IronClaw is an Agent OS focused on privacy, security and extensibility
This report presents the forensic synthetic code analysis of nearai/ironclaw, a Rust project with 12,521 GitHub stars. SynthScan v2.0 examined 1,824,979 lines of code across 4072 source files, recording 6874 pattern matches distributed across 21 syntactic categories. The overall adjusted score of 5.9 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 6874 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | build.rs | 20 | // ── Git build metadata ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | build.rs | 23 | // ── Embed registry manifests ──────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | build.rs | 26 | // ── Embed bundled skills ──────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | build.rs | 29 | // ── Build Telegram channel WASM ───────────────────────────────────── | COMMENT |
| MEDIUM | release-plz.toml | 6 | # ── Main binary ───────────────────────────────────────────── | COMMENT |
| MEDIUM | release-plz.toml | 13 | # ── Internal crates (not useful standalone) ───────────────── | COMMENT |
| MEDIUM | tools-src/portfolio/src/live_tests.rs | 202 | // ── NEAR live tests (hit FastNEAR + Intear, no API key needed) ───── | COMMENT |
| MEDIUM | tools-src/portfolio/src/indexer/near.rs | 76 | // ── FastNEAR response types ──────────────────────────────────────── | COMMENT |
| MEDIUM | tools-src/portfolio/src/indexer/near.rs | 119 | // ── Intear token price types (`/list-token-price` shape) ─────────── | COMMENT |
| MEDIUM | tools-src/portfolio/src/indexer/near.rs | 134 | // ── Parsers (pure functions, no I/O) ─────────────────────────────── | COMMENT |
| MEDIUM | tools-src/portfolio/src/indexer/near.rs | 366 | // ── WASM scan (production path) ──────────────────────────────────── | COMMENT |
| MEDIUM | tools-src/portfolio/src/indexer/near.rs | 442 | // ── Tests ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/ironclaw_reborn_migration/Cargo.toml | 52 | # ── v1 / engine-v2 read side (the legacy monolith) ────────────────────────── | COMMENT |
| MEDIUM | crates/ironclaw_reborn_migration/Cargo.toml | 55 | # ── Reborn write side (path deps; versions intentionally unpinned) ─────────── | COMMENT |
| MEDIUM | crates/ironclaw_reborn_migration/Cargo.toml | 71 | # ── shared ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …es/ironclaw_reborn_migration/src/convert/identities.rs | 41 | // ── user_identities (OAuth/social) via the Database trait ──────────────────── | COMMENT |
| MEDIUM | …es/ironclaw_reborn_migration/src/convert/identities.rs | 134 | // ── channel_identities (channel actors) via raw SQL ────────────────────────── | COMMENT |
| MEDIUM | …s/ironclaw_reborn_migration/src/convert/automations.rs | 50 | // ── v1 routines ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …s/ironclaw_reborn_migration/src/convert/automations.rs | 269 | // ── engine-v2 missions ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …w_product_workflow/tests/outbound_delivery_contract.rs | 1710 | // ── require_direct_message_target flag threading ────────────────────────────── | COMMENT |
| MEDIUM | …roduct_workflow/tests/approval_interaction_contract.rs | 2134 | // ── First call: fresh Deny on a parked, pending gate ────────────────────── | COMMENT |
| MEDIUM | …roduct_workflow/tests/approval_interaction_contract.rs | 2158 | // ── Second call: replay Deny with SAME key, gate now Denied ─────────────── | COMMENT |
| MEDIUM | …aw_product_workflow/tests/auth_interaction_contract.rs | 914 | // ── First call: Deny on a parked gate ───────────────────────────────────── | COMMENT |
| MEDIUM | …aw_product_workflow/tests/auth_interaction_contract.rs | 937 | // ── Second call: replay with SAME idempotency key ───────────────────────── | COMMENT |
| MEDIUM | crates/ironclaw_threads/src/filesystem_service.rs | 2846 | // ── Idempotency key shape ────────────────────────────────────── | COMMENT |
| MEDIUM | crates/ironclaw_threads/src/filesystem_service.rs | 2874 | // ── Paths ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/ironclaw_threads/src/filesystem_service.rs | 3099 | // ── Transcript helpers (shared semantics) ────────────────────── | COMMENT |
| MEDIUM | crates/ironclaw_threads/src/filesystem_service.rs | 3366 | // ── CAS-aware put with `Unsupported`→`Any` fallback ──────────── | COMMENT |
| MEDIUM⚡ | …bilities/tests/capability_host_auth_resume_contract.rs | 947 | // ── Assertion (a): lease must be Claimed, NOT Revoked ─────────────────── | COMMENT |
| MEDIUM⚡ | …bilities/tests/capability_host_auth_resume_contract.rs | 955 | // ── Phase 4: auth_resume_json → reuses Claimed lease → dispatches ─────── | COMMENT |
| MEDIUM⚡ | …bilities/tests/capability_host_auth_resume_contract.rs | 962 | // ── Assertion (b): auth_resume_json succeeds ───────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 843 | // ── Phase 1: invoke_json → BlockedApproval ────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 876 | // ── Phase 2: approve → lease issued (Active) ──────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 900 | // ── Phase 3: resume_json → dispatcher returns AuthRequired ────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 986 | // ── Assertion (c): approval still Approved ─────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 998 | // ── Assertion (d): lease is now Consumed ───────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 1006 | // ── Assertion (e): dispatch was called with the SAME invocation_id ──────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 1785 | // ── Barrier lease store ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 1902 | // ── Gating dispatcher ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 1951 | // ── Phase 1: invoke → BlockedApproval ────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 1980 | // ── Phase 2: approve → Active lease ──────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 1986 | // ── Phase 3: resume_json (call 0) → AuthRequired → lease Claimed ──────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2026 | // ── Phase 4: arm the barrier and spawn BOTH concurrent tasks ──────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2096 | // ── Phase 5: winner is in dispatcher, release and join both ───────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2108 | // ── Phase 6: assert exactly one winner and one loser ──────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2218 | // ── Phase 1: invoke → BlockedApproval ────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2249 | // ── Phase 2: approve → Active lease ──────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2256 | // ── Phase 3: resume_json → AuthRequired bounce → lease Claimed ────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2288 | // ── Phase 4: auth_resume_json with DenyingAuthorizer ──────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2322 | // ── Core assertion: lease must be Revoked, not Dispatching ─────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2372 | // ── Phase 1: invoke → BlockedApproval ────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2402 | // ── Phase 2: approve → Active lease ──────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2409 | // ── Phase 3: resume_json → AuthRequired → lease Claimed ───────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2480 | // ── Core assertion: lease must be Revoked, not Dispatching ─────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 2941 | // ── GatedLeaseStore ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 3064 | // ── Phase 1: invoke → BlockedApproval ────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 3093 | // ── Phase 2: approve → Active lease ───────────────────────────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 3100 | // ── Phase 3: block at auth directly (lease stays Active) ───────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 3112 | // ── Phase 4: arm gate and spawn task A (FRESH Active path) ─────────────── | COMMENT |
| MEDIUM | …bilities/tests/capability_host_auth_resume_contract.rs | 3148 | // ── Phase 5: run B (REUSE path) while A is parked ──────────────────────── | COMMENT |
| 1341 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 41 | # stable surface). These are `warn`, not `deny`, and are *opted into* | COMMENT |
| LOW | Cargo.toml | 321 | # all 17 gated modules into every int-tier test binary — real, one-time | COMMENT |
| LOW | Cargo.toml | 381 | tui = ["dep:ironclaw_tui"] | COMMENT |
| LOW | build.rs | 1 | //! Build script: compile Telegram channel WASM from source. | COMMENT |
| LOW | .coderabbit.yaml | 1 | # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json | COMMENT |
| LOW | .config/nextest.toml | 1 | # Cross-binary parallel test runner config for cargo-nextest. | COMMENT |
| LOW | channels-src/discord/src/lib.rs | 1 | //! Discord Gateway/Webhook channel for IronClaw. | COMMENT |
| LOW | channels-src/feishu/build.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | channels-src/feishu/src/lib.rs | 1 | // Feishu API types have fields reserved for future use. | COMMENT |
| LOW | channels-src/telegram/build.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | channels-src/telegram/src/lib.rs | 1 | // Telegram API types have fields reserved for future use (entities, reply threading, etc.) | COMMENT |
| LOW | channels-src/telegram/src/lib.rs | 341 | struct TelegramConfig { | COMMENT |
| LOW | channels-src/telegram/src/lib.rs | 361 | /// Whether to respond to all group messages (not just mentions). | COMMENT |
| LOW | channels-src/telegram/src/lib.rs | 1821 | } | COMMENT |
| LOW | channels-src/slack/build.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | channels-src/slack/src/lib.rs | 1 | //! Slack Events API channel for IronClaw. | COMMENT |
| LOW | channels-src/whatsapp/src/lib.rs | 1 | // WhatsApp API types have fields reserved for future use (contacts, statuses, etc.) | COMMENT |
| LOW | channels-src/whatsapp/src/lib.rs | 521 | channel_host::LogLevel::Info, | COMMENT |
| LOW | tools-src/google-docs/src/types.rs | 1 | //! Types for Google Docs API requests and responses. | COMMENT |
| LOW | tools-src/google-docs/src/types.rs | 81 | /// Make text bold. | COMMENT |
| LOW | tools-src/google-docs/src/lib.rs | 1 | //! Google Docs WASM Tool for IronClaw. | COMMENT |
| LOW | tools-src/google-docs/src/lib.rs | 21 | //! - `format_paragraph`: Set heading level, alignment, spacing | COMMENT |
| LOW | tools-src/slack_user/src/types.rs | 1 | //! Types for Slack user-token API requests and responses. | COMMENT |
| LOW | tools-src/slack_user/src/types.rs | 21 | pub enum SlackUserAction { | COMMENT |
| LOW | tools-src/slack_user/src/types.rs | 41 | #[serde(default = "default_conversation_types")] | COMMENT |
| LOW | tools-src/slack_user/src/lib.rs | 1 | //! Slack personal (user-token) WASM Tool for IronClaw Reborn. | COMMENT |
| LOW | tools-src/google-calendar/src/types.rs | 1 | //! Types for Google Calendar API requests and responses. | COMMENT |
| LOW | tools-src/google-calendar/src/types.rs | 21 | /// default. Pass an explicit earlier timestamp only when you want | COMMENT |
| LOW | tools-src/google-calendar/src/types.rs | 41 | /// The event ID. | COMMENT |
| LOW | tools-src/google-calendar/src/types.rs | 61 | start_datetime: Option<String>, | COMMENT |
| LOW | tools-src/google-calendar/src/types.rs | 81 | /// Calendar ID (default: "primary"). | COMMENT |
| LOW | tools-src/google-calendar/src/types.rs | 101 | /// New start date for all-day events. | COMMENT |
| LOW | tools-src/google-calendar/src/lib.rs | 1 | //! Google Calendar WASM Tool for IronClaw. | COMMENT |
| LOW | tools-src/github/src/lib.rs | 1 | //! GitHub WASM Tool for IronClaw. | COMMENT |
| LOW | tools-src/google-sheets/src/types.rs | 1 | //! Types for Google Sheets API requests and responses. | COMMENT |
| LOW | tools-src/google-sheets/src/types.rs | 121 | bold: Option<bool>, | COMMENT |
| LOW | tools-src/google-sheets/src/lib.rs | 1 | //! Google Sheets WASM Tool for IronClaw. | COMMENT |
| LOW | tools-src/google-sheets/src/lib.rs | 21 | //! - `add_sheet`: Add a new sheet (tab) | COMMENT |
| LOW | tools-src/google-drive/src/types.rs | 1 | //! Types for Google Drive API requests and responses. | COMMENT |
| LOW | tools-src/google-drive/src/types.rs | 21 | /// "'folderId' in parents", "sharedWithMe = true". | COMMENT |
| LOW | tools-src/google-drive/src/types.rs | 61 | /// Upload a new file (text content). | COMMENT |
| LOW | tools-src/google-drive/src/types.rs | 81 | file_id: String, | COMMENT |
| LOW | tools-src/google-drive/src/lib.rs | 1 | //! Google Drive WASM Tool for IronClaw. | COMMENT |
| LOW | tools-src/google-drive/src/lib.rs | 21 | //! - `delete_file`: Permanently delete a file | COMMENT |
| LOW | tools-src/telegram/src/session.rs | 1 | use serde::{Deserialize, Serialize}; | COMMENT |
| LOW | tools-src/telegram/src/types.rs | 1 | //! Types for the Telegram user-mode tool (MTProto direct). | COMMENT |
| LOW | tools-src/telegram/src/lib.rs | 1 | //! Telegram User-Mode WASM Tool for IronClaw. | COMMENT |
| LOW | tools-src/telegram/src/lib.rs | 21 | //! at `telegram/session.json`. The agent should save updated session data after | COMMENT |
| LOW | tools-src/portfolio/src/format.rs | 1 | //! Deterministic output formatters. | COMMENT |
| LOW | tools-src/portfolio/src/widget.rs | 1 | //! `format_widget` operation — build the `projects/<id>/widgets/state.json` | COMMENT |
| LOW | tools-src/portfolio/src/lib.rs | 1 | // M1 scaffold: several types/methods are reserved for M2+ stages and | COMMENT |
| LOW | tools-src/portfolio/src/lib.rs | 21 | //! Internal layout (one module per stage): | COMMENT |
| LOW | tools-src/portfolio/src/lib.rs | 61 | #[serde(rename = "scan")] | COMMENT |
| LOW | tools-src/portfolio/src/lib.rs | 81 | /// near-lending-yield, near-lp-yield). | COMMENT |
| LOW | tools-src/portfolio/src/live_tests.rs | 1 | //! Live integration tests that hit real external APIs. | COMMENT |
| LOW | tools-src/portfolio/src/replay_tests.rs | 1 | //! Replay-style tests driven by YAML scenarios under `scenarios/`. | COMMENT |
| LOW | tools-src/portfolio/src/intents/bundling.rs | 1 | //! Multi-leg intent bundling. | COMMENT |
| LOW | tools-src/portfolio/src/intents/solver.rs | 1 | //! NEAR Intents solver client. | COMMENT |
| LOW | tools-src/portfolio/src/intents/solver.rs | 301 | /// Live integration test against the real NEAR Intents solver | COMMENT |
| LOW | tools-src/portfolio/src/intents/mod.rs | 1 | //! Intents stage — translate a `MovementPlan` into an unsigned NEAR | COMMENT |
| 2731 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/ironclaw_gateway/static/js/core/onboarding.js | 490 | function showSetupCardForExtension(data) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/sse.js | 8 | function countVisibleRunReplyMessages() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/sse.js | 14 | function appendMissingRunReplyFallback(expectedThreadId, previousReplyCount) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/init-auth.js | 498 | function updateRestartButtonVisibility() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/gateway-tee.js | 3 | function startGatewayStatusPolling() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/gateway-tee.js | 13 | function refreshLegacyRoutinesPresence() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/history.js | 336 | function createToolCallsSummaryElement(toolCalls) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/history.js | 340 | function createActivityGroupFromHistory(toolCalls) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 3 | function formatToolActivityDurationMs(durationMs) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 11 | function truncateToolActivityResult(text) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 45 | function getToolActivityGroupStatus(entries) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 56 | function createToolActivitySummary(toolCount, totalDurationMs, includeDuration, status) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 77 | function setToolActivityCardExpanded(rendered, expanded) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 83 | function applyToolActivityCardState(rendered, options) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 206 | function createActivityGroupFromEntries(entries, options) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 257 | function createToolActivityController(options) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 321 | function getOrCreateGroup() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 507 | function getOrCreateActivityGroup() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/tool-activity.js | 545 | function shouldShowChannelConnectedMessage(extensionName, success) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/core/routing.js | 62 | function normalizeTabForEngineMode(tab) { | CODE |
| LOW⚡ | crates/ironclaw_gateway/static/js/surfaces/projects.js | 528 | function renderMissionProgressMarkup(progress) { | CODE |
| LOW⚡ | crates/ironclaw_gateway/static/js/surfaces/projects.js | 534 | function renderMissionProgressCell(missionId) { | CODE |
| LOW⚡ | crates/ironclaw_gateway/static/js/surfaces/projects.js | 540 | function renderMissionThreadProgress(threadId) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 551 | function haveMissionThreadsChanged(previousMission, nextMission) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 610 | function fetchMissionDetailForProgress(missionId, options = {}) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 634 | function refreshPersistentActivityBar() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 657 | function getTrackedActiveMissionIds() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 661 | function scheduleActiveMissionMappingRefresh() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 674 | function scheduleMissionProgressViewsRefresh() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 683 | function refreshMissionProgressViews() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 1009 | function renderMissionBriefSection(section) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 1114 | function parseApproachHistoryRecord(text) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/projects.js | 1160 | function renderApproachHistoryCard(entryText, index, isLatest) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/logs.js | 29 | function rememberLogEntryForDownload(entry) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/logs.js | 36 | function serializeLogEntriesAsJsonl(entries) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/chat.js | 343 | function createGeneratedImageElement(dataUrl, path, eventId) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/chat.js | 373 | function isSafeGeneratedImageDataUrl(dataUrl) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/chat.js | 377 | function hasRenderedGeneratedImage(container, eventId) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/chat.js | 423 | function getRememberedGeneratedImage(threadId, eventId) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/chat.js | 430 | function resolveGeneratedImageForRender(threadId, image) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/chat.js | 492 | function getSlashAutocompleteItems() { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/chat.js | 795 | function parseAttachmentAttributes(rawAttrs) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 43 | function renderAvailableExtensionCard(entry) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 519 | function refreshCurrentSettingsTab() { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 644 | function basicConfigureValidationError(field, value) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 729 | function appendConfigureFieldGroup(form, fields, items, kind, optionalGroup) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 884 | function renderInteractiveLoginPanel(name) { | CODE |
| LOW⚡ | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 919 | function interactiveLoginDefaultLabel(name, interactiveLogin) { | CODE |
| LOW⚡ | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 924 | function interactiveLoginWaitingLabel(name) { | CODE |
| LOW⚡ | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 929 | function interactiveLoginStatusText(name, res) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 949 | function getInteractiveLoginButton(overlay) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 957 | function updateInteractiveLoginPanel(overlay, res) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 979 | function maybeOpenInteractiveLoginUrl(name, overlay, res) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 994 | function interactiveLoginPollDelayMs(status) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 1110 | function clearConfigureInlineError(overlay) { | CODE |
| LOW | …ates/ironclaw_gateway/static/js/surfaces/extensions.js | 1239 | function cancelAuthFromConfigureModal(overlay) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/settings.js | 243 | function renderStructuredSettingsInto(container, settingsDefs, settings, activeValues) { | CODE |
| LOW | crates/ironclaw_gateway/static/js/surfaces/settings.js | 305 | function renderStructuredSettingsRow(def, value, activeValue) { | CODE |
| LOW | …_webui_v2/frontend/scripts/check-source-conventions.ts | 31 | function isRelativeModuleSpecifier(value: string): boolean { | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/app/auth.ts | 91 | function consumeLoginTicketFromUrl() { | CODE |
| 1398 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | channels-src/discord/src/lib.rs | 1529 | // Step 1: Open (or reuse) a DM channel with the target user. | COMMENT |
| LOW | channels-src/discord/src/lib.rs | 1558 | // Step 2: Send the message to the DM channel. | COMMENT |
| LOW | channels-src/telegram/src/lib.rs | 1129 | // Step 1: Call getFile to get file_path | COMMENT |
| LOW | channels-src/telegram/src/lib.rs | 1173 | // Step 2: Download the actual file bytes | COMMENT |
| LOW⚡ | tools-src/telegram/src/lib.rs | 168 | // Step 1: DH auth key exchange | COMMENT |
| LOW⚡ | tools-src/telegram/src/lib.rs | 175 | // Step 2: send verification code | COMMENT |
| LOW⚡ | tools-src/telegram/src/auth.rs | 19 | // Step 1: generate nonce, send ReqPqMulti | COMMENT |
| LOW⚡ | tools-src/telegram/src/auth.rs | 27 | // Step 2: factorize PQ, RSA encrypt, send ReqDhParams | COMMENT |
| LOW⚡ | tools-src/telegram/src/auth.rs | 35 | // Step 3: compute DH g_b, send SetClientDhParams | COMMENT |
| LOW | tools-src/portfolio/src/live_tests.rs | 135 | // Step 1: Fetch balances from Dune | COMMENT |
| LOW⚡ | tools-src/portfolio/src/live_tests.rs | 157 | // Step 2: Classify through analyzer | COMMENT |
| LOW⚡ | tools-src/portfolio/src/live_tests.rs | 167 | // Step 3: Run strategy proposals | COMMENT |
| LOW | tools-src/portfolio/src/live_tests.rs | 272 | // Step 1: Fetch from FastNEAR + Intear | COMMENT |
| LOW⚡ | tools-src/portfolio/src/live_tests.rs | 287 | // Step 2: Classify through analyzer | COMMENT |
| LOW⚡ | tools-src/portfolio/src/live_tests.rs | 297 | // Step 3: Run strategy proposals (include NEAR-specific strategies) | COMMENT |
| LOW | tools-src/portfolio/src/live_tests.rs | 333 | // Step 4: Build intents for ready proposals | COMMENT |
| LOW | tools-src/portfolio/src/indexer/dune.rs | 329 | // Step 1: balances | COMMENT |
| LOW | tools-src/portfolio/src/indexer/dune.rs | 346 | // Step 2: positions/activity (best-effort enrichment) | COMMENT |
| LOW | …w_host_runtime/tests/host_runtime_services_contract.rs | 6467 | // Step 1: store error → pre-flight skips → approval gate fires. | COMMENT |
| LOW | …w_host_runtime/tests/host_runtime_services_contract.rs | 6511 | // Step 2: approve WITH the required secret handle granted, so dispatch | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 1754 | // Step 3: simulate the crash window by injecting a dangling conv_a index | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 1763 | // Step 4: conv_a lookup must be a miss — the primary record lists conv_b, | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2279 | // Step 1: store_a writes rec_a (conv index version 1). | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2285 | // Step 2: store_b writes rec_b (conv index version 2) — simulates a | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2293 | // Step 3: store_a re-records rec_a. The index already carries rec_a | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2373 | // Step 1: store_a records rec_a → conv index = [rec_a]. | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2379 | // Step 2: store_b records rec_b → conv index = [rec_a, rec_b]. | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2385 | // Step 3: store_a removes rec_a. Its snapshot (from step 1) only sees | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2394 | // Step 4: only rec_b must survive. | COMMENT |
| LOW | crates/ironclaw_outbound/src/filesystem_store.rs | 1716 | // Step 1: record the route delivered to conv_a. | COMMENT |
| LOW | crates/ironclaw_outbound/src/filesystem_store.rs | 1730 | // Step 2: overwrite the route with conv_b (normal path; conv_a index is cleaned). | COMMENT |
| LOW | crates/ironclaw_outbound/src/filesystem_store.rs | 1774 | // Step 5: conv_b lookup must still return the live route. | COMMENT |
| LOW | crates/ironclaw_reborn_webui_ingress/src/auth/github.rs | 372 | /// Step 1: exchange the authorization code for an access token, | COMMENT |
| LOW | …/ironclaw_webui_v2/tests/webui_v2_handlers_contract.rs | 4909 | // Step 1: consume the only slot with a held-open SSE connection | COMMENT |
| LOW | …/ironclaw_webui_v2/tests/webui_v2_handlers_contract.rs | 4942 | // Step 2: same-caller WS upgrade must hit the shared cap. Use a | COMMENT |
| LOW | …/ironclaw_webui_v2/tests/webui_v2_handlers_contract.rs | 4969 | // Step 3: drop the SSE stream → kernel closes the connection | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 245 | // Step 1: Parse the invite URL (trust root). | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 248 | // Step 2: Stage the keypair BEFORE any network call (retry-safe). | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 251 | // Step 3: POST to the onboard endpoint. Terminal invite rejections discard | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 255 | // Step 4: Parse + schema-validate the response body. | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 258 | // Step 5: Trust anchoring — issuer_url origin must equal invite origin. | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 270 | // Step 6: Cross-check the server's echoed device_key_id against the value | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 280 | // Step 7: ingest_url must be HTTPS (loopback http allowed for dev/tests). | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 283 | // Step 8: Write the tenant key file (pending file deliberately kept). | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 286 | // Step 9: Write the standing contribution policy. If this fails the pending | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 291 | // Step 10: Finalize — remove the pending file only now that both the tenant | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 301 | // Step 11: Sanitize browser-nav hints — drop any non-HTTPS URL (never fatal). | COMMENT |
| LOW | crates/ironclaw_llm/src/openai_codex_session.rs | 361 | // Step 3: Poll for authorization code | COMMENT |
| LOW | crates/ironclaw_llm/src/openai_codex_session.rs | 430 | // Step 4: Exchange authorization code for tokens (form-encoded, per Auth0 spec) | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/recording.rs | 1239 | // Step 0: user_input "Do something" | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/recording.rs | 1240 | // Step 1: text response | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/recording.rs | 1241 | // Step 2: text response (no new user_input since no new user messages) | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/github_copilot_auth.rs | 297 | // Step 1: Exchange the OAuth token for a Copilot session token. | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/github_copilot_auth.rs | 301 | // Step 2: Verify the session token works against the models endpoint. | COMMENT |
| LOW⚡ | tests/e2e_wasm_portfolio.rs | 344 | // Step 1: scan the fixture address. The scan response is | COMMENT |
| LOW⚡ | tests/e2e_wasm_portfolio.rs | 346 | // Step 2: propose with the classified positions from step 1. | COMMENT |
| LOW | tests/e2e_wasm_portfolio.rs | 417 | // Step 1: LLM calls scan | COMMENT |
| LOW | tests/e2e_wasm_portfolio.rs | 435 | // Step 2: LLM calls propose with the scan results | COMMENT |
| LOW | tests/e2e_wasm_portfolio.rs | 460 | // Step 3: LLM summarizes | COMMENT |
| LOW | tests/e2e_wasm_portfolio.rs | 569 | // Step 1: scan root.near | COMMENT |
| 201 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/e2e/mock_llm.py | 908 | " var skills = (data && data.skills) || [];\n" | CODE |
| HIGH | tests/e2e/mock_llm.py | 939 | " 'Failed to load skills: ' + (e && e.message ? e.message : e) +\n" | CODE |
| HIGH | tests/e2e/helpers.py | 544 | threadId: typeof currentThreadId !== 'undefined' ? currentThreadId : null, | STRING |
| HIGH | tests/e2e/helpers.py | 545 | pendingId: typeof _nextPendingId !== 'undefined' ? _nextPendingId : null, | STRING |
| HIGH | tests/e2e/helpers.py | 569 | if (!pendingThreadId || pendingId === null || pendingId === undefined) return true; | STRING |
| HIGH | tests/e2e/helpers.py | 569 | if (!pendingThreadId || pendingId === null || pendingId === undefined) return true; | STRING |
| HIGH⚡ | tests/e2e/helpers.py | 582 | text: ((content && content.innerText) || last.innerText || '').trim(), | STRING |
| HIGH⚡ | tests/e2e/helpers.py | 590 | const text = ((content && content.innerText) || last.innerText || '').trim(); | STRING |
| HIGH⚡ | tests/e2e/helpers.py | 591 | if (text.length > 0 && pendingForThisSendCleared()) { | STRING |
| HIGH⚡ | tests/e2e/helpers.py | 592 | if (expectedContains && text.includes(expectedContains)) { | STRING |
| HIGH | tests/e2e/helpers.py | 603 | return null; | STRING |
| HIGH | …/e2e/scenarios/test_reborn_webui_v2_legacy_approval.py | 68 | streams.push(this); | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 792 | text: ((content && content.innerText) || last.innerText || '').trim(), | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 797 | if (assistants.length > assistantCount && input && !input.disabled) { | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 800 | const text = ((content && content.innerText) || last.innerText || '').trim(); | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 808 | return null; | STRING |
| HIGH | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 855 | text: (tool && tool.textContent || '').trim(), | STRING |
| HIGH | tests/e2e/scenarios/test_csp.py | 50 | found.push(tag + id + cls + '[' + attr + ']'); | CODE |
| HIGH⚡ | tests/e2e/scenarios/test_pending_user_messages.py | 37 | previous = await page.evaluate("() => currentThreadId || null") | CODE |
| HIGH⚡ | tests/e2e/scenarios/test_pending_user_messages.py | 40 | "(prev) => !!currentThreadId && currentThreadId !== prev", | CODE |
| HIGH | tests/e2e/scenarios/test_pending_user_messages.py | 138 | return pending && pending.some(p => p.content === {unique_msg!r}); | CODE |
| HIGH | tests/e2e/scenarios/test_pending_user_messages.py | 203 | return pending && pending.some((p) => | STRING |
| HIGH | tests/e2e/scenarios/test_pending_user_messages.py | 218 | const lastUser = users.length ? users[users.length - 1] : null; | STRING |
| HIGH | tests/e2e/scenarios/test_pending_user_messages.py | 276 | if (arr && arr.some(p => p.content === args.msg)) return false; | CODE |
| HIGH⚡ | tests/e2e/scenarios/test_pending_user_messages.py | 353 | return card && card.offsetParent !== null; | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_pending_user_messages.py | 353 | return card && card.offsetParent !== null; | STRING |
| HIGH | tests/e2e/scenarios/test_v2_activity_shell.py | 71 | " return !!el && el.textContent.trim().length > 0;" | CODE |
| HIGH | …ts/e2e/scenarios/test_routines_tab_after_v2_upgrade.py | 39 | return tab && tab.style.display !== 'none'; | STRING |
| HIGH | …ts/e2e/scenarios/test_routines_tab_after_v2_upgrade.py | 57 | return tab && tab.style.display === 'none'; | STRING |
| HIGH | …ts/e2e/scenarios/test_routines_tab_after_v2_upgrade.py | 75 | return tab && tab.style.display !== 'none'; | STRING |
| HIGH | …ts/e2e/scenarios/test_routines_tab_after_v2_upgrade.py | 211 | return tab && tab.style.display === 'none'; | STRING |
| HIGH | …ts/e2e/scenarios/test_routines_tab_after_v2_upgrade.py | 278 | visible: tab && tab.style.display !== 'none', | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_extensions.py | 1504 | await page.wait_for_function("() => window._lastOpenedUrl !== null && window._lastOpenedUrl !== undefined", timeout= | CODE |
| HIGH | tests/e2e/scenarios/test_extensions.py | 725 | "() => window._lastOpenedUrl !== null && window._lastOpenedUrl !== undefined", | CODE |
| HIGH | tests/e2e/scenarios/test_extensions.py | 917 | await page.wait_for_function("() => window._lastOpenedUrl !== null && window._lastOpenedUrl !== undefined", timeout= | CODE |
| HIGH | tests/e2e/scenarios/test_extensions.py | 1621 | await page.evaluate("window._openedUrl = null; window.open = (url) => { window._openedUrl = url; }") | CODE |
| HIGH | tests/e2e/scenarios/test_extensions.py | 1646 | await page.evaluate("window._openedUrl = null; window.open = (url) => { window._openedUrl = url; return null; }") | CODE |
| HIGH | tests/e2e/scenarios/test_extensions.py | 1205 | handleOnboardingState({ extension_name: 'telegram', state: 'auth_required', instructions: 'pending', auth_ur | STRING |
| HIGH⚡ | …2e/scenarios/test_reborn_webui_v2_legacy_auth_flows.py | 77 | window.__openedAuth.push({ url, target, features }); | STRING |
| HIGH⚡ | …2e/scenarios/test_reborn_webui_v2_legacy_auth_flows.py | 78 | return null; | STRING |
| HIGH⚡ | …2e/scenarios/test_reborn_webui_v2_legacy_auth_flows.py | 85 | streams.push(this); | STRING |
| HIGH | …2e/scenarios/test_reborn_webui_v2_legacy_auth_flows.py | 621 | window.__openedAuth.push({ kind: "navigate", url: value }); | STRING |
| HIGH | …2e/scenarios/test_reborn_webui_v2_legacy_auth_flows.py | 625 | window.__openedAuth.push({ kind: "open", url, target, features }); | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_reborn_webui_v2_smoke.py | 79 | let activeStream = null; | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_reborn_webui_v2_smoke.py | 81 | if (!activeStream || activeStream.readyState === 2) { | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_reborn_webui_v2_smoke.py | 91 | if (activeStream && activeStream.readyState !== 2) { | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_reborn_webui_v2_smoke.py | 96 | if (activeStream !== this || this.readyState === 2) return; | STRING |
| HIGH⚡ | tests/e2e/scenarios/test_reborn_webui_v2_smoke.py | 103 | if (activeStream === this) activeStream = null; | STRING |
| HIGH | tests/e2e/scenarios/test_reborn_webui_v2_smoke.py | 118 | if (activeStream === stream) activeStream = null; | STRING |
| HIGH | tests/e2e/scenarios/test_reborn_webui_v2_smoke.py | 821 | return null; | STRING |
| HIGH | tests/e2e/scenarios/test_dom_resource_limits.py | 149 | await page.evaluate("if (eventSource) { eventSource.close(); eventSource = null; }") | CODE |
| HIGH | tests/e2e/scenarios/test_dom_resource_limits.py | 197 | return el ? el.className : null; | CODE |
| HIGH | tests/e2e/scenarios/test_dom_resource_limits.py | 216 | events.push({ type: 'job_status', data: { job_id: jobId }, ts: Date.now() }); | CODE |
| HIGH | tests/e2e/scenarios/test_dom_resource_limits.py | 254 | events.push({ type: 'job_status', data: { job_id: jobId }, ts: Date.now() }); | CODE |
| HIGH | tests/e2e/scenarios/test_dom_resource_limits.py | 307 | return content && content.innerText.trim().length > 0; | CODE |
| HIGH | …ios/test_reborn_webui_v2_legacy_dom_resource_limits.py | 168 | streams.push(this); | STRING |
| HIGH | …ios/test_reborn_webui_v2_legacy_dom_resource_limits.py | 463 | timeoutDelays.push(delay); | STRING |
| HIGH | …ios/test_reborn_webui_v2_legacy_dom_resource_limits.py | 468 | if (delay >= 2000 && delay <= 30000) reconnectTimers.set(id, delay); | STRING |
| HIGH | …ios/test_reborn_webui_v2_legacy_dom_resource_limits.py | 482 | failCalls: window.__sseFailCalls || 0, | STRING |
| HIGH | …ios/test_reborn_webui_v2_legacy_dom_resource_limits.py | 490 | streams.push(this); | STRING |
| 63 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 38 | # Maintainability guardrails against dead/speculative public API | COMMENT |
| MEDIUM | clippy.toml | 1 | # Complexity guardrails for AI-assisted development quality. | COMMENT |
| MEDIUM | CLAUDE.md | 146 | ├── app.rs # App startup orchestration (channel wiring, DB init) | CODE |
| MEDIUM | CLAUDE.md | 206 | │ ├── container.rs # Container worker runtime (ContainerDelegate + shared agentic loop) | CODE |
| MEDIUM | CLAUDE.md | 207 | │ ├── job.rs # Background job worker (JobDelegate + shared agentic loop) | CODE |
| MEDIUM | CLAUDE.md | 222 | │ │ ├── templates.rs # Project scaffolding | CODE |
| MEDIUM | CLAUDE.md | 252 | │ ├── manager.rs # SandboxManager orchestration | CODE |
| MEDIUM | tools-src/portfolio/src/lib.rs | 1 | // M1 scaffold: several types/methods are reserved for M2+ stages and | COMMENT |
| MEDIUM | crates/ironclaw_dispatcher/CLAUDE.md | 1 | # ironclaw_dispatcher guardrails | COMMENT |
| MEDIUM | …ironclaw_reborn_migration/tests/migration_roundtrip.rs | 563 | // (action + guardrails/notify/counters + routine_runs); each non-cron | COMMENT |
| MEDIUM | crates/ironclaw_reborn_migration/src/report.rs | 41 | /// guardrails, notify config, run counters). | COMMENT |
| MEDIUM | …s/ironclaw_reborn_migration/src/convert/automations.rs | 13 | //! - routine guardrails / notify / run counters, mission focus / approach / | COMMENT |
| MEDIUM | crates/ironclaw_wasm_product_adapters/CLAUDE.md | 1 | # ironclaw_wasm_product_adapters guardrails | COMMENT |
| MEDIUM | crates/ironclaw_product_adapter_registry/CLAUDE.md | 1 | # ironclaw_product_adapter_registry guardrails | COMMENT |
| MEDIUM | crates/ironclaw_threads/CLAUDE.md | 1 | # ironclaw_threads guardrails | COMMENT |
| MEDIUM | crates/ironclaw_threads/src/filesystem_service.rs | 3269 | // ordinary transcript content (see crate guardrails). | COMMENT |
| MEDIUM | crates/ironclaw_threads/src/in_memory.rs | 1300 | // ordinary transcript content (see crate guardrails). | COMMENT |
| MEDIUM | crates/ironclaw_capabilities/CLAUDE.md | 1 | # ironclaw_capabilities guardrails | COMMENT |
| MEDIUM | crates/ironclaw_authorization/CLAUDE.md | 1 | # ironclaw_authorization guardrails | COMMENT |
| MEDIUM | crates/ironclaw_agent_loop/src/strategies/budget.rs | 32 | /// ceilings. Long agentic coding turns legitimately run hundreds of model | COMMENT |
| MEDIUM | crates/ironclaw_agent_loop/src/strategies/recovery.rs | 212 | /// agentic turn must ride them out rather than discard all prior work. | COMMENT |
| MEDIUM | crates/ironclaw_filesystem/CLAUDE.md | 1 | # ironclaw_filesystem guardrails | COMMENT |
| MEDIUM | crates/ironclaw_scripts/CLAUDE.md | 1 | # ironclaw_scripts guardrails | COMMENT |
| MEDIUM | crates/ironclaw_common/src/lib.rs | 16 | #[allow(dead_code)] // Trust-boundary scaffolding for the Reborn architecture; not yet consumed. | COMMENT |
| MEDIUM | crates/ironclaw_product_adapters/CLAUDE.md | 1 | # ironclaw_product_adapters guardrails | COMMENT |
| MEDIUM | crates/ironclaw_approvals/CLAUDE.md | 1 | # ironclaw_approvals guardrails | COMMENT |
| MEDIUM | crates/ironclaw_reborn_composition/CLAUDE.md | 1 | # ironclaw_reborn_composition guardrails | COMMENT |
| MEDIUM | …es/ironclaw_reborn_composition/tests/webui_v2_serve.rs | 2405 | // the deferred JS/e2e scaffold. | COMMENT |
| MEDIUM | …es/ironclaw_reborn_composition/tests/webui_v2_serve.rs | 2448 | // deferred e2e scaffold. | COMMENT |
| MEDIUM | …es/ironclaw_reborn_composition/tests/webui_v2_serve.rs | 2558 | // caller test belongs in a separate JS test scaffold the workspace | COMMENT |
| MEDIUM | crates/ironclaw_reborn_composition/src/admin_secrets.rs | 8 | //! "explicit admin-scoped API" the `ironclaw_secrets` guardrails anticipate | COMMENT |
| MEDIUM | …_reborn_composition/src/observability/trace_capture.rs | 909 | // agentic turn clear the submission-score gate in production. | COMMENT |
| MEDIUM | …s/ironclaw_reborn_composition/src/webui/webui_serve.rs | 166 | /// (host-owned config — per the composition crate guardrails, env reads | COMMENT |
| MEDIUM | …_reborn_composition/src/slack/slack_serve/e2e_tests.rs | 882 | /// Shared bounded-poll scaffold for `wait_for_approval_prompt_messages` and | COMMENT |
| MEDIUM | crates/ironclaw_process_sandbox/CLAUDE.md | 1 | # ironclaw_process_sandbox guardrails | COMMENT |
| MEDIUM | crates/ironclaw_conversations/CLAUDE.md | 1 | # ironclaw_conversations guardrails | COMMENT |
| MEDIUM | crates/ironclaw_host_runtime/CLAUDE.md | 1 | # ironclaw_host_runtime guardrails | COMMENT |
| MEDIUM | crates/ironclaw_host_runtime/src/services/builder.rs | 590 | // composition, but must not silently satisfy production guardrails. | COMMENT |
| MEDIUM | crates/ironclaw_runtime_policy/CLAUDE.md | 1 | # ironclaw_runtime_policy guardrails | COMMENT |
| MEDIUM | crates/ironclaw_outbound/CLAUDE.md | 1 | # ironclaw_outbound guardrails | COMMENT |
| MEDIUM | crates/ironclaw_outbound/src/filesystem_store.rs | 1394 | // The outbound CLAUDE.md guardrails forbid leaking backend error detail | COMMENT |
| MEDIUM | crates/ironclaw_run_state/CLAUDE.md | 1 | # ironclaw_run_state guardrails | COMMENT |
| MEDIUM | crates/ironclaw_gateway/static/js/core/sse.js | 398 | // the agentic loop finished, so re-enable input as a safety net in case | COMMENT |
| MEDIUM | crates/ironclaw_trust/CONTRACT.md | 267 | ## 6. Mutation and invalidation orchestration | COMMENT |
| MEDIUM | crates/ironclaw_trust/CLAUDE.md | 1 | # ironclaw_trust guardrails | COMMENT |
| MEDIUM | crates/ironclaw_trust/src/lib.rs | 29 | //! per-file guardrails, and `docs/reborn/contracts/host-api.md` (in the | COMMENT |
| MEDIUM | crates/ironclaw_reborn_webui_ingress/CLAUDE.md | 1 | # ironclaw_reborn_webui_ingress guardrails | COMMENT |
| MEDIUM | …nclaw_reborn_webui_ingress/src/signed_session_login.rs | 10 | //! auth/session model. That keeps the rule from this crate's guardrails | COMMENT |
| MEDIUM | crates/ironclaw_memory/CLAUDE.md | 1 | # ironclaw_memory guardrails | COMMENT |
| MEDIUM | crates/ironclaw_turns/CLAUDE.md | 1 | # ironclaw_turns guardrails | COMMENT |
| MEDIUM | crates/ironclaw_architecture/CLAUDE.md | 1 | # ironclaw_architecture guardrails | COMMENT |
| MEDIUM | crates/ironclaw_host_api/CLAUDE.md | 1 | # ironclaw_host_api guardrails | COMMENT |
| MEDIUM | crates/ironclaw_processes/CLAUDE.md | 1 | # ironclaw_processes guardrails | COMMENT |
| MEDIUM | crates/ironclaw_resources/CLAUDE.md | 1 | # ironclaw_resources guardrails | COMMENT |
| MEDIUM | crates/ironclaw_mcp/CLAUDE.md | 1 | # ironclaw_mcp guardrails | COMMENT |
| MEDIUM | crates/ironclaw_secrets/CLAUDE.md | 1 | # ironclaw_secrets guardrails | COMMENT |
| MEDIUM | crates/ironclaw_secrets/src/filesystem_store.rs | 1415 | // secrets crate guardrails forbid leaking host paths through audit/error | COMMENT |
| MEDIUM | crates/ironclaw_extensions/CLAUDE.md | 1 | # ironclaw_extensions guardrails | COMMENT |
| MEDIUM | crates/ironclaw_network/CLAUDE.md | 1 | # ironclaw_network guardrails | COMMENT |
| MEDIUM | crates/ironclaw_reborn_cli/src/commands/serve_sso.rs | 13 | //! is where this crate's guardrails place `WebuiAuthenticator` / | COMMENT |
| 75 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | channels-src/discord/src/lib.rs | 1529 | // Step 1: Open (or reuse) a DM channel with the target user. | COMMENT |
| LOW | channels-src/discord/src/lib.rs | 1558 | // Step 2: Send the message to the DM channel. | COMMENT |
| LOW | channels-src/telegram/src/lib.rs | 1129 | // Step 1: Call getFile to get file_path | COMMENT |
| LOW | channels-src/telegram/src/lib.rs | 1173 | // Step 2: Download the actual file bytes | COMMENT |
| LOW⚡ | tools-src/telegram/src/lib.rs | 168 | // Step 1: DH auth key exchange | COMMENT |
| LOW⚡ | tools-src/telegram/src/lib.rs | 175 | // Step 2: send verification code | COMMENT |
| LOW⚡ | tools-src/telegram/src/auth.rs | 19 | // Step 1: generate nonce, send ReqPqMulti | COMMENT |
| LOW⚡ | tools-src/telegram/src/auth.rs | 27 | // Step 2: factorize PQ, RSA encrypt, send ReqDhParams | COMMENT |
| LOW⚡ | tools-src/telegram/src/auth.rs | 35 | // Step 3: compute DH g_b, send SetClientDhParams | COMMENT |
| LOW | tools-src/portfolio/src/live_tests.rs | 135 | // Step 1: Fetch balances from Dune | COMMENT |
| LOW⚡ | tools-src/portfolio/src/live_tests.rs | 157 | // Step 2: Classify through analyzer | COMMENT |
| LOW⚡ | tools-src/portfolio/src/live_tests.rs | 167 | // Step 3: Run strategy proposals | COMMENT |
| LOW | tools-src/portfolio/src/live_tests.rs | 272 | // Step 1: Fetch from FastNEAR + Intear | COMMENT |
| LOW⚡ | tools-src/portfolio/src/live_tests.rs | 287 | // Step 2: Classify through analyzer | COMMENT |
| LOW⚡ | tools-src/portfolio/src/live_tests.rs | 297 | // Step 3: Run strategy proposals (include NEAR-specific strategies) | COMMENT |
| LOW | tools-src/portfolio/src/live_tests.rs | 333 | // Step 4: Build intents for ready proposals | COMMENT |
| LOW | tools-src/portfolio/src/indexer/dune.rs | 329 | // Step 1: balances | COMMENT |
| LOW | tools-src/portfolio/src/indexer/dune.rs | 346 | // Step 2: positions/activity (best-effort enrichment) | COMMENT |
| LOW | …w_host_runtime/tests/host_runtime_services_contract.rs | 6467 | // Step 1: store error → pre-flight skips → approval gate fires. | COMMENT |
| LOW | …w_host_runtime/tests/host_runtime_services_contract.rs | 6511 | // Step 2: approve WITH the required secret handle granted, so dispatch | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 1754 | // Step 3: simulate the crash window by injecting a dangling conv_a index | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 1763 | // Step 4: conv_a lookup must be a miss — the primary record lists conv_b, | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2279 | // Step 1: store_a writes rec_a (conv index version 1). | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2285 | // Step 2: store_b writes rec_b (conv index version 2) — simulates a | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2293 | // Step 3: store_a re-records rec_a. The index already carries rec_a | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2373 | // Step 1: store_a records rec_a → conv index = [rec_a]. | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2379 | // Step 2: store_b records rec_b → conv index = [rec_a, rec_b]. | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2385 | // Step 3: store_a removes rec_a. Its snapshot (from step 1) only sees | COMMENT |
| LOW⚡ | crates/ironclaw_outbound/src/filesystem_store.rs | 2394 | // Step 4: only rec_b must survive. | COMMENT |
| LOW | crates/ironclaw_outbound/src/filesystem_store.rs | 1716 | // Step 1: record the route delivered to conv_a. | COMMENT |
| LOW | crates/ironclaw_outbound/src/filesystem_store.rs | 1730 | // Step 2: overwrite the route with conv_b (normal path; conv_a index is cleaned). | COMMENT |
| LOW | crates/ironclaw_outbound/src/filesystem_store.rs | 1774 | // Step 5: conv_b lookup must still return the live route. | COMMENT |
| LOW | crates/ironclaw_reborn_webui_ingress/src/auth/github.rs | 372 | /// Step 1: exchange the authorization code for an access token, | COMMENT |
| LOW | …/ironclaw_webui_v2/tests/webui_v2_handlers_contract.rs | 4909 | // Step 1: consume the only slot with a held-open SSE connection | COMMENT |
| LOW | …/ironclaw_webui_v2/tests/webui_v2_handlers_contract.rs | 4942 | // Step 2: same-caller WS upgrade must hit the shared cap. Use a | COMMENT |
| LOW | …/ironclaw_webui_v2/tests/webui_v2_handlers_contract.rs | 4969 | // Step 3: drop the SSE stream → kernel closes the connection | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 245 | // Step 1: Parse the invite URL (trust root). | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 248 | // Step 2: Stage the keypair BEFORE any network call (retry-safe). | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 251 | // Step 3: POST to the onboard endpoint. Terminal invite rejections discard | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 255 | // Step 4: Parse + schema-validate the response body. | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 258 | // Step 5: Trust anchoring — issuer_url origin must equal invite origin. | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 270 | // Step 6: Cross-check the server's echoed device_key_id against the value | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 280 | // Step 7: ingest_url must be HTTPS (loopback http allowed for dev/tests). | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 283 | // Step 8: Write the tenant key file (pending file deliberately kept). | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 286 | // Step 9: Write the standing contribution policy. If this fails the pending | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 291 | // Step 10: Finalize — remove the pending file only now that both the tenant | COMMENT |
| LOW⚡ | crates/ironclaw_reborn_traces/src/onboarding/mod.rs | 301 | // Step 11: Sanitize browser-nav hints — drop any non-HTTPS URL (never fatal). | COMMENT |
| LOW | crates/ironclaw_llm/src/openai_codex_session.rs | 361 | // Step 3: Poll for authorization code | COMMENT |
| LOW | crates/ironclaw_llm/src/openai_codex_session.rs | 430 | // Step 4: Exchange authorization code for tokens (form-encoded, per Auth0 spec) | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/recording.rs | 1239 | // Step 0: user_input "Do something" | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/recording.rs | 1240 | // Step 1: text response | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/recording.rs | 1241 | // Step 2: text response (no new user_input since no new user messages) | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/github_copilot_auth.rs | 297 | // Step 1: Exchange the OAuth token for a Copilot session token. | COMMENT |
| LOW⚡ | crates/ironclaw_llm/src/github_copilot_auth.rs | 301 | // Step 2: Verify the session token works against the models endpoint. | COMMENT |
| LOW⚡ | tests/e2e_wasm_portfolio.rs | 344 | // Step 1: scan the fixture address. The scan response is | COMMENT |
| LOW⚡ | tests/e2e_wasm_portfolio.rs | 346 | // Step 2: propose with the classified positions from step 1. | COMMENT |
| LOW | tests/e2e_wasm_portfolio.rs | 417 | // Step 1: LLM calls scan | COMMENT |
| LOW | tests/e2e_wasm_portfolio.rs | 435 | // Step 2: LLM calls propose with the scan results | COMMENT |
| LOW | tests/e2e_wasm_portfolio.rs | 460 | // Step 3: LLM summarizes | COMMENT |
| LOW | tests/e2e_wasm_portfolio.rs | 569 | // Step 1: scan root.near | COMMENT |
| 67 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/e2e/helpers.py | 0 | selector => { const input = document.queryselector(selector); return !!input && !input.disabled; } | STRING |
| HIGH | tests/e2e/scenarios/test_mission_gmail_3133.py | 0 | selector => { const input = document.queryselector(selector); return !!input && !input.disabled; } | STRING |
| HIGH | tests/e2e/scenarios/test_owner_scope.py | 0 | selector => { const input = document.queryselector(selector); return !!input && !input.disabled; } | STRING |
| HIGH | tests/e2e/scenarios/test_ownership_model.py | 0 | selector => { const input = document.queryselector(selector); return !!input && !input.disabled; } | STRING |
| HIGH | …/e2e/scenarios/test_reborn_webui_v2_legacy_approval.py | 0 | (() => { const streams = []; class fakeeventsource extends eventtarget { constructor(url) { super(); this.url = url; thi | STRING |
| HIGH | …ios/test_reborn_webui_v2_legacy_dom_resource_limits.py | 0 | (() => { const streams = []; class fakeeventsource extends eventtarget { constructor(url) { super(); this.url = url; thi | STRING |
| HIGH | …cenarios/test_reborn_webui_v2_legacy_tool_execution.py | 0 | (() => { const streams = []; class fakeeventsource extends eventtarget { constructor(url) { super(); this.url = url; thi | STRING |
| HIGH | …narios/test_reborn_webui_v2_legacy_pending_messages.py | 0 | (() => { const streams = []; class fakeeventsource extends eventtarget { constructor(url) { super(); this.url = url; thi | STRING |
| HIGH | …e/scenarios/test_reborn_webui_v2_legacy_sse_history.py | 0 | (() => { const streams = []; class fakeeventsource extends eventtarget { constructor(url) { super(); this.url = url; thi | STRING |
| HIGH | tests/e2e/scenarios/test_wasm_lifecycle.py | 0 | get a specific extension from the extensions list, or none. | STRING |
| HIGH | tests/e2e/scenarios/test_extension_oauth.py | 0 | get a specific extension from the extensions list, or none. | STRING |
| HIGH | tests/e2e/scenarios/test_oauth_url_parameters.py | 0 | get a specific extension from the extensions list, or none. | STRING |
| HIGH | tests/e2e/scenarios/test_mcp_auth_flow.py | 0 | get a specific extension from the extensions list, or none. | STRING |
| HIGH | tests/e2e/scenarios/test_v2_engine_tool_lifecycle.py | 0 | forward llvm coverage env vars from outer environment. | STRING |
| HIGH | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 0 | forward llvm coverage env vars from outer environment. | STRING |
| HIGH | tests/e2e/scenarios/test_v2_engine_error_handling.py | 0 | forward llvm coverage env vars from outer environment. | STRING |
| HIGH | tests/e2e/scenarios/test_v2_engine_oauth_google.py | 0 | forward llvm coverage env vars from outer environment. | STRING |
| HIGH | tests/e2e/scenarios/test_v2_engine_approval_flow.py | 0 | forward llvm coverage env vars from outer environment. | STRING |
| HIGH | tests/e2e/scenarios/test_v2_notion_mcp_oauth_flow.py | 0 | reset mock state between tests so dirty state from a failure doesn't bleed. | STRING |
| HIGH | tests/e2e/scenarios/test_v2_gsuite_oauth_flow.py | 0 | reset mock state between tests so dirty state from a failure doesn't bleed. | STRING |
| HIGH | tests/e2e/scenarios/test_v2_github_pat_flow.py | 0 | reset mock state between tests so dirty state from a failure doesn't bleed. | STRING |
| HIGH | …ios/test_reborn_webui_v2_legacy_dom_resource_limits.py | 0 | () => { object.defineproperty(document, 'visibilitystate', { configurable: true, get: () => 'visible', }); document.disp | STRING |
| HIGH | tests/e2e/scenarios/test_sse_reconnect.py | 0 | () => { object.defineproperty(document, 'visibilitystate', { configurable: true, get: () => 'visible', }); document.disp | STRING |
| HIGH | …e/scenarios/test_reborn_webui_v2_legacy_sse_history.py | 0 | () => { object.defineproperty(document, 'visibilitystate', { configurable: true, get: () => 'visible', }); document.disp | STRING |
| HIGH | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 0 | select user_id, expires_at, updated_at from secrets where name = ? order by updated_at desc limit 1 | STRING |
| HIGH | tests/e2e/scenarios/test_v2_engine_oauth_google.py | 0 | select user_id, expires_at, updated_at from secrets where name = ? order by updated_at desc limit 1 | STRING |
| HIGH | tests/e2e/scenarios/test_oauth_refresh.py | 0 | select user_id, expires_at, updated_at from secrets where name = ? order by updated_at desc limit 1 | STRING |
| HIGH | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 0 | update secrets set expires_at = strftime('%y-%m-%dt%h:%m:%fz', 'now', '-1 hour') where user_id = ? and name = ? | STRING |
| HIGH | tests/e2e/scenarios/test_v2_engine_oauth_google.py | 0 | update secrets set expires_at = strftime('%y-%m-%dt%h:%m:%fz', 'now', '-1 hour') where user_id = ? and name = ? | STRING |
| HIGH | tests/e2e/scenarios/test_oauth_refresh.py | 0 | update secrets set expires_at = strftime('%y-%m-%dt%h:%m:%fz', 'now', '-1 hour') where user_id = ? and name = ? | STRING |
| HIGH | scripts/auth_live_canary/run_live_canary.py | 0 | update secrets set expires_at = strftime('%y-%m-%dt%h:%m:%fz', 'now', '-1 hour') where user_id = ? and name = ? | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/conftest.py | 50 | except Exception: | CODE |
| LOW | tests/e2e/conftest.py | 126 | except Exception: | CODE |
| LOW | tests/e2e/conftest.py | 166 | except Exception: | CODE |
| LOW | tests/e2e/live_harness.py | 147 | except Exception: | CODE |
| LOW | tests/e2e/fake_telegram_api.py | 105 | except Exception: | CODE |
| LOW | tests/e2e/helpers.py | 657 | except Exception: | CODE |
| LOW | tests/e2e/scenarios/test_v2_engine_auth_cancel.py | 235 | except Exception: | CODE |
| LOW | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 687 | except Exception: | CODE |
| LOW | tests/e2e/scenarios/test_v2_kernel_auth_gateway_flow.py | 275 | except Exception: | STRING |
| LOW | …/e2e/scenarios/test_reborn_webui_v2_legacy_projects.py | 242 | except Exception: | CODE |
| LOW | tests/e2e/scenarios/test_message_persistence.py | 315 | except Exception: | CODE |
| LOW | tests/e2e/scenarios/test_message_persistence.py | 447 | except Exception: | CODE |
| MEDIUM | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 63 | def _drain_pipes(): | CODE |
| LOW | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 102 | except Exception: | CODE |
| LOW | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 1341 | except Exception: | CODE |
| LOW⚡ | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 477 | except Exception: | STRING |
| LOW⚡ | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 481 | except Exception: | STRING |
| LOW | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 607 | except Exception: | STRING |
| LOW | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 624 | except Exception: | STRING |
| LOW | tests/e2e/scenarios/test_plan_mode.py | 74 | except Exception: | CODE |
| LOW | tests/e2e/scenarios/test_plan_mode.py | 180 | except Exception: | CODE |
| LOW | tests/e2e/scenarios/test_v2_engine_approval_flow.py | 221 | except Exception as e: | CODE |
| LOW⚡ | tests/e2e/scenarios/test_skill_oauth_flow.py | 193 | except Exception: | CODE |
| LOW | docs/plans/2026-02-24-e2e-infrastructure.md | 692 | except Exception: | CODE |
| LOW | docs/plans/2026-02-24-e2e-infrastructure.md | 711 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/slack_helpers.py | 212 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/slack_helpers.py | 832 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/slack_helpers.py | 873 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/slack_helpers.py | 1001 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/slack_helpers.py | 1230 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/google_auth_helpers.py | 319 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/google_auth_helpers.py | 348 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/google_auth_helpers.py | 498 | except Exception as exc: | CODE |
| MEDIUM | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1733 | def read_main_text() -> str: | CODE |
| LOW⚡ | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1109 | except Exception: | CODE |
| LOW⚡ | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1114 | except Exception as screenshot_exc: | CODE |
| LOW⚡ | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1123 | except Exception as trace_exc: | CODE |
| LOW⚡ | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1133 | except Exception as summary_exc: | CODE |
| LOW⚡ | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1664 | except Exception: | CODE |
| LOW⚡ | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1676 | except Exception: | CODE |
| LOW⚡ | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1684 | except Exception: | CODE |
| LOW⚡ | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1691 | except Exception: | CODE |
| LOW⚡ | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1698 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 844 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 888 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 957 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 994 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1010 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1021 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1374 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1390 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1488 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1598 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1736 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1753 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1763 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1774 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1865 | except Exception: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 2476 | except Exception as exc: | CODE |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 2518 | except Exception as exc: | CODE |
| 95 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_validate_reborn_binary_artifact.py | 1 | CODE | |
| LOW | tests/test_check_reborn_responses_e2e_manifest.py | 1 | CODE | |
| LOW | tests/e2e/live_harness.py | 35 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_engine_tool_lifecycle.py | 25 | CODE | |
| LOW | …e/scenarios/test_reborn_webui_v2_legacy_attachments.py | 14 | CODE | |
| LOW | …e/scenarios/test_reborn_webui_v2_legacy_attachments.py | 14 | CODE | |
| LOW | …e/scenarios/test_reborn_webui_v2_legacy_attachments.py | 14 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_notion_mcp_oauth_flow.py | 33 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_notion_mcp_oauth_flow.py | 33 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_notion_mcp_oauth_flow.py | 33 | CODE | |
| LOW | …e/scenarios/test_routine_oauth_credential_injection.py | 13 | CODE | |
| LOW | …e/scenarios/test_routine_oauth_credential_injection.py | 16 | CODE | |
| LOW | tests/e2e/scenarios/test_channel_approval_gates.py | 21 | CODE | |
| LOW | tests/e2e/scenarios/test_channel_approval_gates.py | 30 | CODE | |
| LOW | …s/e2e/scenarios/test_reborn_webui_v2_filesystem_api.py | 15 | CODE | |
| LOW | tests/e2e/scenarios/test_mission_gmail_3133.py | 68 | CODE | |
| LOW | tests/e2e/scenarios/test_reborn_webui_v2_session_api.py | 13 | CODE | |
| LOW | tests/e2e/scenarios/test_html_injection.py | 3 | CODE | |
| LOW | tests/e2e/scenarios/test_connection.py | 3 | CODE | |
| LOW | tests/e2e/scenarios/test_connection.py | 4 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_gsuite_oauth_flow.py | 22 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_gsuite_oauth_flow.py | 35 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_gsuite_oauth_flow.py | 35 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_gsuite_oauth_flow.py | 35 | CODE | |
| LOW | tests/e2e/scenarios/test_dom_resource_limits.py | 8 | CODE | |
| LOW | …/scenarios/test_reborn_webui_v2_legacy_chat_actions.py | 8 | CODE | |
| LOW | …/scenarios/test_reborn_webui_v2_legacy_chat_actions.py | 8 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_github_pat_flow.py | 32 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_github_pat_flow.py | 40 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_github_pat_flow.py | 40 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_github_pat_flow.py | 40 | CODE | |
| LOW | …ios/test_reborn_webui_v2_legacy_message_persistence.py | 6 | CODE | |
| LOW | …ios/test_reborn_webui_v2_legacy_message_persistence.py | 6 | CODE | |
| LOW | tests/e2e/scenarios/test_chat.py | 11 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_engine_error_handling.py | 30 | CODE | |
| LOW | tests/e2e/scenarios/test_oauth_credential_fallback.py | 16 | CODE | |
| LOW | tests/e2e/scenarios/test_skills.py | 9 | CODE | |
| LOW | tests/e2e/scenarios/test_skills.py | 9 | CODE | |
| LOW | tests/e2e/scenarios/test_reborn_v2_file_download.py | 23 | CODE | |
| LOW | tests/e2e/scenarios/test_reborn_v2_file_download.py | 23 | CODE | |
| LOW | tests/e2e/scenarios/test_plan_mode.py | 8 | CODE | |
| LOW | tests/e2e/scenarios/test_plan_mode.py | 8 | CODE | |
| LOW | tests/e2e/scenarios/test_widget_customization.py | 37 | CODE | |
| LOW | tests/e2e/scenarios/test_auth_no_duplicate_response.py | 33 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_engine_approval_flow.py | 18 | CODE | |
| LOW | …e2e/scenarios/test_reborn_webui_v2_legacy_rendering.py | 6 | CODE | |
| LOW | …e2e/scenarios/test_reborn_webui_v2_legacy_rendering.py | 6 | CODE | |
| LOW | tests/e2e/scenarios/test_skill_oauth_flow.py | 20 | CODE | |
| LOW | tests/e2e/scenarios/test_skill_oauth_flow.py | 20 | CODE | |
| LOW | tests/e2e/scenarios/test_skill_oauth_flow.py | 30 | CODE | |
| LOW | scripts/check_gateway_boundaries.py | 58 | CODE | |
| LOW | …ripts/reborn_webui_v2_live_qa/external_auth_helpers.py | 3 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/slack_helpers.py | 3 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/test_run_live_qa.py | 9 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/case_matrix.py | 3 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/root_filesystem.py | 3 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/env_helpers.py | 3 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/google_auth_helpers.py | 3 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/google_auth_helpers.py | 14 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/google_auth_helpers.py | 17 | CODE | |
| 89 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 341 | # harness seam) — cfg(test) does not propagate from an integration-test binary into its deps. | COMMENT |
| MEDIUM | Cargo.toml | 343 | # Trigger-conversation binding/session services for the E-TRIGGERED-SUBMIT harness seam — | COMMENT |
| MEDIUM | tools-src/portfolio/scenarios/smoke-single-usdc.yaml | 29 | # captured `positions` variable by the test harness. | COMMENT |
| MEDIUM | crates/ironclaw_product_adapter_registry/src/lib.rs | 850 | //! cases are robust to serde renames; the wire path is covered end-to-end | COMMENT |
| MEDIUM | …s/ironclaw_reborn_composition/src/webui/webui_serve.rs | 451 | /// [`Self::canonical_host`] for why this is more robust than | COMMENT |
| MEDIUM | …ronclaw_reborn_composition/src/slack/slack_delivery.rs | 1413 | // is robust to future ack variants that may also target an existing run. | COMMENT |
| MEDIUM | …_reborn_webui_ingress/tests/network_limits_contract.rs | 58 | #[path = "support/harness.rs"] | COMMENT |
| MEDIUM | …nclaw_reborn_webui_ingress/tests/session_round_trip.rs | 175 | // panicking so the test is robust to incidental calls. | COMMENT |
| MEDIUM | …claw_reborn_webui_ingress/tests/auth_route_contract.rs | 58 | #[path = "support/harness.rs"] | COMMENT |
| MEDIUM | …_reborn_webui_ingress/tests/headers_errors_contract.rs | 43 | #[path = "support/harness.rs"] | COMMENT |
| MEDIUM | …ironclaw_reborn_webui_ingress/tests/support/harness.rs | 9 | //! `#[path = "support/harness.rs"] mod harness;` so a new | COMMENT |
| MEDIUM | …aw_architecture/tests/reborn_composition_boundaries.rs | 274 | // modules. This keeps the invariant robust across the #3951 finding-#4 | COMMENT |
| MEDIUM | …law_webui_v2/frontend/src/pages/logs/logs-page.test.ts | 199 | // class string — keeps the test robust to class reordering and to unrelated | COMMENT |
| MEDIUM | crates/ironclaw_hooks/Cargo.toml | 19 | # Exposes the `predicate_state::contract` trait-level test harness so the | COMMENT |
| MEDIUM | crates/ironclaw_hooks/Cargo.toml | 83 | # `harness = false` rationale): each heavy case fills a key to the sample cap, | COMMENT |
| MEDIUM | …ronclaw_hooks/tests/predicate_state_libsql_contract.rs | 6 | //! # Why `harness = false` + a hand-rolled serial runner | COMMENT |
| MEDIUM | crates/ironclaw_reborn_cli/src/commands/config/init.rs | 179 | # [harness] | COMMENT |
| MEDIUM | crates/ironclaw_reborn_cli/src/commands/config/init.rs | 180 | # # Active harness lands with epic #3036. Leave this section commented in | COMMENT |
| MEDIUM | crates/ironclaw_llm/src/rig_adapter.rs | 1138 | /// Deliberately conservative: matches robust indicators (HTTP 401/403, | COMMENT |
| MEDIUM | crates/ironclaw_memory_native/Cargo.toml | 32 | # Exposes the trait-level contract test harness in | COMMENT |
| MEDIUM | crates/ironclaw_memory_native/Cargo.toml | 34 | # Off by default so panic-style calls in the harness (`.expect`, | COMMENT |
| MEDIUM | crates/ironclaw_memory_native/Cargo.toml | 60 | # the `contract_test!` macro. The harness contains `.expect`/`.unwrap`/ | COMMENT |
| MEDIUM | crates/ironclaw_memory_native/Cargo.toml | 61 | # `assert!*` calls (intentional — it's a test harness) and must stay | COMMENT |
| MEDIUM⚡ | tests/skill_chain_load_lifecycle.rs | 219 | #[ignore = "v2 path needs a multi-turn TraceLlm harness to observe \ | COMMENT |
| MEDIUM | tests/integration/wiring_parity.rs | 1 | //! W5-WIRING-PARITY (issue #5637): the harness's `DefaultPlannedRuntimeParts` | COMMENT |
| MEDIUM | tests/integration/support/config.rs | 3 | #![allow(dead_code)] // Shared by staged Reborn harness modules as ports opt in. | COMMENT |
| MEDIUM | tests/integration/support/product_workflow.rs | 28 | #[error("failed to create product workflow harness tempdir: {0}")] | COMMENT |
| MEDIUM | tests/integration/support/product_workflow.rs | 34 | #[error("missing agent id in product workflow harness scope")] | COMMENT |
| MEDIUM | …tion/support/doubles/recording_test_capability_port.rs | 1 | #![allow(dead_code)] // Carried from harness.rs's blanket allow: shared across bins with differing usage. | COMMENT |
| MEDIUM | tests/test-pages/cnn/source.html | 3380 | new Image().src = prefix + '//tapestry.tapad.com/tapestry/1?ta_partner_id=1969&ta_redirect=' + prefix + enco | CODE |
| MEDIUM | tests/e2e/scenarios/test_mission_gmail_3133.py | 290 | # to a direct fire so the test stays robust to LLM phrasing | COMMENT |
| MEDIUM | tests/e2e/scenarios/test_extensions.py | 1 | """Scenario: Extensions tab – comprehensive UI coverage. | STRING |
| MEDIUM | tests/e2e/scenarios/test_tool_approval.py | 228 | # Trigger a real HTTP tool call that pauses for approval in this test harness. | STRING |
| MEDIUM | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 5774 | # harness tokens BEFORE the chat prompt (per-run ms-suffix nonces on every | COMMENT |
| MEDIUM | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 7655 | # turning model-output variance into a blocking harness failure. | COMMENT |
| MEDIUM | scripts/ci/test-check-hermetic-env.sh | 5 | # asserts the checker blocks/allows it. Mirrors the temp-repo harness in | COMMENT |
| MEDIUM | scripts/ci/check-test-suite-boundaries.sh | 11 | # tests/integration/support/ (the roadmap harness), but tests/integration/ | COMMENT |
| MEDIUM | scripts/ci/check-test-suite-boundaries.sh | 13 | # silently pull QA-only fixtures/harness weight into the suites this repo's | COMMENT |
| MEDIUM | scripts/ci/test-reborn-coverage.sh | 136 | # empty-check below and reporting a normal FAIL (the harness runs every case). | COMMENT |
| MEDIUM | scripts/ci/test-reborn-coverage.sh | 909 | # pattern either) — mirrors the real tests/integration/support/ harness tree. | COMMENT |
| MEDIUM | scripts/live-canary/test_emit_results_json.py | 314 | # Generic env-var / assignment shapes the persona harness | COMMENT |
| MEDIUM | .github/workflows/live-canary.yml | 1230 | # Real third-party credentials forwarded into the persona harness. | COMMENT |
| MEDIUM | .github/workflows/live-canary.yml | 1231 | # The harness reads these env vars per | COMMENT |
| MEDIUM | .github/workflows/code_style.yml | 157 | # surfaces at runtime — this is the gate the eval harness cannot provide. | COMMENT |
| MEDIUM | .github/workflows/nearai-bench.yml | 7 | # harness against the PR's ironclaw SHA, runs the suite, compares against | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ates/ironclaw_turns/tests/turn_coordinator_contract.rs | 3121 | run.profile.resolved.loop_driver.id.as_str(), | CODE |
| CRITICAL | …oup_triggers/scenario_trigger_persists_after_reopen.rs | 50 | let tenant_id = g.shared.product_harness.scope.tenant_id.clone(); | CODE |
| CRITICAL | tests/test-pages/cnn/source.html | 3944 | window.ClickTaleSettings.ChangeMonitor.PII.Attributes.push({ | CODE |
| CRITICAL | tests/test-pages/cnn/source.html | 3965 | window.ClickTaleSettings.ChangeMonitor.PII.Text.push({ | CODE |
| CRITICAL | src/app.rs | 648 | self.config.llm.nearai.base_url.clone(), | CODE |
| CRITICAL | src/app.rs | 649 | self.config.llm.nearai.api_key.as_ref().map(|s| { | CODE |
| CRITICAL | src/app.rs | 664 | .unwrap_or_else(|| self.config.llm.nearai.model.clone()); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/conftest.py | 102 | CODE | |
| LOW | tests/e2e/conftest.py | 522 | CODE | |
| LOW | tests/e2e/conftest.py | 712 | CODE | |
| LOW | tests/e2e/conftest.py | 743 | CODE | |
| LOW | tests/e2e/conftest.py | 842 | CODE | |
| LOW | tests/e2e/conftest.py | 1057 | CODE | |
| LOW | tests/e2e/conftest.py | 1155 | CODE | |
| LOW | tests/e2e/conftest.py | 1252 | CODE | |
| LOW | tests/e2e/conftest.py | 1462 | CODE | |
| LOW | tests/e2e/conftest.py | 1653 | CODE | |
| LOW | tests/e2e/conftest.py | 1816 | CODE | |
| LOW | tests/e2e/conftest.py | 1995 | CODE | |
| LOW | tests/e2e/live_llm_proxy.py | 191 | CODE | |
| LOW | tests/e2e/live_llm_proxy.py | 309 | CODE | |
| LOW | tests/e2e/live_harness.py | 85 | CODE | |
| LOW | tests/e2e/mock_llm.py | 974 | CODE | |
| LOW | tests/e2e/mock_llm.py | 1257 | CODE | |
| LOW | tests/e2e/mock_llm.py | 1583 | CODE | |
| LOW | tests/e2e/mock_llm.py | 1716 | CODE | |
| LOW | tests/e2e/mock_llm.py | 1750 | CODE | |
| LOW | tests/e2e/mock_llm.py | 2437 | CODE | |
| LOW | tests/e2e/helpers.py | 646 | CODE | |
| LOW | tests/e2e/helpers.py | 675 | CODE | |
| LOW | tests/e2e/helpers.py | 648 | CODE | |
| LOW | …scenarios/test_reborn_webui_v2_legacy_responses_api.py | 43 | CODE | |
| LOW | tests/e2e/scenarios/test_mission_gmail_3133.py | 159 | CODE | |
| LOW | tests/e2e/scenarios/test_mission_gmail_3133.py | 244 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 553 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_kernel_auth_gateway_flow.py | 509 | CODE | |
| LOW | tests/e2e/scenarios/test_reborn_webui_v2_smoke.py | 48 | CODE | |
| LOW | …cenarios/test_reborn_webui_v2_legacy_tool_execution.py | 83 | CODE | |
| LOW | tests/e2e/scenarios/test_tool_execution.py | 24 | CODE | |
| LOW | tests/e2e/scenarios/test_message_persistence.py | 46 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 82 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_auth_oauth_matrix.py | 1143 | CODE | |
| LOW | …2e/scenarios/test_reborn_webui_v2_legacy_extensions.py | 153 | CODE | |
| LOW | …2e/scenarios/test_reborn_webui_v2_legacy_extensions.py | 195 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_engine_error_handling.py | 175 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_engine_oauth_google.py | 272 | CODE | |
| LOW | tests/e2e/scenarios/test_oauth_refresh.py | 120 | CODE | |
| LOW | tests/e2e/scenarios/test_auth_no_duplicate_response.py | 250 | CODE | |
| LOW | tests/e2e/scenarios/test_auth_no_duplicate_response.py | 262 | CODE | |
| LOW | tests/e2e/scenarios/test_v2_engine_approval_flow.py | 229 | CODE | |
| LOW | tests/e2e/scenarios/test_skill_oauth_flow.py | 111 | CODE | |
| LOW | scripts/check-type-duplicates.py | 27 | CODE | |
| LOW | scripts/check-type-duplicates.py | 41 | CODE | |
| LOW | scripts/check_gateway_boundaries.py | 130 | CODE | |
| LOW | scripts/check_gateway_boundaries.py | 301 | CODE | |
| LOW | scripts/check_gateway_boundaries.py | 334 | CODE | |
| LOW | scripts/check_no_panics.py | 52 | CODE | |
| LOW | scripts/check_no_panics.py | 169 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/slack_helpers.py | 318 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/google_auth_helpers.py | 531 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 354 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1334 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1714 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 2125 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 2554 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 2661 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 2948 | CODE | |
| 29 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | channels-src/telegram/telegram.capabilities.json | 43 | "location": { "type": "url_path", "placeholder": "{TELEGRAM_BOT_TOKEN}" }, | CODE |
| LOW | channels-src/whatsapp/src/lib.rs | 986 | "name": "John Doe" | CODE |
| LOW | …s-src/portfolio/scenarios/hostile/fake-token-dust.yaml | 1 | id: hostile-fake-token-dust | CODE |
| LOW | tools-src/google-slides/src/api.rs | 85 | let pt = el["shape"]["placeholder"]["type"] | CODE |
| LOW | …ty_extensions/assets/google-slides/wasm-src/src/api.rs | 94 | let pt = el["shape"]["placeholder"]["type"] | CODE |
| LOW | crates/ironclaw_gateway/static/index.html | 53 | <input type="password" id="token-input" data-i18n="auth.tokenPlaceholder" data-i18n-attr="placeholder" placehold | CODE |
| LOW | crates/ironclaw_gateway/static/index.html | 72 | <input type="text" id="provider-name" data-i18n="config.providerNamePlaceholder" data-i18n-attr="placeholder | CODE |
| LOW | crates/ironclaw_gateway/static/index.html | 76 | <input type="text" id="provider-id" data-i18n="config.providerIdPlaceholder" data-i18n-attr="placeholder" pl | CODE |
| LOW | crates/ironclaw_gateway/static/index.html | 262 | <textarea id="chat-input" data-i18n="chat.inputPlaceholder" data-i18n-attr="placeholder" placeholder="Messag | CODE |
| LOW | crates/ironclaw_gateway/static/index.html | 278 | <input type="text" id="memory-search" data-i18n="memory.searchPlaceholder" data-i18n-attr="placeholder" plac | CODE |
| LOW | crates/ironclaw_gateway/static/admin/admin.js | 351 | html += '<div class="form-group"><label>Display Name</label><input type="text" id="new-user-name" placeholder="Jane | CODE |
| LOW | crates/ironclaw_turns/src/run_profile/prompt_text.rs | 238 | "placeholder", | CODE |
| LOW | crates/ironclaw_turns/src/run_profile/prompt_text.rs | 248 | || candidate.contains("placeholder") | CODE |
| LOW | crates/ironclaw_host_api/tests/host_api_contract.rs | 141 | "placeholder": "__credential__" | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/i18n/pt-BR.ts | 1106 | "admin.users.displayNamePlaceholder": "Jane Doe", | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/i18n/de.ts | 1106 | "admin.users.displayNamePlaceholder": "Jane Doe", | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/i18n/zh-CN.ts | 1106 | "admin.users.displayNamePlaceholder": "Jane Doe", | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/i18n/ar.ts | 1106 | "admin.users.displayNamePlaceholder": "Jane Doe", | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/i18n/es.ts | 1106 | "admin.users.displayNamePlaceholder": "Jane Doe", | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/i18n/en.ts | 1195 | "admin.users.displayNamePlaceholder": "Jane Doe", | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/i18n/fr.ts | 1106 | "admin.users.displayNamePlaceholder": "Jane Doe", | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/i18n/ko.ts | 1106 | "admin.users.displayNamePlaceholder": "Jane Doe", | CODE |
| LOW | crates/ironclaw_webui_v2/frontend/src/i18n/ja.ts | 1106 | "admin.users.displayNamePlaceholder": "Jane Doe", | CODE |
| LOW | crates/ironclaw_runner/tests/driver_registry.rs | 114 | let fake_key = registry | CODE |
| LOW | crates/ironclaw_runner/tests/driver_registry.rs | 131 | configured_profiles: vec![ConfiguredRunProfile::enabled("local_reference", fake_key)], | CODE |
| LOW | crates/ironclaw_runner/tests/driver_registry.rs | 144 | let fake_key = registry | CODE |
| LOW | crates/ironclaw_runner/tests/driver_registry.rs | 161 | configured_profiles: vec![ConfiguredRunProfile::enabled("local_reference", fake_key)], | CODE |
| LOW | tests/admin_system_prompt.rs | 64 | prompt.contains("Acme Corp"), | CODE |
| LOW | tests/admin_system_prompt.rs | 97 | !prompt.contains("Acme Corp"), | CODE |
| LOW | tests/wasm_channel_integration.rs | 427 | .with_user_name("John Doe") | CODE |
| LOW | tests/wasm_channel_integration.rs | 434 | assert_eq!(messages[0].user_name, Some("John Doe".to_string())); | CODE |
| LOW | tests/e2e/mock_llm.py | 517 | "Acme Corp", | CODE |
| LOW⚡ | tests/e2e/scenarios/test_extensions.py | 839 | placeholders = [await inputs.nth(i).get_attribute("placeholder") or "" for i in range(input_count)] | CODE |
| LOW | …2e/scenarios/test_reborn_webui_v2_legacy_extensions.py | 1526 | "placeholder": "team-slug", | CODE |
| LOW | …2e/scenarios/test_reborn_webui_v2_legacy_extensions.py | 1618 | "placeholder": "team-slug", | CODE |
| LOW | …2e/scenarios/test_reborn_webui_v2_legacy_extensions.py | 1820 | "placeholder", "••••••• (leave blank to keep)" | CODE |
| LOW | docs/plans/2026-04-11-defi-portfolio-keeper.md | 667 | | `hostile/fake-token-dust` | M4 | spam tokens in wallet, must be ignored | | CODE |
| LOW | docs/plans/2026-04-11-defi-portfolio-keeper.md | 813 | - Replay scenarios: `bridge-opportunity`, `hostile/fake-token-dust`, `hostile/malicious-protocol`, `hostile/solver-bad-q | CODE |
| LOW | docs/extensions/google/slides.md | 73 | - _"Replace all occurrences of '[COMPANY]' with 'Acme Corp' across the deck"_ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 603 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 626 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 646 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 676 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 684 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 695 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 713 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 733 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 757 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 782 | GH_TOKEN="fake-token" \ | CODE |
| LOW | scripts/ci/test-reborn-coverage.sh | 809 | GH_TOKEN="fake-token" \ | CODE |
| LOW | src/tools/wasm/capabilities_schema.rs | 901 | "placeholder": "{TELEGRAM_BOT_TOKEN}" | CODE |
| LOW | src/tools/wasm/wrapper.rs | 3694 | "description": "lorem ipsum dolor sit amet consectetur adipiscing elit" | CODE |
| LOW | src/tools/wasm/wrapper.rs | 3694 | "description": "lorem ipsum dolor sit amet consectetur adipiscing elit" | CODE |
| LOW | src/tools/builtin/shell.rs | 1933 | ("OPENAI_API_KEY", "sk-test-fake-key-123"), | CODE |
| LOW | src/tools/builtin/file.rs | 1231 | std::fs::write(ssh_dir.join("id_rsa"), "fake-key").expect("write fake key"); | CODE |
| LOW | src/workspace/mod.rs | 3216 | std::iter::repeat_n("lorem ipsum dolor sit amet ", 500).collect::<String>(); | CODE |
| LOW | src/workspace/mod.rs | 3216 | std::iter::repeat_n("lorem ipsum dolor sit amet ", 500).collect::<String>(); | CODE |
| LOW | src/channels/web/oauth/providers.rs | 595 | SecretString::from("fake-key".to_string()), | CODE |
| LOW | src/channels/web/features/extensions/mod.rs | 1135 | "BOT_TOKEN": "dummy-token" | CODE |
| LOW | src/channels/web/features/extensions/mod.rs | 1485 | "BOT_TOKEN": "dummy-token" | CODE |
| 3 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 1763 | # Create a fresh thread | COMMENT |
| MEDIUM | tests/e2e/scenarios/test_v2_engine_auth_flow.py | 1844 | # Create a fresh thread (credential stored from previous test) | COMMENT |
| MEDIUM | tests/e2e/scenarios/test_pending_user_messages.py | 326 | # Create a new empty thread | COMMENT |
| MEDIUM⚡ | tests/e2e/scenarios/test_tool_permissions.py | 159 | # Create a fresh browser context (new session — no shared cookies/storage) | COMMENT |
| MEDIUM⚡ | tests/e2e/scenarios/test_v2_engine_error_handling.py | 243 | # Create a fresh thread | COMMENT |
| MEDIUM | tests/e2e/scenarios/test_v2_engine_error_handling.py | 301 | # Create a fresh thread | COMMENT |
| MEDIUM | tests/e2e/scenarios/test_v2_engine_oauth_google.py | 566 | # Create a fresh thread | COMMENT |
| MEDIUM | tests/e2e/scenarios/test_v2_engine_oauth_google.py | 617 | # Create a fresh thread | COMMENT |
| MEDIUM | tests/e2e/scenarios/test_v2_engine_oauth_google.py | 662 | # Create a fresh thread | COMMENT |
| MEDIUM | tests/e2e/scenarios/test_v2_engine_oauth_google.py | 793 | # Create a fresh thread | COMMENT |
| MEDIUM | tests/e2e/scenarios/test_skill_oauth_flow.py | 221 | # Create a thread and ask for secrets | COMMENT |
| MEDIUM | scripts/ci/test-check-include-str-paths.sh | 15 | # Create a minimal tree: $1=dir. Populated by the caller before running. | COMMENT |
| MEDIUM | .github/workflows/release.yml | 448 | # Create a GitHub Release while uploading all files to it | COMMENT |
| MEDIUM | .github/workflows/release-plz.yml | 46 | # Create a PR with the new versions and changelog, preparing the next release. | COMMENT |
| MEDIUM | src/db/migration_fixup.rs | 485 | # This file is the immutability guard for released migrations. The\n\ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/runner/seed-runner-db.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/run-reborn-webui.sh | 12 | # Usage: | COMMENT |
| LOW | scripts/replay-snap.sh | 10 | # Usage: | COMMENT |
| LOW | scripts/build-wasm-extensions.sh | 12 | # Usage: | COMMENT |
| LOW | scripts/check-i18n-parity.sh | 10 | # Usage: | COMMENT |
| LOW | scripts/reborn-e2e-rust.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/dev-setup.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/coverage.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/ci/reborn-coverage-summary.sh | 13 | # Usage: | COMMENT |
| LOW | scripts/ci/reborn-coverage-ratchet.sh | 10 | # Usage: | COMMENT |
| LOW | scripts/ci/reborn-coverage-merge-lcov.sh | 23 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/scenarios/test_tool_permissions.py | 57 | # Set echo to a known initial state via REST | COMMENT |
| LOW⚡ | tests/e2e/scenarios/test_tool_permissions.py | 149 | # Set echo to always_allow via REST | COMMENT |
| LOW | tests/e2e/scenarios/test_v2_engine_oauth_google.py | 735 | # Check if a google-related secret exists in the DB (from OAuth or paste flow) | COMMENT |
| LOW | tests/e2e/scenarios/test_skill_oauth_flow.py | 433 | # Check if any auth-related events were emitted. The credential gate | COMMENT |
| LOW⚡ | scripts/check-boundaries.sh | 163 | # Check if the file actually connects to a database (imports DB types | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/capabilities/mcp.md | 85 | --env MINTLIFY_API_KEY=your_api_key | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/ironclaw_llm/src/smart_routing.rs | 875 | "i'm unable to", | CODE |
| MEDIUM | crates/ironclaw_llm/src/reasoning.rs | 3480 | "Let me know if you need anything." | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …2e/scenarios/test_reborn_webui_v2_legacy_extensions.py | 153 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/case_matrix.py | 19 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 1334 | CODE | |
| LOW | scripts/reborn_webui_v2_live_qa/run_live_qa.py | 4540 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/e2e/scenarios/test_channel_approval_gates.py | 58 | async def _set_tool_permission(base_url: str, tool_name: str, state: str) -> None: | CODE |