The open-source managed agents platform. Turn coding agents into real teammates — assign tasks, track progress, compound skills.
This report presents the forensic synthetic code analysis of multica-ai/multica, a Go project with 40,329 GitHub stars. SynthScan v2.0 examined 630,298 lines of code across 2637 source files, recording 1595 pattern matches distributed across 12 syntactic categories. The overall adjusted score of 3.3 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1595 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.selfhost.yml | 1 | # Self-hosting Docker Compose — starts PostgreSQL, backend, and frontend. | COMMENT |
| LOW | docker-compose.selfhost.yml | 101 | # "127.0.0.1/32" when running behind a same-host reverse proxy. | COMMENT |
| LOW | CLI_AND_DAEMON.md | 421 | COMMENT | |
| LOW | deploy/helm/multica/values.yaml | 21 | # ----------------------------------------------------------------------------- | COMMENT |
| LOW | deploy/helm/multica/values.yaml | 41 | # --from-literal=MULTICA_DEV_VERIFICATION_CODE="" | COMMENT |
| LOW | deploy/helm/multica/values.yaml | 81 | # leader-elected workload split — increase this only if you actually | COMMENT |
| LOW | deploy/helm/multica/values.yaml | 141 | # | COMMENT |
| LOW | server/cmd/server/listeners.go | 161 | "actor_type": e.ActorType, | COMMENT |
| LOW | server/cmd/server/autopilot_schedule_job_test.go | 461 | t.Fatalf("disabled trigger must not produce sys_cron_executions rows, got %d", execRows) | COMMENT |
| LOW | server/cmd/server/autopilot_schedule_job_test.go | 541 | // The hook returns its parse error to manager.runJob, which logs a | COMMENT |
| LOW | server/cmd/server/autopilot_schedule_job_test.go | 641 | CronExpression: pgtype.Text{String: cron, Valid: true}, | COMMENT |
| LOW | server/cmd/server/autopilot_schedule_job_test.go | 661 | // of this scheduler) already processed is NOT replayed. | COMMENT |
| LOW | server/cmd/server/autopilot_schedule_job_test.go | 721 | } | COMMENT |
| LOW | server/cmd/server/autopilot_listeners_test.go | 501 | // and task creation), DispatchAutopilot must return (run, nil) with | COMMENT |
| LOW | server/cmd/server/runtime_sweeper.go | 21 | sweepInterval = 30 * time.Second | COMMENT |
| LOW | server/cmd/server/runtime_sweeper.go | 41 | // liveness (agent_runtime.last_seen_at freshness within | COMMENT |
| LOW | server/cmd/server/runtime_sweeper.go | 61 | // "queued behind a long-running task" window for an online runtime, so we | COMMENT |
| LOW | server/cmd/server/runtime_sweeper.go | 241 | ActorType: "system", | COMMENT |
| LOW | server/cmd/server/dbstats.go | 21 | // defaultMaxConns / defaultMinConns are the per-pod pgxpool sizing | COMMENT |
| LOW | server/cmd/server/dbstats.go | 41 | // | COMMENT |
| LOW | server/cmd/server/dbstats.go | 201 | // newSamplerDBPool builds a tiny pgxpool aimed exclusively at the | COMMENT |
| LOW | server/cmd/server/autopilot_dispatch_for_plan_test.go | 261 | // | COMMENT |
| LOW | server/cmd/server/autopilot_failure_monitor.go | 181 | // emitAutopilotPausedNotifications creates one inbox_item per relevant | COMMENT |
| LOW | server/cmd/server/comment_at_least_once_test.go | 181 | COMMENT | |
| LOW | server/cmd/server/main.go | 401 | // alongside the other long-running workers, AFTER the HTTP server has | COMMENT |
| LOW | server/cmd/server/main.go | 481 | COMMENT | |
| LOW | server/cmd/server/router.go | 261 | // APIClient: wire the real Lark Open Platform HTTP client | COMMENT |
| LOW | server/cmd/server/router.go | 301 | // Feishu ResolverSet that the engine.Router runs through, | COMMENT |
| LOW | server/cmd/server/router.go | 361 | COMMENT | |
| LOW | server/cmd/server/router.go | 421 | // Slack integration. Multi-tenant B2 model (MUL-3666): Multica hosts ONE | COMMENT |
| LOW | server/cmd/server/router.go | 481 | // `/issue` slash command (MUL-3908): a real Slack slash command, | COMMENT |
| LOW | server/cmd/server/router.go | 641 | // Health / readiness checks | COMMENT |
| LOW | server/cmd/server/router.go | 701 | r.Post("/api/webhooks/autopilots/{token}", h.HandleAutopilotWebhook) | COMMENT |
| LOW | server/cmd/server/router.go | 781 | r.Patch("/api/me/onboarding", h.PatchOnboarding) | COMMENT |
| LOW | server/cmd/server/router.go | 801 | // web/client needs must go through a purpose-built business endpoint | COMMENT |
| LOW | server/cmd/server/router.go | 861 | r.Group(func(r chi.Router) { | COMMENT |
| LOW | server/cmd/server/router.go | 881 | // initiator or an admin) before doing anything. | COMMENT |
| LOW | server/cmd/server/router.go | 961 | // model is single-user; X-Workspace-ID would be ignored even | COMMENT |
| LOW | server/cmd/server/router.go | 1321 | }) | COMMENT |
| LOW | server/cmd/server/composio_callback_public_test.go | 1 | package main | COMMENT |
| LOW | server/cmd/multica/cmd_setup.go | 281 | // resolveSelfHostServerURL picks the backend URL for `setup self-host`: the | COMMENT |
| LOW | server/cmd/multica/cmd_setup.go | 301 | return normalizeAPIBaseURL(v), true | COMMENT |
| LOW | server/cmd/multica/cmd_id_resolver.go | 121 | return matches[i].ID < matches[j].ID | COMMENT |
| LOW | server/cmd/multica/cmd_agent.go | 1181 | if err != nil { | COMMENT |
| LOW | server/cmd/multica/cmd_auth.go | 141 | // | COMMENT |
| LOW | server/cmd/multica/cmd_login.go | 41 | COMMENT | |
| LOW | server/cmd/multica/cmd_issue.go | 21 | "github.com/multica-ai/multica/server/internal/cli" | COMMENT |
| LOW | server/cmd/multica/cmd_issue.go | 1441 | output, _ := cmd.Flags().GetString("output") | COMMENT |
| LOW | server/cmd/multica/cmd_daemon.go | 161 | COMMENT | |
| LOW | server/cmd/multica/cmd_daemon_windows.go | 21 | // createBreakawayFromJob lets the daemon escape its parent shell's Job | COMMENT |
| LOW | server/cmd/multica/cmd_daemon_windows.go | 61 | // isAccessDeniedSpawnErr reports whether the error returned from | COMMENT |
| LOW | server/cmd/multica/cmd_runtime_profile.go | 21 | // | COMMENT |
| LOW | server/cmd/multica/cmd_issue_test.go | 2221 | } | COMMENT |
| LOW | server/cmd/multica/cmd_agent_test.go | 61 | t.Fatalf("restore cwd: %v", err) | COMMENT |
| LOW | server/cmd/multica/cmd_agent_test.go | 641 | } | COMMENT |
| LOW | server/cmd/multica/cmd_auth_test.go | 201 | // TestLoginTokenHelpOutputRendersCleanly renders loginCmd's flag help through | COMMENT |
| LOW | server/cmd/migrate/migrate_concurrent_test.go | 21 | // MUL-2956 — concurrent migration race test. | COMMENT |
| LOW | server/cmd/migrate/migrate_concurrent_test.go | 41 | // lock externally, every concurrent runMigrations is observed to | COMMENT |
| LOW | server/cmd/migrate/migrate_concurrent_test.go | 141 | COMMENT | |
| LOW | server/cmd/migrate/migrate_concurrent_test.go | 321 | // TestRunMigrationsAdvisoryLockSerializes proves the lock genuinely | COMMENT |
| 966 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | deploy/helm/multica/values.yaml | 1 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 3 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 21 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | deploy/helm/multica/values.yaml | 45 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | deploy/helm/multica/values.yaml | 48 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | deploy/helm/multica/values.yaml | 50 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 72 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 74 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 139 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 145 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 166 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 168 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 181 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 183 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 20 | // ── List ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 74 | // ── Get ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 112 | // ── Create ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 164 | // ── Update ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 224 | // ── Delete ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 253 | // ── Members ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 299 | // ── Member Add ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 346 | // ── Member Set Role ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 396 | // ── Member Remove ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 440 | // ── Activity ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 499 | // ── Init ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 80 | // ── Payload normalization ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 212 | // ── Dedupe + signature helpers ────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 305 | // ── Public ingress ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 565 | // ── Event filter helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 713 | // ── Persistence helpers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 856 | // ── Rate-limit / IP plumbing ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 28 | // ── Response types ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 159 | // ── Converters ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 298 | // ── Request types ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 378 | // ── Handlers ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 986 | // ── Collaborator (access grant) management ─────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 1103 | // ── Trigger management ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 1690 | // ── Runs ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 1773 | // ── Manual trigger ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/webhook_delivery.go | 17 | // ── Response types ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/webhook_delivery.go | 147 | // ── Handlers ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/webhook_delivery_test.go | 20 | // ── Setup helpers ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/webhook_delivery_test.go | 102 | // ── Tests ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 22 | // ── Fixture helpers ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 177 | // ── HTTP contract: event_filters JSON shape & PATCH semantics ────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 445 | // ── Tests ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 719 | // ── Additional coverage (PR #2348 review) ────────────────────────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 719 | // ── Additional coverage (PR #2348 review) ────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/github_test.go | 1430 | // ── CI / mergeable_state tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook_test.go | 10 | // ── Token generation ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook_test.go | 50 | // ── Payload normalization ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook_test.go | 218 | // ── Event filter helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 20 | // ── Response types ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 59 | // ── Converters ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 110 | // ── Helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 187 | // ── Handlers ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 483 | // ── Squad Members ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 502 | // ── Squad Member Status ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 883 | // ── Squad Leader Evaluation ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 983 | // ── Squad Trigger Logic ───────────────────────────────────────────────────── | COMMENT |
| 110 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/ui/markdown/mentions.ts | 17 | export function preprocessMentionShortcodes(text: string): string { | CODE |
| LOW | packages/ui/markdown/issue-identifiers.ts | 61 | export function preprocessIssueIdentifiers(text: string): string { | CODE |
| LOW | packages/ui/components/ui/chart.tsx | 346 | function getPayloadConfigFromPayload( | CODE |
| LOW | packages/core/types/attachment-url.ts | 65 | export function attachmentIdFromDownloadURL(rawURL: string): string | undefined { | CODE |
| LOW | packages/core/types/attachment-url.ts | 121 | export function contentReferencesAttachment( | CODE |
| LOW | packages/core/inbox/ws-updaters.ts | 28 | export function onInboxIssueStatusChanged( | CODE |
| LOW | packages/core/inbox/queries.ts | 25 | export function inboxUnreadSummaryOptions() { | CODE |
| LOW | packages/core/autopilots/queries.ts | 63 | export function autopilotDeliveriesOptions( | CODE |
| LOW | packages/core/autopilots/mutations.ts | 131 | export function useCreateAutopilotTrigger() { | CODE |
| LOW | packages/core/autopilots/mutations.ts | 143 | export function useUpdateAutopilotTrigger() { | CODE |
| LOW | packages/core/autopilots/mutations.ts | 155 | export function useDeleteAutopilotTrigger() { | CODE |
| LOW | packages/core/autopilots/mutations.ts | 167 | export function useRotateAutopilotTriggerWebhookToken() { | CODE |
| LOW | packages/core/autopilots/mutations.ts | 183 | export function useReplayAutopilotDelivery() { | CODE |
| LOW | packages/core/chat/queries.ts | 200 | export function hasPendingChatTasksOptions(wsId: string) { | CODE |
| LOW | packages/core/chat/mutations.ts | 211 | export function useSetChatSessionArchived() { | CODE |
| LOW | packages/core/markdown/mention-shortcodes.ts | 18 | export function preprocessMentionShortcodes(text: string): string { | CODE |
| LOW | packages/core/platform/workspace-storage.ts | 90 | export function registerForWorkspaceRehydration(fn: () => void) { | CODE |
| LOW | packages/core/platform/workspace-storage.ts | 106 | export function createWorkspaceAwareStorage(adapter: StorageAdapter): StateStorage { | CODE |
| LOW | packages/core/platform/system-notification.ts | 45 | export function registerSystemNotificationClickHandler( | CODE |
| LOW⚡ | packages/core/platform/system-notification.ts | 61 | export function isWebNotificationSupported(): boolean { | CODE |
| LOW⚡ | packages/core/platform/system-notification.ts | 68 | export function getWebNotificationPermission(): WebNotificationPermission { | CODE |
| LOW⚡ | packages/core/platform/system-notification.ts | 78 | export async function requestWebNotificationPermission(): Promise<WebNotificationPermission> { | CODE |
| LOW | packages/core/workspace/avatar-url.ts | 3 | export function resolvePublicFileUrlWithBase(rawUrl: string | null | undefined, baseUrl: string): string | null { | CODE |
| LOW | packages/core/workspace/pending-delete.ts | 21 | export function markWorkspaceDeletePending(workspaceId: string) { | CODE |
| LOW | packages/core/workspace/pending-delete.ts | 25 | export function unmarkWorkspaceDeletePending(workspaceId: string) { | CODE |
| LOW | packages/core/runtimes/profiles.ts | 23 | export function runtimeProfileListOptions(wsId: string) { | CODE |
| LOW | packages/core/runtimes/profiles.ts | 83 | export function parseRuntimeProfileBoundConflict( | CODE |
| LOW | packages/core/runtimes/cloud-runtime.ts | 51 | export function isCloudRuntimeNodePending(status: string): boolean { | CODE |
| LOW | packages/core/runtimes/cloud-runtime.ts | 55 | export function cloudRuntimeNodeListOptions( | CODE |
| LOW | packages/core/runtimes/cloud-runtime.ts | 72 | export function useCreateCloudRuntimeNode(wsId: string) { | CODE |
| LOW | packages/core/runtimes/cloud-runtime.ts | 83 | export function useDeleteCloudRuntimeNode(wsId: string) { | CODE |
| LOW | packages/core/runtimes/cli-version.ts | 54 | export function checkQuickCreateCliVersion(detected: string | undefined | null): CliVersionCheck { | CODE |
| LOW | packages/core/runtimes/queries.ts | 31 | export function runtimeUsageByAgentOptions( | CODE |
| LOW | packages/core/runtimes/queries.ts | 43 | export function runtimeUsageByHourOptions(runtimeId: string, days: number, tz: string) { | CODE |
| LOW | packages/core/runtimes/local-skills.ts | 29 | export async function resolveRuntimeLocalSkills( | CODE |
| LOW | packages/core/runtimes/local-skills.ts | 56 | export async function resolveRuntimeLocalSkillImport( | CODE |
| LOW | packages/core/runtimes/local-skills.ts | 95 | export function runtimeLocalSkillsOptions(runtimeId: string | null | undefined) { | CODE |
| LOW | packages/core/runtimes/mutations.ts | 27 | export function useArchiveAgentsAndDeleteRuntime(wsId: string) { | CODE |
| LOW | packages/core/paths/resolve.ts | 30 | export function resolvePostAuthDestination( | CODE |
| LOW | packages/core/agents/queries.ts | 104 | export function agentTemplateDetailOptions(slug: string) { | CODE |
| LOW | packages/core/agents/openclaw-runtime-config.ts | 32 | export function parseOpenclawRuntimeConfig( | CODE |
| LOW | packages/core/agents/openclaw-runtime-config.ts | 57 | export function serializeOpenclawRuntimeConfig( | CODE |
| LOW | packages/core/agents/openclaw-runtime-config.ts | 82 | export function openclawRuntimeConfigEquals( | CODE |
| LOW | packages/core/agents/use-workspace-presence-prefetch.ts | 24 | export function useWorkspacePresencePrefetch(wsId: string | undefined): void { | CODE |
| LOW | packages/core/agents/mcp-support.ts | 22 | export function providerSupportsMcpConfig(provider: string | undefined | null): boolean { | CODE |
| LOW | …ckages/core/agents/use-workspace-agent-availability.ts | 35 | export function useWorkspaceAgentAvailability(): WorkspaceAgentAvailability { | CODE |
| LOW | packages/core/agents/derive-presence.ts | 96 | export function deriveAgentPresenceDetail(input: DerivePresenceInput): AgentPresenceDetail { | CODE |
| LOW | packages/core/permissions/rules.ts | 188 | export function canUpdateWorkspaceSettings(ctx: PermissionContext): Decision { | CODE |
| LOW | packages/core/dashboard/queries.ts | 53 | export function dashboardUsageDailyOptions( | CODE |
| LOW | packages/core/dashboard/queries.ts | 77 | export function dashboardUsageByAgentOptions( | CODE |
| LOW | packages/core/dashboard/queries.ts | 101 | export function dashboardAgentRunTimeOptions( | CODE |
| LOW | packages/core/dashboard/queries.ts | 125 | export function dashboardRunTimeDailyOptions( | CODE |
| LOW | packages/core/realtime/use-realtime-sync.test.ts | 652 | function installBrowserNotification( | CODE |
| LOW | packages/core/realtime/use-realtime-sync.ts | 95 | export function invalidateChatMessageQueries( | CODE |
| LOW | packages/core/realtime/use-realtime-sync.ts | 116 | export function refetchPendingChatAggregate( | CODE |
| LOW | packages/core/realtime/use-realtime-sync.ts | 168 | function patchLatestChatMessagePage( | CODE |
| LOW | packages/core/realtime/use-realtime-sync.ts | 212 | export function applyChatSessionUpdatedToCache( | CODE |
| LOW | packages/core/realtime/use-realtime-sync.ts | 250 | export function applyWorkspaceUpdatedToCache( | CODE |
| LOW | packages/core/realtime/use-realtime-sync.ts | 393 | function invalidateWorkspaceScopedQueries(qc: QueryClient): void { | CODE |
| LOW | packages/core/realtime/use-realtime-sync.ts | 439 | function invalidateSquadMemberStatusQueries(qc: QueryClient, wsId: string): void { | CODE |
| 190 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/internal/handler/github_test.go | 107 | in: []string{"ABC-1: Lorem Ipsum", "Closes ABC-1. Follow up work planned in ABC-2. Unblocks ABC-3."}, | CODE |
| LOW | server/internal/handler/github_test.go | 853 | title := closes.Identifier + ": Lorem Ipsum dolor sit amet" | CODE |
| LOW | server/internal/handler/github_test.go | 853 | title := closes.Identifier + ": Lorem Ipsum dolor sit amet" | CODE |
| LOW | server/internal/integrations/slack/byo_install_test.go | 41 | _, _ = w.Write([]byte(`{"ok":true,"team_id":"T999","user_id":"UBOTBYO","bot_id":"B0BOT","team":"Acme Inc","url":"http | CODE |
| LOW | packages/views/locales/zh-Hans/search.json | 4 | "placeholder": "输入命令或关键词搜索...", | CODE |
| LOW | packages/views/locales/zh-Hans/runtimes.json | 71 | "placeholder": "例如:我的 MacBook", | CODE |
| LOW | packages/views/locales/zh-Hans/modals.json | 25 | "placeholder": "聊聊你的体验、遇到的 bug,或想看到的功能...", | CODE |
| LOW | packages/views/locales/zh-Hans/agents.json | 315 | "placeholder": "描述你需要的智能体…", | CODE |
| LOW | packages/views/locales/zh-Hans/agents.json | 375 | "placeholder": "从工作区添加 skill", | CODE |
| LOW | packages/views/locales/zh-Hans/agents.json | 401 | "placeholder": "定义这个智能体的角色、专长和工作风格。\n\n# 示例\n你是一名专注 React 和 TypeScript 的前端工程师。\n\n## 工作风格\n- 写小而聚焦的 PR —— 每个逻辑变更一个 | CODE |
| LOW | packages/views/locales/zh-Hans/issues.json | 39 | "placeholder": "筛选...", | CODE |
| LOW | packages/views/locales/zh-Hans/issues.json | 230 | "placeholder": "在 issue 中查找...", | CODE |
| LOW | packages/views/locales/zh-Hans/issues.json | 326 | "placeholder": "回复..." | CODE |
| LOW | packages/views/locales/zh-Hans/skills.json | 180 | "placeholder": "templates/review.md", | CODE |
| LOW | packages/views/locales/ja/search.json | 4 | "placeholder": "コマンドを入力するか検索...", | CODE |
| LOW | packages/views/locales/ja/runtimes.json | 71 | "placeholder": "例:私の MacBook", | CODE |
| LOW | packages/views/locales/ja/modals.json | 25 | "placeholder": "使用感、見つけたバグ、追加してほしい機能などをお聞かせください…", | CODE |
| LOW | packages/views/locales/ja/agents.json | 294 | "placeholder": "ワークスペースからスキルを追加", | CODE |
| LOW | packages/views/locales/ja/agents.json | 320 | "placeholder": "このエージェントの役割、専門分野、作業スタイルを定義してください。\n\n# 例\nあなたは React と TypeScript を専門とするフロントエンドエンジニアです。\n\n## 作業スタ | CODE |
| LOW | packages/views/locales/ja/agents.json | 762 | "placeholder": "必要なエージェントを説明…", | CODE |
| LOW | packages/views/locales/ja/issues.json | 39 | "placeholder": "フィルター...", | CODE |
| LOW | packages/views/locales/ja/issues.json | 230 | "placeholder": "イシュー内を検索...", | CODE |
| LOW | packages/views/locales/ja/issues.json | 326 | "placeholder": "返信を残す..." | CODE |
| LOW | packages/views/locales/ja/skills.json | 168 | "placeholder": "templates/review.md", | CODE |
| LOW | packages/views/locales/ko/search.json | 4 | "placeholder": "명령어를 입력하거나 검색하세요...", | CODE |
| LOW | packages/views/locales/ko/runtimes.json | 71 | "placeholder": "예: 내 MacBook", | CODE |
| LOW | packages/views/locales/ko/modals.json | 25 | "placeholder": "사용 경험, 발견한 버그, 필요한 기능을 알려주세요...", | CODE |
| LOW | packages/views/locales/ko/agents.json | 302 | "placeholder": "워크스페이스에서 스킬 추가", | CODE |
| LOW | packages/views/locales/ko/agents.json | 328 | "placeholder": "이 에이전트의 역할, 전문성, 작업 방식을 정의하세요.\n\n# 예시\n당신은 React와 TypeScript에 특화된 프런트엔드 엔지니어입니다.\n\n## 작업 방식\n- 작 | CODE |
| LOW | packages/views/locales/ko/agents.json | 762 | "placeholder": "필요한 에이전트를 설명하세요…", | CODE |
| LOW | packages/views/locales/ko/issues.json | 39 | "placeholder": "필터...", | CODE |
| LOW | packages/views/locales/ko/issues.json | 230 | "placeholder": "이슈에서 찾기...", | CODE |
| LOW | packages/views/locales/ko/issues.json | 326 | "placeholder": "답글 남기기..." | CODE |
| LOW | packages/views/locales/ko/skills.json | 168 | "placeholder": "templates/review.md", | CODE |
| LOW | packages/views/locales/en/search.json | 4 | "placeholder": "Type a command or search...", | CODE |
| LOW | packages/views/locales/en/runtimes.json | 75 | "placeholder": "e.g. Bohan's MacBook", | CODE |
| LOW | packages/views/locales/en/modals.json | 25 | "placeholder": "Tell us about your experience, bugs you've found, or features you'd like to see…", | CODE |
| LOW | packages/views/locales/en/agents.json | 324 | "placeholder": "Describe the agent you need…", | CODE |
| LOW | packages/views/locales/en/agents.json | 384 | "placeholder": "Add skills from workspace", | CODE |
| LOW | packages/views/locales/en/agents.json | 411 | "placeholder": "Define this agent's role, expertise, and working style.\n\n# Example\nYou are a frontend engineer | CODE |
| LOW | packages/views/locales/en/issues.json | 39 | "placeholder": "Filter...", | CODE |
| LOW | packages/views/locales/en/issues.json | 233 | "placeholder": "Find in issue...", | CODE |
| LOW | packages/views/locales/en/issues.json | 338 | "placeholder": "Leave a reply..." | CODE |
| LOW | packages/views/locales/en/skills.json | 175 | "placeholder": "templates/review.md", | CODE |
| LOW | packages/views/auth/login-page.test.tsx | 420 | email: "user@example.com", | CODE |
| LOW | packages/views/auth/login-page.test.tsx | 452 | email: "user@example.com", | CODE |
| LOW | packages/views/auth/login-page.test.tsx | 487 | email: "user@example.com", | CODE |
| LOW | packages/views/workspace/create-workspace-form.test.tsx | 59 | target: { value: "Acme Corp" }, | CODE |
| LOW | packages/views/workspace/slug.test.ts | 7 | expect(nameToWorkspaceSlug("Acme Inc")).toBe("acme-inc"); | CODE |
| LOW | packages/views/issues/surface/issue-surface.test.tsx | 41 | const mockAuthUser = { id: "user-1", email: "test@test.com", name: "Test User" }; | CODE |
| LOW | packages/views/issues/components/issues-page.test.tsx | 19 | const mockAuthUser = { id: "user-1", email: "test@test.com", name: "Test User" }; | CODE |
| LOW | packages/views/issues/components/issues-page.test.tsx | 74 | email: "test@test.com", | CODE |
| LOW | packages/views/issues/components/issue-detail.test.tsx | 31 | const mockAuthUser = { id: "user-1", email: "test@test.com", name: "Test User" }; | CODE |
| LOW | packages/views/issues/components/issue-detail.test.tsx | 63 | queryFn: () => Promise.resolve([{ user_id: "user-1", name: "Test User", email: "test@test.com", role: "admin" }]), | CODE |
| LOW | packages/views/issues/components/issue-detail.test.tsx | 222 | listMembers: vi.fn().mockResolvedValue([{ user_id: "user-1", name: "Test User", email: "test@test.com", role: "admin" | CODE |
| LOW | packages/views/issues/components/issue-detail.test.tsx | 538 | { user_id: "user-1", name: "Test User", email: "test@test.com", role: "admin" }, | CODE |
| LOW | packages/views/issues/components/swimlane-view.test.tsx | 71 | const mockAuthUser = { id: "user-1", email: "test@test.com", name: "Test User" }; | CODE |
| LOW | apps/mobile/lib/mention-serialize.ts | 67 | // prevents random in-word @ (e.g. "user@example.com") from triggering. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CLI_INSTALL.md | 15 | ## Step 1: Check if Multica CLI is already installed | COMMENT |
| LOW | CLI_INSTALL.md | 28 | ## Step 2: Install the Multica CLI | COMMENT |
| LOW | CLI_INSTALL.md | 120 | ## Step 3: Log in | COMMENT |
| LOW | CLI_INSTALL.md | 148 | ## Step 4: Start the daemon | COMMENT |
| LOW | CLI_INSTALL.md | 178 | ## Step 5: Verify everything is working | COMMENT |
| LOW | server/cmd/server/integration_test.go | 302 | // Step 1: Send code | COMMENT |
| LOW | server/cmd/server/integration_test.go | 320 | // Step 2: Verify code | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 88 | // Step 1: agent A creates an issue through the ordinary create path and | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 137 | // Step 2: the leader L, running its assignment task, posts a comment that | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 152 | // Step 3: the private worker J must now have a queued task whose originator | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 141 | // Step 1: cheap precondition check — if the rollup state tables | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 155 | // Step 2: read task_usage range and current watermark on the pool. | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 214 | // Step 3: serialise against the SQL cron entry / standalone backfill | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 93 | // Step 1: original runner claims the plan. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 102 | // Step 2: simulate a stuck handler — stale_after moved to the past. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 112 | // Step 3: a different runner steals the lease via the same primitive. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 136 | // Step 4: the original runner returns and tries to write SUCCESS | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 146 | // Step 5: verify the row is still RUNNING under runner-B. | COMMENT |
| LOW | server/internal/scheduler/stale_steal_test.go | 166 | // Step 6: runner B finishes successfully with its own token — that | COMMENT |
| LOW | server/internal/integrations/lark/outbound_test.go | 416 | // Step 1: ChatDone arrives with the real agent reply. Plain text | COMMENT |
| LOW | server/internal/integrations/lark/outbound_test.go | 429 | // Step 2: TaskCompleted fires immediately after with no content. | COMMENT |
| LOW | server/internal/daemon/execenv/hermes_home.go | 199 | // Step 2: honor the sticky <root>/active_profile. (The container-only | COMMENT |
| LOW⚡ | scripts/check.sh | 73 | # Step 0: Ensure DB | COMMENT |
| LOW⚡ | scripts/check.sh | 80 | # Step 1: TypeScript typecheck | COMMENT |
| LOW⚡ | scripts/check.sh | 87 | # Step 2: TypeScript unit tests (Vitest) | COMMENT |
| LOW⚡ | scripts/check.sh | 94 | # Step 3: Go tests | COMMENT |
| LOW⚡ | scripts/check.sh | 103 | # Step 4: Start services for E2E (only if not already running) | COMMENT |
| LOW⚡ | scripts/check.sh | 129 | # Step 5: E2E tests (Playwright) | COMMENT |
| LOW⚡ | packages/views/auth/login-page.test.tsx | 258 | // Step 1: email | COMMENT |
| LOW⚡ | packages/views/auth/login-page.test.tsx | 262 | // Step 2: code | COMMENT |
| LOW | …es/views/runtimes/components/connect-remote-dialog.tsx | 188 | // Step 1: Instructions | COMMENT |
| LOW | …es/views/runtimes/components/connect-remote-dialog.tsx | 329 | // Step 2: Success | COMMENT |
| LOW⚡ | e2e/fixtures.ts | 37 | // Step 1: Send verification code | COMMENT |
| LOW⚡ | e2e/fixtures.ts | 47 | // Step 2: Read code from database | COMMENT |
| LOW | e2e/fixtures.ts | 59 | // Step 3: Verify code to get JWT | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/cmd/server/integration_test.go | 302 | // Step 1: Send code | COMMENT |
| LOW | server/cmd/server/integration_test.go | 320 | // Step 2: Verify code | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 88 | // Step 1: agent A creates an issue through the ordinary create path and | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 137 | // Step 2: the leader L, running its assignment task, posts a comment that | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 152 | // Step 3: the private worker J must now have a queued task whose originator | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 141 | // Step 1: cheap precondition check — if the rollup state tables | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 155 | // Step 2: read task_usage range and current watermark on the pool. | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 214 | // Step 3: serialise against the SQL cron entry / standalone backfill | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 93 | // Step 1: original runner claims the plan. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 102 | // Step 2: simulate a stuck handler — stale_after moved to the past. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 112 | // Step 3: a different runner steals the lease via the same primitive. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 136 | // Step 4: the original runner returns and tries to write SUCCESS | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 146 | // Step 5: verify the row is still RUNNING under runner-B. | COMMENT |
| LOW | server/internal/scheduler/stale_steal_test.go | 166 | // Step 6: runner B finishes successfully with its own token — that | COMMENT |
| LOW | server/internal/integrations/lark/outbound_test.go | 416 | // Step 1: ChatDone arrives with the real agent reply. Plain text | COMMENT |
| LOW | server/internal/integrations/lark/outbound_test.go | 429 | // Step 2: TaskCompleted fires immediately after with no content. | COMMENT |
| LOW | server/internal/daemon/execenv/hermes_home.go | 199 | // Step 2: honor the sticky <root>/active_profile. (The container-only | COMMENT |
| LOW⚡ | scripts/check.sh | 73 | # Step 0: Ensure DB | COMMENT |
| LOW⚡ | scripts/check.sh | 80 | # Step 1: TypeScript typecheck | COMMENT |
| LOW⚡ | scripts/check.sh | 87 | # Step 2: TypeScript unit tests (Vitest) | COMMENT |
| LOW⚡ | scripts/check.sh | 94 | # Step 3: Go tests | COMMENT |
| LOW⚡ | scripts/check.sh | 103 | # Step 4: Start services for E2E (only if not already running) | COMMENT |
| LOW⚡ | scripts/check.sh | 129 | # Step 5: E2E tests (Playwright) | COMMENT |
| LOW⚡ | packages/views/auth/login-page.test.tsx | 258 | // Step 1: email | COMMENT |
| LOW⚡ | packages/views/auth/login-page.test.tsx | 262 | // Step 2: code | COMMENT |
| LOW | …es/views/runtimes/components/connect-remote-dialog.tsx | 188 | // Step 1: Instructions | COMMENT |
| LOW | …es/views/runtimes/components/connect-remote-dialog.tsx | 329 | // Step 2: Success | COMMENT |
| LOW⚡ | e2e/fixtures.ts | 37 | // Step 1: Send verification code | COMMENT |
| LOW⚡ | e2e/fixtures.ts | 47 | // Step 2: Read code from database | COMMENT |
| LOW | e2e/fixtures.ts | 59 | // Step 3: Verify code to get JWT | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | SELF_HOSTING_ADVANCED.md | 257 | DATABASE_URL="your-database-url" ./server/bin/migrate up | CODE |
| HIGH | SELF_HOSTING_ADVANCED.md | 260 | DATABASE_URL="your-database-url" PORT=8080 JWT_SECRET="your-secret" ./server/bin/server | CODE |
| HIGH | scripts/install.test.sh | 179 | if ! grep -q "multica login --token <YOUR_TOKEN>" "$tmp/install.out"; then | CODE |
| HIGH | scripts/install.test.sh | 232 | if grep -q "multica login --token <YOUR_TOKEN>" "$tmp/install.out"; then | CODE |
| HIGH | scripts/install.sh | 58 | printf " ${CYAN}multica login --token <YOUR_TOKEN>${RESET}\n" | CODE |
| HIGH | …es/views/runtimes/components/connect-remote-dialog.tsx | 45 | multica login --token <YOUR_TOKEN> | CODE |
| HIGH | …es/views/runtimes/components/connect-remote-dialog.tsx | 54 | multica login --token <YOUR_TOKEN> | CODE |
| HIGH | …ews/runtimes/components/connect-remote-dialog.test.tsx | 113 | node.textContent?.includes("multica login --token <YOUR_TOKEN>"), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ver/internal/daemon/execenv/runtime_config_sections.go | 217 | // section for quick-create runs. Quick-create's hard guardrails forbid | COMMENT |
| MEDIUM | …ver/internal/daemon/execenv/runtime_config_sections.go | 325 | // guardrails. | COMMENT |
| MEDIUM | server/internal/daemon/execenv/codex_multi_agent.go | 58 | multicaMultiAgentBeginMarker = "# BEGIN multica-managed multi-agent (do not edit; regenerated by daemon)" | CODE |
| MEDIUM | server/internal/daemon/execenv/codex_multi_agent.go | 59 | multicaMultiAgentEndMarker = "# END multica-managed multi-agent" | CODE |
| MEDIUM | server/internal/daemon/execenv/execenv_test.go | 4214 | // guardrails forbid every other CLI call for that kind. | COMMENT |
| MEDIUM | server/internal/daemon/execenv/context.go | 700 | // and guardrails live in AGENTS.md (runtime config) and the per-turn prompt | COMMENT |
| MEDIUM | …er/internal/daemon/execenv/runtime_config_kind_test.go | 157 | // other Core command absent (the hard guardrails forbid the call). | COMMENT |
| MEDIUM | …er/internal/daemon/execenv/runtime_config_kind_test.go | 200 | // the no-background-and-yield / no-"standing by" guardrails that address | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/internal/handler/agent.go | 555 | // the strip robust against unusual casings seen on shared drives. | COMMENT |
| MEDIUM | server/internal/integrations/lark/outcome_replier.go | 119 | // boot path stays robust on partially-configured deployments. | COMMENT |
| MEDIUM | server/internal/daemon/execenv/openclaw_config.go | 286 | // with only `workspace` rewritten — this is robust regardless of whether | COMMENT |
| MEDIUM | server/internal/service/task.go | 2148 | // the requester's workspace since the task started — more robust than | COMMENT |
| MEDIUM | server/internal/service/task.go | 3488 | // deterministic — robust against the same agent creating other issues in | COMMENT |
| MEDIUM | server/pkg/agent/antigravity.go | 298 | // is more robust than guessing $HOME, and follows agy through a custom data dir. | COMMENT |
| MEDIUM | apps/mobile/app/(app)/[workspace]/project/new.tsx | 128 | // robust than a hard-coded `setTimeout(150)` if iOS timing | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ages/views/editor/extensions/mention-extension.test.ts | 18 | " at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) \\~\\[spring-w | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | server/cmd/server/autopilot_listeners_test.go | 513 | // In this implementation the admission gate also re-reads the runtime, so | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.selfhost.yml | 11 | # Usage: | COMMENT |