Hermes WebUI: The best way to use Hermes Agent from the web or from your phone!
This report summarizes scanner evidence for nesquena/hermes-webui, a Python project with 18,852 GitHub stars. SynthScan examined 679,199 lines of code across 1825 source files, recording 28386 pattern matches distributed across 20 syntactic categories. The legacy adjusted pattern signal is 79.3 (High pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 19068 finding(s).
Are imports declared and package/API names verified? 5260 finding(s).
Are wrappers, guards, and repeated structures necessary? 21792 finding(s).
Which changes need focused human review? 28386 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 28386 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | tests/test_real_steer.py | 593 | appendChild(child){{this.children.push(child);}}, | CODE |
| HIGH⚡ | tests/test_real_steer.py | 596 | querySelector(sel){{return null;}}, | CODE |
| HIGH⚡ | tests/test_real_steer.py | 601 | getElementById(id){{return id==='msgInner'?inner:null;}}, | CODE |
| HIGH⚡ | tests/test_real_steer.py | 608 | function showToast(key){{if(globalThis.__toasts)globalThis.__toasts.push(key);}} | CODE |
| HIGH⚡ | tests/test_real_steer.py | 612 | function _clearComposerDraft(sid,text,files){{if(globalThis.__draftClears)globalThis.__draftClears.push({{si | CODE |
| HIGH⚡ | tests/test_real_steer.py | 621 | let sendInput = null; | CODE |
| HIGH⚡ | tests/test_real_steer.py | 622 | let sendOptions = null; | CODE |
| HIGH⚡ | tests/test_real_steer.py | 623 | let apiPayload = null; | CODE |
| HIGH⚡ | tests/test_real_steer.py | 633 | globalThis.clearInflightState = sid => clearInflightCalls.push(sid); | CODE |
| HIGH⚡ | tests/test_real_steer.py | 732 | globalThis.clearInflightState = sid => clearInflightCalls.push(sid); | CODE |
| HIGH⚡ | tests/test_real_steer.py | 734 | globalThis.queueSessionMessage = (sid, payload) => queued.push({{sid, payload}}); | CODE |
| HIGH⚡ | tests/test_real_steer.py | 735 | globalThis.updateQueueBadge = sid => queueBadges.push(sid); | CODE |
| HIGH⚡ | tests/test_real_steer.py | 968 | _uploadPendingFilesUpdateProgress('A', null); | CODE |
| HIGH⚡ | tests/test_real_steer.py | 971 | assert.strictEqual(barWrap.dataset.uploadSessionId, undefined); | CODE |
| HIGH | tests/test_real_steer.py | 363 | assert "const ownerSid=(typeof S!=='undefined'&&S.session&&S.session.session_id)||null;" in body | CODE |
| HIGH | tests/test_real_steer.py | 424 | let apiPayload = null; | CODE |
| HIGH | tests/test_real_steer.py | 425 | let indicatorText = null; | CODE |
| HIGH | tests/test_real_steer.py | 473 | let apiPayload = null; | CODE |
| HIGH | tests/test_real_steer.py | 474 | let indicatorText = null; | CODE |
| HIGH | tests/test_real_steer.py | 521 | let uploadOptions = null; | CODE |
| HIGH | tests/test_real_steer.py | 522 | let apiPayload = null; | CODE |
| HIGH | tests/test_real_steer.py | 533 | function _clearComposerDraft(sid,text,files){{draftClears.push({{sid,text,files}});}} | CODE |
| HIGH | tests/test_real_steer.py | 646 | assert.strictEqual(S.activeStreamId, null); | CODE |
| HIGH | tests/test_real_steer.py | 647 | assert.strictEqual(S.session.active_stream_id, null); | CODE |
| HIGH | tests/test_real_steer.py | 669 | let apiPayload = null; | CODE |
| HIGH | tests/test_real_steer.py | 679 | globalThis.clearInflightState = sid => clearInflightCalls.push(sid); | CODE |
| HIGH | tests/test_real_steer.py | 721 | let apiPayload = null; | CODE |
| HIGH | tests/test_real_steer.py | 800 | globalThis.clearInflightState = sid => clearInflightCalls.push(sid); | CODE |
| HIGH | tests/test_real_steer.py | 834 | globalThis.clearInflightState = sid => clearInflightCalls.push(sid); | CODE |
| HIGH | tests/test_real_steer.py | 944 | return null; | CODE |
| HIGH | tests/test_real_steer.py | 956 | assert.strictEqual(barWrap.dataset.uploadSessionId, undefined); | CODE |
| HIGH | tests/test_real_steer.py | 907 | assert "_uploadPendingFilesUpdateProgress(sessionId,null)" in upload_body | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 104 | : null; | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 110 | this.children.push(child); | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 113 | querySelector: () => null, | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 147 | _store: Object.create(null), | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 149 | return Object.prototype.hasOwnProperty.call(this._store, k) ? this._store[k] : null; | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 157 | querySelector: () => null, | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 161 | global.$ = (id) => registry[id] || null; | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 171 | apiCalls.push({ url: String(url), method: (opts.method || 'GET').toUpperCase(), body: opts.body || '' }); | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 214 | if (forceNoRestore) global._dashboardLastNonNeverMode = null; | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 223 | chipText: chip && chip.textContent, | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 224 | chipAriaChecked: chip && chip.getAttribute('aria-checked'), | STRING |
| HIGH⚡ | tests/test_sidebar_tab_visibility.py | 225 | chipIsOff: chip && chip.classList.contains('chip-off'), | STRING |
| HIGH | tests/test_sidebar_tab_visibility.py | 43 | let inString = null; | STRING |
| HIGH | tests/test_sidebar_tab_visibility.py | 64 | inString = null; | STRING |
| HIGH | tests/test_sidebar_tab_visibility.py | 134 | const registry = Object.create(null); | STRING |
| HIGH | tests/test_sidebar_tab_visibility.py | 183 | const normalized = _normalizeDashboardEnabledMode(saved && saved.enabled); | STRING |
| HIGH⚡ | tests/test_6728_cron_running_sidebar.py | 60 | let str = null; | CODE |
| HIGH⚡ | tests/test_6728_cron_running_sidebar.py | 65 | while (depth > 0 && i < src.length) { | CODE |
| HIGH⚡ | tests/test_6728_cron_running_sidebar.py | 72 | if (c === str) str = null; | CODE |
| HIGH | tests/test_6728_cron_running_sidebar.py | 118 | function _markSessionCompletionUnread(sid, messageCount, meta) { markCount += 1; markedSids.push(sid); } | CODE |
| HIGH | tests/test_6728_cron_running_sidebar.py | 123 | let S = { session: null, busy: false }; | CODE |
| HIGH | tests/test_issue3635_profile_chip_active.py | 75 | assert "(S.session && S.session.profile) || S.activeProfile" not in body, ( | CODE |
| HIGH | tests/test_issue4749_steer_reason_and_recovery.py | 82 | return (typeof LOCALES !== 'undefined' && LOCALES.en && LOCALES.en[key]) | CODE |
| HIGH | tests/test_issue4749_steer_reason_and_recovery.py | 106 | const n = _steerFailureMessageKey(null); | CODE |
| HIGH | tests/test_issue4749_steer_reason_and_recovery.py | 111 | const u = _steerFailureMessageKey(undefined); | CODE |
| HIGH⚡ | tests/test_issue4749_steer_reason_and_recovery.py | 175 | appendChild(c) { this.children.push(c); }, | CODE |
| HIGH⚡ | tests/test_issue4749_steer_reason_and_recovery.py | 180 | return null; | CODE |
| HIGH⚡ | tests/test_issue4749_steer_reason_and_recovery.py | 187 | inner.querySelector = (sel) => null; // no existing recovery bar | CODE |
| 4437 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bootstrap.py | 101 | def ensure_supported_platform() -> None: | CODE |
| LOW | bootstrap.py | 117 | def _agent_dir_from_hermes_cli() -> Path | None: | CODE |
| LOW | bootstrap.py | 254 | def _python_can_run_webui_and_agent(python_exe: str, agent_dir: Path | None = None) -> bool: | CODE |
| LOW | bootstrap.py | 281 | def ensure_python_has_webui_deps(python_exe: str, agent_dir: Path | None = None) -> str: | CODE |
| LOW | bootstrap.py | 597 | def _is_real_supervisor_value(name: str, value: str) -> bool: | CODE |
| LOW⚡ | server.py | 204 | def _drain_request_input_nonblocking(self, request) -> None: | CODE |
| LOW⚡ | server.py | 257 | def _reject_overflow_request_worker(self, request) -> None: | CODE |
| LOW | server.py | 68 | def _blocked_create_connection(address, *a, **kw): | CODE |
| LOW | server.py | 536 | def _abort_if_already_serving(host: str, port: int) -> None: | CODE |
| LOW | tests/test_session_events_http_integration.py | 61 | def test_session_events_bus_subscribe_unsubscribe_balance(): | CODE |
| LOW | tests/test_session_events_http_integration.py | 82 | def test_session_events_sse_endpoint_handshake_succeeds(cleanup_test_sessions): | CODE |
| LOW | tests/test_session_events_http_integration.py | 149 | def test_session_events_sse_endpoint_survives_rapid_disconnect(): | CODE |
| LOW | tests/test_session_events_http_integration.py | 182 | def test_session_events_handler_uses_disconnect_safe_errors_tuple(): | CODE |
| LOW | tests/test_moa_virtual_provider_single_fanout.py | 87 | def test_virtual_moa_session_never_stacks_per_turn_moa_config(monkeypatch, tmp_path, body_extra): | CODE |
| LOW | tests/test_moa_virtual_provider_single_fanout.py | 102 | def test_legacy_agent_moa_session_keeps_per_turn_moa_config(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_moa_virtual_provider_single_fanout.py | 112 | def test_slash_moa_on_regular_session_still_gets_moa_config(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_moa_virtual_provider_single_fanout.py | 127 | def test_agent_has_moa_virtual_provider_probe(monkeypatch): | CODE |
| LOW⚡ | tests/test_issues_907_908_909_model_dropdown.py | 97 | def test_get_label_for_model_helper_exists(self): | CODE |
| LOW⚡ | tests/test_issues_907_908_909_model_dropdown.py | 103 | def test_label_helper_capitalizes_bare_id(self): | CODE |
| LOW⚡ | tests/test_issues_907_908_909_model_dropdown.py | 112 | def test_label_helper_uses_catalog_when_available(self): | CODE |
| LOW | tests/test_issues_907_908_909_model_dropdown.py | 124 | def test_label_helper_strips_at_prefix_for_lookup(self): | CODE |
| LOW | tests/test_issues_907_908_909_model_dropdown.py | 137 | def test_config_uses_label_helper_not_raw_split(self): | CODE |
| LOW⚡ | tests/test_real_steer.py | 321 | def test_cmd_steer_calls_endpoint(self): | CODE |
| LOW⚡ | tests/test_real_steer.py | 328 | def test_try_steer_calls_endpoint(self): | CODE |
| LOW⚡ | tests/test_real_steer.py | 335 | def test_try_steer_handles_fallback_without_cancelling(self): | CODE |
| LOW⚡ | tests/test_real_steer.py | 345 | def test_send_busy_steer_uses_try_steer(self): | CODE |
| LOW⚡ | tests/test_real_steer.py | 352 | def test_try_steer_uploads_pending_files_without_clearing_until_accepted(self): | CODE |
| LOW⚡ | tests/test_real_steer.py | 995 | def test_cmd_steer_delivered_in_all_locales(self): | CODE |
| LOW⚡ | tests/test_real_steer.py | 1001 | def test_steer_leftover_queued_in_all_locales(self): | CODE |
| LOW⚡ | tests/test_real_steer.py | 1014 | def test_leftover_drain_call_in_streaming(self): | CODE |
| LOW⚡ | tests/test_real_steer.py | 1024 | def test_leftover_drain_runs_before_done_event(self): | CODE |
| LOW | tests/test_real_steer.py | 104 | def test_accepts_when_agent_cached_and_running(self, _clear_caches, monkeypatch): | CODE |
| LOW | tests/test_real_steer.py | 151 | def test_gateway_owned_stream_without_cached_agent_queues_fallback(self, _clear_caches, monkeypatch): | CODE |
| LOW | tests/test_real_steer.py | 177 | def test_agent_lacks_steer_method(self, _clear_caches): | CODE |
| LOW | tests/test_real_steer.py | 292 | def test_empty_text_after_strip(self, _clear_caches): | CODE |
| LOW | tests/test_real_steer.py | 373 | def test_file_steer_does_not_read_live_session_after_upload_await(self): | CODE |
| LOW | tests/test_real_steer.py | 388 | def test_file_steer_upload_status_and_indicator_are_owner_scoped(self): | CODE |
| LOW | tests/test_real_steer.py | 404 | def test_file_steer_indicator_omits_attachment_tool_note(self): | CODE |
| LOW | tests/test_real_steer.py | 787 | async function runLateDeadFallbackDoesNotClearNewStream(){{ | CODE |
| LOW⚡ | tests/test_real_steer.py | 869 | def test_send_busy_steer_accepts_file_only_input(self): | STRING |
| LOW⚡ | tests/test_real_steer.py | 878 | def test_upload_pending_files_can_preserve_staged_files_for_steer(self): | STRING |
| LOW⚡ | tests/test_real_steer.py | 888 | def test_upload_pending_files_progress_bar_is_session_scoped(self): | STRING |
| LOW⚡ | tests/test_real_steer.py | 976 | def test_pending_steer_leftover_listener(self): | STRING |
| LOW | tests/test_real_steer.py | 453 | def test_attachment_only_steer_indicator_uses_file_label(self): | STRING |
| LOW | tests/test_real_steer.py | 501 | def test_file_steer_targets_captured_session_when_user_switches_mid_upload(self): | STRING |
| LOW | tests/test_real_steer.py | 566 | def test_dead_steer_fallback_clears_busy_state_and_recovery_sends_normally(self): | STRING |
| LOW | tests/test_real_steer.py | 911 | def test_upload_progress_bar_hides_on_switch_and_reappears_on_owner_return(self): | STRING |
| LOW⚡ | tests/test_issue4842_cli_sessions_streaming_freeze.py | 30 | def test_freeze_marker_none_when_idle(monkeypatch): | CODE |
| LOW⚡ | tests/test_issue4842_cli_sessions_streaming_freeze.py | 35 | def test_freeze_marker_stable_for_same_streams(monkeypatch): | CODE |
| LOW⚡ | tests/test_issue4842_cli_sessions_streaming_freeze.py | 45 | def test_freeze_marker_changes_when_stream_set_changes(monkeypatch): | CODE |
| LOW⚡ | tests/test_issue4842_cli_sessions_streaming_freeze.py | 55 | def test_cache_key_stable_across_message_writes_while_streaming(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_issue4842_cli_sessions_streaming_freeze.py | 91 | def test_streaming_ttl_wider_than_idle(monkeypatch): | CODE |
| LOW | tests/test_issue4842_cli_sessions_streaming_freeze.py | 102 | def test_structural_change_listener_clears_cli_cache(monkeypatch): | CODE |
| LOW | tests/test_issue697_mcp_tool_inventory.py | 34 | def test_endpoint_returns_sanitized_registered_mcp_tools(self, mock_home, mock_cfg, mock_runtime): | CODE |
| LOW | tests/test_issue697_mcp_tool_inventory.py | 83 | def test_schema_summary_uses_parameter_names_types_required_and_descriptions_only(self): | CODE |
| LOW | tests/test_issue697_mcp_tool_inventory.py | 97 | def test_tool_summary_rejects_non_dict_schema_and_redacts_description(self): | CODE |
| LOW | tests/test_issue697_mcp_tool_inventory.py | 109 | def test_system_settings_contains_searchable_global_mcp_tool_section(self): | CODE |
| LOW | tests/test_issue697_mcp_tool_inventory.py | 116 | def test_panels_js_loads_tools_and_filters_name_server_description(self): | CODE |
| LOW | tests/test_surrogate_backup_restore.py | 20 | def test_journal_answer_restores_losslessly_from_actual_shrink_backup(char, duplicate, entry): | CODE |
| LOW | tests/test_surrogate_backup_restore.py | 69 | def test_surrogate_backup_does_not_override_intentional_shrink(tmp_path, char, marker): | CODE |
| 17639 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | mcp_server.py | 41 | # ── Ensure the repo root is on sys.path so api.* imports work ───────────── | COMMENT |
| MEDIUM⚡ | mcp_server.py | 46 | # ── CLI: optional --profile override ────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | mcp_server.py | 53 | # ── Import webui canonical modules (after path setup) ───────────────────── | COMMENT |
| MEDIUM⚡ | mcp_server.py | 195 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | mcp_server.py | 197 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | mcp_server.py | 388 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | mcp_server.py | 390 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | mcp_server.py | 66 | # ── API auth state ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcp_server.py | 79 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | mcp_server.py | 81 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | mcp_server.py | 120 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | mcp_server.py | 122 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | mcp_server.py | 248 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | mcp_server.py | 250 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | mcp_server.py | 450 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | mcp_server.py | 452 | # ═════════════════════════════════════════════════════════════════════════== | COMMENT |
| MEDIUM | mcp_server.py | 467 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | mcp_server.py | 469 | # ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | tests/test_issues_907_908_909_model_dropdown.py | 10 | # ── #907: Normalized dedup in _addLiveModelsToSelect ───────────────────────── | COMMENT |
| MEDIUM | tests/test_issues_907_908_909_model_dropdown.py | 66 | # ── #908: window._defaultModel updated on settings save ───────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_issues_907_908_909_model_dropdown.py | 92 | # ── #909: Injected default model label quality ─────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_real_steer.py | 986 | # ── i18n keys ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_real_steer.py | 1008 | # ── Leftover SSE delivery: streaming.py emits pending_steer_leftover ───── | COMMENT |
| MEDIUM | tests/test_real_steer.py | 99 | # ── Backend: the /api/chat/steer endpoint ───────────────────────────────── | COMMENT |
| MEDIUM | tests/test_real_steer.py | 299 | # ── Routing ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_real_steer.py | 310 | # ── Frontend: cmdSteer + busy-mode steer use the new endpoint ──────────── | COMMENT |
| MEDIUM⚡ | tests/test_workspace_blocked_roots_macos.py | 36 | # ── Blocked-roots set includes both literal and resolved forms ────────────── | COMMENT |
| MEDIUM⚡ | tests/test_workspace_blocked_roots_macos.py | 55 | # ── /etc is rejected on both Linux and macOS ──────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_workspace_blocked_roots_macos.py | 76 | # ── /var is selectively blocked (system parts) but tmp carve-outs work ────── | COMMENT |
| MEDIUM⚡ | tests/test_workspace_blocked_roots_macos.py | 111 | # ── Carve-out invariants ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_workspace_blocked_roots_macos.py | 130 | # ── Other roots: literal == resolved on both platforms ───────────────────── | COMMENT |
| MEDIUM | tests/test_workspace_blocked_roots_macos.py | 155 | # ── New macOS-specific blocked roots: /System and /Library ────────────────── | COMMENT |
| MEDIUM | tests/test_v050255_opus_followups.py | 37 | # ── 1: rollback checkpoint id validation ───────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_v050255_opus_followups.py | 94 | # ── 2: redact_session_data settings.json read-once optimization ────────────── | COMMENT |
| MEDIUM | tests/test_v050255_opus_followups.py | 164 | # ── 3: voice mode session-id capture ───────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_v050255_opus_followups.py | 205 | # ── 4: rollback _inspect_checkpoint except tuple ───────────────────────────── | COMMENT |
| MEDIUM | tests/test_extension_sidecar_proxy.py | 1016 | # ── token-v1 proxy auth (§9.1/§9.2) ───────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_issue2565_reasoning_accumulation.py | 27 | # ── Issue 1: live reasoning segment reset at turn boundaries ───────────────── | COMMENT |
| MEDIUM⚡ | tests/test_issue2565_reasoning_accumulation.py | 90 | # ── Issue 2: reasoning metadata renders as Worklog Thinking Card ───────────── | COMMENT |
| MEDIUM⚡ | tests/test_issue2565_reasoning_accumulation.py | 130 | # ── Cross-cutting: done event still has the persist-on-done guard ──────────── | COMMENT |
| MEDIUM | tests/test_resolve_model_provider_free_suffix.py | 22 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_resolve_model_provider_free_suffix.py | 25 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_resolve_model_provider_free_suffix.py | 38 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_resolve_model_provider_free_suffix.py | 40 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_resolve_model_provider_free_suffix.py | 118 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_resolve_model_provider_free_suffix.py | 133 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_issue5339_restart_stale_user_dedup.py | 132 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_issue5339_restart_stale_user_dedup.py | 134 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_issue5339_restart_stale_user_dedup.py | 486 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_issue5339_restart_stale_user_dedup.py | 488 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_issue5339_restart_stale_user_dedup.py | 536 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_issue5339_restart_stale_user_dedup.py | 538 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_issue569_579.py | 18 | # ── #569: docker UID/GID auto-detect ───────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_issue569_579.py | 120 | # ── #579: topbar message count already filters tool messages ────────────────── | COMMENT |
| MEDIUM | tests/test_issue4765_sessions_lru_eviction.py | 112 | # ─────────────────────────── config knob ──────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_issue4765_sessions_lru_eviction.py | 153 | # ─────────────────────────── invariant 1: eviction ────────────────────────── | COMMENT |
| MEDIUM | tests/test_issue4765_sessions_lru_eviction.py | 180 | # ────────────────────── invariant 2: never evict active ────────────────────── | COMMENT |
| MEDIUM | tests/test_issue4765_sessions_lru_eviction.py | 259 | # ───────────────── invariant 3: lazy reload + invariant 4: no data loss ────── | COMMENT |
| MEDIUM⚡ | tests/test_media_message_snapshots.py | 198 | # ── resolve_media_ref / media_capture_allowed ────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_media_message_snapshots.py | 603 | # ── display-metadata persistence (state.db ↔ sidecar merge) ──────────────── | COMMENT |
| 1903 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | server.py | 551 | except (ConnectionRefusedError, ConnectionResetError, OSError, socket.timeout): | CODE |
| HIGH | server.py | 598 | except FileNotFoundError: | CODE |
| HIGH | server.py | 201 | except Exception: | CODE |
| HIGH | server.py | 313 | except OSError: | CODE |
| HIGH | server.py | 317 | except OSError: | CODE |
| HIGH | server.py | 232 | except OSError: | CODE |
| HIGH | server.py | 237 | except Exception: | CODE |
| HIGH | server.py | 266 | except Exception: | CODE |
| HIGH | server.py | 324 | except OSError: | CODE |
| HIGH | server.py | 264 | except Exception: | CODE |
| HIGH | server.py | 329 | except OSError: | CODE |
| HIGH | server.py | 402 | except _CLIENT_DISCONNECT_ERRORS: | CODE |
| HIGH | server.py | 428 | except _CLIENT_DISCONNECT_ERRORS: | CODE |
| HIGH | mcp_server.py | 378 | except Exception: | CODE |
| HIGH | tests/test_session_events_http_integration.py | 121 | except Exception: | CODE |
| HIGH | tests/test_session_events_http_integration.py | 135 | except (ValueError, AssertionError): | CODE |
| HIGH | tests/test_sidebar_tab_visibility.py | 301 | except OSError: | CODE |
| HIGH | tests/test_issue765_streaming_persistence.py | 140 | except Exception: | CODE |
| HIGH | tests/test_issue765_streaming_persistence.py | 599 | except ValueError: | CODE |
| HIGH | tests/test_issue765_streaming_persistence.py | 577 | except Exception: | CODE |
| HIGH | tests/test_issue765_streaming_persistence.py | 715 | except Exception: | CODE |
| HIGH | tests/test_terminal_fd_leak.py | 78 | except Exception: | CODE |
| HIGH | tests/test_issue4746_extension_gallery.py | 546 | except OSError: | CODE |
| HIGH | tests/test_issue4746_extension_gallery.py | 564 | except OSError: | CODE |
| HIGH | tests/test_issue1094_provider_bugs.py | 70 | except Exception: | CODE |
| HIGH | tests/conftest.py | 886 | except Exception: | CODE |
| HIGH | tests/conftest.py | 934 | except Exception: | CODE |
| HIGH | tests/conftest.py | 991 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1241 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1247 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1431 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1436 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1448 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1454 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1461 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1466 | except Exception: | CODE |
| HIGH | tests/conftest.py | 409 | except Exception: | CODE |
| HIGH | tests/conftest.py | 426 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1189 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1343 | except Exception: | CODE |
| HIGH | tests/conftest.py | 1443 | except Exception: | CODE |
| HIGH | tests/test_sprint28.py | 67 | except Exception: | CODE |
| HIGH | tests/test_issue1499_keyless_onboarding.py | 357 | except Exception: | CODE |
| HIGH | tests/test_7506_full_cap_dead_endpoint.py | 38 | except (BrokenPipeError, ConnectionResetError): | CODE |
| HIGH | tests/test_issue1106_custom_providers_models.py | 9 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 227 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 258 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 293 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 353 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 384 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 427 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 500 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 777 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 852 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 892 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 938 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 978 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 1026 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 1129 | except Exception: | CODE |
| HIGH | tests/test_gateway_sync.py | 1151 | except Exception: | CODE |
| 450 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bootstrap.py | 68 | except Exception as exc: | CODE |
| LOW | bootstrap.py | 435 | except Exception: | CODE |
| LOW | bootstrap.py | 437 | except Exception: | CODE |
| LOW | bootstrap.py | 536 | except Exception as exc: | CODE |
| LOW | bootstrap.py | 1015 | except Exception as exc: | CODE |
| LOW | managed_agent_startup.py | 32 | except Exception as exc: # noqa: BLE001 - SystemExit (relaunch/repair exit) still propagates | CODE |
| MEDIUM | server.py | 68 | def _blocked_create_connection(address, *a, **kw): | CODE |
| MEDIUM | server.py | 198 | def _close_request_quietly(self, request) -> None: | CODE |
| MEDIUM | server.py | 257 | def _reject_overflow_request_worker(self, request) -> None: | CODE |
| MEDIUM | server.py | 283 | def process_request_thread(self, request, client_address): | CODE |
| MEDIUM | server.py | 645 | def _start_watcher_safe(): | CODE |
| LOW⚡ | server.py | 201 | except Exception: | CODE |
| LOW⚡ | server.py | 213 | except Exception: | CODE |
| LOW⚡ | server.py | 253 | except Exception: | CODE |
| LOW⚡ | server.py | 264 | except Exception: | CODE |
| LOW⚡ | server.py | 266 | except Exception: | CODE |
| LOW⚡ | server.py | 648 | except Exception as e: | CODE |
| LOW⚡ | server.py | 656 | except Exception as e: | CODE |
| LOW⚡ | server.py | 663 | except Exception as e: | CODE |
| LOW⚡ | server.py | 670 | except Exception as e: | CODE |
| LOW⚡ | server.py | 676 | except Exception as e: | CODE |
| LOW⚡ | server.py | 740 | except Exception: | CODE |
| LOW⚡ | server.py | 745 | except Exception: | CODE |
| LOW⚡ | server.py | 750 | except Exception: | CODE |
| LOW⚡ | server.py | 755 | except Exception: | CODE |
| LOW | server.py | 187 | except Exception: | CODE |
| LOW | server.py | 237 | except Exception: | CODE |
| LOW | server.py | 278 | except Exception: | CODE |
| LOW | server.py | 363 | except Exception: | CODE |
| LOW | server.py | 368 | except Exception: | CODE |
| LOW | server.py | 398 | except Exception: | CODE |
| LOW | server.py | 404 | except Exception: | CODE |
| LOW | server.py | 424 | except Exception: | CODE |
| LOW | server.py | 430 | except Exception: | CODE |
| LOW | server.py | 464 | except Exception as exc: | CODE |
| LOW | server.py | 474 | except Exception as exc: | CODE |
| LOW | server.py | 489 | except Exception: | CODE |
| LOW | server.py | 522 | except Exception: | CODE |
| LOW | server.py | 590 | except Exception as exc: | CODE |
| LOW | server.py | 693 | except Exception as e: | CODE |
| LOW | ctl.sh | 757 | except Exception: | CODE |
| LOW⚡ | mcp_server.py | 191 | except Exception as e: | CODE |
| LOW⚡ | mcp_server.py | 378 | except Exception: | CODE |
| LOW | mcp_server.py | 101 | except Exception: | CODE |
| LOW | mcp_server.py | 164 | except Exception: | CODE |
| LOW | tests/test_session_events_http_integration.py | 121 | except Exception: | CODE |
| LOW | tests/test_issue4749_steer_reason_and_recovery.py | 280 | except Exception: | CODE |
| LOW | tests/test_issue2931_edge_tts_endpoint.py | 41 | except Exception: | CODE |
| MEDIUM | tests/test_issue2931_edge_tts_endpoint.py | 38 | def payload(self): | CODE |
| MEDIUM | tests/test_issue765_streaming_persistence.py | 303 | def _save_worker(): | CODE |
| LOW | tests/test_issue765_streaming_persistence.py | 140 | except Exception: | CODE |
| LOW | tests/test_issue765_streaming_persistence.py | 306 | except Exception as e: | CODE |
| LOW | tests/test_issue765_streaming_persistence.py | 577 | except Exception: | CODE |
| LOW | tests/test_issue765_streaming_persistence.py | 580 | except Exception as e: | CODE |
| LOW | tests/test_issue765_streaming_persistence.py | 715 | except Exception: | CODE |
| LOW | tests/test_issue765_streaming_persistence.py | 718 | except Exception as e: | CODE |
| LOW⚡ | tests/test_terminal_fd_leak.py | 78 | except Exception: | CODE |
| LOW | tests/test_session_action_menu_focus.py | 129 | except Exception: # pragma: no cover - dependency missing path | CODE |
| LOW | tests/test_session_action_menu_focus.py | 161 | except Exception: # pragma: no cover - dependency missing path | CODE |
| MEDIUM | tests/test_session_action_menu_focus.py | 126 | def test_session_action_menu_focus_lifecycle_in_browser(): | CODE |
| 1360 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bootstrap.py | 4 | CODE | |
| LOW | mcp_server.py | 54 | CODE | |
| LOW | mcp_server.py | 55 | CODE | |
| LOW | mcp_server.py | 55 | CODE | |
| LOW | mcp_server.py | 55 | CODE | |
| LOW | mcp_server.py | 59 | CODE | |
| LOW | tests/test_real_steer.py | 20 | CODE | |
| LOW | tests/test_surrogate_backup_restore.py | 10 | CODE | |
| LOW | tests/test_zip_media_delivery.py | 12 | CODE | |
| LOW | tests/test_v050255_opus_followups.py | 27 | CODE | |
| LOW | tests/test_v050255_opus_followups.py | 29 | CODE | |
| LOW | tests/test_run_journal_protocol_upgrade.py | 9 | CODE | |
| LOW | tests/test_issue5532_clear_truncation_watermark.py | 28 | CODE | |
| LOW | tests/test_issue4891_detail_header_visibility.py | 16 | CODE | |
| LOW | tests/test_issue1257_llm_wiki_status.py | 1 | CODE | |
| LOW | tests/test_issue569_579.py | 11 | CODE | |
| LOW | tests/test_compaction_current_summary_fallback.py | 15 | CODE | |
| LOW | tests/test_visible_video_preload.py | 3 | CODE | |
| LOW | tests/test_run_journal_seq_cache.py | 11 | CODE | |
| LOW | tests/test_media_message_snapshots.py | 16 | CODE | |
| LOW | tests/test_issue3987_imported_session_titles.py | 3 | CODE | |
| LOW | tests/test_issue7941_csp_remote_image_exfiltration.py | 16 | CODE | |
| LOW | tests/test_issue5270_cli_webui_continuity.py | 1 | CODE | |
| LOW | tests/test_sprint49.py | 13 | CODE | |
| LOW | tests/test_update_checker.py | 11 | CODE | |
| LOW | tests/test_update_checker.py | 12 | CODE | |
| LOW | tests/test_update_checker.py | 13 | CODE | |
| LOW | tests/test_update_checker.py | 15 | CODE | |
| LOW | tests/test_gateway_watcher_idle_park.py | 12 | CODE | |
| LOW | tests/test_mcp_runtime_profile_scope.py | 13 | CODE | |
| LOW | tests/test_mcp_runtime_profile_scope.py | 26 | CODE | |
| LOW | tests/test_mcp_runtime_profile_scope.py | 28 | CODE | |
| LOW | tests/test_approval_sse.py | 14 | CODE | |
| LOW | tests/test_cli_session_tool_metadata.py | 3 | CODE | |
| LOW | tests/test_issue3260_self_hosted_providers_settings.py | 3 | CODE | |
| LOW | tests/test_wakeup_model_resolve_hang.py | 30 | CODE | |
| LOW | tests/test_agent_runtime_revision_guard.py | 3 | CODE | |
| LOW | tests/test_sprint40_ui_polish.py | 8 | CODE | |
| LOW | tests/test_sprint40_ui_polish.py | 10 | CODE | |
| LOW | tests/test_sprint40_ui_polish.py | 13 | CODE | |
| LOW | tests/test_metadata_save_wipe_1558.py | 21 | CODE | |
| LOW | tests/test_metadata_save_wipe_1558.py | 22 | CODE | |
| LOW | tests/test_empty_session_no_disk_write.py | 22 | CODE | |
| LOW | tests/test_empty_session_no_disk_write.py | 27 | CODE | |
| LOW | tests/test_issue7056_login_hides_password_form.py | 16 | CODE | |
| LOW | tests/test_bg_task_complete_focus_drop.py | 22 | CODE | |
| LOW | tests/test_issue1240_generic_cli_catalog_sync.py | 8 | CODE | |
| LOW | tests/test_issue1095_pasted_images.py | 8 | CODE | |
| LOW | tests/test_cancelled_history_real_producers.py | 7 | CODE | |
| LOW | tests/test_lineage_display_cache.py | 13 | CODE | |
| LOW | tests/test_anchor_fallback_ownership.py | 9 | CODE | |
| LOW | tests/test_cancelled_turn_status.py | 7 | CODE | |
| LOW | tests/test_session_channel_option_x.py | 12 | CODE | |
| LOW | tests/test_issue7361_turn_adoption_stamp.py | 22 | CODE | |
| LOW | tests/test_7792_terminal_row_parity.py | 19 | CODE | |
| LOW | tests/test_clarify_sse.py | 12 | CODE | |
| LOW | tests/test_partial_bloat_fix.py | 19 | CODE | |
| LOW | tests/test_issue3929_error_preserves_partial.py | 3 | CODE | |
| LOW | tests/test_claude_code_session_import.py | 1 | CODE | |
| LOW | tests/test_docker_docs_and_readonly.py | 20 | CODE | |
| 661 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_6728_cron_running_sidebar.py | 0 | function extractfunc(name) { const re = new regexp('function\\s+' + name + '\\s*\\('); const start = src.search(re); if | STRING |
| HIGH | …s/test_issue5638_user_row_intrinsic_height_collapse.py | 0 | function extractfunc(name) { const re = new regexp('function\\s+' + name + '\\s*\\('); const start = src.search(re); if | STRING |
| HIGH | …test_issue5744_nonvirtual_userrow_collapse_jumpback.py | 0 | function extractfunc(name) { const re = new regexp('function\\s+' + name + '\\s*\\('); const start = src.search(re); if | STRING |
| HIGH | tests/test_issue5637_stale_anchor_guard.py | 0 | function extractfunc(name) { const re = new regexp('function\\s+' + name + '\\s*\\('); const start = src.search(re); if | STRING |
| HIGH | tests/test_issue2051_duplicate_model_picker_entry.py | 0 | real source of the named ui.js functions — never a re-implementation. | STRING |
| HIGH | tests/test_issue2051_duplicate_assistant_answer.py | 0 | real source of the named ui.js functions — never a re-implementation. | STRING |
| HIGH | tests/test_issue2051_duplicate_interrupt_notice.py | 0 | real source of the named ui.js functions — never a re-implementation. | STRING |
| HIGH | tests/test_issue1154_fenced_code_leak.py | 0 | const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = { | STRING |
| HIGH | tests/test_issue1618_yaml_json_diff_newline_preserve.py | 0 | const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = { | STRING |
| HIGH | tests/test_issue1446_glued_heading_lift.py | 0 | const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = { | STRING |
| HIGH | tests/test_issue2881_workspace_chat_links.py | 0 | const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = { | STRING |
| HIGH | tests/test_issue2428_table_pipe_protection.py | 0 | const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = { | STRING |
| HIGH | tests/test_gateway_watcher_idle_park.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_gateway_watcher_resubscribe_fresh.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_issue5379_cron_project_optin.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_cross_profile_system_project_tagging.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_session_lineage_report.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_pr7555_cli_session_availability.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_issue3930_source_filter_pushdown.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_issue3506_memory_and_watcher.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_profile_home_resolve_caching.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_issue3585_cron_session_overflow.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_acp_session_sidebar_visibility.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_issue4842_cron_projection_perf.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_issue3586_cli_session_source_label.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_issue2628_cli_sessions_perf.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_issue1013_handoff_dock.py | 0 | create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n | STRING |
| HIGH | tests/test_issue5379_cron_project_optin.py | 0 | create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text | STRING |
| HIGH | tests/test_issue4385_cron_archive_reappears.py | 0 | create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text | STRING |
| HIGH | tests/test_issue3762_importable_rows_schema_guard.py | 0 | create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text | STRING |
| HIGH | tests/test_issue5455_listing_readonly_connection.py | 0 | create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text | STRING |
| HIGH | tests/test_issue3172_cron_session_limit.py | 0 | create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text | STRING |
| HIGH | tests/test_session_discoverability_repair.py | 0 | create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text | STRING |
| HIGH | tests/test_cron_session_title.py | 0 | create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text | STRING |
| HIGH | tests/test_issue3929_error_preserves_partial.py | 0 | redirect session_dir / session_index_file to an isolated temp dir. | STRING |
| HIGH | tests/test_issue1361_cancel_data_loss.py | 0 | redirect session_dir / session_index_file to an isolated temp dir. | STRING |
| HIGH | tests/test_issue1298_cancel_and_activity.py | 0 | redirect session_dir / session_index_file to an isolated temp dir. | STRING |
| HIGH | tests/test_issue1094_provider_bugs.py | 0 | stub hermes_cli so tests are deterministic and offline. | STRING |
| HIGH | tests/test_provider_management.py | 0 | stub hermes_cli so tests are deterministic and offline. | STRING |
| HIGH | tests/test_issue1500_lmstudio_env_var_alignment.py | 0 | stub hermes_cli so tests are deterministic and offline. | STRING |
| HIGH | tests/test_custom_provider_dict_models.py | 0 | stub hermes_cli so tests are deterministic and offline. | STRING |
| HIGH | tests/test_custom_providers_in_panel.py | 0 | stub hermes_cli so tests are deterministic and offline. | STRING |
| HIGH | tests/test_agent_max_turns_parity.py | 0 | return the source of the `_compute_agent_cache_signature()` helper. the signature blob used to be inlined in the streami | STRING |
| HIGH | tests/test_issue1897_profile_switch_agent_cache.py | 0 | return the source of the `_compute_agent_cache_signature()` helper. the signature blob used to be inlined in the streami | STRING |
| HIGH | tests/test_streaming_max_tokens_quota.py | 0 | return the source of the `_compute_agent_cache_signature()` helper. the signature blob used to be inlined in the streami | STRING |
| HIGH | tests/test_agent_max_turns_parity.py | 0 | return the `_json.dumps([...])` field list the signature hashes. | STRING |
| HIGH | tests/test_issue1897_profile_switch_agent_cache.py | 0 | return the `_json.dumps([...])` field list the signature hashes. | STRING |
| HIGH | tests/test_streaming_max_tokens_quota.py | 0 | return the `_json.dumps([...])` field list the signature hashes. | STRING |
| HIGH | tests/test_agent_max_turns_parity.py | 0 | return `(offset, source)` for every production signature call site. paren-balanced so the whole multi-line keyword-argum | STRING |
| HIGH | tests/test_issue1897_profile_switch_agent_cache.py | 0 | return `(offset, source)` for every production signature call site. paren-balanced so the whole multi-line keyword-argum | STRING |
| HIGH | tests/test_streaming_max_tokens_quota.py | 0 | return `(offset, source)` for every production signature call site. paren-balanced so the whole multi-line keyword-argum | STRING |
| HIGH | tests/test_agent_max_turns_parity.py | 0 | return the single offset of a lifecycle marker in streaming.py. | STRING |
| HIGH | tests/test_issue1897_profile_switch_agent_cache.py | 0 | return the single offset of a lifecycle marker in streaming.py. | STRING |
| HIGH | tests/test_streaming_max_tokens_quota.py | 0 | return the single offset of a lifecycle marker in streaming.py. | STRING |
| HIGH | tests/test_agent_max_turns_parity.py | 0 | map each lifecycle region to the single signature call inside it. the regions are the initial send, the returned-error s | STRING |
| HIGH | tests/test_streaming_max_tokens_quota.py | 0 | map each lifecycle region to the single signature call inside it. the regions are the initial send, the returned-error s | STRING |
| HIGH | tests/test_issue1897_profile_switch_agent_cache.py | 0 | map each lifecycle region to the single signature call inside it. the regions are the initial send, the returned-error s | STRING |
| HIGH | tests/test_issue_neuralwatt_env_key.py | 0 | force get_available_models() down its explicit env-var fallback path. | STRING |
| HIGH | tests/test_issue2025_xiaomi_env_key.py | 0 | force get_available_models() down its explicit env-var fallback path. | STRING |
| HIGH | tests/test_issue2720_bedrock_model_picker.py | 0 | force get_available_models() down its explicit env-var fallback path. | STRING |
| 52 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bootstrap.py | 28 | CODE | |
| LOW | bootstrap.py | 281 | CODE | |
| LOW | bootstrap.py | 442 | CODE | |
| LOW | bootstrap.py | 845 | CODE | |
| LOW | server.py | 151 | CODE | |
| LOW | mcp_server.py | 321 | CODE | |
| LOW | tests/test_session_events_http_integration.py | 25 | CODE | |
| LOW | tests/test_session_events_http_integration.py | 82 | CODE | |
| LOW | tests/test_issue5637_mobile_scroll_clamp_jumpback.py | 35 | CODE | |
| LOW | tests/test_issue5637_mobile_scroll_clamp_jumpback.py | 52 | CODE | |
| LOW | tests/test_run_journal_protocol_upgrade.py | 54 | CODE | |
| LOW | tests/test_issue3635_profile_chip_active.py | 29 | CODE | |
| LOW | tests/test_issue3635_profile_chip_active.py | 98 | CODE | |
| LOW | tests/test_issue3599_inline_thinking_extraction.py | 15 | CODE | |
| LOW | tests/test_issue4891_detail_header_visibility.py | 24 | CODE | |
| LOW | tests/test_issue4749_steer_reason_and_recovery.py | 268 | CODE | |
| LOW | tests/test_issue1431_toolsets_chip_responsive.py | 141 | CODE | |
| LOW | tests/test_issue3250_upward_scroll_intent_window.py | 15 | CODE | |
| LOW | tests/test_issue1731_upward_scroll_unpins.py | 22 | CODE | |
| LOW | tests/test_issue765_streaming_persistence.py | 521 | CODE | |
| LOW | tests/test_issue765_streaming_persistence.py | 663 | CODE | |
| LOW | tests/test_issue765_streaming_persistence.py | 564 | CODE | |
| LOW | tests/test_issue765_streaming_persistence.py | 702 | CODE | |
| LOW | tests/test_korean_locale.py | 18 | CODE | |
| LOW | tests/test_issue3571_saved_prompts.py | 18 | CODE | |
| LOW | tests/test_large_text_paste_attachment.py | 22 | CODE | |
| LOW | tests/test_session_unread_dot_on_visit.py | 145 | CODE | |
| LOW | tests/test_agent_runtime_revision_guard.py | 102 | CODE | |
| LOW | tests/test_bg_task_complete_focus_drop.py | 51 | CODE | |
| LOW | tests/test_cancelled_history_real_producers.py | 438 | CODE | |
| LOW | tests/test_cancelled_history_real_producers.py | 520 | CODE | |
| LOW | tests/test_issue6080_model_picker_reparent.py | 33 | CODE | |
| LOW | tests/test_anchor_fallback_ownership.py | 127 | CODE | |
| LOW | tests/test_anchor_fallback_ownership.py | 191 | CODE | |
| LOW | tests/test_session_channel_option_x.py | 23 | CODE | |
| LOW | tests/test_session_channel_option_x.py | 230 | CODE | |
| LOW | tests/test_session_channel_option_x.py | 259 | CODE | |
| LOW | tests/test_language_precedence.py | 55 | CODE | |
| LOW | tests/test_language_precedence.py | 122 | CODE | |
| LOW | tests/test_tars_scroll_reset_regressions.py | 8 | CODE | |
| LOW | tests/test_session_middle_click_new_tab.py | 37 | CODE | |
| LOW | tests/test_issue5514_composer_grow_scroll_pin.py | 47 | CODE | |
| LOW | tests/test_issue6067_artifact_paths.py | 35 | CODE | |
| LOW | tests/test_issue6067_artifact_paths.py | 116 | CODE | |
| LOW | tests/test_issue4598_composer_control_visibility.py | 69 | CODE | |
| LOW | tests/conftest.py | 228 | CODE | |
| LOW | tests/conftest.py | 455 | CODE | |
| LOW | tests/conftest.py | 807 | CODE | |
| LOW | tests/conftest.py | 890 | CODE | |
| LOW | tests/test_agent_max_turns_parity.py | 36 | CODE | |
| LOW | tests/test_issue4877_fresh_blank_boot_workspace_bind.py | 20 | CODE | |
| LOW | tests/test_issue1690_scroll_completion.py | 9 | CODE | |
| LOW | tests/test_issue1690_scroll_completion.py | 23 | CODE | |
| LOW | tests/test_scroll_collapse_clamp_keeps_follow.py | 32 | CODE | |
| LOW | tests/test_profile_switch_ux.py | 20 | CODE | |
| LOW | tests/test_profile_switch_ux.py | 85 | CODE | |
| LOW | tests/test_smd_media_in_stream.py | 686 | CODE | |
| LOW | tests/test_smd_media_in_stream.py | 744 | CODE | |
| LOW | tests/test_cancelled_successor_identity_proof.py | 54 | CODE | |
| LOW | tests/test_pwa_notification_controls.py | 52 | CODE | |
| 599 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bootstrap.py | 561 | "under launchd / systemd / supervisord so the " | COMMENT |
| LOW | bootstrap.py | 921 | f"Could not chdir to {server_cwd!r} before exec: {exc}" | COMMENT |
| LOW | server.py | 701 | print('', flush=True) | COMMENT |
| LOW | requirements.txt | 1 | # Hermes Web UI -- minimal Python dependencies | COMMENT |
| LOW | pyproject.toml | 61 | "static", | COMMENT |
| LOW | pyproject.toml | 81 | # prevention value lives. | COMMENT |
| LOW | docker-compose.three-container.yml | 1 | # Three-container Docker Compose: Hermes Agent + Dashboard + WebUI | COMMENT |
| LOW | docker-compose.three-container.yml | 21 | # | COMMENT |
| LOW | docker-compose.three-container.yml | 61 | # Gateway API server (port 8642). The WebUI's Tasks/cron health probe | COMMENT |
| LOW | docker-compose.three-container.yml | 121 | container_name: hermes-webui | COMMENT |
| LOW | docker-compose.three-container.yml | 141 | environment: | COMMENT |
| LOW | docker-compose.three-container.yml | 161 | # NOTE: When using bind-mount volumes shared across containers, ALL containers | COMMENT |
| LOW | docker-compose.three-container.yml | 181 | COMMENT | |
| LOW | docker-compose.yml | 1 | # Hermes WebUI — single-container Docker Compose | COMMENT |
| LOW | docker-compose.yml | 21 | volumes: | COMMENT |
| LOW | docker-compose.yml | 41 | # Where to store sessions, workspaces, and other state (default: ~/.hermes/webui) | COMMENT |
| LOW | docker_init.bash | 61 | # identity the operator chose explicitly — including the legitimate value 1024, | COMMENT |
| LOW | docker_init.bash | 221 | fi | COMMENT |
| LOW | docker_init.bash | 461 | echo "" | COMMENT |
| LOW | docker_init.bash | 481 | # it the same lifecycle as .deps_installed: both survive restarts and both | COMMENT |
| LOW | ctl.sh | 521 | COMMENT | |
| LOW | docker-compose.two-container.yml | 1 | # Two-container Docker Compose: Hermes Agent + Hermes WebUI | COMMENT |
| LOW | docker-compose.two-container.yml | 21 | # → see https://github.com/sunnysktsang/hermes-suite for an all-in-one image | COMMENT |
| LOW | docker-compose.two-container.yml | 61 | # Expose agent source so the WebUI can install dependencies from it | COMMENT |
| LOW | docker-compose.two-container.yml | 101 | - hermes-home:/home/hermeswebui/.hermes | COMMENT |
| LOW | docker-compose.two-container.yml | 121 | # Match your host user's UID/GID for correct file permissions. | COMMENT |
| LOW | docker-compose.two-container.yml | 141 | # - HERMES_HOME_MODE=0640 | COMMENT |
| LOW | start.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | start.sh | 21 | # requires a password — better than exiting non-zero with `sudo: a password | COMMENT |
| LOW | start.sh | 61 | exit 1 | COMMENT |
| LOW | start.sh | 121 | *) _hermes_probe_host="${_hermes_host}" ;; | COMMENT |
| LOW | tests/test_resolve_model_provider_free_suffix.py | 121 | # The PR #1762 fix for #1744 skipped the rsplit-fallback when the provider | COMMENT |
| LOW | tests/test_issue765_streaming_persistence.py | 741 | assert data["active_stream_id"] is None, ( | COMMENT |
| LOW | tests/test_media_message_snapshots.py | 761 | # Transparent segments: original _getCachedRender line is preserved (source | COMMENT |
| LOW | tests/test_session_channel_option_x.py | 521 | COMMENT | |
| LOW | tests/test_session_channel_option_x.py | 621 | with bp.SESSION_CHANNELS_LOCK: | COMMENT |
| LOW | tests/test_session_channel_option_x.py | 841 | assert '"event_id"' in fn_src or "'event_id'" in fn_src, ( | COMMENT |
| LOW | tests/test_session_channel_option_x.py | 861 | # EventSource was ever created — the session stream stayed dead until the user | COMMENT |
| LOW | tests/test_session_channel_option_x.py | 901 | # Bug: loadSession() tears down the live per-session SSE unconditionally at the | COMMENT |
| LOW | tests/test_language_precedence.py | 281 | # maintainer cannot silently reintroduce the round-2 regressions: | COMMENT |
| LOW | tests/test_docker_docs_and_readonly.py | 161 | # `uv pip install "$_agent_src[all]"` invokes setuptools' egg_info build step, | COMMENT |
| LOW | tests/test_issue5514_composer_grow_scroll_pin.py | 541 | COMMENT | |
| LOW | tests/test_issue5514_composer_grow_scroll_pin.py | 641 | COMMENT | |
| LOW | tests/test_issue5514_composer_grow_scroll_pin.py | 741 | COMMENT | |
| LOW | tests/conftest.py | 121 | # Test state must NEVER live inside the real Hermes home (~/.hermes or any | COMMENT |
| LOW | tests/conftest.py | 181 | os.environ['HERMES_BASE_HOME'] = str(TEST_STATE_DIR) | COMMENT |
| LOW | tests/conftest.py | 381 | # re-establishes its own profile so the leak is masked, but a test that only | COMMENT |
| LOW | tests/conftest.py | 521 | yield | COMMENT |
| LOW | tests/conftest.py | 541 | # imports trigger botocore initialisation. | COMMENT |
| LOW | tests/conftest.py | 561 | # Tests that need to verify execv WAS called still monkeypatch it themselves | COMMENT |
| LOW | tests/conftest.py | 581 | # an existing mock and tried to hit the real LM Studio host. | COMMENT |
| LOW | tests/conftest.py | 1061 | # HERMES_WEBUI_STATE_DIR for their own purposes, but HERMES_WEBUI_TEST_STATE_DIR | COMMENT |
| LOW | tests/conftest.py | 1101 | # Github tokens (PR/issue tools shouldn't be exercised in tests) | COMMENT |
| LOW | tests/conftest.py | 1261 | # even after the module object itself is restored. That is the exact chronic | COMMENT |
| LOW | tests/conftest.py | 1281 | # (test_v050259_sessiondb_fd_leak's `from hermes_state import SessionDB` fails | COMMENT |
| LOW | tests/conftest.py | 1361 | if _v is None: | COMMENT |
| LOW | tests/test_custom_provider_prefix_collisions.py | 1 | import sys | COMMENT |
| LOW | tests/test_issue2518_active_provider_fallback.py | 161 | ], | COMMENT |
| LOW | tests/test_issue2518_active_provider_fallback.py | 181 | # consulting the catalog — silently re-pointing the session at the wrong | COMMENT |
| LOW | tests/test_mcp_server.py | 21 | # CI and the local test runner install the compatible dependency; minimal | COMMENT |
| 437 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bootstrap.py | 937 | # Mirror the robust pattern from api/updates._schedule_restart: | COMMENT |
| LOW | ctl.sh | 127 | # into the shell environment (including those just set by repo .env) are | COMMENT |
| MEDIUM | tests/test_issue5532_clear_truncation_watermark.py | 40 | """Point the session store at an isolated tmp dir (mirror #2914 harness).""" | STRING |
| MEDIUM | tests/test_media_message_snapshots.py | 766 | # scene render chain is exercised by harness-extracted tests that would | COMMENT |
| MEDIUM⚡ | tests/test_session_unread_dot_on_visit.py | 38 | # Sibling harness scaffolding lives beside this file and is not on sys.path by | COMMENT |
| MEDIUM⚡ | tests/test_session_unread_dot_on_visit.py | 39 | # default; import it the same way the other node-harness tests do. | COMMENT |
| MEDIUM | tests/test_session_middle_click_new_tab.py | 641 | # ReferenceError path that only exists in the harness. | COMMENT |
| MEDIUM | tests/test_session_middle_click_new_tab.py | 304 | # harness must stub every closure free-var the branch touches: | STRING |
| MEDIUM | tests/test_session_middle_click_new_tab.py | 417 | # harness must stub every closure free-var the branch touches. | STRING |
| MEDIUM⚡ | tests/test_issue5514_composer_grow_scroll_pin.py | 559 | # harness leaves the reader stranded; with the preserve-scrollTop fix it does not. | COMMENT |
| MEDIUM | tests/conftest.py | 1032 | # Stale servers from QA harness runs or prior test sessions cause | COMMENT |
| MEDIUM | tests/test_scroll_collapse_clamp_keeps_follow.py | 17 | with controllable geometry, the same way the #4970 harness does. | STRING |
| MEDIUM | tests/test_7027_state_dir_uid_probe.py | 133 | # ── behavioural harness ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_runtime_adapter_seam.py | 557 | assert "#### Slice 4c: Feature-flagged runner backend and restart/reattach harness" in rfc | CODE |
| MEDIUM | tests/test_runtime_adapter_seam.py | 589 | assert "#### Slice 4e: Default-off runner chat-start route-selection harness" in rfc | CODE |
| MEDIUM | tests/test_runtime_adapter_seam.py | 626 | assert "#### Slice 4g: Supervised local runner process harness gate" in rfc | CODE |
| MEDIUM⚡ | tests/test_6710_panel_dismiss_and_artifact_open.py | 64 | # behaviour under test for the reopen-during-read case, so the harness | COMMENT |
| MEDIUM⚡ | tests/test_6710_panel_dismiss_and_artifact_open.py | 69 | # real shipped code too, not a harness mirror. | COMMENT |
| LOW | tests/test_session_sidebar_cache.py | 615 | # text-file state.db (a real sqlite connect would just return None here). | COMMENT |
| MEDIUM⚡ | tests/test_5428_stale_client_recovery.py | 62 | # Node-backed behavioral harness | COMMENT |
| MEDIUM | tests/test_gateway_events_watchdog_7978.py | 164 | # ---------------------------------------------------------------- harness --- | COMMENT |
| MEDIUM | tests/test_gateway_events_watchdog_7978.py | 2190 | except Exception as exc: # noqa: BLE001 - harness reporter | CODE |
| MEDIUM⚡ | …test_6808_appearance_bootstrap_no_fabricated_choice.py | 110 | # The harness must have actually run the bootstrap: it always paints. | STRING |
| MEDIUM | tests/test_mobile_layout.py | 498 | _BOOT_JS = BOOT # alias used by the lifecycle harness | STRING |
| MEDIUM⚡ | …ts/test_issue1567_nous_picker_capacity_and_symmetry.py | 578 | # robust against minor refactors of surrounding code. | COMMENT |
| MEDIUM⚡ | tests/test_issue5960_cron_unread_profile_scope.py | 20 | # Sibling harness scaffolding lives beside this file and is not on sys.path by | COMMENT |
| MEDIUM⚡ | tests/test_issue5960_cron_unread_profile_scope.py | 21 | # default; import it the same way the other node-harness tests do. | COMMENT |
| MEDIUM | tests/_unread_store_helpers.py | 41 | # Declared from the module source so a harness cannot drift from the values the | COMMENT |
| MEDIUM | tests/_unread_store_helpers.py | 89 | # Ready to interpolate into a node harness. | COMMENT |
| MEDIUM | tests/test_issue4856_android_scroll_regression.py | 138 | # ── #4970 low-delta wheel intent: behavioral node-harness ──────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_issue4856_android_scroll_regression.py | 173 | Mirrors the #4295 harness shape but injects the #4970 helpers so we can | STRING |
| MEDIUM | tests/test_issue4856_android_scroll_regression.py | 858 | # ── Behavioral harness: execute the REAL _fixMobileScrollJank against a mock | STRING |
| MEDIUM | tests/test_pinned_tail_midstream_jitter.py | 209 | # The call is typeof-guarded so a standalone renderMessages() node harness (which does | STRING |
| MEDIUM | tests/test_7628_recovery_window_integrity.py | 122 | # ── node harness ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_issue500_message_list_virtualization.py | 108 | This deliberately reuses issue #500's proven virtualization harness instead | CODE |
| MEDIUM | tests/test_issue500_message_list_virtualization.py | 1482 | (~30% WebContent CPU, issue #6654). The queued-rAF harness drives the | CODE |
| MEDIUM | tests/test_blank_live_turn_preserve_guard.py | 182 | """#6948 browser-lifecycle equivalent in the node harness: the full | STRING |
| MEDIUM | tests/test_issue7391_first_party_edge_tts_engine.py | 155 | # explicitly or the harness hits ReferenceError. | COMMENT |
| MEDIUM | tests/test_issue7391_first_party_edge_tts_engine.py | 174 | # profile. The harness pins activeProfile='default' and the old code omitted | COMMENT |
| MEDIUM | tests/test_issue6414_programmatic_scroll_user_intent.py | 71 | // #7494: the inlined handler consults the targeting gate; this harness has no | COMMENT |
| MEDIUM | …sts/test_issue1806_named_custom_provider_resolution.py | 1653 | # Each driver composes the harness the way its consumer needs it and returns the | COMMENT |
| MEDIUM | …sts/test_issue1806_named_custom_provider_resolution.py | 4960 | # over the whole captured harness, so a leak through ANY field — bundle, error | COMMENT |
| MEDIUM⚡ | tests/test_issue5364_skills_stats_thundering_herd.py | 37 | # Import harness (mirrors tests/test_issue4783_profile_skills_mtime_cache.py) | COMMENT |
| MEDIUM⚡ | tests/test_issue4662_profile_switch_skeleton_static.py | 155 | # window. Anchoring on the next function def keeps the assertion robust. | COMMENT |
| MEDIUM⚡ | tests/test_cron_toast_notifications.py | 231 | # Node harness: drives the real startCronPolling tick with stubbed api / | COMMENT |
| MEDIUM⚡ | tests/test_extension_theme_registration.py | 113 | # ── Layer 2: behavioral (Node harness drives the real functions) ───────────── | COMMENT |
| MEDIUM | tests/test_issue3162_ensure_messages_loaded.py | 23 | # Balancing braces from the opening `{` is robust to any in-function growth. | COMMENT |
| MEDIUM | tests/test_issue1574_cron_profile_lock.py | 299 | # Use fork only for the outer test harness so this pytest module does not | COMMENT |
| MEDIUM | tests/test_optionz_liveview_perf.py | 591 | # jump). Reproduced deterministically with the controlled Playwright harness in | COMMENT |
| MEDIUM | tests/test_7318_live_title_owner.py | 60 | # node harness that drains without asserting also exits 0. | STRING |
| MEDIUM⚡ | tests/test_issue5273_active_done_viewed_sync.py | 15 | # Sibling harness scaffolding lives beside this file and is not on sys.path by | COMMENT |
| MEDIUM⚡ | tests/test_issue5273_active_done_viewed_sync.py | 16 | # default; import it the same way the other node-harness tests do. | COMMENT |
| MEDIUM⚡ | tests/test_issue2024_env_lock_skill_imports.py | 108 | # Simple string check is sufficient and more robust than AST for | COMMENT |
| LOW | tests/test_model_resolver.py | 1563 | # which would overwrite the in-memory cfg we just set up. | COMMENT |
| MEDIUM | tests/test_issue5637_stale_anchor_guard.py | 121 | # input actually advances _messageScrollInputGeneration in the harness. | COMMENT |
| MEDIUM⚡ | tests/test_v050260_docker_invariants.py | 126 | # ── 4: docs/docker.md comprehensive guide ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_cron_panel_intent_round5.py | 376 | # panel is switched after that. The harness therefore evaluates the block, then | COMMENT |
| MEDIUM | api/gateway_chat.py | 1215 | # observer (harness/test seam) is notified. | COMMENT |
| MEDIUM⚡ | api/crash_visibility.py | 102 | # Absolutely nothing a diagnostic writer may raise should propagate. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_issue3957_profile_providers_models.py | 804 | # Create a config.yaml with a custom provider that has key_env | COMMENT |
| MEDIUM⚡ | tests/test_issue1094_provider_bugs.py | 210 | # Create a fake config.yaml with a provider key | COMMENT |
| MEDIUM | tests/test_issue570_permission.py | 24 | # Create the file then make the parent unreadable so .exists() raises PermissionError | COMMENT |
| MEDIUM | tests/test_gateway_sync.py | 2798 | # Create a WebUI session with a known ID | COMMENT |
| MEDIUM | tests/test_bootstrap_foreground.py | 514 | # Create a non-executable file at the python path | COMMENT |
| MEDIUM | tests/test_v050257_opus_followups.py | 185 | # Create a fake session file | COMMENT |
| MEDIUM | tests/test_symlink_cycle_detection.py | 184 | # Create a symlink inside target that points back to workspace | COMMENT |
| MEDIUM | tests/test_session_sidecar_repair.py | 530 | # Create an agent lock | COMMENT |
| MEDIUM | tests/test_sprint14.py | 39 | # Create a file first | COMMENT |
| MEDIUM | tests/test_issue893_cancel_preserves_partial.py | 87 | # Create a session and a fake running stream | COMMENT |
| MEDIUM | tests/test_workspace_upload.py | 650 | # Create a zip with a malicious member path | COMMENT |
| MEDIUM⚡ | tests/test_sprint11.py | 87 | # Create a session with a custom model string | COMMENT |
| MEDIUM | tests/test_issue2698_isolated_hermes_home.py | 130 | # Create a few test profiles | COMMENT |
| MEDIUM⚡ | tests/test_regressions.py | 323 | # Create a session with a title so it shows in the list | COMMENT |
| MEDIUM⚡ | tests/test_session_index.py | 1496 | # Create a valid index file so the incremental path is attempted | COMMENT |
| MEDIUM | tests/test_session_index.py | 309 | # Create a new session C not in the index | COMMENT |
| MEDIUM | tests/test_media_inline.py | 1313 | # Create a session so we can use /api/file/raw | COMMENT |
| MEDIUM⚡ | tests/test_issue1195_session_profile_routing.py | 43 | # Create an existing profile directory | COMMENT |
| MEDIUM | scripts/lib/health_probe.sh | 23 | # This file is safe to `source` (defines functions only) and is also runnable | COMMENT |
| MEDIUM | .github/workflows/native-windows-startup.yml | 43 | # Create the WebUI venv. start.ps1 prefers $AgentDir\venv if it | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_7865_regate_round3.py | 442 | // Step 2: "Save Settings". The server echoes the bare form back, and | COMMENT |
| LOW⚡ | tests/test_7865_regate_round3.py | 447 | // Step 3: re-open and autosave again — the phantom-bar case. | COMMENT |
| LOW | tests/test_7865_regate_round3.py | 428 | // Step 1: open with the bare default stored, picker shows the qualified one. | COMMENT |
| LOW⚡ | tests/test_issue2914_truncation_watermark.py | 356 | # Step 4: Undo — removes "light speed" | COMMENT |
| LOW⚡ | tests/test_issue2914_truncation_watermark.py | 365 | # Step 5: New turn — agent context should NOT include "triangle" | COMMENT |
| LOW | tests/test_issue2914_truncation_watermark.py | 281 | # Step 1: Initial message "triangle" | COMMENT |
| LOW | tests/test_issue2914_truncation_watermark.py | 301 | # Step 2: Edit "triangle" → "square" (new timestamp 200) | COMMENT |
| LOW | tests/test_issue2914_truncation_watermark.py | 330 | # Step 3: New message "light speed" | COMMENT |
| LOW⚡ | tests/test_approval_unblock.py | 165 | # Step 1: streaming.py registers the notify callback | COMMENT |
| LOW⚡ | tests/test_approval_unblock.py | 170 | # Step 2: check_all_command_guards fires the callback and queues an entry | COMMENT |
| LOW⚡ | tests/test_approval_unblock.py | 187 | # Step 3: user responds via /api/approval/respond → resolve_gateway_approval | COMMENT |
| LOW⚡ | tests/test_approval_unblock.py | 191 | # Step 4: agent thread is unblocked with the correct choice | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 97 | # Step 1: Truncate (edit) — keep 2 messages (first exchange) | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 104 | # Step 2: Send new message "square" — checkpoint advances watermark | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 134 | # Step 1: Truncate (edit) — keep 2 messages (first exchange) | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 138 | # Step 2: Send new message "square" | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 145 | # Step 3: Simulate state.db containing both original and edited messages | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 155 | # Step 4: Reload from disk (simulates session switch → switch back) | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 164 | # Step 5: Merge sidecar + state.db (what GET /api/session does) | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 202 | # Step 1: Truncate (edit) — keep 2 messages | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 206 | # Step 2: Send edited message | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 211 | # Step 3: Simulate assistant reply | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 215 | # Step 4: Send second new turn | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 221 | # Step 5: Simulate state.db with all messages | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 233 | # Step 6: Reload from disk | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 241 | # Step 7: Merge | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 277 | # Step 1: Retry — truncates to before "second" | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 283 | # Step 2: Send new message | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 310 | # Step 1: Undo — removes "second" and "reply2" | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 316 | # Step 2: Send new message | COMMENT |
| LOW⚡ | tests/test_issue1633_models_cache_version_stamp.py | 369 | # Step 4: cache rejected → caller will rebuild from live provider data | COMMENT |
| LOW | tests/test_issue1633_models_cache_version_stamp.py | 351 | # Step 1: v0.50.281 writes cache | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_7865_regate_round3.py | 447 | // Step 3: re-open and autosave again — the phantom-bar case. | COMMENT |
| LOW | tests/test_7865_regate_round3.py | 428 | // Step 1: open with the bare default stored, picker shows the qualified one. | COMMENT |
| LOW⚡ | tests/test_issue2914_truncation_watermark.py | 356 | # Step 4: Undo — removes "light speed" | COMMENT |
| LOW⚡ | tests/test_issue2914_truncation_watermark.py | 365 | # Step 5: New turn — agent context should NOT include "triangle" | COMMENT |
| LOW | tests/test_issue2914_truncation_watermark.py | 281 | # Step 1: Initial message "triangle" | COMMENT |
| LOW | tests/test_issue2914_truncation_watermark.py | 301 | # Step 2: Edit "triangle" → "square" (new timestamp 200) | COMMENT |
| LOW | tests/test_issue2914_truncation_watermark.py | 330 | # Step 3: New message "light speed" | COMMENT |
| LOW⚡ | tests/test_approval_unblock.py | 165 | # Step 1: streaming.py registers the notify callback | COMMENT |
| LOW⚡ | tests/test_approval_unblock.py | 170 | # Step 2: check_all_command_guards fires the callback and queues an entry | COMMENT |
| LOW⚡ | tests/test_approval_unblock.py | 187 | # Step 3: user responds via /api/approval/respond → resolve_gateway_approval | COMMENT |
| LOW⚡ | tests/test_approval_unblock.py | 191 | # Step 4: agent thread is unblocked with the correct choice | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 97 | # Step 1: Truncate (edit) — keep 2 messages (first exchange) | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 104 | # Step 2: Send new message "square" — checkpoint advances watermark | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 134 | # Step 1: Truncate (edit) — keep 2 messages (first exchange) | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 138 | # Step 2: Send new message "square" | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 145 | # Step 3: Simulate state.db containing both original and edited messages | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 155 | # Step 4: Reload from disk (simulates session switch → switch back) | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 164 | # Step 5: Merge sidecar + state.db (what GET /api/session does) | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 202 | # Step 1: Truncate (edit) — keep 2 messages | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 206 | # Step 2: Send edited message | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 211 | # Step 3: Simulate assistant reply | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 215 | # Step 4: Send second new turn | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 221 | # Step 5: Simulate state.db with all messages | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 233 | # Step 6: Reload from disk | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 241 | # Step 7: Merge | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 277 | # Step 1: Retry — truncates to before "second" | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 283 | # Step 2: Send new message | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 310 | # Step 1: Undo — removes "second" and "reply2" | COMMENT |
| LOW⚡ | tests/test_watermark_advance_after_edit.py | 316 | # Step 2: Send new message | COMMENT |
| LOW⚡ | tests/test_issue1633_models_cache_version_stamp.py | 369 | # Step 4: cache rejected → caller will rebuild from live provider data | COMMENT |
| LOW | tests/test_issue1633_models_cache_version_stamp.py | 351 | # Step 1: v0.50.281 writes cache | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/test_session_unread_dot_on_visit.py | 38 | # Sibling harness scaffolding lives beside this file and is not on sys.path by | COMMENT |
| MEDIUM⚡ | tests/test_issue5960_cron_unread_profile_scope.py | 20 | # Sibling harness scaffolding lives beside this file and is not on sys.path by | COMMENT |
| MEDIUM | tests/test_issue3831_watermark_clear.py | 148 | # --- The guardrails: the fix must NOT regress #2914/#3102 --------------------- | COMMENT |
| MEDIUM | tests/test_pr1341_context_window_persistence.py | 33 | # Find the post-merge save block — anchored on the unique reasoning trace | COMMENT |
| MEDIUM | tests/test_tool_limit_terminal_state.py | 760 | # Synthetic scaffolding turn was still dropped, even after fallback injection. | COMMENT |
| MEDIUM⚡ | tests/test_issue5273_active_done_viewed_sync.py | 15 | # Sibling harness scaffolding lives beside this file and is not on sys.path by | COMMENT |
| MEDIUM | tests/test_issue5334_verification_stop_leak.py | 105 | # No leftover synthetic scaffolding rows. | COMMENT |
| MEDIUM | tests/test_1003_preferences_autosave.py | 86 | # We use a context window around the dom_id to find the listener. | COMMENT |
| MEDIUM | docs/rfcs/stable-assistant-turn-anchors.md | 860 | ### Phase 1: Internal anchor scaffold | COMMENT |
| MEDIUM | …cs/architecture/stable-assistant-turn-anchor-phase0.md | 15 | - The #3962 Phase 0 scaffold shipped through #3977 / v0.51.359: inventory the | CODE |
| MEDIUM | api/config.py | 12079 | # agent token stream), an OOM risk with many tabs × long agentic turns. This | COMMENT |
| MEDIUM | api/config.py | 12336 | STREAM_REASONING_TEXT: dict = {} # stream_id -> reasoning trace accumulated during streaming (#1361 §A) | CODE |
| MEDIUM | api/streaming.py | 2125 | # Structured markers the Hermes Agent stamps on synthetic scaffolding turns that | COMMENT |
| MEDIUM | api/streaming.py | 2897 | # synthetic-scaffolding flag convention already used elsewhere (#5334). | COMMENT |
| MEDIUM | api/streaming.py | 4585 | # Guard against chain-of-thought leakage, meta-reasoning, and trivial echo. | COMMENT |
| MEDIUM | api/streaming.py | 4952 | # agentic first-turn plans that are legitimate title candidates. | COMMENT |
| MEDIUM | api/streaming.py | 8986 | # Drop Hermes Agent internal verify-loop scaffolding (synthetic "premature | COMMENT |
| MEDIUM | api/streaming.py | 14550 | # Persist reasoning trace in the session so it survives reload. | COMMENT |
| MEDIUM | api/streaming.py | 14604 | # Persist context window data on the session so the context-ring | COMMENT |
| MEDIUM | api/streaming.py | 14606 | # s.save() for the same reason as the reasoning trace above. | COMMENT |
| MEDIUM | api/streaming.py | 14992 | # Include context window data from the agent's compressor for the UI indicator. | COMMENT |
| MEDIUM | api/streaming.py | 15054 | # resolve the model's context window from metadata so the UI indicator | COMMENT |
| MEDIUM | api/streaming.py | 15119 | # (reasoning trace already attached + saved above, before s.save()) | COMMENT |
| MEDIUM | api/streaming.py | 16376 | # Capture reasoning trace and live tool calls (#1361 §A + §B) | COMMENT |
| MEDIUM | api/streaming.py | 16590 | # #1361: Also persist reasoning trace and live tool calls that were | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server.py | 108 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | tests/test_auth_password_hash_cache.py | 65 | def _set_env_pw(self, pw: str) -> None: | CODE |
| LOW | tests/test_auth_password_hash_cache.py | 178 | def _set_env_pw(self, pw: str) -> None: | CODE |
| LOW | api/plugins.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/auth.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/auth.py | 1293 | def set_auth_cookie(handler, cookie_value) -> None: | CODE |
| LOW | api/process_event_utils.py | 14 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/session_lifecycle.py | 41 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/config.py | 117 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/config.py | 12869 | def update_active_run(stream_id: str, **metadata) -> None: | CODE |
| LOW | api/plugin_providers.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/models.py | 52 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/terminal.py | 39 | def _set_nonblocking(fd: int) -> None: | CODE |
| LOW | api/terminal.py | 386 | def _set_size(term: TerminalSession, rows: int, cols: int) -> None: | CODE |
| LOW | api/goals.py | 12 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/agent_sessions.py | 11 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/onboarding.py | 35 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/updates.py | 41 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/background_process.py | 64 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | api/compression_continuation.py | 10 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/metering.py | 100 | def set_pending_started_at(self, stream_id: str, pending_started_at) -> None: | CODE |
| LOW | api/background.py | 9 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/auth_oidc.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/skill_usage.py | 9 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/gateway_chat.py | 45 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/gateway_chat.py | 1824 | def _settle_gateway_cancelled_turn(session_id, stream_id) -> None: | CODE |
| LOW | api/rollback.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/session_ops.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/session_events.py | 7 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/todo_state.py | 53 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/mcp_runtime.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/route_approvals.py | 150 | def set_session_yolo_enabled(session_key: str, enabled: bool) -> None: | CODE |
| LOW | api/route_approvals.py | 526 | def _settle_gateway_entry(entry, choice: str, reason: str | None = None) -> None: | CODE |
| LOW | api/providers.py | 59 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/session_recovery.py | 45 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/workspace_git.py | 33 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/crash_visibility.py | 50 | __all__ = [ | CODE |
| LOW | api/gateway_watcher.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | api/workspace.py | 708 | def set_last_workspace(path: str, profile: str | Path | None = None) -> None: | CODE |
| LOW | api/workspace.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/streaming.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/helpers.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/gateway_restart.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/commands.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | api/profiles.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/profiles.py | 505 | def set_request_profile(name: str) -> None: | CODE |
| LOW | api/shares.py | 36 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/state_sync.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/oauth.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/oauth.py | 668 | def _set_flow_status(flow_id: str, status: str, **fields: Any) -> None: | CODE |
| LOW | api/worktrees.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | api/dashboard_probe.py | 17 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_issue3957_profile_providers_models.py | 674 | return "fake_token" | CODE |
| LOW | tests/test_issue3957_profile_providers_models.py | 727 | return "fake_token" | CODE |
| LOW | tests/test_issue7056_login_hides_password_form.py | 148 | "placeholder": "Password", | CODE |
| LOW | tests/test_pr7555_cli_session_availability.py | 882 | db.write_text("placeholder", encoding="utf-8") | CODE |
| LOW⚡ | tests/test_auth_sessions.py | 39 | auth._sessions["fake_token"] = time.time() - 100 | CODE |
| LOW⚡ | tests/test_auth_sessions.py | 49 | auth.verify_session("fake_token.fake_sig") | CODE |
| LOW⚡ | tests/test_auth_sessions.py | 54 | self.assertNotIn("fake_token", auth._sessions) | CODE |
| LOW⚡ | tests/_layout_helpers.py | 290 | var RAW_ATTRS = ["title", "aria-label", "placeholder"] | CODE |
| LOW | tests/test_runtime_model_observation.py | 47 | writer.append_sse_event("runtime_model", malformed if malformed is not None else {"placeholder": True}) | CODE |
| LOW | tests/test_issue3825_oidc_auth.py | 307 | "allow_values": ["user@example.com"], | CODE |
| LOW | tests/test_issue3825_oidc_auth.py | 404 | "allow_values": ["user@example.com"], | CODE |
| LOW | tests/test_issue2271_keyless_custom_provider.py | 18 | assert api_key == "dummy-key" | CODE |
| LOW | tests/test_issue2271_keyless_custom_provider.py | 54 | assert api_key == "dummy-key" | CODE |
| LOW | tests/test_sprint46.py | 73 | "api_key": "fake-key", | CODE |
| LOW | tests/test_sprint46.py | 98 | "api_key": "fake-key", | CODE |
| LOW | tests/test_mobile_scroll_jank.html | 166 | addMessage(role,`Message ${i+1}: `+'Lorem ipsum dolor sit amet consectetur adipiscing elit. '.repeat(3)); | CODE |
| LOW | tests/test_mobile_scroll_jank.html | 166 | addMessage(role,`Message ${i+1}: `+'Lorem ipsum dolor sit amet consectetur adipiscing elit. '.repeat(3)); | CODE |
| LOW | tests/test_login_locale_parity.py | 221 | "placeholder", | CODE |
| LOW | tests/test_issue4836_manual_compression_recovery.py | 61 | "api_key": "fake-key", | CODE |
| LOW | tests/test_issue4836_manual_compression_recovery.py | 86 | "api_key": "fake-key", | CODE |
| LOW | tests/test_issue5331_index_only_ghost_cleanup.py | 144 | routes.SESSIONS["sess-mem"] = "placeholder" | CODE |
| LOW | tests/test_issue5331_index_only_ghost_cleanup.py | 168 | routes.SESSIONS["sess-3"] = "placeholder" | CODE |
| LOW⚡ | …sts/test_issue1806_named_custom_provider_resolution.py | 2101 | # The second half of the same contract is ``dummy-key``. It asserts "this | COMMENT |
| LOW | …sts/test_issue1806_named_custom_provider_resolution.py | 1075 | # The same distinction gates ``dummy-key``: it is a statement that the endpoint | COMMENT |
| LOW⚡ | …sts/test_issue1806_named_custom_provider_resolution.py | 1281 | endpoint ``dummy-key`` instead — because the row carries no literal | STRING |
| LOW⚡ | …sts/test_issue1806_named_custom_provider_resolution.py | 1358 | rotation at the previous authority; falling back to ``dummy-key`` drops the | STRING |
| LOW | …sts/test_issue1806_named_custom_provider_resolution.py | 1315 | """(b) ``dummy-key`` asserts "this endpoint is unauthenticated" — never a guess. | STRING |
| LOW | …sts/test_issue1806_named_custom_provider_resolution.py | 2153 | ``dummy-key``. | STRING |
| LOW | …sts/test_issue1806_named_custom_provider_resolution.py | 2360 | that as keyless is what let ``dummy-key`` be substituted for a genuinely | STRING |
| LOW | …sts/test_issue1806_named_custom_provider_resolution.py | 2414 | """The negative control: a genuinely unauthenticated endpoint keeps ``dummy-key``. | STRING |
| LOW | …sts/test_issue1806_named_custom_provider_resolution.py | 2558 | is unauthenticated. ``dummy-key`` follows from the row, not from the keyed | STRING |
| LOW | …sts/test_issue1806_named_custom_provider_resolution.py | 2950 | so no ``dummy-key`` is substituted and the pair stays incomplete — and an | STRING |
| LOW⚡ | tests/test_redact_large_string_cache.py | 52 | unit = "lorem ipsum dolor sit amet " | CODE |
| LOW⚡ | tests/test_redact_large_string_cache.py | 52 | unit = "lorem ipsum dolor sit amet " | CODE |
| LOW | tests/test_redact_large_string_cache.py | 123 | text = ("see https://example.invalid/docs lorem ipsum " * 500) + _RUNTIME_TOKEN + " tail" | CODE |
| LOW⚡ | tests/test_compression_phantom_barrier.py | 242 | assert before["placeholder"] == "Type a message — it will queue and send after compression" | STRING |
| LOW⚡ | tests/test_compression_phantom_barrier.py | 251 | "placeholder": "Original placeholder", | STRING |
| LOW | tests/test_sensitive_prefilter_equivalence.py | 107 | "https", "http", "user@example.com", "1234567890", | CODE |
| LOW | tests/test_update_banner_fixes.py | 1696 | 'api_key': 'fake-key', | CODE |
| LOW | tests/test_issue540_workspace_office_documents.py | 323 | preview_office_document("budget.xlsx", b"placeholder") | CODE |
| LOW | tests/test_issue540_workspace_office_documents.py | 406 | preview = preview_office_document("budget.xlsx", b"placeholder") | CODE |
| LOW | api/config.py | 4016 | KEYLESS_CUSTOM_API_KEY = "dummy-key" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_session_middle_click_new_tab.py | 612 | CODE | |
| LOW | tests/test_auto_compression_terminal_failure.py | 58 | CODE | |
| LOW | tests/test_auto_compression_terminal_failure.py | 356 | CODE | |
| LOW | tests/test_scroll_collapse_clamp_keeps_follow.py | 52 | CODE | |
| LOW | tests/test_gateway_sync.py | 125 | CODE | |
| LOW | tests/test_gateway_sync.py | 169 | CODE | |
| LOW | tests/test_6710_panel_dismiss_and_artifact_open.py | 234 | CODE | |
| LOW | tests/test_issue7396_key_cmd_cache.py | 97 | CODE | |
| LOW | tests/test_sprint42.py | 201 | CODE | |
| LOW | tests/test_sprint42.py | 294 | CODE | |
| LOW | tests/test_sprint42.py | 686 | CODE | |
| LOW | tests/test_sprint42.py | 1055 | CODE | |
| LOW | tests/test_issue3895_opencode_go_model_picker.py | 114 | CODE | |
| LOW | tests/test_session_lineage_metadata_api.py | 85 | CODE | |
| LOW | tests/test_issue1857_usage_overwrite.py | 80 | CODE | |
| LOW | tests/test_issue_progress_echo_dedupe.py | 76 | CODE | |
| LOW | tests/test_issue_progress_echo_dedupe.py | 244 | CODE | |
| LOW | tests/test_issue_progress_echo_dedupe.py | 426 | CODE | |
| LOW | …sts/test_issue1806_named_custom_provider_resolution.py | 510 | CODE | |
| LOW | …sts/test_issue1806_named_custom_provider_resolution.py | 1583 | CODE | |
| LOW | tests/test_issue4251_wakeup_model_picker_race.py | 54 | CODE | |
| LOW | tests/test_tool_limit_terminal_state.py | 18 | CODE | |
| LOW | tests/test_native_image_turn_display_context.py | 62 | CODE | |
| LOW | tests/test_settlement_agent_reasoning_authoritative.py | 117 | CODE | |
| LOW | tests/test_settlement_agent_reasoning_authoritative.py | 159 | CODE | |
| LOW | tests/test_issue5637_stale_anchor_guard.py | 368 | CODE | |
| LOW | tests/test_model_alias_routes.py | 937 | CODE | |
| LOW | api/models.py | 9302 | CODE | |
| LOW | api/models.py | 1463 | CODE | |
| LOW | api/gateway_chat.py | 1928 | CODE | |
| LOW | api/runtime_adapter.py | 314 | CODE | |
| LOW | api/workspace_git.py | 180 | CODE | |
| LOW | api/route_session_list_cache.py | 324 | CODE | |
| LOW | api/streaming.py | 10955 | CODE | |
| LOW | api/state_sync.py | 268 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_onboarding_mvp.py | 18 | # Check if pyyaml is available — onboarding setup tests need it on the server | COMMENT |
| LOW | tests/test_sprint42.py | 828 | # Check if this try imports hermes_state | COMMENT |
| LOW | tests/test_issue1139_password_remote.py | 75 | # Check if pane has any input fields (not just buttons) | COMMENT |
| LOW | tests/test_sprint15.py | 137 | # Assign session to project | COMMENT |
| LOW | tests/test_session_batch_select.py | 190 | # Check if the key exists in the locale block | COMMENT |
| LOW⚡ | api/config.py | 934 | # Check if session store is empty | COMMENT |
| LOW⚡ | api/config.py | 944 | # Check if SESSION_INDEX_FILE is absent, empty, or contains only {}|[]|null | COMMENT |
| LOW | api/config.py | 10395 | # Check if user has configured models in config.yaml — | COMMENT |
| LOW | api/providers.py | 2602 | # Check if actually authenticated via hermes_cli. | COMMENT |
| LOW | api/streaming.py | 4541 | # Check if contains any function_calls/DSML marker (case-insensitive) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_issue3293_title_language_drift.py | 255 | # Japanese title for an English conversation would be generated as requested | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_gateway_events_watchdog_7978.py | 353 | CODE |