82.0

Adjusted Signal

82.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

19.3K

Stars

Python

Language

828.9K

Lines of Code

2.1K

Files

34.9K

Pattern Hits

2026-10-31

Scan Date

3.41

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 70.7/100 · HIGH

Can maintainers explain intent, assumptions, and trade-offs? 22818 finding(s).

Hallucinated Dependency & Supply Chain Risk 87.5/100 · CRITICAL

Are imports declared and package/API names verified? 7190 finding(s).

Agent Over-Engineering Ratio 85.5/100 · CRITICAL

Are wrappers, guards, and repeated structures necessary? 26117 finding(s).

PR Review Velocity Impact 99.0/100 · CRITICAL

Which changes need focused human review? 34909 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 7057MEDIUM 2710LOW 25142

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 34909 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Cross-Language Confusion6320 hits · 33778 pts

Severity	File	Line	Snippet	Context
HIGH	tests/test_session_batch_delete_partial.py	38	while (depth > 0 && i < src.length) {	CODE
HIGH⚡	tests/test_session_batch_delete_partial.py	52	const $ = () => null;	CODE
HIGH⚡	tests/test_session_batch_delete_partial.py	54	function showToast(msg, ms, kind) { calls.toasts.push({ msg, kind: kind \|\| null }); }	CODE
HIGH⚡	tests/test_session_batch_delete_partial.py	54	function showToast(msg, ms, kind) { calls.toasts.push({ msg, kind: kind \|\| null }); }	CODE
HIGH⚡	tests/test_session_batch_delete_partial.py	54	function showToast(msg, ms, kind) { calls.toasts.push({ msg, kind: kind \|\| null }); }	CODE
HIGH⚡	tests/test_session_batch_delete_partial.py	56	function _readComposerModelPick() { return null; }	CODE
HIGH⚡	tests/test_session_batch_delete_partial.py	59	function _forgetComposerDraftLocalFallback(sid) { calls.drafts.push(sid); }	CODE
HIGH⚡	tests/test_session_batch_delete_partial.py	61	function _clearHandoffStorageForSession(sid) { calls.handoff.push(sid); }	CODE
HIGH⚡	tests/test_session_batch_delete_partial.py	67	async function loadSession(sid) { calls.loaded.push(sid); }	CODE
HIGH	tests/test_session_batch_delete_partial.py	91	active: S.session && S.session.session_id,	CODE
HIGH	tests/test_session_batch_delete_partial.py	96	process.stderr.write(String((e && e.stack) \|\| e));	CODE
HIGH⚡	tests/test_real_steer.py	593	appendChild(child){{this.children.push(child);}},	CODE
HIGH⚡	tests/test_real_steer.py	596	querySelector(sel){{return null;}},	CODE
HIGH⚡	tests/test_real_steer.py	601	getElementById(id){{return id==='msgInner'?inner:null;}},	CODE
HIGH⚡	tests/test_real_steer.py	608	function showToast(key){{if(globalThis.__toasts)globalThis.__toasts.push(key);}}	CODE
HIGH⚡	tests/test_real_steer.py	612	function _clearComposerDraft(sid,text,files){{if(globalThis.__draftClears)globalThis.__draftClears.push({{si	CODE
HIGH⚡	tests/test_real_steer.py	621	let sendInput = null;	CODE
HIGH⚡	tests/test_real_steer.py	622	let sendOptions = null;	CODE
HIGH⚡	tests/test_real_steer.py	623	let apiPayload = null;	CODE
HIGH⚡	tests/test_real_steer.py	633	globalThis.clearInflightState = sid => clearInflightCalls.push(sid);	CODE
HIGH⚡	tests/test_real_steer.py	732	globalThis.clearInflightState = sid => clearInflightCalls.push(sid);	CODE
HIGH⚡	tests/test_real_steer.py	734	globalThis.queueSessionMessage = (sid, payload) => queued.push({{sid, payload}});	CODE
HIGH⚡	tests/test_real_steer.py	735	globalThis.updateQueueBadge = sid => queueBadges.push(sid);	CODE
HIGH⚡	tests/test_real_steer.py	921	function $(id) { return null; }	CODE
HIGH⚡	tests/test_real_steer.py	929	function showToast(key) { toasts.push(key); }	CODE
HIGH⚡	tests/test_real_steer.py	936	saveCalls.push({sid, text, files: (Array.isArray(files)?files.filter(Boolean):[])});	CODE
HIGH⚡	tests/test_real_steer.py	949	const draft = S.session && S.session.composer_draft ? S.session.composer_draft : null;	CODE
HIGH⚡	tests/test_real_steer.py	949	const draft = S.session && S.session.composer_draft ? S.session.composer_draft : null;	CODE
HIGH⚡	tests/test_real_steer.py	958	activeSessionStream: S.session && S.session.active_stream_id,	CODE
HIGH⚡	tests/test_real_steer.py	960	})().catch(err => { console.log(JSON.stringify({error: String(err && err.message \|\| err \|\| 'failure')})); })	CODE
HIGH⚡	tests/test_real_steer.py	960	})().catch(err => { console.log(JSON.stringify({error: String(err && err.message \|\| err \|\| 'failure')})); })	CODE
HIGH⚡	tests/test_real_steer.py	1082	_uploadPendingFilesUpdateProgress('A', null);	CODE
HIGH⚡	tests/test_real_steer.py	1085	assert.strictEqual(barWrap.dataset.uploadSessionId, undefined);	CODE
HIGH	tests/test_real_steer.py	363	assert "const ownerSid=(typeof S!=='undefined'&&S.session&&S.session.session_id)\|\|null;" in body	CODE
HIGH	tests/test_real_steer.py	424	let apiPayload = null;	CODE
HIGH	tests/test_real_steer.py	425	let indicatorText = null;	CODE
HIGH	tests/test_real_steer.py	473	let apiPayload = null;	CODE
HIGH	tests/test_real_steer.py	474	let indicatorText = null;	CODE
HIGH	tests/test_real_steer.py	521	let uploadOptions = null;	CODE
HIGH	tests/test_real_steer.py	522	let apiPayload = null;	CODE
HIGH	tests/test_real_steer.py	533	function _clearComposerDraft(sid,text,files){{draftClears.push({{sid,text,files}});}}	CODE
HIGH	tests/test_real_steer.py	646	assert.strictEqual(S.activeStreamId, null);	CODE
HIGH	tests/test_real_steer.py	647	assert.strictEqual(S.session.active_stream_id, null);	CODE
HIGH	tests/test_real_steer.py	669	let apiPayload = null;	CODE
HIGH	tests/test_real_steer.py	679	globalThis.clearInflightState = sid => clearInflightCalls.push(sid);	CODE
HIGH	tests/test_real_steer.py	721	let apiPayload = null;	CODE
HIGH	tests/test_real_steer.py	800	globalThis.clearInflightState = sid => clearInflightCalls.push(sid);	CODE
HIGH	tests/test_real_steer.py	834	globalThis.clearInflightState = sid => clearInflightCalls.push(sid);	CODE
HIGH	tests/test_real_steer.py	1058	return null;	CODE
HIGH	tests/test_real_steer.py	1070	assert.strictEqual(barWrap.dataset.uploadSessionId, undefined);	CODE
HIGH	tests/test_real_steer.py	1021	assert "_uploadPendingFilesUpdateProgress(sessionId,null)" in upload_body	STRING
HIGH⚡	tests/test_project_bindings_uigate_1008.py	87	globalThis.S = { activeProfile: 'default', session: null };	CODE
HIGH⚡	tests/test_sidebar_tab_visibility.py	104	: null;	STRING
HIGH⚡	tests/test_sidebar_tab_visibility.py	110	this.children.push(child);	STRING
HIGH⚡	tests/test_sidebar_tab_visibility.py	113	querySelector: () => null,	STRING
HIGH⚡	tests/test_sidebar_tab_visibility.py	147	_store: Object.create(null),	STRING
HIGH⚡	tests/test_sidebar_tab_visibility.py	149	return Object.prototype.hasOwnProperty.call(this._store, k) ? this._store[k] : null;	STRING
HIGH⚡	tests/test_sidebar_tab_visibility.py	157	querySelector: () => null,	STRING
HIGH⚡	tests/test_sidebar_tab_visibility.py	161	global.$ = (id) => registry[id] \|\| null;	STRING
HIGH⚡	tests/test_sidebar_tab_visibility.py	171	apiCalls.push({ url: String(url), method: (opts.method \|\| 'GET').toUpperCase(), body: opts.body \|\| '' });	STRING
6260 more matches not shown…

Hyper-Verbose Identifiers21174 hits · 18943 pts

Severity	File	Line	Snippet	Context
LOW	bootstrap.py	102	def ensure_supported_platform() -> None:	CODE
LOW	bootstrap.py	114	def _agent_dir_from_hermes_cli() -> Path \| None:	CODE
LOW	bootstrap.py	169	def _python_can_run_webui_and_agent(python_exe: str, agent_dir: Path \| None = None) -> bool:	CODE
LOW	bootstrap.py	196	def ensure_python_has_webui_deps(python_exe: str, agent_dir: Path \| None = None) -> str:	CODE
LOW	bootstrap.py	512	def _is_real_supervisor_value(name: str, value: str) -> bool:	CODE
LOW⚡	server.py	206	def _drain_request_input_nonblocking(self, request) -> None:	CODE
LOW⚡	server.py	259	def _reject_overflow_request_worker(self, request) -> None:	CODE
LOW	server.py	68	def _blocked_create_connection(address, a, *kw):	CODE
LOW	server.py	541	def _abort_if_already_serving(host: str, port: int) -> None:	CODE
LOW	tests/test_session_batch_delete_partial.py	116	def test_mixed_batch_delete_finishes_the_committed_ones(tmp_path):	STRING
LOW	tests/test_session_batch_delete_partial.py	137	def test_full_success_batch_delete_clears_selection(tmp_path):	STRING
LOW	tests/test_session_batch_delete_partial.py	147	def test_refusal_codes_map_to_user_facing_messages(tmp_path):	STRING
LOW	tests/test_session_events_http_integration.py	61	def test_session_events_bus_subscribe_unsubscribe_balance():	CODE
LOW	tests/test_session_events_http_integration.py	82	def test_session_events_sse_endpoint_handshake_succeeds(cleanup_test_sessions):	CODE
LOW	tests/test_session_events_http_integration.py	149	def test_session_events_sse_endpoint_survives_rapid_disconnect():	CODE
LOW	tests/test_session_events_http_integration.py	182	def test_session_events_handler_uses_disconnect_safe_errors_tuple():	CODE
LOW	tests/test_moa_virtual_provider_single_fanout.py	87	def test_virtual_moa_session_never_stacks_per_turn_moa_config(monkeypatch, tmp_path, body_extra):	CODE
LOW	tests/test_moa_virtual_provider_single_fanout.py	102	def test_legacy_agent_moa_session_keeps_per_turn_moa_config(monkeypatch, tmp_path):	CODE
LOW	tests/test_moa_virtual_provider_single_fanout.py	112	def test_slash_moa_on_regular_session_still_gets_moa_config(monkeypatch, tmp_path):	CODE
LOW	tests/test_moa_virtual_provider_single_fanout.py	127	def test_agent_has_moa_virtual_provider_probe(monkeypatch):	CODE
LOW⚡	tests/test_issues_907_908_909_model_dropdown.py	98	def test_get_label_for_model_helper_exists(self):	CODE
LOW⚡	tests/test_issues_907_908_909_model_dropdown.py	104	def test_label_helper_capitalizes_bare_id(self):	CODE
LOW⚡	tests/test_issues_907_908_909_model_dropdown.py	113	def test_label_helper_uses_catalog_when_available(self):	CODE
LOW	tests/test_issues_907_908_909_model_dropdown.py	125	def test_label_helper_strips_at_prefix_for_lookup(self):	CODE
LOW	tests/test_issues_907_908_909_model_dropdown.py	138	def test_config_uses_label_helper_not_raw_split(self):	CODE
LOW⚡	tests/test_real_steer.py	321	def test_cmd_steer_calls_endpoint(self):	CODE
LOW⚡	tests/test_real_steer.py	328	def test_try_steer_calls_endpoint(self):	CODE
LOW⚡	tests/test_real_steer.py	335	def test_try_steer_handles_fallback_without_cancelling(self):	CODE
LOW⚡	tests/test_real_steer.py	345	def test_send_busy_steer_uses_try_steer(self):	CODE
LOW⚡	tests/test_real_steer.py	352	def test_try_steer_uploads_pending_files_without_clearing_until_accepted(self):	CODE
LOW⚡	tests/test_real_steer.py	1109	def test_cmd_steer_delivered_in_all_locales(self):	CODE
LOW⚡	tests/test_real_steer.py	1115	def test_steer_leftover_queued_in_all_locales(self):	CODE
LOW⚡	tests/test_real_steer.py	1128	def test_leftover_drain_call_in_streaming(self):	CODE
LOW⚡	tests/test_real_steer.py	1138	def test_leftover_drain_runs_before_done_event(self):	CODE
LOW	tests/test_real_steer.py	104	def test_accepts_when_agent_cached_and_running(self, _clear_caches, monkeypatch):	CODE
LOW	tests/test_real_steer.py	151	def test_gateway_owned_stream_without_cached_agent_queues_fallback(self, _clear_caches, monkeypatch):	CODE
LOW	tests/test_real_steer.py	177	def test_agent_lacks_steer_method(self, _clear_caches):	CODE
LOW	tests/test_real_steer.py	292	def test_empty_text_after_strip(self, _clear_caches):	CODE
LOW	tests/test_real_steer.py	373	def test_file_steer_does_not_read_live_session_after_upload_await(self):	CODE
LOW	tests/test_real_steer.py	388	def test_file_steer_upload_status_and_indicator_are_owner_scoped(self):	CODE
LOW	tests/test_real_steer.py	404	def test_file_steer_indicator_omits_attachment_tool_note(self):	CODE
LOW	tests/test_real_steer.py	787	async function runLateDeadFallbackDoesNotClearNewStream(){{	CODE
LOW⚡	tests/test_real_steer.py	983	def test_send_busy_steer_accepts_file_only_input(self):	STRING
LOW⚡	tests/test_real_steer.py	992	def test_upload_pending_files_can_preserve_staged_files_for_steer(self):	STRING
LOW⚡	tests/test_real_steer.py	1002	def test_upload_pending_files_progress_bar_is_session_scoped(self):	STRING
LOW⚡	tests/test_real_steer.py	1090	def test_pending_steer_leftover_listener(self):	STRING
LOW	tests/test_real_steer.py	453	def test_attachment_only_steer_indicator_uses_file_label(self):	STRING
LOW	tests/test_real_steer.py	501	def test_file_steer_targets_captured_session_when_user_switches_mid_upload(self):	STRING
LOW	tests/test_real_steer.py	566	def test_dead_steer_fallback_clears_busy_state_and_recovery_sends_normally(self):	STRING
LOW	tests/test_real_steer.py	869	def test_old_owner_steer_recovery_persistence_rejection_is_consumed(self):	STRING
LOW	tests/test_real_steer.py	1025	def test_upload_progress_bar_hides_on_switch_and_reappears_on_owner_return(self):	STRING
LOW⚡	tests/test_issue4842_cli_sessions_streaming_freeze.py	30	def test_freeze_marker_none_when_idle(monkeypatch):	CODE
LOW⚡	tests/test_issue4842_cli_sessions_streaming_freeze.py	35	def test_freeze_marker_stable_for_same_streams(monkeypatch):	CODE
LOW⚡	tests/test_issue4842_cli_sessions_streaming_freeze.py	45	def test_freeze_marker_changes_when_stream_set_changes(monkeypatch):	CODE
LOW⚡	tests/test_issue4842_cli_sessions_streaming_freeze.py	55	def test_cache_key_stable_across_message_writes_while_streaming(monkeypatch, tmp_path):	CODE
LOW	tests/test_issue4842_cli_sessions_streaming_freeze.py	91	def test_streaming_ttl_wider_than_idle(monkeypatch):	CODE
LOW	tests/test_issue4842_cli_sessions_streaming_freeze.py	102	def test_structural_change_listener_clears_cli_cache(monkeypatch):	CODE
LOW	tests/test_issue697_mcp_tool_inventory.py	34	def test_endpoint_returns_sanitized_registered_mcp_tools(self, mock_home, mock_cfg, mock_runtime):	CODE
LOW	tests/test_issue697_mcp_tool_inventory.py	83	def test_schema_summary_uses_parameter_names_types_required_and_descriptions_only(self):	CODE
LOW	tests/test_issue697_mcp_tool_inventory.py	97	def test_tool_summary_rejects_non_dict_schema_and_redacts_description(self):	CODE
21114 more matches not shown…

Decorative Section Separators2463 hits · 8332 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker_init.bash	530	# ── Rebuilding the agent venv without ever losing a working one (#8113) ─────	COMMENT
MEDIUM⚡	mcp_server.py	41	# ── Ensure the repo root is on sys.path so api.* imports work ─────────────	COMMENT
MEDIUM⚡	mcp_server.py	46	# ── CLI: optional --profile override ──────────────────────────────────────	COMMENT
MEDIUM⚡	mcp_server.py	53	# ── Import webui canonical modules (after path setup) ─────────────────────	COMMENT
MEDIUM⚡	mcp_server.py	195	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	mcp_server.py	197	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	mcp_server.py	388	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	mcp_server.py	390	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	mcp_server.py	66	# ── API auth state ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcp_server.py	79	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	mcp_server.py	81	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	mcp_server.py	120	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	mcp_server.py	122	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	mcp_server.py	248	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	mcp_server.py	250	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	mcp_server.py	450	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	mcp_server.py	452	# ═════════════════════════════════════════════════════════════════════════==	COMMENT
MEDIUM	mcp_server.py	467	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	mcp_server.py	469	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	tests/test_issues_907_908_909_model_dropdown.py	10	# ── #907: Normalized dedup in _addLiveModelsToSelect ─────────────────────────	COMMENT
MEDIUM	tests/test_issues_907_908_909_model_dropdown.py	67	# ── #908: window._defaultModel updated on settings save ─────────────────────	COMMENT
MEDIUM⚡	tests/test_issues_907_908_909_model_dropdown.py	93	# ── #909: Injected default model label quality ───────────────────────────────	COMMENT
MEDIUM⚡	tests/test_real_steer.py	1100	# ── i18n keys ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/test_real_steer.py	1122	# ── Leftover SSE delivery: streaming.py emits pending_steer_leftover ─────	COMMENT
MEDIUM	tests/test_real_steer.py	99	# ── Backend: the /api/chat/steer endpoint ─────────────────────────────────	COMMENT
MEDIUM	tests/test_real_steer.py	299	# ── Routing ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_real_steer.py	310	# ── Frontend: cmdSteer + busy-mode steer use the new endpoint ────────────	COMMENT
MEDIUM⚡	tests/test_workspace_blocked_roots_macos.py	36	# ── Blocked-roots set includes both literal and resolved forms ──────────────	COMMENT
MEDIUM⚡	tests/test_workspace_blocked_roots_macos.py	55	# ── /etc is rejected on both Linux and macOS ────────────────────────────────	COMMENT
MEDIUM⚡	tests/test_workspace_blocked_roots_macos.py	76	# ── /var is selectively blocked (system parts) but tmp carve-outs work ──────	COMMENT
MEDIUM⚡	tests/test_workspace_blocked_roots_macos.py	111	# ── Carve-out invariants ───────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/test_workspace_blocked_roots_macos.py	130	# ── Other roots: literal == resolved on both platforms ─────────────────────	COMMENT
MEDIUM	tests/test_workspace_blocked_roots_macos.py	155	# ── New macOS-specific blocked roots: /System and /Library ──────────────────	COMMENT
MEDIUM	tests/test_v050255_opus_followups.py	37	# ── 1: rollback checkpoint id validation ─────────────────────────────────────	COMMENT
MEDIUM	tests/test_v050255_opus_followups.py	94	# ── 2: redact_session_data settings.json read-once optimization ──────────────	COMMENT
MEDIUM	tests/test_v050255_opus_followups.py	164	# ── 3: voice mode session-id capture ─────────────────────────────────────────	COMMENT
MEDIUM	tests/test_v050255_opus_followups.py	205	# ── 4: rollback _inspect_checkpoint except tuple ─────────────────────────────	COMMENT
MEDIUM⚡	tests/test_project_bindings_uigate_1008.py	81	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/test_project_bindings_uigate_1008.py	83	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/test_project_bindings_uigate_1008.py	150	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/test_project_bindings_uigate_1008.py	152	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/test_project_bindings_uigate_1008.py	194	# ---------------------------------------------------------------------------	STRING
MEDIUM⚡	tests/test_project_bindings_uigate_1008.py	196	# ---------------------------------------------------------------------------	STRING
MEDIUM	tests/test_project_bindings_uigate_1008.py	213	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_project_bindings_uigate_1008.py	215	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_extension_sidecar_proxy.py	1016	# ── token-v1 proxy auth (§9.1/§9.2) ─────────────────────────────────────────	COMMENT
MEDIUM	tests/test_issue2565_reasoning_accumulation.py	27	# ── Issue 1: live reasoning segment reset at turn boundaries ─────────────────	COMMENT
MEDIUM⚡	tests/test_issue2565_reasoning_accumulation.py	90	# ── Issue 2: reasoning metadata renders as Worklog Thinking Card ─────────────	COMMENT
MEDIUM⚡	tests/test_issue2565_reasoning_accumulation.py	130	# ── Cross-cutting: done event still has the persist-on-done guard ────────────	COMMENT
MEDIUM	tests/test_resolve_model_provider_free_suffix.py	22	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_resolve_model_provider_free_suffix.py	25	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/test_resolve_model_provider_free_suffix.py	38	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/test_resolve_model_provider_free_suffix.py	40	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/test_resolve_model_provider_free_suffix.py	118	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_resolve_model_provider_free_suffix.py	133	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/test_issue8517_shared_provider_instance.py	217	# ── GREEN before and after: no behaviour change for these users ─────────────	COMMENT
MEDIUM	tests/test_issue8517_shared_provider_instance.py	259	# ── the guard's own contract ────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/test_issue5339_restart_stale_user_dedup.py	132	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/test_issue5339_restart_stale_user_dedup.py	134	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/test_issue5339_restart_stale_user_dedup.py	486	# ---------------------------------------------------------------------------	COMMENT
2403 more matches not shown…

Empty Error Handlers606 hits · 2745 pts

Severity	File	Line	Snippet	Context
HIGH	server.py	556	except (ConnectionRefusedError, ConnectionResetError, OSError, socket.timeout):	CODE
HIGH	server.py	603	except FileNotFoundError:	CODE
HIGH	server.py	203	except Exception:	CODE
HIGH	server.py	315	except OSError:	CODE
HIGH	server.py	319	except OSError:	CODE
HIGH	server.py	379	except Exception:	CODE
HIGH	server.py	234	except OSError:	CODE
HIGH	server.py	239	except Exception:	CODE
HIGH	server.py	268	except Exception:	CODE
HIGH	server.py	326	except OSError:	CODE
HIGH	server.py	266	except Exception:	CODE
HIGH	server.py	331	except OSError:	CODE
HIGH	server.py	405	except _CLIENT_DISCONNECT_ERRORS:	CODE
HIGH	server.py	433	except _CLIENT_DISCONNECT_ERRORS:	CODE
HIGH	mcp_server.py	378	except Exception:	CODE
HIGH	tests/test_session_events_http_integration.py	121	except Exception:	CODE
HIGH	tests/test_session_events_http_integration.py	135	except (ValueError, AssertionError):	CODE
HIGH	tests/test_sidebar_tab_visibility.py	301	except OSError:	CODE
HIGH	tests/test_issue765_streaming_persistence.py	140	except Exception:	CODE
HIGH	tests/test_issue765_streaming_persistence.py	622	except ValueError:	CODE
HIGH	tests/test_issue765_streaming_persistence.py	600	except Exception:	CODE
HIGH	tests/test_issue765_streaming_persistence.py	738	except Exception:	CODE
HIGH	tests/test_terminal_fd_leak.py	78	except Exception:	CODE
HIGH	tests/test_issue7295_cron_readers_no_global_lock.py	454	except threading.BrokenBarrierError:	CODE
HIGH	tests/test_issue4746_extension_gallery.py	546	except OSError:	CODE
HIGH	tests/test_issue4746_extension_gallery.py	564	except OSError:	CODE
HIGH	tests/test_issue1094_provider_bugs.py	70	except Exception:	CODE
HIGH	tests/test_7855_goal_continuation_binding.py	274	except ValueError:	CODE
HIGH	tests/conftest.py	1015	except Exception:	CODE
HIGH	tests/conftest.py	1063	except Exception:	CODE
HIGH	tests/conftest.py	1120	except Exception:	CODE
HIGH	tests/conftest.py	1370	except Exception:	CODE
HIGH	tests/conftest.py	1376	except Exception:	CODE
HIGH	tests/conftest.py	1565	except Exception:	CODE
HIGH	tests/conftest.py	1570	except Exception:	CODE
HIGH	tests/conftest.py	1582	except Exception:	CODE
HIGH	tests/conftest.py	1588	except Exception:	CODE
HIGH	tests/conftest.py	1595	except Exception:	CODE
HIGH	tests/conftest.py	1600	except Exception:	CODE
HIGH	tests/conftest.py	288	except OSError:	CODE
HIGH	tests/conftest.py	490	except Exception:	CODE
HIGH	tests/conftest.py	507	except Exception:	CODE
HIGH	tests/conftest.py	1318	except Exception:	CODE
HIGH	tests/conftest.py	1477	except Exception:	CODE
HIGH	tests/conftest.py	1577	except Exception:	CODE
HIGH	tests/conftest.py	791	except OSError:	CODE
HIGH	tests/test_sprint28.py	67	except Exception:	CODE
HIGH	tests/browser_session_row_activation.py	94	except (urllib.error.URLError, OSError):	CODE
HIGH	tests/test_issue1499_keyless_onboarding.py	357	except Exception:	CODE
HIGH	tests/test_7506_full_cap_dead_endpoint.py	38	except (BrokenPipeError, ConnectionResetError):	CODE
HIGH	tests/test_issue1106_custom_providers_models.py	9	except Exception:	CODE
HIGH	tests/test_gateway_sync.py	234	except Exception:	CODE
HIGH	tests/test_gateway_sync.py	265	except Exception:	CODE
HIGH	tests/test_gateway_sync.py	300	except Exception:	CODE
HIGH	tests/test_gateway_sync.py	360	except Exception:	CODE
HIGH	tests/test_gateway_sync.py	391	except Exception:	CODE
HIGH	tests/test_gateway_sync.py	434	except Exception:	CODE
HIGH	tests/test_gateway_sync.py	507	except Exception:	CODE
HIGH	tests/test_gateway_sync.py	784	except Exception:	CODE
HIGH	tests/test_gateway_sync.py	859	except Exception:	CODE
546 more matches not shown…

Excessive Try-Catch Wrapping1639 hits · 1301 pts

Severity	File	Line	Snippet	Context
LOW	bootstrap.py	69	except Exception as exc:	CODE
LOW	bootstrap.py	350	except Exception:	CODE
LOW	bootstrap.py	352	except Exception:	CODE
LOW	bootstrap.py	451	except Exception as exc:	CODE
LOW	bootstrap.py	959	except Exception as exc:	CODE
LOW	managed_agent_startup.py	75	except Exception: # noqa: BLE001 - discovery is best-effort, never fatal here	CODE
LOW	managed_agent_startup.py	119	except Exception as exc: # noqa: BLE001 - SystemExit (relaunch/repair exit) still propagates	CODE
MEDIUM	server.py	68	def _blocked_create_connection(address, a, *kw):	CODE
MEDIUM	server.py	200	def _close_request_quietly(self, request) -> None:	CODE
MEDIUM	server.py	259	def _reject_overflow_request_worker(self, request) -> None:	CODE
MEDIUM	server.py	285	def process_request_thread(self, request, client_address):	CODE
MEDIUM	server.py	650	def _start_watcher_safe():	CODE
LOW⚡	server.py	203	except Exception:	CODE
LOW⚡	server.py	215	except Exception:	CODE
LOW⚡	server.py	255	except Exception:	CODE
LOW⚡	server.py	266	except Exception:	CODE
LOW⚡	server.py	268	except Exception:	CODE
LOW⚡	server.py	653	except Exception as e:	CODE
LOW⚡	server.py	661	except Exception as e:	CODE
LOW⚡	server.py	669	except Exception as e:	CODE
LOW⚡	server.py	676	except Exception as e:	CODE
LOW⚡	server.py	682	except Exception as e:	CODE
LOW⚡	server.py	730	except Exception:	CODE
LOW⚡	server.py	735	except Exception:	CODE
LOW⚡	server.py	740	except Exception:	CODE
LOW⚡	server.py	745	except Exception:	CODE
LOW	server.py	189	except Exception:	CODE
LOW	server.py	239	except Exception:	CODE
LOW	server.py	280	except Exception:	CODE
LOW	server.py	365	except Exception:	CODE
LOW	server.py	379	except Exception:	CODE
LOW	server.py	401	except Exception:	CODE
LOW	server.py	407	except Exception:	CODE
LOW	server.py	429	except Exception:	CODE
LOW	server.py	435	except Exception:	CODE
LOW	server.py	469	except Exception as exc:	CODE
LOW	server.py	479	except Exception as exc:	CODE
LOW	server.py	494	except Exception:	CODE
LOW	server.py	527	except Exception:	CODE
LOW	server.py	595	except Exception as exc:	CODE
LOW	server.py	699	except Exception as e:	CODE
LOW	docker_init.bash	1024	except Exception:	CODE
LOW	ctl.sh	825	except Exception:	CODE
LOW⚡	mcp_server.py	191	except Exception as e:	CODE
LOW⚡	mcp_server.py	378	except Exception:	CODE
LOW	mcp_server.py	101	except Exception:	CODE
LOW	mcp_server.py	164	except Exception:	CODE
LOW	tests/test_session_events_http_integration.py	121	except Exception:	CODE
LOW	tests/test_issue4749_steer_reason_and_recovery.py	280	except Exception:	CODE
LOW	tests/test_issue2931_edge_tts_endpoint.py	41	except Exception:	CODE
MEDIUM	tests/test_issue2931_edge_tts_endpoint.py	38	def payload(self):	CODE
LOW	tests/test_issue765_streaming_persistence.py	140	except Exception:	CODE
LOW	tests/test_issue765_streaming_persistence.py	325	except Exception as e:	CODE
LOW	tests/test_issue765_streaming_persistence.py	600	except Exception:	CODE
LOW	tests/test_issue765_streaming_persistence.py	603	except Exception as e:	CODE
LOW	tests/test_issue765_streaming_persistence.py	738	except Exception:	CODE
LOW	tests/test_issue765_streaming_persistence.py	741	except Exception as e:	CODE
LOW⚡	tests/test_terminal_fd_leak.py	78	except Exception:	CODE
MEDIUM	tests/test_session_action_menu_focus.py	69	def test_deferred_parent_focus_never_rehomes_to_nested_fork_in_browser():	CODE
MEDIUM	tests/test_session_action_menu_focus.py	308	def test_session_action_menu_focus_lifecycle_in_browser():	CODE
1579 more matches not shown…

Unused Imports825 hits · 698 pts

Severity	File	Line	Context
LOW	bootstrap.py	4	CODE
LOW	managed_agent_startup.py	3	CODE
LOW	mcp_server.py	54	CODE
LOW	mcp_server.py	55	CODE
LOW	mcp_server.py	55	CODE
LOW	mcp_server.py	55	CODE
LOW	mcp_server.py	59	CODE
LOW	tests/test_real_steer.py	20	CODE
LOW	tests/test_surrogate_backup_restore.py	10	CODE
LOW	tests/test_zip_media_delivery.py	12	CODE
LOW	tests/test_v050255_opus_followups.py	27	CODE
LOW	tests/test_v050255_opus_followups.py	29	CODE
LOW	tests/test_project_bindings_uigate_1008.py	22	CODE
LOW	tests/test_run_journal_protocol_upgrade.py	9	CODE
LOW	tests/test_issue5532_clear_truncation_watermark.py	28	CODE
LOW	tests/test_project_bindings_round5_1010.py	27	CODE
LOW	tests/test_issue4891_detail_header_visibility.py	16	CODE
LOW	tests/test_issue8517_shared_provider_instance.py	22	CODE
LOW	tests/test_issue8517_shared_provider_instance.py	30	CODE
LOW	tests/test_issue1257_llm_wiki_status.py	1	CODE
LOW	tests/test_issue569_579.py	11	CODE
LOW	tests/test_compaction_current_summary_fallback.py	15	CODE
LOW	tests/test_visible_video_preload.py	3	CODE
LOW	tests/test_issue8212_subpath_next_open_redirect.py	30	CODE
LOW	tests/test_run_journal_seq_cache.py	11	CODE
LOW	tests/test_media_message_snapshots.py	16	CODE
LOW	tests/test_project_bindings_round14_1011.py	25	CODE
LOW	tests/test_issue3987_imported_session_titles.py	3	CODE
LOW	tests/test_issue7941_csp_remote_image_exfiltration.py	16	CODE
LOW	tests/test_issue8524_docker_agent_uv_overrides.py	15	CODE
LOW	tests/test_issue5270_cli_webui_continuity.py	1	CODE
LOW	tests/test_sprint49.py	13	CODE
LOW	tests/test_update_checker.py	11	CODE
LOW	tests/test_update_checker.py	12	CODE
LOW	tests/test_update_checker.py	13	CODE
LOW	tests/test_update_checker.py	15	CODE
LOW	tests/test_gateway_watcher_idle_park.py	12	CODE
LOW	tests/test_mcp_runtime_profile_scope.py	13	CODE
LOW	tests/test_mcp_runtime_profile_scope.py	26	CODE
LOW	tests/test_mcp_runtime_profile_scope.py	28	CODE
LOW	tests/test_approval_sse.py	14	CODE
LOW	tests/test_cli_session_tool_metadata.py	3	CODE
LOW	tests/test_issue3260_self_hosted_providers_settings.py	3	CODE
LOW	tests/test_wakeup_model_resolve_hang.py	30	CODE
LOW	tests/test_agent_runtime_revision_guard.py	3	CODE
LOW	tests/test_sprint40_ui_polish.py	8	CODE
LOW	tests/test_sprint40_ui_polish.py	10	CODE
LOW	tests/test_sprint40_ui_polish.py	13	CODE
LOW	tests/test_metadata_save_wipe_1558.py	21	CODE
LOW	tests/test_metadata_save_wipe_1558.py	22	CODE
LOW	tests/test_empty_session_no_disk_write.py	22	CODE
LOW	tests/test_empty_session_no_disk_write.py	27	CODE
LOW	tests/test_issue7056_login_hides_password_form.py	16	CODE
LOW	tests/test_bg_task_complete_focus_drop.py	22	CODE
LOW	tests/test_parse_cookie_junk_cookie.py	1	CODE
LOW	tests/test_issue1240_generic_cli_catalog_sync.py	8	CODE
LOW	tests/test_issue1095_pasted_images.py	8	CODE
LOW	tests/test_cancelled_history_real_producers.py	7	CODE
LOW	tests/test_lineage_display_cache.py	13	CODE
LOW	tests/test_anchor_fallback_ownership.py	9	CODE
765 more matches not shown…

Cross-File Repetition130 hits · 650 pts

Severity	File	Line	Snippet	Context
HIGH	tests/test_6728_cron_running_sidebar.py	0	function extractfunc(name) { const re = new regexp('function\\s+' + name + '\\s*\\('); const start = src.search(re); if	STRING
HIGH	…s/test_issue5638_user_row_intrinsic_height_collapse.py	0	function extractfunc(name) { const re = new regexp('function\\s+' + name + '\\s*\\('); const start = src.search(re); if	STRING
HIGH	…test_issue5744_nonvirtual_userrow_collapse_jumpback.py	0	function extractfunc(name) { const re = new regexp('function\\s+' + name + '\\s*\\('); const start = src.search(re); if	STRING
HIGH	tests/test_issue7677_settle_and_measure_pass.py	0	function extractfunc(name) { const re = new regexp('function\\s+' + name + '\\s*\\('); const start = src.search(re); if	STRING
HIGH	tests/test_issue5637_stale_anchor_guard.py	0	function extractfunc(name) { const re = new regexp('function\\s+' + name + '\\s*\\('); const start = src.search(re); if	STRING
HIGH	tests/test_issue2051_duplicate_model_picker_entry.py	0	real source of the named ui.js functions — never a re-implementation.	STRING
HIGH	tests/test_issue2051_duplicate_assistant_answer.py	0	real source of the named ui.js functions — never a re-implementation.	STRING
HIGH	tests/test_issue2051_duplicate_interrupt_notice.py	0	real source of the named ui.js functions — never a re-implementation.	STRING
HIGH	tests/test_issue1154_fenced_code_leak.py	0	const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = {	STRING
HIGH	tests/test_issue1618_yaml_json_diff_newline_preserve.py	0	const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = {	STRING
HIGH	tests/test_issue1446_glued_heading_lift.py	0	const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = {	STRING
HIGH	tests/test_issue2881_workspace_chat_links.py	0	const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = {	STRING
HIGH	tests/test_issue2428_table_pipe_protection.py	0	const fs = require('fs'); const src = fs.readfilesync(process.argv[2], 'utf8'); global.window = {}; global.document = {	STRING
HIGH	tests/test_gateway_watcher_idle_park.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_gateway_watcher_resubscribe_fresh.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_issue5379_cron_project_optin.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_cross_profile_system_project_tagging.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_session_lineage_report.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_pr7555_cli_session_availability.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_issue3930_source_filter_pushdown.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_issue3506_memory_and_watcher.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_profile_home_resolve_caching.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_issue3585_cron_session_overflow.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_acp_session_sidebar_visibility.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_issue4842_cron_projection_perf.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_issue3586_cli_session_source_label.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_issue2628_cli_sessions_perf.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_issue1013_handoff_dock.py	0	create table sessions ( id text primary key, source text, session_source text, title text, model text, started_at real n	STRING
HIGH	tests/test_issue5379_cron_project_optin.py	0	create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text	STRING
HIGH	tests/test_issue4385_cron_archive_reappears.py	0	create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text	STRING
HIGH	tests/test_issue3762_importable_rows_schema_guard.py	0	create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text	STRING
HIGH	tests/test_issue5455_listing_readonly_connection.py	0	create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text	STRING
HIGH	tests/test_issue3172_cron_session_limit.py	0	create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text	STRING
HIGH	tests/test_session_discoverability_repair.py	0	create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text	STRING
HIGH	tests/test_cron_session_title.py	0	create table sessions ( id text primary key, title text, model text, message_count integer, started_at real, source text	STRING
HIGH	tests/test_issue3929_error_preserves_partial.py	0	redirect session_dir / session_index_file to an isolated temp dir.	STRING
HIGH	tests/test_issue1361_cancel_data_loss.py	0	redirect session_dir / session_index_file to an isolated temp dir.	STRING
HIGH	tests/test_issue1298_cancel_and_activity.py	0	redirect session_dir / session_index_file to an isolated temp dir.	STRING
HIGH	tests/test_issue1094_provider_bugs.py	0	stub hermes_cli so tests are deterministic and offline.	STRING
HIGH	tests/test_provider_management.py	0	stub hermes_cli so tests are deterministic and offline.	STRING
HIGH	tests/test_issue1500_lmstudio_env_var_alignment.py	0	stub hermes_cli so tests are deterministic and offline.	STRING
HIGH	tests/test_custom_provider_dict_models.py	0	stub hermes_cli so tests are deterministic and offline.	STRING
HIGH	tests/test_custom_providers_in_panel.py	0	stub hermes_cli so tests are deterministic and offline.	STRING
HIGH	tests/test_agent_max_turns_parity.py	0	return the source of the `_compute_agent_cache_signature()` helper. the signature blob used to be inlined in the streami	STRING
HIGH	tests/test_issue1897_profile_switch_agent_cache.py	0	return the source of the `_compute_agent_cache_signature()` helper. the signature blob used to be inlined in the streami	STRING
HIGH	tests/test_streaming_max_tokens_quota.py	0	return the source of the `_compute_agent_cache_signature()` helper. the signature blob used to be inlined in the streami	STRING
HIGH	tests/test_agent_max_turns_parity.py	0	return the `_json.dumps([...])` field list the signature hashes.	STRING
HIGH	tests/test_issue1897_profile_switch_agent_cache.py	0	return the `_json.dumps([...])` field list the signature hashes.	STRING
HIGH	tests/test_streaming_max_tokens_quota.py	0	return the `_json.dumps([...])` field list the signature hashes.	STRING
HIGH	tests/test_agent_max_turns_parity.py	0	return `(offset, source)` for every production signature call site. paren-balanced so the whole multi-line keyword-argum	STRING
HIGH	tests/test_issue1897_profile_switch_agent_cache.py	0	return `(offset, source)` for every production signature call site. paren-balanced so the whole multi-line keyword-argum	STRING
HIGH	tests/test_streaming_max_tokens_quota.py	0	return `(offset, source)` for every production signature call site. paren-balanced so the whole multi-line keyword-argum	STRING
HIGH	tests/test_agent_max_turns_parity.py	0	return the single offset of a lifecycle marker in streaming.py.	STRING
HIGH	tests/test_issue1897_profile_switch_agent_cache.py	0	return the single offset of a lifecycle marker in streaming.py.	STRING
HIGH	tests/test_streaming_max_tokens_quota.py	0	return the single offset of a lifecycle marker in streaming.py.	STRING
HIGH	tests/test_agent_max_turns_parity.py	0	map each lifecycle region to the single signature call inside it. the regions are the initial send, the returned-error s	STRING
HIGH	tests/test_streaming_max_tokens_quota.py	0	map each lifecycle region to the single signature call inside it. the regions are the initial send, the returned-error s	STRING
HIGH	tests/test_issue1897_profile_switch_agent_cache.py	0	map each lifecycle region to the single signature call inside it. the regions are the initial send, the returned-error s	STRING
HIGH	tests/browser_session_row_activation.py	0	poll ``expression`` with page.evaluate. the app's csp has no 'unsafe-eval', which playwright's interval-polled wait_for_	STRING
HIGH	tests/browser_terminal_screen_reader_mode.py	0	poll ``expression`` with page.evaluate. the app's csp has no 'unsafe-eval', which playwright's interval-polled wait_for_	STRING
70 more matches not shown…

Deep Nesting754 hits · 532 pts

Severity	File	Line	Context
LOW	bootstrap.py	29	CODE
LOW	bootstrap.py	196	CODE
LOW	bootstrap.py	357	CODE
LOW	bootstrap.py	781	CODE
LOW	server.py	153	CODE
LOW	mcp_server.py	321	CODE
LOW	tests/test_session_events_http_integration.py	25	CODE
LOW	tests/test_session_events_http_integration.py	82	CODE
LOW	tests/test_issue5637_mobile_scroll_clamp_jumpback.py	35	CODE
LOW	tests/test_issue5637_mobile_scroll_clamp_jumpback.py	52	CODE
LOW	tests/test_run_journal_protocol_upgrade.py	54	CODE
LOW	tests/test_issue3635_profile_chip_active.py	29	CODE
LOW	tests/test_issue3635_profile_chip_active.py	98	CODE
LOW	tests/test_issue3599_inline_thinking_extraction.py	15	CODE
LOW	tests/test_issue4891_detail_header_visibility.py	24	CODE
LOW	tests/test_issue4749_steer_reason_and_recovery.py	268	CODE
LOW	tests/test_issue1431_toolsets_chip_responsive.py	141	CODE
LOW	tests/test_issue3250_upward_scroll_intent_window.py	15	CODE
LOW	tests/test_issue1731_upward_scroll_unpins.py	22	CODE
LOW	tests/test_issue765_streaming_persistence.py	544	CODE
LOW	tests/test_issue765_streaming_persistence.py	686	CODE
LOW	tests/test_issue765_streaming_persistence.py	587	CODE
LOW	tests/test_issue765_streaming_persistence.py	725	CODE
LOW	tests/test_korean_locale.py	18	CODE
LOW	tests/test_issue8524_docker_agent_uv_overrides.py	287	CODE
LOW	tests/test_issue3571_saved_prompts.py	18	CODE
LOW	tests/test_large_text_paste_attachment.py	22	CODE
LOW	tests/test_session_unread_dot_on_visit.py	170	CODE
LOW	tests/test_agent_runtime_revision_guard.py	102	CODE
LOW	tests/test_bg_task_complete_focus_drop.py	51	CODE
LOW	tests/test_cancelled_history_real_producers.py	438	CODE
LOW	tests/test_cancelled_history_real_producers.py	520	CODE
LOW	tests/test_issue6080_model_picker_reparent.py	33	CODE
LOW	tests/test_anchor_fallback_ownership.py	127	CODE
LOW	tests/test_anchor_fallback_ownership.py	191	CODE
LOW	tests/test_session_channel_option_x.py	23	CODE
LOW	tests/test_session_channel_option_x.py	230	CODE
LOW	tests/test_session_channel_option_x.py	259	CODE
LOW	tests/test_language_precedence.py	55	CODE
LOW	tests/test_language_precedence.py	122	CODE
LOW	tests/test_tars_scroll_reset_regressions.py	8	CODE
LOW	tests/test_session_middle_click_new_tab.py	37	CODE
LOW	tests/test_issue5514_composer_grow_scroll_pin.py	47	CODE
LOW	tests/test_issue6067_artifact_paths.py	35	CODE
LOW	tests/test_issue6067_artifact_paths.py	116	CODE
LOW	tests/test_7855_goal_continuation_binding.py	52	CODE
LOW	tests/test_issue4598_composer_control_visibility.py	69	CODE
LOW	tests/conftest.py	309	CODE
LOW	tests/conftest.py	536	CODE
LOW	tests/conftest.py	936	CODE
LOW	tests/conftest.py	1019	CODE
LOW	tests/test_agent_max_turns_parity.py	36	CODE
LOW	tests/test_issue4877_fresh_blank_boot_workspace_bind.py	20	CODE
LOW	tests/test_issue1690_scroll_completion.py	9	CODE
LOW	tests/test_issue1690_scroll_completion.py	23	CODE
LOW	tests/test_scroll_collapse_clamp_keeps_follow.py	32	CODE
LOW	tests/test_webui_provider_routing_parity.py	206	CODE
LOW	tests/test_profile_switch_ux.py	20	CODE
LOW	tests/test_profile_switch_ux.py	85	CODE
LOW	tests/test_smd_media_in_stream.py	686	CODE
694 more matches not shown…

Over-Commented Block635 hits · 360 pts

Severity	File	Line	Snippet	Context
LOW	bootstrap.py	481	)	COMMENT
LOW	bootstrap.py	881	# Mirror the robust pattern from api/updates._schedule_restart:	COMMENT
LOW	managed_agent_startup.py	101	# Activate dependencies without importing the application: api.config must	COMMENT
LOW	requirements.txt	1	# Hermes Web UI -- minimal Python dependencies	COMMENT
LOW	pyproject.toml	61	"static",	COMMENT
LOW	pyproject.toml	81	# prevention value lives.	COMMENT
LOW	docker-compose.three-container.yml	1	# Three-container Docker Compose: Hermes Agent + Dashboard + WebUI	COMMENT
LOW	docker-compose.three-container.yml	21	#	COMMENT
LOW	docker-compose.three-container.yml	61	# Gateway API server (port 8642). The WebUI's Tasks/cron health probe	COMMENT
LOW	docker-compose.three-container.yml	121	container_name: hermes-webui	COMMENT
LOW	docker-compose.three-container.yml	141	environment:	COMMENT
LOW	docker-compose.three-container.yml	161	# NOTE: When using bind-mount volumes shared across containers, ALL containers	COMMENT
LOW	docker-compose.three-container.yml	181		COMMENT
LOW	docker-compose.yml	1	# Hermes WebUI — single-container Docker Compose	COMMENT
LOW	docker-compose.yml	21	volumes:	COMMENT
LOW	docker-compose.yml	41	# Where to store sessions, workspaces, and other state (default: ~/.hermes/webui)	COMMENT
LOW	docker_init.bash	61	# identity the operator chose explicitly — including the legitimate value 1024,	COMMENT
LOW	docker_init.bash	261	}	COMMENT
LOW	docker_init.bash	601	echo "!! If this is not an intentional local development checkout, switch the WebUI"	COMMENT
LOW	docker_init.bash	941	# has no .git, so the Agent's bootstrap leaves the process alone. Agent images	COMMENT
LOW	docker_init.bash	961	# taking mount edits on restart.	COMMENT
LOW	docker-compose.two-container.yml	1	# Two-container Docker Compose: Hermes Agent + Hermes WebUI	COMMENT
LOW	docker-compose.two-container.yml	21	# → see https://github.com/sunnysktsang/hermes-suite for an all-in-one image	COMMENT
LOW	docker-compose.two-container.yml	61	# Expose agent source so the WebUI can install dependencies from it	COMMENT
LOW	docker-compose.two-container.yml	101	- hermes-home:/home/hermeswebui/.hermes	COMMENT
LOW	docker-compose.two-container.yml	121	# Match your host user's UID/GID for correct file permissions.	COMMENT
LOW	docker-compose.two-container.yml	141	# - HERMES_HOME_MODE=0640	COMMENT
LOW	start.sh	1	#!/usr/bin/env bash	COMMENT
LOW	start.sh	21	# requires a password — better than exiting non-zero with `sudo: a password	COMMENT
LOW	start.sh	61	exit 1	COMMENT
LOW	start.sh	121	*) _hermes_probe_host="${_hermes_host}" ;;	COMMENT
LOW	tests/test_project_bindings_round5_1010.py	461	# --- finding 4: the sweep's live-binding read shares the catalog lock --------	COMMENT
LOW	tests/test_resolve_model_provider_free_suffix.py	121	# The PR #1762 fix for #1744 skipped the rsplit-fallback when the provider	COMMENT
LOW	tests/test_issue765_streaming_persistence.py	761	assert not errors, f"Checkpoint thread encountered errors: {errors}"	COMMENT
LOW	tests/test_media_message_snapshots.py	761	# Transparent segments: original _getCachedRender line is preserved (source	COMMENT
LOW	tests/test_session_channel_option_x.py	521		COMMENT
LOW	tests/test_session_channel_option_x.py	621	with bp.SESSION_CHANNELS_LOCK:	COMMENT
LOW	tests/test_session_channel_option_x.py	841	assert '"event_id"' in fn_src or "'event_id'" in fn_src, (	COMMENT
LOW	tests/test_session_channel_option_x.py	861	# EventSource was ever created — the session stream stayed dead until the user	COMMENT
LOW	tests/test_session_channel_option_x.py	901	# Bug: loadSession() tears down the live per-session SSE unconditionally at the	COMMENT
LOW	tests/test_language_precedence.py	281	# maintainer cannot silently reintroduce the round-2 regressions:	COMMENT
LOW	tests/test_docker_docs_and_readonly.py	161	# `uv pip install "$_agent_src[all]"` invokes setuptools' egg_info build step,	COMMENT
LOW	tests/test_issue5514_composer_grow_scroll_pin.py	541		COMMENT
LOW	tests/test_issue5514_composer_grow_scroll_pin.py	641		COMMENT
LOW	tests/test_issue5514_composer_grow_scroll_pin.py	741		COMMENT
LOW	tests/test_7864_forwarded_for_startup_warning.py	41	assert "HERMES_WEBUI_TRUSTED_PROXY_CIDRS" in warning	COMMENT
LOW	tests/conftest.py	121	# Test state must NEVER live inside the real Hermes home (~/.hermes or any	COMMENT
LOW	tests/conftest.py	201	os.environ['HERMES_DISABLE_LAZY_INSTALLS'] = '1'	COMMENT
LOW	tests/conftest.py	461	# in place and never restores it. In a sequential run the next test usually	COMMENT
LOW	tests/conftest.py	601	try:	COMMENT
LOW	tests/conftest.py	621	# Setting this here instead of in a fixture so it lands BEFORE any test-file	COMMENT
LOW	tests/conftest.py	641	#	COMMENT
LOW	tests/conftest.py	661	# regression like the one PR #1970 introduced where a new code path bypassed	COMMENT
LOW	tests/conftest.py	681	# by AWS_EC2_METADATA_DISABLED, but allowed at the socket	COMMENT
LOW	tests/conftest.py	1181	test_skills = TEST_STATE_DIR / 'skills'	COMMENT
LOW	tests/conftest.py	1241	for _model_env in ('HERMES_MODEL', 'OPENAI_MODEL', 'LLM_MODEL'):	COMMENT
LOW	tests/conftest.py	1381	# Several tests simulate "hermes_cli unavailable / CI without the package" by	COMMENT
LOW	tests/conftest.py	1401	_REAL_HERMES_CLI = sys.modules.get("hermes_cli")	COMMENT
LOW	tests/conftest.py	1501	sys.path[:] = _REAL_SYS_PATH	COMMENT
LOW	tests/test_custom_provider_prefix_collisions.py	1	import sys	COMMENT
575 more matches not shown…

AI Slop Vocabulary88 hits · 222 pts

Severity	File	Line	Snippet	Context
MEDIUM	bootstrap.py	881	# Mirror the robust pattern from api/updates._schedule_restart:	COMMENT
MEDIUM	docker_init.bash	963	# bash 4 (macOS /bin/bash is 3.2, so the test harness there died with "bad	COMMENT
LOW	ctl.sh	134	# into the shell environment (including those just set by repo .env) are	COMMENT
MEDIUM	tests/test_issue5532_clear_truncation_watermark.py	40	"""Point the session store at an isolated tmp dir (mirror #2914 harness)."""	STRING
MEDIUM	tests/test_media_message_snapshots.py	766	# scene render chain is exercised by harness-extracted tests that would	COMMENT
MEDIUM	tests/test_issue8524_docker_agent_uv_overrides.py	49	# browser-harness pins pillow==12.3.0	COMMENT
MEDIUM⚡	tests/test_session_unread_dot_on_visit.py	38	# Sibling harness scaffolding lives beside this file and is not on sys.path by	COMMENT
MEDIUM⚡	tests/test_session_unread_dot_on_visit.py	39	# default; import it the same way the other node-harness tests do.	COMMENT
MEDIUM	tests/test_session_middle_click_new_tab.py	641	# ReferenceError path that only exists in the harness.	COMMENT
MEDIUM	tests/test_session_middle_click_new_tab.py	304	# harness must stub every closure free-var the branch touches:	STRING
MEDIUM	tests/test_session_middle_click_new_tab.py	417	# harness must stub every closure free-var the branch touches.	STRING
MEDIUM⚡	tests/test_issue5514_composer_grow_scroll_pin.py	559	# harness leaves the reader stranded; with the preserve-scrollTop fix it does not.	COMMENT
MEDIUM	tests/test_7855_goal_continuation_binding.py	286	# happens AFTER the harness has printed every probe line, so the observed	COMMENT
MEDIUM	tests/conftest.py	1161	# Stale servers from QA harness runs or prior test sessions cause	COMMENT
MEDIUM	tests/test_scroll_collapse_clamp_keeps_follow.py	17	with controllable geometry, the same way the #4970 harness does.	STRING
MEDIUM	tests/test_pwa_notification_controls.py	57	# inside "async function name", so slicing at `start` would hand the harness	COMMENT
MEDIUM	tests/test_model_picker_no_search_autofocus.py	160	# These execute the real renderer against a minimal-DOM harness and prove it	COMMENT
MEDIUM⚡	tests/test_model_picker_no_search_autofocus.py	681	# NEW node or a user mid-word gets silently dropped to <body>. The harness	STRING
MEDIUM	tests/test_issue8228_image_data_uri_hash.py	33	# Lives in tests/ so the sharded CI suite actually runs it; the harness itself is	COMMENT
MEDIUM	tests/test_issue7591_virtual_scroll_calibration.py	403	# Shared harness for the two COMPOSED render-path regressions below. It wires the	STRING
MEDIUM	tests/test_7027_state_dir_uid_probe.py	133	# ── behavioural harness ───────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/test_runtime_adapter_seam.py	557	assert "#### Slice 4c: Feature-flagged runner backend and restart/reattach harness" in rfc	CODE
MEDIUM	tests/test_runtime_adapter_seam.py	589	assert "#### Slice 4e: Default-off runner chat-start route-selection harness" in rfc	CODE
MEDIUM	tests/test_runtime_adapter_seam.py	626	assert "#### Slice 4g: Supervised local runner process harness gate" in rfc	CODE
MEDIUM⚡	tests/test_6710_panel_dismiss_and_artifact_open.py	64	# behaviour under test for the reopen-during-read case, so the harness	COMMENT
MEDIUM⚡	tests/test_6710_panel_dismiss_and_artifact_open.py	69	# real shipped code too, not a harness mirror.	COMMENT
LOW	tests/test_session_sidebar_cache.py	615	# text-file state.db (a real sqlite connect would just return None here).	COMMENT
MEDIUM⚡	tests/test_gateway_routing_footer_scope.py	415	// Master calls this at the end of renderMessages (#7591). The harness extracts	COMMENT
MEDIUM	tests/test_gateway_routing_footer_scope.py	500	# The harness embeds renderMessages(), which is ~110 KB of source. Passing	STRING
MEDIUM⚡	tests/test_5428_stale_client_recovery.py	62	# Node-backed behavioral harness	COMMENT
MEDIUM	tests/test_gateway_events_watchdog_7978.py	164	# ---------------------------------------------------------------- harness ---	COMMENT
MEDIUM	tests/test_gateway_events_watchdog_7978.py	1146	# The harness reuses one session key; another test's parked card would	COMMENT
MEDIUM	tests/test_gateway_events_watchdog_7978.py	2365	except Exception as exc: # noqa: BLE001 - harness reporter	CODE
MEDIUM⚡	…test_6808_appearance_bootstrap_no_fabricated_choice.py	110	# The harness must have actually run the bootstrap: it always paints.	STRING
MEDIUM	tests/test_mobile_layout.py	510	_BOOT_JS = BOOT # alias used by the lifecycle harness	STRING
MEDIUM⚡	…ts/test_issue1567_nous_picker_capacity_and_symmetry.py	578	# robust against minor refactors of surrounding code.	COMMENT
MEDIUM⚡	tests/test_delegation_status.py	31	# Real per-profile state.db harness	COMMENT
MEDIUM	tests/test_composer_capture_clear_race.py	146	# token through this real helper, so the harness must run the real one.	COMMENT
MEDIUM⚡	tests/test_issue5960_cron_unread_profile_scope.py	20	# Sibling harness scaffolding lives beside this file and is not on sys.path by	COMMENT
MEDIUM⚡	tests/test_issue5960_cron_unread_profile_scope.py	21	# default; import it the same way the other node-harness tests do.	COMMENT
MEDIUM	tests/_unread_store_helpers.py	41	# Declared from the module source so a harness cannot drift from the values the	COMMENT
MEDIUM	tests/_unread_store_helpers.py	89	# Ready to interpolate into a node harness.	COMMENT
MEDIUM	tests/test_issue4856_android_scroll_regression.py	138	# ── #4970 low-delta wheel intent: behavioral node-harness ────────────────────	COMMENT
MEDIUM⚡	tests/test_issue4856_android_scroll_regression.py	173	Mirrors the #4295 harness shape but injects the #4970 helpers so we can	STRING
MEDIUM	tests/test_issue4856_android_scroll_regression.py	858	# ── Behavioral harness: execute the REAL _fixMobileScrollJank against a mock	STRING
MEDIUM	tests/test_issue6594_last_used_model_fallback.py	551	# Run through production composer and sidebar formatters in Node harness	COMMENT
MEDIUM	tests/test_issue6594_last_used_model_fallback.py	1041	# ponytail: isolated worker turn harness verifying route lifecycle (#7438)	STRING
MEDIUM	tests/test_pinned_tail_midstream_jitter.py	209	# The call is typeof-guarded so a standalone renderMessages() node harness (which does	STRING
MEDIUM	tests/test_issue8517_memory_off_notice.py	147	# The test harness's session ids carry the profile name; nothing else may.	COMMENT
MEDIUM	tests/test_7628_recovery_window_integrity.py	122	# ── node harness ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/test_issue5472_preserve_draft_on_failed_send.py	182	# continuation draft, so every harness that runs it must also run the REAL	COMMENT
MEDIUM	tests/test_issue5472_preserve_draft_on_failed_send.py	202	# identifiable continuation draft, so the harness must run the REAL	COMMENT
MEDIUM	tests/test_issue500_message_list_virtualization.py	108	This deliberately reuses issue #500's proven virtualization harness instead	CODE
MEDIUM	tests/test_issue500_message_list_virtualization.py	1510	(~30% WebContent CPU, issue #6654). The queued-rAF harness drives the	CODE
MEDIUM	tests/test_insights.py	524	# on some Node 20 releases, where this harness's top-level `await` was a	COMMENT
MEDIUM	tests/test_blank_live_turn_preserve_guard.py	190	"""#6948 browser-lifecycle equivalent in the node harness: the full	STRING
MEDIUM	tests/test_issue7391_first_party_edge_tts_engine.py	155	# explicitly or the harness hits ReferenceError.	COMMENT
MEDIUM	tests/test_issue7391_first_party_edge_tts_engine.py	174	# profile. The harness pins activeProfile='default' and the old code omitted	COMMENT
MEDIUM	tests/test_issue6414_programmatic_scroll_user_intent.py	71	// #7494: the inlined handler consults the targeting gate; this harness has no	COMMENT
MEDIUM	tests/test_issue8517_helper_and_boundary_memory.py	46	# ── P2: /api/session/compress after a UI switch (harness case aux_compress) ──	COMMENT
28 more matches not shown…

Self-Referential Comments21 hits · 69 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/test_issue3957_profile_providers_models.py	804	# Create a config.yaml with a custom provider that has key_env	COMMENT
MEDIUM⚡	tests/test_issue1094_provider_bugs.py	210	# Create a fake config.yaml with a provider key	COMMENT
MEDIUM	tests/test_issue570_permission.py	24	# Create the file then make the parent unreadable so .exists() raises PermissionError	COMMENT
MEDIUM	tests/test_gateway_sync.py	3079	# Create a WebUI session with a known ID	COMMENT
MEDIUM	tests/test_bootstrap_foreground.py	514	# Create a non-executable file at the python path	COMMENT
MEDIUM	tests/test_v050257_opus_followups.py	185	# Create a fake session file	COMMENT
MEDIUM	tests/test_symlink_cycle_detection.py	184	# Create a symlink inside target that points back to workspace	COMMENT
MEDIUM	tests/test_session_sidecar_repair.py	530	# Create an agent lock	COMMENT
MEDIUM	tests/test_sprint14.py	39	# Create a file first	COMMENT
MEDIUM	tests/test_issue893_cancel_preserves_partial.py	87	# Create a session and a fake running stream	COMMENT
MEDIUM	tests/test_workspace_upload.py	650	# Create a zip with a malicious member path	COMMENT
MEDIUM⚡	tests/test_sprint11.py	87	# Create a session with a custom model string	COMMENT
MEDIUM	tests/test_issue2698_isolated_hermes_home.py	130	# Create a few test profiles	COMMENT
MEDIUM⚡	tests/test_regressions.py	323	# Create a session with a title so it shows in the list	COMMENT
MEDIUM⚡	tests/test_session_index.py	1496	# Create a valid index file so the incremental path is attempted	COMMENT
MEDIUM	tests/test_session_index.py	309	# Create a new session C not in the index	COMMENT
MEDIUM	tests/test_media_inline.py	1313	# Create a session so we can use /api/file/raw	COMMENT
MEDIUM⚡	tests/test_issue1195_session_profile_routing.py	43	# Create an existing profile directory	COMMENT
MEDIUM	scripts/docker_first_start_race.sh	45	# Create a hermes-home volume holding SEED_FILES files and a git repository,	COMMENT
MEDIUM	scripts/lib/health_probe.sh	23	# This file is safe to `source` (defines functions only) and is also runnable	COMMENT
MEDIUM	.github/workflows/native-windows-startup.yml	43	# Create the WebUI venv. start.ps1 prefers $AgentDir\venv if it	COMMENT

Verbosity Indicators34 hits · 63 pts

Severity	File	Line	Snippet	Context
LOW⚡	tests/test_7865_regate_round3.py	442	// Step 2: "Save Settings". The server echoes the bare form back, and	COMMENT
LOW⚡	tests/test_7865_regate_round3.py	447	// Step 3: re-open and autosave again — the phantom-bar case.	COMMENT
LOW	tests/test_7865_regate_round3.py	428	// Step 1: open with the bare default stored, picker shows the qualified one.	COMMENT
LOW⚡	tests/test_issue2914_truncation_watermark.py	356	# Step 4: Undo — removes "light speed"	COMMENT
LOW⚡	tests/test_issue2914_truncation_watermark.py	365	# Step 5: New turn — agent context should NOT include "triangle"	COMMENT
LOW	tests/test_issue2914_truncation_watermark.py	281	# Step 1: Initial message "triangle"	COMMENT
LOW	tests/test_issue2914_truncation_watermark.py	301	# Step 2: Edit "triangle" → "square" (new timestamp 200)	COMMENT
LOW	tests/test_issue2914_truncation_watermark.py	330	# Step 3: New message "light speed"	COMMENT
LOW⚡	tests/test_7864_forwarded_ignored_per_record.py	85	# Step 1: a direct client sending its own XFF.	COMMENT
LOW⚡	tests/test_7864_forwarded_ignored_per_record.py	95	# Step 2: the operator's unallowlisted Docker-bridge proxy. No second	COMMENT
LOW⚡	tests/test_approval_unblock.py	165	# Step 1: streaming.py registers the notify callback	COMMENT
LOW⚡	tests/test_approval_unblock.py	170	# Step 2: check_all_command_guards fires the callback and queues an entry	COMMENT
LOW⚡	tests/test_approval_unblock.py	187	# Step 3: user responds via /api/approval/respond → resolve_gateway_approval	COMMENT
LOW⚡	tests/test_approval_unblock.py	191	# Step 4: agent thread is unblocked with the correct choice	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	97	# Step 1: Truncate (edit) — keep 2 messages (first exchange)	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	104	# Step 2: Send new message "square" — checkpoint advances watermark	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	134	# Step 1: Truncate (edit) — keep 2 messages (first exchange)	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	138	# Step 2: Send new message "square"	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	145	# Step 3: Simulate state.db containing both original and edited messages	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	155	# Step 4: Reload from disk (simulates session switch → switch back)	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	164	# Step 5: Merge sidecar + state.db (what GET /api/session does)	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	202	# Step 1: Truncate (edit) — keep 2 messages	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	206	# Step 2: Send edited message	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	211	# Step 3: Simulate assistant reply	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	215	# Step 4: Send second new turn	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	221	# Step 5: Simulate state.db with all messages	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	233	# Step 6: Reload from disk	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	241	# Step 7: Merge	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	277	# Step 1: Retry — truncates to before "second"	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	283	# Step 2: Send new message	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	310	# Step 1: Undo — removes "second" and "reply2"	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	316	# Step 2: Send new message	COMMENT
LOW⚡	tests/test_issue1633_models_cache_version_stamp.py	369	# Step 4: cache rejected → caller will rebuild from live provider data	COMMENT
LOW	tests/test_issue1633_models_cache_version_stamp.py	351	# Step 1: v0.50.281 writes cache	COMMENT

Structural Annotation Overuse33 hits · 60 pts

Severity	File	Line	Snippet	Context
LOW⚡	tests/test_7865_regate_round3.py	447	// Step 3: re-open and autosave again — the phantom-bar case.	COMMENT
LOW	tests/test_7865_regate_round3.py	428	// Step 1: open with the bare default stored, picker shows the qualified one.	COMMENT
LOW⚡	tests/test_issue2914_truncation_watermark.py	356	# Step 4: Undo — removes "light speed"	COMMENT
LOW⚡	tests/test_issue2914_truncation_watermark.py	365	# Step 5: New turn — agent context should NOT include "triangle"	COMMENT
LOW	tests/test_issue2914_truncation_watermark.py	281	# Step 1: Initial message "triangle"	COMMENT
LOW	tests/test_issue2914_truncation_watermark.py	301	# Step 2: Edit "triangle" → "square" (new timestamp 200)	COMMENT
LOW	tests/test_issue2914_truncation_watermark.py	330	# Step 3: New message "light speed"	COMMENT
LOW⚡	tests/test_7864_forwarded_ignored_per_record.py	85	# Step 1: a direct client sending its own XFF.	COMMENT
LOW⚡	tests/test_7864_forwarded_ignored_per_record.py	95	# Step 2: the operator's unallowlisted Docker-bridge proxy. No second	COMMENT
LOW⚡	tests/test_approval_unblock.py	165	# Step 1: streaming.py registers the notify callback	COMMENT
LOW⚡	tests/test_approval_unblock.py	170	# Step 2: check_all_command_guards fires the callback and queues an entry	COMMENT
LOW⚡	tests/test_approval_unblock.py	187	# Step 3: user responds via /api/approval/respond → resolve_gateway_approval	COMMENT
LOW⚡	tests/test_approval_unblock.py	191	# Step 4: agent thread is unblocked with the correct choice	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	97	# Step 1: Truncate (edit) — keep 2 messages (first exchange)	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	104	# Step 2: Send new message "square" — checkpoint advances watermark	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	134	# Step 1: Truncate (edit) — keep 2 messages (first exchange)	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	138	# Step 2: Send new message "square"	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	145	# Step 3: Simulate state.db containing both original and edited messages	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	155	# Step 4: Reload from disk (simulates session switch → switch back)	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	164	# Step 5: Merge sidecar + state.db (what GET /api/session does)	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	202	# Step 1: Truncate (edit) — keep 2 messages	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	206	# Step 2: Send edited message	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	211	# Step 3: Simulate assistant reply	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	215	# Step 4: Send second new turn	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	221	# Step 5: Simulate state.db with all messages	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	233	# Step 6: Reload from disk	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	241	# Step 7: Merge	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	277	# Step 1: Retry — truncates to before "second"	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	283	# Step 2: Send new message	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	310	# Step 1: Undo — removes "second" and "reply2"	COMMENT
LOW⚡	tests/test_watermark_advance_after_edit.py	316	# Step 2: Send new message	COMMENT
LOW⚡	tests/test_issue1633_models_cache_version_stamp.py	369	# Step 4: cache rejected → caller will rebuild from live provider data	COMMENT
LOW	tests/test_issue1633_models_cache_version_stamp.py	351	# Step 1: v0.50.281 writes cache	COMMENT

Modern Structural Boilerplate62 hits · 54 pts

Severity	File	Line	Snippet	Context
LOW	server.py	108	logger = logging.getLogger(__name__)	CODE
LOW	tests/browser_approval_first_click.py	285	def _settle_reconcile(page, timeout: float = 5.0) -> None:	CODE
LOW⚡	tests/test_auth_password_hash_cache.py	65	def _set_env_pw(self, pw: str) -> None:	CODE
LOW	tests/test_auth_password_hash_cache.py	178	def _set_env_pw(self, pw: str) -> None:	CODE
LOW	api/agent_health.py	38	logger = logging.getLogger(__name__)	CODE
LOW	api/plugins.py	21	logger = logging.getLogger(__name__)	CODE
LOW	api/auth.py	22	logger = logging.getLogger(__name__)	CODE
LOW	api/auth.py	1409	def set_auth_cookie(handler, cookie_value) -> None:	CODE
LOW	api/process_event_utils.py	14	logger = logging.getLogger(__name__)	CODE
LOW	api/session_lifecycle.py	45	logger = logging.getLogger(__name__)	CODE
LOW	api/run_journal.py	35	logger = logging.getLogger(__name__)	CODE
LOW	api/config.py	301	logger = logging.getLogger(__name__)	CODE
LOW	api/config.py	13679	def update_active_run(stream_id: str, **metadata) -> None:	CODE
LOW	api/plugin_providers.py	19	logger = logging.getLogger(__name__)	CODE
LOW	api/models.py	57	logger = logging.getLogger(__name__)	CODE
LOW	api/run_drain.py	38	logger = logging.getLogger(__name__)	CODE
LOW	api/run_drain.py	349	def _settle_one(stream_id: str, ev: threading.Event) -> None:	CODE
LOW	api/terminal.py	39	def _set_nonblocking(fd: int) -> None:	CODE
LOW	api/terminal.py	386	def _set_size(term: TerminalSession, rows: int, cols: int) -> None:	CODE
LOW	api/goals.py	14	logger = logging.getLogger(__name__)	CODE
LOW	api/gateway_delegation_wakeup.py	39	logger = logging.getLogger(__name__)	CODE
LOW	api/agent_sessions.py	11	logger = logging.getLogger(__name__)	CODE
LOW	api/onboarding.py	35	logger = logging.getLogger(__name__)	CODE
LOW	api/updates.py	44	logger = logging.getLogger(__name__)	CODE
LOW	api/background_process.py	64	logger = logging.getLogger(__name__)	CODE
LOW	api/memory_profile_scope.py	55	logger = logging.getLogger(__name__)	CODE
LOW	api/memory_profile_scope.py	294	def _set_memory_status(agent: Any, code: str) -> None:	CODE
LOW⚡	api/compression_continuation.py	10	logger = logging.getLogger(__name__)	CODE
LOW	api/metering.py	100	def set_pending_started_at(self, stream_id: str, pending_started_at) -> None:	CODE
LOW	api/background.py	9	logger = logging.getLogger(__name__)	CODE
LOW	api/auth_oidc.py	24	logger = logging.getLogger(__name__)	CODE
LOW	api/skill_usage.py	9	logger = logging.getLogger(__name__)	CODE
LOW⚡	api/gateway_chat.py	2271	def _settle_delegation_reservation(session_id, stream_id, accepted: bool) -> None:	CODE
LOW	api/gateway_chat.py	47	logger = logging.getLogger(__name__)	CODE
LOW	api/gateway_chat.py	2447	def _settle_gateway_cancelled_turn(session_id, stream_id) -> None:	CODE
LOW	api/rollback.py	22	logger = logging.getLogger(__name__)	CODE
LOW	api/session_ops.py	26	logger = logging.getLogger(__name__)	CODE
LOW	api/session_events.py	7	logger = logging.getLogger(__name__)	CODE
LOW	api/todo_state.py	53	logger = logging.getLogger(__name__)	CODE
LOW	api/mcp_runtime.py	27	logger = logging.getLogger(__name__)	CODE
LOW	api/route_approvals.py	151	def set_session_yolo_enabled(session_key: str, enabled: bool) -> None:	CODE
LOW	api/route_approvals.py	527	def _settle_gateway_entry(entry, choice: str, reason: str \| None = None) -> None:	CODE
LOW	api/providers.py	67	logger = logging.getLogger(__name__)	CODE
LOW	api/session_recovery.py	46	logger = logging.getLogger(__name__)	CODE
LOW	api/workspace_git.py	33	logger = logging.getLogger(__name__)	CODE
LOW	api/crash_visibility.py	50	__all__ = [	CODE
LOW	api/gateway_watcher.py	25	logger = logging.getLogger(__name__)	CODE
LOW⚡	api/workspace.py	708	def set_last_workspace(path: str, profile: str \| Path \| None = None) -> None:	CODE
LOW	api/workspace.py	29	logger = logging.getLogger(__name__)	CODE
LOW	api/delegation_status.py	42	logger = logging.getLogger(__name__)	CODE
LOW	api/streaming.py	29	logger = logging.getLogger(__name__)	CODE
LOW	api/helpers.py	17	logger = logging.getLogger(__name__)	CODE
LOW	api/gateway_restart.py	22	logger = logging.getLogger(__name__)	CODE
LOW	api/commands.py	13	logger = logging.getLogger(__name__)	CODE
LOW⚡	api/profiles.py	27	logger = logging.getLogger(__name__)	CODE
LOW	api/profiles.py	541	def set_request_profile(name: str) -> None:	CODE
LOW	api/shares.py	36	logger = logging.getLogger(__name__)	CODE
LOW	api/state_sync.py	26	logger = logging.getLogger(__name__)	CODE
LOW	api/oauth.py	25	logger = logging.getLogger(__name__)	CODE
LOW	api/oauth.py	668	def _set_flow_status(flow_id: str, status: str, **fields: Any) -> None:	CODE
2 more matches not shown…

Modern AI Meta-Vocabulary26 hits · 54 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	tests/test_session_unread_dot_on_visit.py	38	# Sibling harness scaffolding lives beside this file and is not on sys.path by	COMMENT
MEDIUM	tests/browser_approval_first_click.py	61	# ── server boot scaffolding (same shape as browser_conversation_lifecycle.py) ─	COMMENT
MEDIUM⚡	tests/test_issue5960_cron_unread_profile_scope.py	20	# Sibling harness scaffolding lives beside this file and is not on sys.path by	COMMENT
MEDIUM	tests/test_issue3831_watermark_clear.py	148	# --- The guardrails: the fix must NOT regress #2914/#3102 ---------------------	COMMENT
MEDIUM	tests/test_pr1341_context_window_persistence.py	33	# Find the post-merge save block — anchored on the unique reasoning trace	COMMENT
MEDIUM	tests/test_tool_limit_terminal_state.py	888	# Synthetic scaffolding turn was still dropped, even after fallback injection.	COMMENT
MEDIUM⚡	tests/test_issue5273_active_done_viewed_sync.py	15	# Sibling harness scaffolding lives beside this file and is not on sys.path by	COMMENT
MEDIUM	tests/test_issue5334_verification_stop_leak.py	105	# No leftover synthetic scaffolding rows.	COMMENT
MEDIUM	tests/test_1003_preferences_autosave.py	86	# We use a context window around the dom_id to find the listener.	COMMENT
MEDIUM	docs/rfcs/stable-assistant-turn-anchors.md	888	### Phase 1: Internal anchor scaffold	COMMENT
MEDIUM	…cs/architecture/stable-assistant-turn-anchor-phase0.md	15	- The #3962 Phase 0 scaffold shipped through #3977 / v0.51.359: inventory the	CODE
MEDIUM	api/config.py	12868	# agent token stream), an OOM risk with many tabs × long agentic turns. This	COMMENT
MEDIUM	api/config.py	13125	STREAM_REASONING_TEXT: dict = {} # stream_id -> reasoning trace accumulated during streaming (#1361 §A)	CODE
MEDIUM	api/streaming.py	2363	# Structured markers the Hermes Agent stamps on synthetic scaffolding turns that	COMMENT
MEDIUM	api/streaming.py	3270	# synthetic-scaffolding flag convention already used elsewhere (#5334).	COMMENT
MEDIUM	api/streaming.py	5115	# Guard against chain-of-thought leakage, meta-reasoning, and trivial echo.	COMMENT
MEDIUM	api/streaming.py	5482	# agentic first-turn plans that are legitimate title candidates.	COMMENT
MEDIUM	api/streaming.py	11630	# Drop Hermes Agent internal verify-loop scaffolding (synthetic "premature	COMMENT
MEDIUM	api/streaming.py	17427	# Persist reasoning trace in the session so it survives reload.	COMMENT
MEDIUM	api/streaming.py	17551	# Persist context window data on the session so the context-ring	COMMENT
MEDIUM	api/streaming.py	17553	# s.save() for the same reason as the reasoning trace above.	COMMENT
MEDIUM	api/streaming.py	17945	# Include context window data from the agent's compressor for the UI indicator.	COMMENT
MEDIUM	api/streaming.py	18007	# resolve the model's context window from metadata so the UI indicator	COMMENT
MEDIUM	api/streaming.py	18072	# (reasoning trace already attached + saved above, before s.save())	COMMENT
MEDIUM	api/streaming.py	19546	# Capture reasoning trace and live tool calls (#1361 §A + §B)	COMMENT
MEDIUM	api/streaming.py	19842	# #1361: Also persist reasoning trace and live tool calls that were	COMMENT

Fake / Example Data45 hits · 38 pts

Severity	File	Line	Snippet	Context
LOW	tests/test_issue3957_profile_providers_models.py	674	return "fake_token"	CODE
LOW	tests/test_issue3957_profile_providers_models.py	727	return "fake_token"	CODE
LOW	tests/test_issue7056_login_hides_password_form.py	148	"placeholder": "Password",	CODE
LOW	tests/test_pr7555_cli_session_availability.py	882	db.write_text("placeholder", encoding="utf-8")	CODE
LOW⚡	tests/test_auth_sessions.py	39	auth._sessions["fake_token"] = time.time() - 100	CODE
LOW⚡	tests/test_auth_sessions.py	49	auth.verify_session("fake_token.fake_sig")	CODE
LOW⚡	tests/test_auth_sessions.py	54	self.assertNotIn("fake_token", auth._sessions)	CODE
LOW⚡	tests/_layout_helpers.py	290	var RAW_ATTRS = ["title", "aria-label", "placeholder"]	CODE
LOW	tests/test_runtime_model_observation.py	47	writer.append_sse_event("runtime_model", malformed if malformed is not None else {"placeholder": True})	CODE
LOW	tests/test_issue3825_oidc_auth.py	307	"allow_values": ["user@example.com"],	CODE
LOW	tests/test_issue3825_oidc_auth.py	404	"allow_values": ["user@example.com"],	CODE
LOW	tests/test_issue2271_keyless_custom_provider.py	18	assert api_key == "dummy-key"	CODE
LOW	tests/test_issue2271_keyless_custom_provider.py	54	assert api_key == "dummy-key"	CODE
LOW⚡	tests/test_webui_gateway_chat_backend.py	2166	monkeypatch.setenv(key, "placeholder") # registers the key so monkeypatch removes what the loader sets	CODE
LOW	tests/test_sprint46.py	73	"api_key": "fake-key",	CODE
LOW	tests/test_sprint46.py	98	"api_key": "fake-key",	CODE
LOW	tests/test_mobile_scroll_jank.html	166	addMessage(role,`Message ${i+1}: `+'Lorem ipsum dolor sit amet consectetur adipiscing elit. '.repeat(3));	CODE
LOW	tests/test_mobile_scroll_jank.html	166	addMessage(role,`Message ${i+1}: `+'Lorem ipsum dolor sit amet consectetur adipiscing elit. '.repeat(3));	CODE
LOW	tests/test_login_locale_parity.py	221	"placeholder",	CODE
LOW	tests/test_issue4836_manual_compression_recovery.py	61	"api_key": "fake-key",	CODE
LOW	tests/test_issue4836_manual_compression_recovery.py	86	"api_key": "fake-key",	CODE
LOW	tests/test_issue5331_index_only_ghost_cleanup.py	144	routes.SESSIONS["sess-mem"] = "placeholder"	CODE
LOW	tests/test_issue5331_index_only_ghost_cleanup.py	168	routes.SESSIONS["sess-3"] = "placeholder"	CODE
LOW⚡	…sts/test_issue1806_named_custom_provider_resolution.py	2101	# The second half of the same contract is ``dummy-key``. It asserts "this	COMMENT
LOW	…sts/test_issue1806_named_custom_provider_resolution.py	1075	# The same distinction gates ``dummy-key``: it is a statement that the endpoint	COMMENT
LOW⚡	…sts/test_issue1806_named_custom_provider_resolution.py	1281	endpoint ``dummy-key`` instead — because the row carries no literal	STRING
LOW⚡	…sts/test_issue1806_named_custom_provider_resolution.py	1358	rotation at the previous authority; falling back to ``dummy-key`` drops the	STRING
LOW	…sts/test_issue1806_named_custom_provider_resolution.py	1315	"""(b) ``dummy-key`` asserts "this endpoint is unauthenticated" — never a guess.	STRING
LOW	…sts/test_issue1806_named_custom_provider_resolution.py	2153	``dummy-key``.	STRING
LOW	…sts/test_issue1806_named_custom_provider_resolution.py	2360	that as keyless is what let ``dummy-key`` be substituted for a genuinely	STRING
LOW	…sts/test_issue1806_named_custom_provider_resolution.py	2414	"""The negative control: a genuinely unauthenticated endpoint keeps ``dummy-key``.	STRING
LOW	…sts/test_issue1806_named_custom_provider_resolution.py	2558	is unauthenticated. ``dummy-key`` follows from the row, not from the keyed	STRING
LOW	…sts/test_issue1806_named_custom_provider_resolution.py	2950	so no ``dummy-key`` is substituted and the pair stays incomplete — and an	STRING
LOW⚡	tests/test_redact_large_string_cache.py	52	unit = "lorem ipsum dolor sit amet "	CODE
LOW⚡	tests/test_redact_large_string_cache.py	52	unit = "lorem ipsum dolor sit amet "	CODE
LOW	tests/test_redact_large_string_cache.py	123	text = ("see https://example.invalid/docs lorem ipsum " * 500) + _RUNTIME_TOKEN + " tail"	CODE
LOW	tests/test_oidc_token_endpoint_auth.py	27	"allow_values": ["user@example.com"],	CODE
LOW	tests/test_oidc_token_endpoint_auth.py	60	lambda _args, *_kwargs: {"sub": "user-1", "email": "user@example.com"},	CODE
LOW⚡	tests/test_compression_phantom_barrier.py	242	assert before["placeholder"] == "Type a message — it will queue and send after compression"	STRING
LOW⚡	tests/test_compression_phantom_barrier.py	251	"placeholder": "Original placeholder",	STRING
LOW	tests/test_sensitive_prefilter_equivalence.py	107	"https", "http", "user@example.com", "1234567890",	CODE
LOW	tests/test_update_banner_fixes.py	1706	'api_key': 'fake-key',	CODE
LOW	tests/test_issue540_workspace_office_documents.py	323	preview_office_document("budget.xlsx", b"placeholder")	CODE
LOW	tests/test_issue540_workspace_office_documents.py	406	preview = preview_office_document("budget.xlsx", b"placeholder")	CODE
LOW	api/config.py	4416	KEYLESS_CUSTOM_API_KEY = "dummy-key"	CODE

AI Structural Patterns42 hits · 30 pts

Severity	File	Line	Context
LOW	tests/test_session_middle_click_new_tab.py	612	CODE
LOW	tests/test_auto_compression_terminal_failure.py	62	CODE
LOW	tests/test_auto_compression_terminal_failure.py	474	CODE
LOW	tests/test_scroll_collapse_clamp_keeps_follow.py	52	CODE
LOW	tests/test_webui_provider_routing_parity.py	371	CODE
LOW	tests/test_gateway_sync.py	132	CODE
LOW	tests/test_gateway_sync.py	176	CODE
LOW	tests/test_6710_panel_dismiss_and_artifact_open.py	234	CODE
LOW	tests/test_issue7396_key_cmd_cache.py	97	CODE
LOW	tests/test_sprint42.py	201	CODE
LOW	tests/test_sprint42.py	294	CODE
LOW	tests/test_sprint42.py	686	CODE
LOW	tests/test_sprint42.py	1057	CODE
LOW	tests/test_issue3895_opencode_go_model_picker.py	114	CODE
LOW	tests/test_session_lineage_metadata_api.py	85	CODE
LOW	tests/test_issue1857_usage_overwrite.py	80	CODE
LOW	tests/test_issue_progress_echo_dedupe.py	76	CODE
LOW	tests/test_issue_progress_echo_dedupe.py	244	CODE
LOW	tests/test_issue_progress_echo_dedupe.py	426	CODE
LOW	…sts/test_issue1806_named_custom_provider_resolution.py	510	CODE
LOW	…sts/test_issue1806_named_custom_provider_resolution.py	1583	CODE
LOW	tests/test_issue4251_wakeup_model_picker_race.py	54	CODE
LOW	tests/test_tool_limit_terminal_state.py	48	CODE
LOW	tests/test_native_image_turn_display_context.py	62	CODE
LOW	tests/test_issue5720_reasoning_owner.py	18	CODE
LOW	tests/test_settlement_agent_reasoning_authoritative.py	117	CODE
LOW	tests/test_settlement_agent_reasoning_authoritative.py	159	CODE
LOW	tests/test_turn_usage_persisted_on_settle.py	104	CODE
LOW	tests/test_issue5637_stale_anchor_guard.py	369	CODE
LOW	tests/test_model_alias_routes.py	937	CODE
LOW	api/startup.py	131	CODE
LOW	api/startup.py	204	CODE
LOW	api/models.py	10590	CODE
LOW	api/models.py	1771	CODE
LOW	api/goals.py	760	CODE
LOW	api/agent_sessions.py	750	CODE
LOW	api/gateway_chat.py	2993	CODE
LOW	api/runtime_adapter.py	314	CODE
LOW	api/workspace_git.py	180	CODE
LOW	api/route_session_list_cache.py	327	CODE
LOW	api/streaming.py	13667	CODE
LOW	api/state_sync.py	268	CODE

Redundant / Tautological Comments10 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	tests/test_onboarding_mvp.py	18	# Check if pyyaml is available — onboarding setup tests need it on the server	COMMENT
LOW	tests/test_sprint42.py	828	# Check if this try imports hermes_state	COMMENT
LOW	tests/test_issue1139_password_remote.py	75	# Check if pane has any input fields (not just buttons)	COMMENT
LOW	tests/test_sprint15.py	137	# Assign session to project	COMMENT
LOW	tests/test_session_batch_select.py	190	# Check if the key exists in the locale block	COMMENT
LOW⚡	api/config.py	1131	# Check if session store is empty	COMMENT
LOW⚡	api/config.py	1141	# Check if SESSION_INDEX_FILE is absent, empty, or contains only {}\|[]\|null	COMMENT
LOW	api/config.py	11118	# Check if user has configured models in config.yaml —	COMMENT
LOW	api/providers.py	2993	# Check if actually authenticated via hermes_cli.	COMMENT
LOW	api/streaming.py	5071	# Check if contains any function_calls/DSML marker (case-insensitive)	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	tests/test_issue3293_title_language_drift.py	255	# Japanese title for an English conversation would be generated as requested	COMMENT

Dead Code1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/test_gateway_events_watchdog_7978.py	353		CODE

nesquena/hermes-webui

Open-Source Code Quality, Security and Technical Debt Review