test_acp_client.py	5703	CODE
MEDIUM	test/test_turn_teardown_release.py	72	CODE
MEDIUM	test/test_turn_teardown_release.py	107	CODE
MEDIUM	test/test_session_cleanup.py	407	CODE
MEDIUM	test/test_subagent.py	34	CODE
MEDIUM	test/test_acp_runtime.py	3905	CODE
MEDIUM	test/test_acp_runtime.py	3929	CODE
MEDIUM	test/test_kiro_prerequisite.py	3281	CODE
MEDIUM	test/test_kiro_prerequisite.py	3416	CODE
MEDIUM	test/test_taskrunner_v2_scenarios.py	109	CODE
MEDIUM	test/test_taskrunner_v2_scenarios.py	150	CODE
MEDIUM	test/test_taskrunner_v2_scenarios.py	1344	CODE
MEDIUM	test/test_taskrunner_v2_scenarios.py	2201	CODE
MEDIUM	test/test_taskrunner_v2_scenarios.py	2764	CODE
MEDIUM	test/test_side.py	242	CODE
MEDIUM	test/test_taskrunner.py	357	CODE
MEDIUM	test/test_taskrunner.py	1082	CODE
MEDIUM	test/test_taskrunner.py	1114	CODE
MEDIUM	test/test_taskrunner.py	1800	CODE
MEDIUM	test/test_taskrunner.py	2560	CODE
MEDIUM	test/test_persistence_probe.py	57	CODE
MEDIUM	test/test_persistence_probe.py	73	CODE
MEDIUM	test/test_slack_agent_passthrough.py	29	CODE
MEDIUM	test/test_dashboard_chat.py	2708	CODE
MEDIUM	test/test_dashboard_chat.py	7196	CODE
MEDIUM	test/test_dashboard_chat.py	7239	CODE
MEDIUM	test/test_dashboard_chat.py	10733	CODE
MEDIUM	test/test_dashboard_chat.py	11999	CODE
MEDIUM	test/test_dashboard_chat.py	12033	CODE
MEDIUM	test/test_dashboard_chat.py	12071	CODE
MEDIUM	test/test_dashboard_chat.py	12130	CODE
MEDIUM	test/test_dashboard_chat.py	12246	CODE
MEDIUM	test/test_dashboard_chat.py	12361	CODE
MEDIUM	test/test_dashboard_chat.py	12404	CODE
MEDIUM	test/test_dashboard_chat.py	12445	CODE
MEDIUM	test/test_dashboard_chat.py	12494	CODE
MEDIUM	test/test_subagent_continuable.py	44	CODE
MEDIUM	test/test_weixin_dispatch.py	375	CODE
MEDIUM	test/test_scenarios_v2_logic.py	294	CODE
MEDIUM	test/test_subagent_persistence.py	268	CODE
MEDIUM	test/test_subagent_persistence.py	331	CODE
MEDIUM	test/test_acp_session_provider.py	390	CODE
MEDIUM	test/test_acp_session_provider.py	674	CODE
MEDIUM	test/test_acp_session_provider.py	693	CODE
MEDIUM	test/test_acp_session_provider.py	862	CODE
MEDIUM	test/test_slack_handler.py	632	CODE
MEDIUM	test/test_slack_handler.py	659	CODE
MEDIUM	test/test_subagent_turn_resilience.py	175	CODE
MEDIUM	test/test_subagent_turn_resilience.py	197	CODE

Verbosity Indicators50 hits · 86 pts

Severity	File	Line	Snippet	Context
LOW⚡	install.sh	135	# Step 1: Dependencies	COMMENT
LOW⚡	install.sh	276	# Step 2: Agent Backend (claude-agent-acp)	COMMENT
LOW⚡	install.sh	299	# Step 3: Build	COMMENT
LOW⚡	install.sh	431	# Step 4: PATH & Shell Config	COMMENT
LOW⚡	install.sh	511	# Step 5: Agent Config	COMMENT
LOW⚡	test/test_token_auth.py	1938	# Step 1: query-param auth sets cookie	COMMENT
LOW⚡	test/test_token_auth.py	1949	# Step 2: cookie-based auth on subsequent request uses the EXCHANGED cookie	COMMENT
LOW⚡	test/test_shutdown_event.py	91	# Step 1: make sure there's a default loop on the main thread	COMMENT
LOW⚡	test/test_shutdown_event.py	99	# Step 2: reset the proxy's cached Event so it has to rebuild	COMMENT
LOW⚡	test/test_mcp_artifacts.py	618	# Step 1: GET the target version	COMMENT
LOW⚡	test/test_mcp_artifacts.py	620	# Step 2: PATCH with reverted event metadata	COMMENT
LOW⚡	test/test_taskrunner_v2_scenarios.py	372	# Step 1: create foo.py	COMMENT
LOW⚡	test/test_taskrunner_v2_scenarios.py	378	# Step 2: create bar.py	COMMENT
LOW⚡	test/test_taskrunner_v2_scenarios.py	973	# Step 1: succeeds	COMMENT
LOW⚡	test/test_taskrunner_v2_scenarios.py	980	# Step 2: commits then fails (simulating commit before review catches issue)	COMMENT
LOW⚡	test/test_scenarios_v2.py	69	# Step 1: Create models.py	COMMENT
LOW⚡	test/test_scenarios_v2.py	76	# Step 2: Create routes.py	COMMENT
LOW⚡	test/test_scenarios_v2.py	84	# Step 3: Create tests	COMMENT
LOW⚡	test/test_scenarios_v2.py	355	# Step 1: no-op	COMMENT
LOW⚡	test/test_scenarios_v2.py	359	# Step 2: real change	COMMENT
LOW⚡	test/test_scenarios_v2.py	364	# Step 3: no-op	COMMENT
LOW⚡	test/test_scenarios_v2.py	448	# Step 1: Create 5 files	COMMENT
LOW⚡	test/test_scenarios_v2.py	456	# Step 2: Modify 3 of them	COMMENT
LOW⚡	website/src/test/useDashboardHealthProbe.test.tsx	130	// Step 1: still disconnected on initial load -- probe must NOT fire	COMMENT
LOW⚡	website/src/test/useDashboardHealthProbe.test.tsx	133	// Step 2: simulate WS connect -> connected=true	COMMENT
LOW⚡	website/src/test/useDashboardHealthProbe.test.tsx	139	// Step 3: simulate WS drop -> connected=false; probe SHOULD now fire	COMMENT
LOW	website/src/apps/design-critique/DesignCritiquePage.tsx	405	// Step 2: critique only what was picked, in the picked order, reusing the same slot.	COMMENT
LOW⚡	src/kiro_crew/mcp_core.py	5119	# Step 1: read the target version's content. Using the API endpoint	COMMENT
LOW⚡	src/kiro_crew/mcp_core.py	5126	# Step 2: PATCH the artifact with the target's content + reverted	COMMENT
LOW⚡	src/kiro_crew/sandbox.py	1191	# Step 1: enter user namespace	COMMENT
LOW⚡	src/kiro_crew/sandbox.py	1199	# Step 2: enter mount namespace (now we have a mapped UID)	COMMENT
LOW⚡	src/kiro_crew/session_pid.py	659	# Step 1: Read file under lock (fast I/O only)	COMMENT
LOW⚡	src/kiro_crew/session_pid.py	664	# Step 2: Process outside lock (slow: os.kill, _get_child_pids, SIGKILL)	COMMENT
LOW	src/kiro_crew/session_pid.py	677	# Step 3: Re-read and write under lock — only remove handled entries,	COMMENT
LOW	…n_skills/kirocrew-dev/prepare-pr/scripts/push_guard.py	296	# Step 1: get patch-ids for ahead-commits (origin/<base>..HEAD).	COMMENT
LOW	…n_skills/kirocrew-dev/prepare-pr/scripts/push_guard.py	353	# Step 2: get patch-ids for bounded base history.	COMMENT
LOW	…n_skills/kirocrew-dev/prepare-pr/scripts/push_guard.py	411	# Step 3: find matches.	COMMENT
LOW⚡	src/kiro_crew/config/loader.py	5966	# Step 1: explicit agent_name	COMMENT
LOW⚡	src/kiro_crew/config/loader.py	5971	# Step 2: default_agent (guaranteed valid by load())	COMMENT
LOW	src/kiro_crew/apps/registry.py	2979	# Step 1: Clone the app repo and build it (npm/pip auto-detected).	COMMENT
LOW	src/kiro_crew/apps/registry.py	3105	# Step 2: Run install script	COMMENT
LOW	src/kiro_crew/apps/registry.py	3273	# Step 3: Resolve dependencies (if declared in manifest)	COMMENT
LOW	src/kiro_crew/apps/registry.py	3290	# Step 4: Register with KiroCrew	COMMENT
LOW⚡	src/kiro_crew/apps/routes.py	872	# Step 2: Run onUninstall script. Reached only once cron cleanup has	COMMENT
LOW⚡	src/kiro_crew/apps/routes.py	897	# Step 3: Stop backend + deregister resources (gateway-managed only)	COMMENT
LOW⚡	src/kiro_crew/apps/routes.py	904	# Step 4: Clean dependencies (atomic classify + ledger update)	COMMENT
LOW	src/kiro_crew/apps/routes.py	750	# Step 0: the execution grant must be removable before anything is	COMMENT
LOW	src/kiro_crew/apps/routes.py	795	# Step 1: Cron cleanup is the FIRST uninstall precondition, run BEFORE	COMMENT
LOW	src/kiro_crew/apps/routes.py	928	# Step 5: Remove files. Off-loop: rmtree of a large installed tree is	COMMENT
LOW	src/kiro_crew/apps/routes.py	969	# Step 6: Clean up workspace (each registry app has its own workspace)	COMMENT

Fake / Example Data68 hits · 72 pts

Severity	File	Line	Snippet	Context
LOW⚡	test/test_deploy_round6_fixes.py	15	fake_key = "AKIAIOSFODNN7EXAMPLE"	CODE
LOW⚡	test/test_deploy_round6_fixes.py	17	Finding(kind="credential", snippet=fake_key, line=5, severity="credential"),	CODE
LOW⚡	test/test_deploy_round6_fixes.py	20	assert fake_key not in result, "Raw AKIA key must not appear in summarize output"	CODE
LOW⚡	test/test_deploy_round6_fixes.py	22	assert "[REDACTED" in result or "…" in result or len(fake_key) > len(result.split(fake_key[0])[0])	CODE
LOW⚡	test/test_deploy_round6_fixes.py	51	fake_key = "AKIAIOSFODNN7EXAMPLE"	CODE
LOW⚡	test/test_deploy_round6_fixes.py	52	raw_summary = f"⚠️ 1 potential issue(s):\n • line 5 [credential]: {fake_key}"	CODE
LOW⚡	test/test_deploy_round6_fixes.py	54	assert fake_key not in redacted, "Raw AKIA key must not appear in redacted response"	CODE
LOW	test/test_papyrus_tectonic.py	113	info = zipfile.ZipInfo("placeholder")	CODE
LOW⚡	test/test_kiro_usage_api.py	499	"profileName": "Acme Corp"}]})	CODE
LOW⚡	test/test_kiro_usage_api.py	505	assert out["account"] == "Acme Corp"	CODE
LOW	test/test_cloud_login.py	85	lambda a, *k: ssm.CommandResult("Success", "user@example.com", "", 0),	CODE
LOW⚡	test/test_webex_client.py	197	assert received[0].person_email == "user@example.com" # lowercased	CODE
LOW⚡	test/test_webex_client.py	274	await c.send_message("user@example.com", "hi")	CODE
LOW⚡	test/test_webex_client.py	275	assert calls[0] == {"markdown": "hi", "toPersonEmail": "user@example.com"}	CODE
LOW	test/test_webex_client.py	152	actor_email: str = "user@example.com",	CODE
LOW⚡	test/test_artifacts.py	808	store.create(name="ok", content="placeholder", kind="markdown")	CODE
LOW	test/test_artifacts.py	823	assert loaded.content == "placeholder"	CODE
LOW	test/test_api_file_diff.py	87	subprocess.run(["git", "config", "user.email", "test@test.com"], cwd=tmp_path, capture_output=True)	CODE
LOW	test/test_api_file_diff.py	109	subprocess.run(["git", "config", "user.email", "test@test.com"], cwd=tmp_path, capture_output=True)	CODE
LOW	test/test_api_file_diff.py	134	subprocess.run(["git", "config", "user.email", "test@test.com"], cwd=tmp_path, capture_output=True)	CODE
LOW	test/test_api_file_diff.py	159	subprocess.run(["git", "config", "user.email", "test@test.com"], cwd=tmp_path, capture_output=True)	CODE
LOW	test/test_api_file_diff.py	194	subprocess.run(["git", "config", "user.email", "test@test.com"], cwd=tmp_path, capture_output=True)	CODE
LOW	test/test_action_interactions.py	186	action["placeholder"] = {"text": "Pick date"}	CODE
LOW⚡	test/test_deploy_web_profiles.py	280	fake_key = "AKIAIOSFODNN7EXAMPLE"	CODE
LOW⚡	test/test_deploy_web_profiles.py	282	lambda a, *k: f"aws configure failed: key {fake_key} rejected")	CODE
LOW⚡	test/test_deploy_web_profiles.py	286	assert fake_key not in resp.text	CODE
LOW⚡	test/test_context.py	666	fake_key = "AKIAIOSFODNN7EXAMPLE"	CODE
LOW⚡	test/test_context.py	669	AsyncMock(return_value=f"summary with {fake_key} leaked"),	CODE
LOW⚡	test/test_context.py	674	assert fake_key not in result	CODE
LOW	website/electron/browser-ops.js	313	var attrs = ["alt", "title", "placeholder", "value"];	CODE
LOW	website/electron/browser-ops.js	327	attrs = ["alt", "title", "placeholder"];	CODE
LOW	website/src/test/DisplayPanel.test.tsx	221	'placeholder',	CODE
LOW	website/src/test/DisplayPanel.test.tsx	230	expect(location).toHaveAttribute('placeholder', '/path/to/theme')	CODE
LOW	website/src/test/SessionGridLayout.resizeTouch.test.tsx	29	const leaf = (id: string) => ({ type: 'leaf' as const, id, kind: 'placeholder' as const })	CODE
LOW	website/src/test/CodeReviewSageModuleLabels.test.tsx	28	'label', 'title', 'placeholder', 'heading', 'text', 'description', 'tooltip',	CODE
LOW	website/src/test/splitLayoutStore.test.ts	14	const pLeaf = (id: string): GridNode => ({ type: 'leaf', id, kind: 'placeholder' })	CODE
LOW	website/src/hooks/useSessionGrid.ts	8	export type LeafKind = 'placeholder' \| 'session' \| 'terminal'	CODE
LOW	website/src/hooks/useSessionGrid.ts	23	const newLeaf = (kind: LeafKind = 'placeholder', extra: Partial<GridLeaf> = {}): GridLeaf => ({	CODE
LOW	website/src/hooks/useSessionGrid.ts	235	const paneCount = leaves.filter((l) => l.kind !== 'placeholder').length	CODE
LOW	website/src/i18n/locales/en.manual.json	623	"placeholder": "Tell me what to remember…",	CODE
LOW	website/src/i18n/locales/ja.json	964	"placeholder": "覚えておくことを教えてください…",	CODE
LOW	website/src/i18n/locales/ja.json	2146	"placeholder": "すべてのリッスンしているエージェントに何かを言う…",	CODE
LOW	website/src/i18n/locales/de.json	992	"placeholder": "Sag mir, woran ich dich erinnern soll…",	CODE
LOW	website/src/i18n/locales/de.json	2186	"placeholder": "Etwas an alle zuhörenden Agenten sagen…",	CODE
LOW	website/src/i18n/locales/ru.json	1048	"placeholder": "Скажи, о чём напомнить...",	CODE
LOW	website/src/i18n/locales/ru.json	2266	"placeholder": "Скажите что-нибудь всем слушающим агентам…",	CODE
LOW	website/src/i18n/locales/zh-CN.json	964	"placeholder": "告诉我要记住什么…",	CODE
LOW	website/src/i18n/locales/zh-CN.json	2146	"placeholder": "对所有正在聆听的代理说点什么……",	CODE
LOW	website/src/i18n/locales/pt.json	1020	"placeholder": "Me diga o que lembrar…",	CODE
LOW	website/src/i18n/locales/pt.json	2226	"placeholder": "Diga algo a todos os agentes à escuta…",	CODE
LOW	website/src/i18n/locales/en.json	1504	"placeholder": "Say something to every listening agent…",	CODE
LOW	website/src/i18n/locales/it.json	1020	"placeholder": "Dimmi cosa ricordare…",	CODE
LOW	website/src/i18n/locales/it.json	2226	"placeholder": "Dì qualcosa a tutti gli agenti in ascolto…",	CODE
LOW	website/src/i18n/locales/fr.json	1020	"placeholder": "Dis-moi quoi retenir…",	CODE
LOW	website/src/i18n/locales/fr.json	2226	"placeholder": "Dites quelque chose à tous les agents à l’écoute…",	CODE
LOW	website/src/i18n/locales/ko.json	964	"placeholder": "기억할 내용을 알려 주세요…",	CODE
LOW	website/src/i18n/locales/ko.json	2146	"placeholder": "듣고 있는 모든 에이전트에게 말하기…",	CODE
LOW	website/src/i18n/locales/es.json	1020	"placeholder": "Dime qué quieres recordar…",	CODE
LOW	website/src/i18n/locales/es.json	2226	"placeholder": "Di algo a todos los agentes que escuchan…",	CODE
LOW	docs/system-specs/features/inline-action-buttons.md	167	"placeholder": {"type": "plain_text", "text": "Snooze until..."}	CODE
8 more matches not shown…

Redundant / Tautological Comments41 hits · 60 pts

Severity	File	Line	Snippet	Context
LOW⚡	test/test_sandbox_launcher_sweep.py	151	# Set mtime to 2 hours ago (well past threshold)	COMMENT
LOW	test/test_crash_dump_store.py	288	# Read the file content — should contain faulthandler thread stack output	COMMENT
LOW	test/test_crash_dump_store.py	338	# Read the file and confirm real stacks landed (not just the header)	COMMENT
LOW⚡	test/test_push_guard.py	176	# Set origin to a non-existent path so fetch always fails.	COMMENT
LOW	test/test_push_guard.py	765	# Set origin to a credential-bearing URL that will fail to fetch.	COMMENT
LOW	test/test_pip_deps_consistency.py	281	# Check if this try catches ImportError	COMMENT
LOW	test/test_mcp_gateway_oversize.py	347	# Set mtime to 25h ago	COMMENT
LOW	test/test_dashboard_chat.py	5628	# Set s1 to normal (leaving YOLO) — s2 should be untouched	COMMENT
LOW⚡	test/test_session_restore.py	346	# Set mtime to 30 days ago	COMMENT
LOW	test/test_session_restore.py	143	# Set mtime to 2 hours ago	COMMENT
LOW	src/kiro_crew/cli_server.py	1253	# Check if there are new commits	COMMENT
LOW⚡	src/kiro_crew/cli_setup.py	782	# Check if already configured	COMMENT
LOW⚡	src/kiro_crew/mcp_core.py	5097	# Open file affordance on diff blocks). See artifacts skill for	COMMENT
LOW	src/kiro_crew/security.py	3757	# Check if this token resolves to "git"	COMMENT
LOW	src/kiro_crew/security.py	5039	# Check if any token resolves to a known read verb or hardlink/symlink	COMMENT
LOW	src/kiro_crew/session.py	2646	# Check if session was resumed	COMMENT
LOW	src/kiro_crew/mcp_shared.py	976	# Check if worker just finished	COMMENT
LOW	src/kiro_crew/sandbox.py	1624	# Check if any exposed files live under this dir	STRING
LOW	src/kiro_crew/session_pid.py	789	# Check if the owning gateway is still alive. Route through	COMMENT
LOW	src/kiro_crew/session_pid.py	852	# Check if root died between our signal and now	COMMENT
LOW	src/kiro_crew/cli_doctor.py	994	# Check if gateway is running — connect to 127.0.0.1 (loopback)	COMMENT
LOW	src/kiro_crew/_vendor/llama_cpp/llama_chat_format.py	2818	# Check if vision is supported	COMMENT
LOW	src/kiro_crew/_vendor/llama_cpp/llama.py	1468	# Check if stop sequence is in the token	COMMENT
LOW	src/kiro_crew/config/validation.py	279	# Check if the deprecated key is present in data	COMMENT
LOW	…o_crew/deploy/skills/artifact-deploy/scripts/reaper.sh	147	# Check if bucket is truly gone (NoSuchBucket) or deletion failed.	COMMENT
LOW	…o_crew/deploy/skills/artifact-deploy/scripts/reaper.sh	193	# Check if already gone (NoSuchOriginAccessControl) vs real failure	COMMENT
LOW	…o_crew/deploy/skills/artifact-deploy/scripts/reaper.sh	261	# Check if this deployment has a backend stack.	COMMENT
LOW	…/skills/artifact-deploy/scripts/reaper_lambda/index.py	571	# Check if this deployment has a backend stack.	COMMENT
LOW	src/kiro_crew/dashboard/chat_runner.py	3439	# Check if last stop was soft (session preserved, no re-injection).	COMMENT
LOW	src/kiro_crew/dashboard/chat_slack.py	332	# Check if already linked	COMMENT
LOW	src/kiro_crew/dashboard/handlers/terminal.py	482	# Check if reconnecting to existing session	COMMENT
LOW	src/kiro_crew/dashboard/handlers/discover.py	156	# Check if a skill with a matching provider/slug key is already installed.	COMMENT
LOW	src/kiro_crew/dashboard/handlers/core.py	1945	# Check if the subagent is done.	COMMENT
LOW	src/kiro_crew/knowledge/agent_fetch.py	59	# Check if the response is an error message rather than actual content	COMMENT
LOW	src/kiro_crew/mcp_gateway/spill.py	139	# Check if this looks like an MCP tools/call result	COMMENT
LOW	src/kiro_crew/slack/gateway.py	1089	# Check if the parent slot is trusted (not all slots).	COMMENT
LOW	src/kiro_crew/slack/gateway.py	5730	# Check if there are actually new commits	COMMENT
LOW	src/kiro_crew/slack/interactions.py	2481	# Check if session already has a linked thread/channel	COMMENT
LOW	src/kiro_crew/apps/backend.py	605	# Check if the port is already in use by a healthy instance	COMMENT
LOW	src/kiro_crew/apps/manager.py	477	# Check if already installed — reject, use update_app() or uninstall first	COMMENT
LOW	src/kiro_crew/acp/client.py	2782	# Check if kiro-cli supports session/load	COMMENT

AI Structural Patterns77 hits · 52 pts

Severity	File	Line	Context
LOW	test/test_issue_triage_workflow.py	167	CODE
LOW	test/test_source_providers.py	5593	CODE
LOW	test/test_instances.py	845	CODE
LOW	test/test_instances.py	1954	CODE
LOW	test/test_sandbox_unsandboxed_exec_consent.py	17	CODE
LOW	packages/kirocrew-client-py/kirocrew_client/client.py	95	CODE
LOW	src/kiro_crew/voice_reply.py	363	CODE
LOW	src/kiro_crew/voice_reply.py	681	CODE
LOW	src/kiro_crew/hooks.py	403	CODE
LOW	src/kiro_crew/subagent.py	1154	CODE
LOW	src/kiro_crew/subagent.py	2548	CODE
LOW	src/kiro_crew/cron.py	1100	CODE
LOW	src/kiro_crew/cron.py	1209	CODE
LOW	src/kiro_crew/cron.py	1316	CODE
LOW	src/kiro_crew/taskrunner.py	186	CODE
LOW	src/kiro_crew/llm_helpers.py	436	CODE
LOW	src/kiro_crew/context.py	1084	CODE
LOW	src/kiro_crew/context.py	1594	CODE
LOW	src/kiro_crew/context.py	2017	CODE
LOW	src/kiro_crew/artifacts.py	882	CODE
LOW	src/kiro_crew/artifacts.py	1277	CODE
LOW	src/kiro_crew/artifacts.py	1866	CODE
LOW	src/kiro_crew/webhooks.py	724	CODE
LOW	src/kiro_crew/sel.py	555	CODE
LOW	src/kiro_crew/kiro_prerequisite.py	1350	CODE
LOW	src/kiro_crew/kiro_prerequisite.py	1678	CODE
LOW	src/kiro_crew/history.py	3953	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama_chat_format.py	1461	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama_chat_format.py	1824	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama_chat_format.py	4131	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama_chat_format.py	69	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama_chat_format.py	613	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama_chat_format.py	2852	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama_chat_format.py	3402	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama.py	60	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama.py	697	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama.py	785	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama.py	847	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama.py	1188	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama.py	1808	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama.py	1905	CODE
LOW	src/kiro_crew/_vendor/llama_cpp/llama.py	1997	CODE
LOW	src/kiro_crew/providers/acp.py	231	CODE
LOW	src/kiro_crew/workflows/service.py	123	CODE
LOW	src/kiro_crew/workflows/runner.py	273	CODE
LOW	src/kiro_crew/workflows/runner.py	361	CODE
LOW	src/kiro_crew/workflows/runner.py	601	CODE
LOW	src/kiro_crew/workflows/runner.py	975	CODE
LOW	src/kiro_crew/workflows/__init__.py	129	CODE
LOW	src/kiro_crew/dashboard/server.py	1680	CODE
LOW	src/kiro_crew/dashboard/server.py	3448	CODE
LOW	src/kiro_crew/dashboard/loop_watchdog.py	167	CODE
LOW	src/kiro_crew/dashboard/state.py	3227	CODE
LOW	src/kiro_crew/dashboard/handlers/usage.py	1166	CODE
LOW	src/kiro_crew/dashboard/handlers/usage.py	1226	CODE
LOW	src/kiro_crew/cloud/ec2.py	413	CODE
LOW	src/kiro_crew/slack/handler.py	2575	CODE
LOW	src/kiro_crew/slack/transport_dispatch.py	110	CODE
LOW	src/kiro_crew/slack/blocks.py	255	CODE
LOW	src/kiro_crew/instances/registry.py	351	CODE
17 more matches not shown…

Docstring Block Structure10 hits · 50 pts

Severity	File	Line	Snippet	Context
HIGH	src/kiro_crew/sandbox.py	2614	Wrap a command argv with OS-level sandbox if available. Args: argv: Original command + args. mode:	STRING
HIGH	src/kiro_crew/metrics/schema.py	145	Validate a metric name against C4 namespace rules. Args: name: Dotted metric name to validate. app_	STRING
HIGH	src/kiro_crew/metrics/schema.py	200	Validate and sanitize metric attributes per C4 rules. - Caps attribute count at MAX_ATTR_COUNT. - Rejects/redac	STRING
HIGH	src/kiro_crew/_vendor/llama_cpp/llama.py	123	Load a llama.cpp model from `model_path`. Examples: Basic usage >>> import llama_cpp	STRING
HIGH	src/kiro_crew/_vendor/llama_cpp/llama.py	598	Tokenize a string. Args: text: The utf-8 encoded string to tokenize. add_bos: Whether t	STRING
HIGH	src/kiro_crew/_vendor/llama_cpp/llama.py	868	Create a generator of tokens from a prompt. Examples: >>> llama = Llama("models/ggml-7b.bin")	STRING
HIGH	src/kiro_crew/_vendor/llama_cpp/llama.py	1836	Generate text from a prompt. Args: prompt: The prompt to generate text from. suffix: A	STRING
HIGH	src/kiro_crew/_vendor/llama_cpp/llama.py	1933	Generate text from a prompt. Args: prompt: The prompt to generate text from. suffix: A	STRING
HIGH	src/kiro_crew/testing/harness.py	412	Spin up an isolated gateway from the current workspace checkout. Args: fixture: Named fixture (``empty`` /	STRING
HIGH	src/kiro_crew/apps/module_loader.py	60	Load an app module and return the specified callable. Uses importlib.util.spec_from_file_location to load directly	STRING

Example Usage Blocks9 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	packaging/build-desktop.sh	29	# Usage:	COMMENT
LOW	packaging/signing/sign.sh	4	# Usage:	COMMENT
LOW⚡	skills/goal-loop/scaffold.sh	10	# Usage:	COMMENT
LOW⚡	skills/self-nudge-loop/scaffold.sh	4	# Usage:	COMMENT
LOW	…crew/deploy/skills/artifact-deploy/scripts/teardown.sh	5	# Usage:	COMMENT
LOW	…eploy/skills/artifact-deploy/scripts/deploy-backend.sh	7	# Usage:	COMMENT
LOW	…eploy/skills/artifact-deploy/scripts/install-reaper.sh	6	# Usage:	COMMENT
LOW	…o_crew/deploy/skills/artifact-deploy/scripts/deploy.sh	4	# Usage:	COMMENT
LOW	…ew/deploy/skills/artifact-deploy/scripts/deploy-app.sh	7	# Usage:	COMMENT

Overly Generic Function Names7 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW⚡	test/test_no_blocking_call_on_loop.py	313	" def helper():\n"	CODE
LOW	src/kiro_crew/task_executor.py	276	async def execute_task(	CODE
LOW	src/kiro_crew/testing/fake_computer_use.py	501	def perform_action(self, app: AppRef, rec: ElementRec, action: str) -> DriverResult:	CODE
LOW	src/kiro_crew/computer_use/service.py	299	def perform_action(self, app: AppRef, rec: ElementRec, action: str) -> str:	CODE
LOW	src/kiro_crew/computer_use/backend.py	187	def perform_action(self, app: AppRef, rec: ElementRec, action: str) -> DriverResult:	CODE
LOW	src/kiro_crew/computer_use/backend.py	266	def perform_action(self, app: AppRef, rec: ElementRec, action: str) -> DriverResult:	CODE
LOW	src/kiro_crew/computer_use/macos_driver.py	518	def perform_action(self, app: AppRef, rec: ElementRec, action: str) -> DriverResult:	CODE

Slop Phrases3 hits · 7 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	test/test_llm_helpers.py	69	text = '{"key": "value"}\nLet me know if you need anything else.'	CODE
MEDIUM	test/test_chat_title.py	304	"I'm unable to open the document",	CODE
MEDIUM	src/kiro_crew/knowledge/agent_fetch.py	34	"I'm unable to",	CODE

Analysis Overview

What These Metrics Mean

Score History

Severity Breakdown

Directory Score Breakdown

Pattern Findings