Make humans and AI agents work as one team — open-source and self-hostable.
This report summarizes scanner evidence for multica-ai/multica, a Go project with 54,423 GitHub stars. SynthScan examined 1,502,755 lines of code across 5444 source files, recording 3966 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 2.9 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 3591 finding(s).
Are imports declared and package/API names verified? 153 finding(s).
Are wrappers, guards, and repeated structures necessary? 725 finding(s).
Which changes need focused human review? 3966 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 3966 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.selfhost.yml | 1 | # Self-hosting Docker Compose — starts PostgreSQL, backend, and frontend. | COMMENT |
| LOW | docker-compose.selfhost.yml | 21 | # variable to edit; BACKEND_PORT, API_PORT and SERVER_PORT are optional aliases | COMMENT |
| LOW | docker-compose.selfhost.yml | 121 | # App API credentials. The pull_request webhook is what mirrors a PR | COMMENT |
| LOW | docker-compose.selfhost.yml | 141 | # either empty disables plugin surfaces rather than weakening isolation. | COMMENT |
| LOW | docker-compose.selfhost.yml | 161 | # turn model reasoning off; see .env.example for the contract. | COMMENT |
| LOW | docker-compose.selfhost.yml | 181 | # which are brought by each workspace via OAuth/BYO and stored encrypted | COMMENT |
| LOW | docker-compose.selfhost.yml | 201 | # an installation is created from the WeCom settings tab. | COMMENT |
| LOW | turbo.json | 21 | "DESKTOP_APP_SUFFIX" | COMMENT |
| LOW | turbo.json | 61 | // depends on it. `dependsOn: ["^cache-inputs"]` makes that recursive, so | COMMENT |
| LOW | CLI_AND_DAEMON.md | 701 | # List comments — flat timeline, chronological. Hard cap of 2000 rows; on | COMMENT |
| LOW | CLI_AND_DAEMON.md | 841 | # overlapping code or PR work. Advisory only — it reserves nothing. | COMMENT |
| LOW | deploy/helm/multica/values.yaml | 21 | # ----------------------------------------------------------------------------- | COMMENT |
| LOW | deploy/helm/multica/values.yaml | 41 | # --from-literal=MULTICA_DEV_VERIFICATION_CODE="" | COMMENT |
| LOW | deploy/helm/multica/values.yaml | 81 | # `migrate up` run, so late-arriving pods queue and then no-op (see | COMMENT |
| LOW | deploy/helm/multica/values.yaml | 101 | size: 5Gi | COMMENT |
| LOW | deploy/helm/multica/values.yaml | 141 | corsAllowedOrigins: "" | COMMENT |
| LOW | server/cmd/backfill_delegated_failure_settled/main.go | 1 | // backfill_delegated_failure_settled retires delegated-failure recovery | COMMENT |
| LOW | server/cmd/server/notification_listeners.go | 81 | // 'delegated' — an agent created this issue on their behalf, MUL-5483) receives | COMMENT |
| LOW | server/cmd/server/notification_listeners.go | 101 | // and the webhook repair all key off it — so arriving there is routine | COMMENT |
| LOW | server/cmd/server/notification_listeners.go | 141 | COMMENT | |
| LOW | server/cmd/server/wecom_replier_wiring_test.go | 21 | // comes out in the deployment's language whatever the reader's profile says. | COMMENT |
| LOW | server/cmd/server/quick_create_subscriber_test.go | 21 | // origin waterfall attribution uses. That behavior is covered by | COMMENT |
| LOW | server/cmd/server/listeners.go | 21 | // activity_listeners.go records the title change. Those all run on | COMMENT |
| LOW | server/cmd/server/listeners.go | 81 | return e.Type == protocol.EventTaskMessage && e.ChatSessionID != "" | COMMENT |
| LOW | server/cmd/server/listeners.go | 301 | b.BroadcastToScope(realtime.ScopeWorkspaceMember, realtime.WorkspaceMemberScopeID(e.WorkspaceID, e.MemberPrivateUserI | COMMENT |
| LOW | server/cmd/server/autopilot_schedule_job_test.go | 461 | util.UUIDToString(trigger.ID)).Scan(&execRows); err != nil { | COMMENT |
| LOW | server/cmd/server/autopilot_schedule_job_test.go | 541 | // depth), but if a corrupt expression ever lands in | COMMENT |
| LOW | server/cmd/server/autopilot_schedule_job_test.go | 661 | // Trigger fired by the legacy goroutine at Mon 17:10 Beijing | COMMENT |
| LOW | server/cmd/server/wecom_claim_redis_wiring_test.go | 1 | package main | COMMENT |
| LOW | server/cmd/server/autopilot_listeners_test.go | 921 | // status='skipped' rather than (nil, err). Without this, manual trigger | COMMENT |
| LOW | server/cmd/server/delegated_subscriber_test.go | 301 | COMMENT | |
| LOW | server/cmd/server/runtime_sweeper.go | 21 | "github.com/multica-ai/multica/server/pkg/redact" | COMMENT |
| LOW | server/cmd/server/runtime_sweeper.go | 41 | // delayed. A daemon that actually restarts bypasses this grace through the | COMMENT |
| LOW | server/cmd/server/runtime_sweeper.go | 61 | // per-runtime transactions one sweeper tick may open. At the hourly cadence, | COMMENT |
| LOW | server/cmd/server/runtime_sweeper.go | 81 | // survive on self-hosted deployments (MUL-4107) — the daemon itself | COMMENT |
| LOW | server/cmd/server/runtime_sweeper.go | 581 | // even when the runtime is still online at the row level. Each branch pairs | COMMENT |
| LOW | server/cmd/server/wecom_progress_wiring_test.go | 21 | // being published, nobody reads them, and the bubble opens and closes with a | COMMENT |
| LOW | server/cmd/server/shutdown.go | 1 | package main | COMMENT |
| LOW | server/cmd/server/shutdown.go | 21 | // without channels use the same sequence. | COMMENT |
| LOW | …er/cmd/server/delegated_subscriber_concurrency_test.go | 21 | // stale state, and that it reaches the correct decision once released. | COMMENT |
| LOW | server/cmd/server/wecom_media_wiring_test.go | 21 | // installation revoked since the message came in. Every unit test in the | COMMENT |
| LOW | server/cmd/server/cors_headers_test.go | 61 | for _, value := range strings.Split(header, ",") { | COMMENT |
| LOW | server/cmd/server/dbstats.go | 21 | dbStatsInterval = 15 * time.Second | COMMENT |
| LOW | server/cmd/server/dbstats.go | 81 | COMMENT | |
| LOW | server/cmd/server/autopilot_dispatch_for_plan_test.go | 261 | }) | COMMENT |
| LOW | server/cmd/server/scope_authorizer.go | 21 | } | COMMENT |
| LOW | server/cmd/server/wecom_env_documented_test.go | 1 | package main | COMMENT |
| LOW | server/cmd/server/rerun_session_test.go | 661 | COMMENT | |
| LOW | server/cmd/server/subscriber_listeners.go | 141 | addSubscriber(bus, queries, e.WorkspaceID, issueID, authorType, authorID, "commenter") | COMMENT |
| LOW | server/cmd/server/subscriber_listeners.go | 201 | return | COMMENT |
| LOW | server/cmd/server/comment_at_least_once_test.go | 181 | if err != nil || v == nil { | COMMENT |
| LOW | server/cmd/server/main.go | 161 | // budget, not a taste call: SDK backoff is 0.5s doubling to an 8s cap, so 6 | COMMENT |
| LOW | server/cmd/server/main.go | 801 | go h.LarkTyping.Run(sweepCtx) | COMMENT |
| LOW | server/cmd/server/main.go | 821 | // cause and indicates a code bug). Once running, the manager | COMMENT |
| LOW | server/cmd/server/router.go | 221 | HTTPMetrics *obsmetrics.HTTPMetrics | COMMENT |
| LOW | server/cmd/server/router.go | 241 | WecomRelayOutbound *wecom.RelayOutbound | COMMENT |
| LOW | server/cmd/server/router.go | 521 | h.WebhookRateLimiter = handler.NewRedisWebhookRateLimiter(rdb, handler.DefaultWebhookRateLimit()) | COMMENT |
| LOW | server/cmd/server/router.go | 601 | // MULTICA_LARK_HTTP_BASE_URL is an OPTIONAL deployment-wide | COMMENT |
| LOW | server/cmd/server/router.go | 621 | if store != nil && patcher.SetAttachments(store) { | COMMENT |
| LOW | server/cmd/server/router.go | 661 | AppURL: appURLFromEnv(), | COMMENT |
| 2923 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | deploy/helm/multica/values.yaml | 1 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 3 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 21 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | deploy/helm/multica/values.yaml | 45 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | deploy/helm/multica/values.yaml | 48 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | deploy/helm/multica/values.yaml | 50 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 75 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 77 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 185 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 187 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 221 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | deploy/helm/multica/values.yaml | 223 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 20 | // ── List ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 74 | // ── Get ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 112 | // ── Create ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 164 | // ── Update ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 224 | // ── Delete ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 253 | // ── Members ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 299 | // ── Member Add ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 346 | // ── Member Set Role ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 396 | // ── Member Remove ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 440 | // ── Activity ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/cmd/multica/cmd_squad.go | 505 | // ── Init ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 82 | // ── Payload normalization ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 214 | // ── Dedupe + signature helpers ────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 307 | // ── Public ingress ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 633 | // ── Event filter helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 781 | // ── Persistence helpers ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook.go | 929 | // ── Rate-limit / IP plumbing ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 33 | // ── Response types ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 183 | // ── Converters ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 357 | // ── Request types ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 437 | // ── Handlers ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 1397 | // ── Collaborator (access grant) management ─────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 1512 | // ── Trigger management ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 2254 | // ── Runs ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot.go | 2337 | // ── Manual trigger ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/webhook_delivery.go | 20 | // ── Response types ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/webhook_delivery.go | 156 | // ── Handlers ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/webhook_delivery_test.go | 20 | // ── Setup helpers ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/webhook_delivery_test.go | 102 | // ── Tests ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/vcs_webhook.go | 19 | // ── Response mappers ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/vcs_webhook.go | 84 | // ── Webhook ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 22 | // ── Fixture helpers ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 229 | // ── HTTP contract: event_filters JSON shape & PATCH semantics ────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 500 | // ── Tests ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 833 | // ── Additional coverage (PR #2348 review) ────────────────────────────────── | COMMENT |
| MEDIUM | …ver/internal/handler/autopilot_webhook_handler_test.go | 833 | // ── Additional coverage (PR #2348 review) ────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/github_test.go | 953 | // ── PR auto-complete (MUL-7429) ──────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/github_test.go | 1698 | // ── CI / mergeable_state tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/vcs.go | 24 | // ── Response shapes ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/vcs.go | 106 | // ── Handlers ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/pr_auto_complete.go | 335 | // ── Issue page read model ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/pr_auto_complete.go | 391 | // ── Manual link / unlink ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook_test.go | 10 | // ── Token generation ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook_test.go | 36 | // ── Payload normalization ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/autopilot_webhook_test.go | 204 | // ── Event filter helpers ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 22 | // ── Response types ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 61 | // ── Converters ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/internal/handler/squad.go | 112 | // ── Helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| 162 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/ui/markdown/mentions.ts | 17 | export function preprocessMentionShortcodes(text: string): string { | CODE |
| LOW | packages/ui/markdown/issue-identifiers.ts | 61 | export function preprocessIssueIdentifiers(text: string): string { | CODE |
| LOW | packages/ui/components/ui/chart.tsx | 346 | function getPayloadConfigFromPayload( | CODE |
| LOW | packages/core/search-index/store.ts | 237 | function parseSearchIndexDatabaseName(name: string): SearchIndexDatabaseOwner | null { | CODE |
| LOW | packages/core/search-index/store.ts | 247 | export async function deleteSearchIndexDatabases( | CODE |
| LOW | packages/core/search-index/store.ts | 265 | export function deleteAllSearchIndexDatabases(): Promise<void> { | CODE |
| LOW | packages/core/types/quick-action.ts | 98 | export function findQuickActionTemplateToken(prompt: string): string | null { | CODE |
| LOW | packages/core/types/attachment-url.ts | 56 | export function attachmentIdFromDownloadURL(rawURL: string): string | undefined { | CODE |
| LOW | packages/core/types/attachment-url.ts | 112 | export function contentReferencesAttachment( | CODE |
| LOW | packages/core/inbox/ws-updaters.ts | 69 | export function patchInboxIssueProjection( | CODE |
| LOW | packages/core/inbox/ws-updaters.ts | 108 | export function onInboxIssueStatusChanged( | CODE |
| LOW | packages/core/inbox/ws-updaters.ts | 146 | export function isInboxListRequestInFlight( | CODE |
| LOW⚡ | packages/core/inbox/queries.ts | 47 | export function archivedInboxPagesOptions(wsId: string, filters: ArchivedInboxFilters) { | CODE |
| LOW⚡ | packages/core/inbox/queries.ts | 57 | export function archivedInboxLookupOptions(wsId: string, groupId: string, filters: ArchivedInboxFilters = EMPTY_INBOX_FI | CODE |
| LOW⚡ | packages/core/inbox/queries.ts | 66 | export function archivedInboxFacetsOptions(wsId: string, filters: ArchivedInboxFilters) { | CODE |
| LOW | packages/core/inbox/queries.ts | 101 | export function inboxUnreadSummaryOptions() { | CODE |
| LOW | packages/core/inbox/queries.ts | 121 | export function inboxUnreadSummaryEnabled( | CODE |
| LOW | packages/core/inbox/queries.ts | 207 | export function deduplicateArchivedInboxItems(items: InboxItem[]): InboxItem[] { | CODE |
| LOW | packages/core/inbox/mutations.ts | 50 | export function useRetrySourceContextQuickCreate() { | CODE |
| LOW | packages/core/inbox/filter-store.ts | 180 | export function inboxPriorityFilterSupport( | CODE |
| LOW | packages/core/inbox/filter-store.ts | 190 | export function inboxFiltersForPrioritySupport( | CODE |
| LOW | packages/core/issue-views/active-view-store.ts | 41 | export function lockedDimensionsFromQuery( | CODE |
| LOW | packages/core/issue-views/queries.ts | 20 | export function issueViewEverywhereOptions(wsId: string) { | CODE |
| LOW | packages/core/issue-views/definition.ts | 26 | export function issueViewDefinitionFromState(state: IssueViewState): IssueViewDefinition { | CODE |
| LOW | packages/core/issue-views/preferences.ts | 35 | export function issueViewPreferenceOptions(wsId: string, scope: IssueViewPreferenceScope) { | CODE |
| LOW | packages/core/issue-views/preferences.ts | 54 | export function useUpdateIssueViewPreference(wsId: string, scope: IssueViewPreferenceScope) { | CODE |
| LOW | packages/core/autopilots/queries.ts | 22 | export function autopilotQuotaUsageOptions(wsId: string) { | CODE |
| LOW | packages/core/autopilots/queries.ts | 76 | export function autopilotDeliveriesOptions( | CODE |
| LOW | packages/core/autopilots/mutations.ts | 131 | export function useCreateAutopilotTrigger() { | CODE |
| LOW | packages/core/autopilots/mutations.ts | 143 | export function useUpdateAutopilotTrigger() { | CODE |
| LOW | packages/core/autopilots/mutations.ts | 155 | export function useDeleteAutopilotTrigger() { | CODE |
| LOW | packages/core/autopilots/mutations.ts | 167 | export function useRotateAutopilotTriggerWebhookToken() { | CODE |
| LOW | packages/core/autopilots/mutations.ts | 183 | export function useReplayAutopilotDelivery() { | CODE |
| LOW | packages/core/chat/use-quick-actions-pending-timeout.ts | 22 | export function useQuickActionsPendingTimeout( | CODE |
| LOW | packages/core/chat/queries.ts | 323 | export function isTaskMessageTimelineHeld( | CODE |
| LOW | packages/core/chat/queries.ts | 350 | export function hasPendingChatTasksOptions(wsId: string) { | CODE |
| LOW | packages/core/chat/queries.ts | 364 | export function chatQuickActionsPendingOptions(sessionId: string) { | CODE |
| LOW | packages/core/chat/queries.ts | 378 | export function chatQuickActionsFailureOptions(sessionId: string) { | CODE |
| LOW | packages/core/chat/pending.ts | 165 | export function prioritizePendingChatTask( | CODE |
| LOW | packages/core/chat/message-cache.ts | 118 | export function upsertChatMessageToCaches( | CODE |
| LOW | packages/core/chat/mutations.ts | 27 | export function useConsumeChatDraftRestore() { | CODE |
| LOW | packages/core/chat/mutations.ts | 296 | export function useSetChatSessionArchived() { | CODE |
| LOW | packages/core/chat/mutations.ts | 384 | export function useRegenerateChatQuickActions() { | CODE |
| LOW | packages/core/plugins/queries.ts | 10 | export function pluginInstallationsOptions(wsId: string) { | CODE |
| LOW | packages/core/plugins/queries.ts | 28 | export function pluginSurfaceLaunchOptions( | CODE |
| LOW | packages/core/plugins/mutations.ts | 35 | export function usePublishLocalPluginPackage(wsId: string) { | CODE |
| LOW | packages/core/markdown/mention-shortcodes.ts | 18 | export function preprocessMentionShortcodes(text: string): string { | CODE |
| LOW | packages/core/drafts/reply-annotation.ts | 20 | export function normalizeReplyAnnotations(value: unknown): ReplyAnnotation[] { | CODE |
| LOW | packages/core/drafts/cleanup-registry.ts | 53 | export function clearRegisteredWorkspaceDrafts( | CODE |
| LOW | packages/core/platform/session-renewal.ts | 98 | function scheduleRetryAfterFailure(): number { | CODE |
| LOW | packages/core/platform/workspace-storage.ts | 90 | export function registerForWorkspaceRehydration(fn: () => void) { | CODE |
| LOW | packages/core/platform/workspace-storage.ts | 106 | export function createWorkspaceAwareStorage(adapter: StorageAdapter): StateStorage { | CODE |
| LOW | packages/core/platform/system-notification.ts | 45 | export function registerSystemNotificationClickHandler( | CODE |
| LOW⚡ | packages/core/platform/system-notification.ts | 61 | export function isWebNotificationSupported(): boolean { | CODE |
| LOW⚡ | packages/core/platform/system-notification.ts | 68 | export function getWebNotificationPermission(): WebNotificationPermission { | CODE |
| LOW⚡ | packages/core/platform/system-notification.ts | 78 | export async function requestWebNotificationPermission(): Promise<WebNotificationPermission> { | CODE |
| LOW | packages/core/platform/auth-initializer.test.tsx | 79 | function makeApiWithConfigResponse(config: unknown): ApiClient { | CODE |
| LOW | packages/core/workspace/avatar-url.ts | 3 | export function resolvePublicFileUrlWithBase(rawUrl: string | null | undefined, baseUrl: string): string | null { | CODE |
| LOW | packages/core/workspace/queries.ts | 199 | export function workspaceMcpServersOptions(wsId: string) { | CODE |
| LOW | packages/core/workspace/pending-delete.ts | 21 | export function markWorkspaceDeletePending(workspaceId: string) { | CODE |
| 443 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/internal/handler/github_test.go | 119 | in: []string{"ABC-1: Lorem Ipsum", "Closes ABC-1. Follow up work planned in ABC-2. Unblocks ABC-3."}, | CODE |
| LOW | server/internal/handler/github_test.go | 160 | "ABC-1: Lorem Ipsum", | CODE |
| LOW | server/internal/handler/github_test.go | 1096 | title := primary.Identifier + ": Lorem Ipsum dolor sit amet" | CODE |
| LOW | server/internal/handler/github_test.go | 1096 | title := primary.Identifier + ": Lorem Ipsum dolor sit amet" | CODE |
| LOW | server/internal/handler/auth_google_error_code_test.go | 113 | {name: "error status with profile fields", status: 500, body: `{"email":"user@example.com"}`, wantStatus: 502}, | CODE |
| LOW | server/internal/handler/telegram_test.go | 51 | body: `{"bot_token":"placeholder"}`, | CODE |
| LOW | server/internal/handler/telegram_test.go | 64 | body: `{"token":"placeholder"}`, | CODE |
| LOW | server/internal/integrations/telegram/inbound.go | 48 | Placeholder string `json:"placeholder"` | CODE |
| LOW | server/internal/integrations/slack/byo_install_test.go | 41 | _, _ = w.Write([]byte(`{"ok":true,"team_id":"T999","user_id":"UBOTBYO","bot_id":"B0BOT","team":"Acme Inc","url":"http | CODE |
| LOW | server/internal/daemon/repocache/identity_test.go | 26 | gitIdentityCommand(t, "config", "--global", "user.email", "user@example.com") | CODE |
| LOW | server/internal/daemon/repocache/identity_test.go | 66 | assertCommitIdentity(t, first.Path, "User", "user@example.com") | CODE |
| LOW | server/internal/daemon/repocache/identity_test.go | 69 | assertCommitIdentity(t, again.Path, "User", "user@example.com") | CODE |
| LOW | server/internal/daemon/repocache/identity_test.go | 110 | assertCommitIdentity(t, results[1].Path, "User", "user@example.com") | CODE |
| LOW | server/internal/daemon/repocache/identity_test.go | 118 | assertCommitIdentity(t, results[1].Path, "Updated User", "user@example.com") | CODE |
| LOW | server/internal/daemon/repocache/identity_test.go | 143 | assertCommitIdentity(t, result.Path, "User", "user@example.com") | CODE |
| LOW | server/internal/daemon/repocache/identity_test.go | 232 | assertCommitIdentity(t, result.Path, "User", "user@example.com") | CODE |
| LOW | server/internal/daemon/repocache/identity_test.go | 285 | assertCommitIdentity(t, path, "User", "user@example.com") | CODE |
| LOW | …/internal/daemon/execenv/openclaw_shim_windows_test.go | 171 | if err := os.WriteFile(filepath.Join(dir, "node.exe"), []byte("placeholder"), 0o644); err != nil { | CODE |
| LOW | server/internal/daemon/execenv/local_worktree_test.go | 70 | {"config", "user.email", "test@test.com"}, | CODE |
| LOW | examples/plugins/triage-notify/multica.plugin.json | 23 | "placeholder": "platform" | CODE |
| LOW | examples/plugins/release-checklist/multica.plugin.json | 22 | "placeholder": "Tests pass\nDocs updated\nMigration reviewed", | CODE |
| LOW | examples/plugins/release-checklist/multica.plugin.json | 30 | "placeholder": "Release checklist complete:\n{{items}}", | CODE |
| LOW | packages/core/markdown/mention-boundary.test.ts | 44 | ["a dotted domain", "user@example.com"], | CODE |
| LOW | packages/views/settings/components/mcp-tab.test.tsx | 118 | expect(screen.getByLabelText(label)).toHaveAttribute("placeholder", example); | CODE |
| LOW | packages/views/locales/zh-Hans/search.json | 4 | "placeholder": "搜索,或输入要做的事...", | CODE |
| LOW | packages/views/locales/zh-Hans/runtimes.json | 122 | "placeholder": "例如:我的 MacBook", | CODE |
| LOW | packages/views/locales/zh-Hans/modals.json | 24 | "placeholder": "任务标题", | CODE |
| LOW | packages/views/locales/zh-Hans/modals.json | 34 | "placeholder": "聊聊你的体验、遇到的 bug,或想看到的功能...", | CODE |
| LOW | packages/views/locales/zh-Hans/squads.json | 32 | "placeholder": "小队名称", | CODE |
| LOW | packages/views/locales/zh-Hans/squads.json | 55 | "placeholder": "角色(例如:审查者)" | CODE |
| LOW | packages/views/locales/zh-Hans/squads.json | 126 | "placeholder": "例如:始终先编写失败测试。提交应保持小而独立。" | CODE |
| LOW | packages/views/locales/zh-Hans/agents.json | 349 | "placeholder": "描述你需要的智能体…", | CODE |
| LOW | packages/views/locales/zh-Hans/agents.json | 485 | "placeholder": "从工作区添加 skill", | CODE |
| LOW | packages/views/locales/zh-Hans/agents.json | 532 | "placeholder": "定义这个智能体的角色、专长和工作风格。\n\n# 示例\n你是一名专注 React 和 TypeScript 的前端工程师。\n\n## 工作风格\n- 写小而聚焦的 PR——每个逻辑变更一个 c | CODE |
| LOW | packages/views/locales/zh-Hans/issues.json | 159 | "placeholder": "筛选...", | CODE |
| LOW | packages/views/locales/zh-Hans/issues.json | 540 | "placeholder": "在任务中查找...", | CODE |
| LOW | packages/views/locales/zh-Hans/issues.json | 716 | "placeholder": "回复...", | CODE |
| LOW | packages/views/locales/zh-Hans/skills.json | 165 | "placeholder": "templates/review.md", | CODE |
| LOW | packages/views/locales/zh-Hant/search.json | 4 | "placeholder": "搜尋,或輸入要做的事...", | CODE |
| LOW | packages/views/locales/zh-Hant/runtimes.json | 122 | "placeholder": "例如:我的 MacBook", | CODE |
| LOW | packages/views/locales/zh-Hant/modals.json | 24 | "placeholder": "任務標題", | CODE |
| LOW | packages/views/locales/zh-Hant/modals.json | 34 | "placeholder": "聊聊你的體驗、遇到的 bug,或想看到的功能...", | CODE |
| LOW | packages/views/locales/zh-Hant/squads.json | 32 | "placeholder": "小隊名稱", | CODE |
| LOW | packages/views/locales/zh-Hant/squads.json | 55 | "placeholder": "角色(例如:審查者)" | CODE |
| LOW | packages/views/locales/zh-Hant/squads.json | 126 | "placeholder": "例如:始終先編寫失敗測試。提交應保持小而獨立。" | CODE |
| LOW | packages/views/locales/zh-Hant/agents.json | 349 | "placeholder": "描述你需要的智慧體…", | CODE |
| LOW | packages/views/locales/zh-Hant/agents.json | 485 | "placeholder": "從工作區新增 skill", | CODE |
| LOW | packages/views/locales/zh-Hant/agents.json | 532 | "placeholder": "定義這個智慧體的角色、專長和工作風格。\n\n# 示例\n你是一名專注 React 和 TypeScript 的前端工程師。\n\n## 工作風格\n- 寫小而聚焦的 PR——每個邏輯變更一個 c | CODE |
| LOW | packages/views/locales/zh-Hant/issues.json | 159 | "placeholder": "篩選...", | CODE |
| LOW | packages/views/locales/zh-Hant/issues.json | 540 | "placeholder": "在任務中查詢...", | CODE |
| LOW | packages/views/locales/zh-Hant/issues.json | 716 | "placeholder": "回覆...", | CODE |
| LOW | packages/views/locales/zh-Hant/skills.json | 165 | "placeholder": "templates/review.md", | CODE |
| LOW | packages/views/locales/ja/search.json | 4 | "placeholder": "検索するか、やりたいことを入力...", | CODE |
| LOW | packages/views/locales/ja/runtimes.json | 122 | "placeholder": "例:私の MacBook", | CODE |
| LOW | packages/views/locales/ja/modals.json | 24 | "placeholder": "タスク名", | CODE |
| LOW | packages/views/locales/ja/modals.json | 34 | "placeholder": "使用感、見つけたバグ、追加してほしい機能などをお聞かせください…", | CODE |
| LOW | packages/views/locales/ja/squads.json | 32 | "placeholder": "スクワッド名", | CODE |
| LOW | packages/views/locales/ja/squads.json | 55 | "placeholder": "役割(例:レビュアー)" | CODE |
| LOW | packages/views/locales/ja/squads.json | 126 | "placeholder": "例:必ず失敗するテストから始める。コミットは小さく独立させる。" | CODE |
| LOW | packages/views/locales/ja/agents.json | 328 | "placeholder": "ワークスペースからスキルを追加", | CODE |
| 84 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CLI_INSTALL.md | 15 | ## Step 1: Check if Multica CLI is already installed | COMMENT |
| LOW | CLI_INSTALL.md | 28 | ## Step 2: Install the Multica CLI | COMMENT |
| LOW | CLI_INSTALL.md | 120 | ## Step 3: Log in | COMMENT |
| LOW | CLI_INSTALL.md | 148 | ## Step 4: Start the daemon | COMMENT |
| LOW | CLI_INSTALL.md | 178 | ## Step 5: Verify everything is working | COMMENT |
| LOW | server/cmd/server/integration_test.go | 309 | // Step 1: Send code | COMMENT |
| LOW | server/cmd/server/integration_test.go | 327 | // Step 2: Verify code | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 90 | // Step 1: agent A creates an issue through the ordinary create path and | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 139 | // Step 2: the leader L, running its assignment task, posts a comment that | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 154 | // Step 3: the private worker J must now have a queued task whose originator | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 141 | // Step 1: cheap precondition check — if the rollup state tables | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 155 | // Step 2: read task_usage range and current watermark on the pool. | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 214 | // Step 3: serialise against the SQL cron entry / standalone backfill | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 93 | // Step 1: original runner claims the plan. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 102 | // Step 2: simulate a stuck handler — stale_after moved to the past. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 112 | // Step 3: a different runner steals the lease via the same primitive. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 136 | // Step 4: the original runner returns and tries to write SUCCESS | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 146 | // Step 5: verify the row is still RUNNING under runner-B. | COMMENT |
| LOW | server/internal/scheduler/stale_steal_test.go | 166 | // Step 6: runner B finishes successfully with its own token — that | COMMENT |
| LOW | server/internal/integrations/lark/outbound_test.go | 556 | // Step 1: ChatDone arrives with the real agent reply. Plain text | COMMENT |
| LOW | server/internal/integrations/lark/outbound_test.go | 569 | // Step 2: TaskCompleted fires immediately after with no content. | COMMENT |
| LOW⚡ | server/internal/daemon/cursor_terminal_boundary_test.go | 113 | // Step 2: the terminal result becomes decided while cleanup holds | COMMENT |
| LOW⚡ | server/internal/daemon/cursor_terminal_boundary_test.go | 121 | // Step 3: ownership could not be confirmed. | COMMENT |
| LOW | server/internal/daemon/execenv/hermes_home.go | 202 | // Step 2: honor the sticky <root>/active_profile. (The container-only | COMMENT |
| LOW | …rver/internal/daemon/execenv/qwenpaw_workspace_test.go | 264 | // Step 1: prepare with skills (A) | COMMENT |
| LOW | …rver/internal/daemon/execenv/qwenpaw_workspace_test.go | 280 | // Step 2: prepare with no skills (A → ∅) | COMMENT |
| LOW | …rver/internal/daemon/execenv/qwenpaw_workspace_test.go | 301 | // Step 1: prepare with skill A | COMMENT |
| LOW | …rver/internal/daemon/execenv/qwenpaw_workspace_test.go | 315 | // Step 2: prepare with skill B (different set) | COMMENT |
| LOW⚡ | scripts/check.sh | 78 | # Step 0: Ensure DB | COMMENT |
| LOW⚡ | scripts/check.sh | 85 | # Step 1: TypeScript typecheck | COMMENT |
| LOW⚡ | scripts/check.sh | 92 | # Step 2: TypeScript unit tests (Vitest) | COMMENT |
| LOW⚡ | scripts/check.sh | 99 | # Step 3: Go tests | COMMENT |
| LOW⚡ | scripts/check.sh | 110 | # Step 4: Start services for E2E (only if not already running) | COMMENT |
| LOW⚡ | scripts/check.sh | 136 | # Step 5: E2E tests (Playwright) | COMMENT |
| LOW⚡ | packages/core/paths/paths.ts | 52 | // Step 2: configure the agent on the chosen runtime. A real route so a | COMMENT |
| LOW⚡ | packages/core/paths/paths.ts | 55 | // Step 3: the agent exists; offer its first uses. | COMMENT |
| LOW⚡ | packages/views/auth/login-page.test.tsx | 278 | // Step 1: email | COMMENT |
| LOW⚡ | packages/views/auth/login-page.test.tsx | 282 | // Step 2: code | COMMENT |
| LOW | …es/views/runtimes/components/connect-remote-dialog.tsx | 271 | // Step 1: Instructions | COMMENT |
| LOW | …es/views/runtimes/components/connect-remote-dialog.tsx | 423 | // Step 2: Success | COMMENT |
| LOW⚡ | e2e/fixtures.ts | 66 | // Step 1: Send verification code | COMMENT |
| LOW⚡ | e2e/fixtures.ts | 76 | // Step 2: Read code from database | COMMENT |
| LOW | e2e/fixtures.ts | 88 | // Step 3: Verify code to get JWT | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/cmd/server/integration_test.go | 309 | // Step 1: Send code | COMMENT |
| LOW | server/cmd/server/integration_test.go | 327 | // Step 2: Verify code | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 90 | // Step 1: agent A creates an issue through the ordinary create path and | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 139 | // Step 2: the leader L, running its assignment task, posts a comment that | COMMENT |
| LOW | server/internal/handler/issue_agent_create_e2e_test.go | 154 | // Step 3: the private worker J must now have a queued task whose originator | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 141 | // Step 1: cheap precondition check — if the rollup state tables | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 155 | // Step 2: read task_usage range and current watermark on the pool. | COMMENT |
| LOW | server/internal/taskusagebackfill/backfill.go | 214 | // Step 3: serialise against the SQL cron entry / standalone backfill | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 93 | // Step 1: original runner claims the plan. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 102 | // Step 2: simulate a stuck handler — stale_after moved to the past. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 112 | // Step 3: a different runner steals the lease via the same primitive. | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 136 | // Step 4: the original runner returns and tries to write SUCCESS | COMMENT |
| LOW⚡ | server/internal/scheduler/stale_steal_test.go | 146 | // Step 5: verify the row is still RUNNING under runner-B. | COMMENT |
| LOW | server/internal/scheduler/stale_steal_test.go | 166 | // Step 6: runner B finishes successfully with its own token — that | COMMENT |
| LOW | server/internal/integrations/lark/outbound_test.go | 556 | // Step 1: ChatDone arrives with the real agent reply. Plain text | COMMENT |
| LOW | server/internal/integrations/lark/outbound_test.go | 569 | // Step 2: TaskCompleted fires immediately after with no content. | COMMENT |
| LOW⚡ | server/internal/daemon/cursor_terminal_boundary_test.go | 113 | // Step 2: the terminal result becomes decided while cleanup holds | COMMENT |
| LOW⚡ | server/internal/daemon/cursor_terminal_boundary_test.go | 121 | // Step 3: ownership could not be confirmed. | COMMENT |
| LOW | server/internal/daemon/execenv/hermes_home.go | 202 | // Step 2: honor the sticky <root>/active_profile. (The container-only | COMMENT |
| LOW | …rver/internal/daemon/execenv/qwenpaw_workspace_test.go | 264 | // Step 1: prepare with skills (A) | COMMENT |
| LOW | …rver/internal/daemon/execenv/qwenpaw_workspace_test.go | 280 | // Step 2: prepare with no skills (A → ∅) | COMMENT |
| LOW | …rver/internal/daemon/execenv/qwenpaw_workspace_test.go | 301 | // Step 1: prepare with skill A | COMMENT |
| LOW | …rver/internal/daemon/execenv/qwenpaw_workspace_test.go | 315 | // Step 2: prepare with skill B (different set) | COMMENT |
| LOW⚡ | scripts/check.sh | 78 | # Step 0: Ensure DB | COMMENT |
| LOW⚡ | scripts/check.sh | 85 | # Step 1: TypeScript typecheck | COMMENT |
| LOW⚡ | scripts/check.sh | 92 | # Step 2: TypeScript unit tests (Vitest) | COMMENT |
| LOW⚡ | scripts/check.sh | 99 | # Step 3: Go tests | COMMENT |
| LOW⚡ | scripts/check.sh | 110 | # Step 4: Start services for E2E (only if not already running) | COMMENT |
| LOW⚡ | scripts/check.sh | 136 | # Step 5: E2E tests (Playwright) | COMMENT |
| LOW⚡ | packages/core/paths/paths.ts | 52 | // Step 2: configure the agent on the chosen runtime. A real route so a | COMMENT |
| LOW⚡ | packages/core/paths/paths.ts | 55 | // Step 3: the agent exists; offer its first uses. | COMMENT |
| LOW⚡ | packages/views/auth/login-page.test.tsx | 278 | // Step 1: email | COMMENT |
| LOW⚡ | packages/views/auth/login-page.test.tsx | 282 | // Step 2: code | COMMENT |
| LOW | …es/views/runtimes/components/connect-remote-dialog.tsx | 271 | // Step 1: Instructions | COMMENT |
| LOW | …es/views/runtimes/components/connect-remote-dialog.tsx | 423 | // Step 2: Success | COMMENT |
| LOW⚡ | e2e/fixtures.ts | 66 | // Step 1: Send verification code | COMMENT |
| LOW⚡ | e2e/fixtures.ts | 76 | // Step 2: Read code from database | COMMENT |
| LOW | e2e/fixtures.ts | 88 | // Step 3: Verify code to get JWT | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | SELF_HOSTING_ADVANCED.md | 489 | DATABASE_URL="your-database-url" ./server/bin/migrate up | CODE |
| HIGH | SELF_HOSTING_ADVANCED.md | 492 | DATABASE_URL="your-database-url" PORT=8080 JWT_SECRET="your-secret" ./server/bin/server | CODE |
| HIGH | scripts/install.test.sh | 179 | if ! grep -q "multica login --token <YOUR_TOKEN>" "$tmp/install.out"; then | CODE |
| HIGH | scripts/install.test.sh | 232 | if grep -q "multica login --token <YOUR_TOKEN>" "$tmp/install.out"; then | CODE |
| HIGH | scripts/install.sh | 63 | printf " ${CYAN}multica login --token <YOUR_TOKEN>${RESET}\n" | CODE |
| HIGH | packages/core/runtimes/commands.ts | 34 | multica login --token <YOUR_TOKEN> | CODE |
| HIGH | packages/core/runtimes/commands.ts | 46 | multica login --token <YOUR_TOKEN> | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/internal/handler/agent.go | 1051 | // the strip robust against unusual casings seen on shared drives. | COMMENT |
| MEDIUM | server/internal/integrations/lark/outcome_replier.go | 119 | // boot path stays robust on partially-configured deployments. | COMMENT |
| MEDIUM | server/internal/service/task.go | 4782 | // the requester's workspace since the task started — more robust than | COMMENT |
| MEDIUM | server/internal/service/task.go | 8087 | // deterministic — robust against the same agent creating other issues in | COMMENT |
| MEDIUM | server/pkg/agent/antigravity.go | 684 | // is more robust than guessing $HOME, and follows agy through a custom data dir. | COMMENT |
| MEDIUM | packages/views/rich-content/rich-table.test.tsx | 51 | "| #7738 harness switch | MUL-12 tracks it | 10 |", | CODE |
| MEDIUM | packages/views/rich-content/rich-table.test.tsx | 138 | "| #7738 harness switch | MUL-12 tracks it | 10 |", | CODE |
| MEDIUM | packages/views/rich-content/rich-table.test.tsx | 168 | ["1", "#7738 harness switch", "MUL-12 tracks it", "10"], | CODE |
| MEDIUM | packages/views/rich-content/rich-table.test.tsx | 184 | "GitHub,Relation,Count\n#7738 harness switch,MUL-12 tracks it,10\n#4753 agent registry,see hot,9\n#9250 PATH key,n | CODE |
| MEDIUM | …kages/views/issues/components/use-drag-settle.test.tsx | 32 | // the hundreds before React throws. Bound generously to stay robust. | COMMENT |
| MEDIUM | apps/mobile/app/(app)/[workspace]/project/new.tsx | 130 | // robust than a hard-coded `setTimeout(150)` if iOS timing | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/internal/integrations/wecom/markdown_test.go | 316 | // goldmark and scaffold alphabet, so falling past the floor means the sweep now | COMMENT |
| MEDIUM | server/internal/daemon/poisoned.go | 86 | // GH #6402: the provider's "this session's context window is full" notice, | COMMENT |
| MEDIUM | …ver/internal/daemon/execenv/runtime_config_sections.go | 338 | // section for quick-create runs. Quick-create's hard guardrails forbid | COMMENT |
| MEDIUM | …ver/internal/daemon/execenv/runtime_config_sections.go | 557 | // guardrails. | COMMENT |
| MEDIUM | server/internal/daemon/execenv/codex_multi_agent.go | 58 | multicaMultiAgentBeginMarker = "# BEGIN multica-managed multi-agent (do not edit; regenerated by daemon)" | CODE |
| MEDIUM | server/internal/daemon/execenv/codex_multi_agent.go | 59 | multicaMultiAgentEndMarker = "# END multica-managed multi-agent" | CODE |
| MEDIUM | …er/internal/daemon/execenv/runtime_config_kind_test.go | 221 | // the copy that survives, because its own contract is that these guardrails | COMMENT |
| MEDIUM | …er/internal/daemon/execenv/runtime_config_kind_test.go | 275 | // other Core command absent (the hard guardrails forbid the call). | COMMENT |
| MEDIUM | …er/internal/daemon/execenv/runtime_config_kind_test.go | 315 | // the no-background-and-yield / no-"standing by" guardrails that address | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ages/views/editor/extensions/mention-extension.test.ts | 18 | " at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) \\~\\[spring-w | CODE |
| CRITICAL | apps/desktop/src/renderer/src/stores/tab-store.test.ts | 1690 | stored.state.byWorkspace.acme.tabs.map((tab: { url: string }) => tab.url), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | server/cmd/server/autopilot_listeners_test.go | 932 | // In this implementation the admission gate also re-reads the runtime, so | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/internal/service/chat_quick_actions_test.go | 100 | "\n```\nLet me know if you need more." | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.selfhost.yml | 11 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | deploy/helm/multica/values.yaml | 161 | # Set false to hide and reject the integration for this deployment. | COMMENT |