2.2

Adjusted Signal

2.2

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

3.7K

Stars

Language

829.5K

Lines of Code

4.3K

Files

1.1K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 827 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.5/100 · LOW

Are imports declared and package/API names verified? 72 finding(s).

Agent Over-Engineering Ratio 4.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 364 finding(s).

PR Review Velocity Impact 9.4/100 · LOW

Which changes need focused human review? 1138 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 23MEDIUM 192LOW 923

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1138 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators153 hits · 459 pts

Severity	File	Line	Snippet	Context
MEDIUM	cmd/pkg-helper/main_test.go	462	// ── v2 tests ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/integration/hooks_phase08_helpers.go	18	// ─── Phase 08 shared test helpers ────────────────────────────────────────────	COMMENT
MEDIUM	internal/workstation/security/allowlist.go	87	// ── Step 1: NFKC normalize ───────────────────────────────────────────────	COMMENT
MEDIUM	internal/workstation/security/allowlist.go	94	// ── Step 2: byte-level safety (NUL / CRLF) ──────────────────────────────	COMMENT
MEDIUM	internal/workstation/security/allowlist.go	107	// ── Step 3: binary allowlist (default-deny) ──────────────────────────────	COMMENT
MEDIUM	internal/pipeline/stages_test.go	3135	// ─── parseTTL (Phase 06) ─────────────────────────────────────────────────	COMMENT
MEDIUM	internal/pipeline/stages_test.go	3157	// ─── Cache-TTL gate (Phase 06) ───────────────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	19	// ─── minimal stub stores ───────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	129	// ─── NewTaskTicker ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	158	// ─── Start / Stop ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	193	// ─── Periodic tick ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	222	// ─── recoverAll steps (unit-level, no goroutine) ──────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	271	// ─── followupInterval ──────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	303	// ─── pruneCooldowns ───────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	335	// ─── processTeamFollowups ─────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	451	// ─── notifyLeaders (nil msgBus is a no-op) ────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	464	// ─── Race detector: concurrent Start/Stop ────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	483	// ─── processFollowups with no tasks ──────────────────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	527	// ─── notifyLeaders: nil-team and tenant propagation ──────────────────────────	COMMENT
MEDIUM	internal/tasks/task_ticker_test.go	659	// ─── processFollowups: multi-tenant tenant ctx and nil-team guard ─────────────	COMMENT
MEDIUM	internal/tools/knowledge_graph_test.go	13	// ── mock KG store ──────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tools/knowledge_graph_test.go	133	// ── test helpers ───────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tools/knowledge_graph_test.go	200	// ── tests ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tools/user_tool_overlay_test.go	50	// ─── Overlay exposes per-user tools via List/Get ──────────────────────────	COMMENT
MEDIUM	internal/tools/user_tool_overlay_test.go	70	// ─── Empty / all-nil userTools returns base unchanged ─────────────────────	COMMENT
MEDIUM	internal/tools/user_tool_overlay_test.go	82	// ─── Policy with default (full) profile emits per-user tools ──────────────	COMMENT
MEDIUM	internal/tools/session_scope_test.go	10	// ─── extractGroupChatID ──────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tools/session_scope_test.go	123	// ─── isSessionInScope ────────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tools/session_scope_test.go	382	// ─── Guild user through isSessionInScope ─────────────────────────────────────	COMMENT
MEDIUM	internal/tools/session_scope_test.go	403	// ─── Realistic long chatIDs (production Zalo IDs) ────────────────────────────	COMMENT
MEDIUM	internal/tools/session_scope_test.go	451	// ─── Cron own session match ──────────────────────────────────────────────────	COMMENT
MEDIUM	internal/tools/session_scope_test.go	464	// ─── Multi-colon chatID through full flow ────────────────────────────────────	COMMENT
MEDIUM	internal/tools/session_scope_test.go	503	// ─── Malformed group userID → no restriction ─────────────────────────────────	COMMENT
MEDIUM	internal/agent/intent_classify_test.go	11	// ─── quickClassify ────────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/intent_classify_test.go	63	// ─── containsWholeWord ───────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/intent_classify_test.go	87	// ─── ClassifyIntent via mock provider ────────────────────────────────────	COMMENT
MEDIUM	internal/agent/intent_classify_test.go	165	// ─── formatPhase / formatToolLabel ───────────────────────────────────────	COMMENT
MEDIUM	internal/agent/intent_classify_test.go	211	// ─── FormatStatusReply ────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/intent_classify_test.go	231	// ─── IsExactCancelKeyword ─────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_mcp_user_test.go	226	// ── Bitrix24-specific cases (C1 fix) ───────────────────────────	COMMENT
MEDIUM	internal/agent/loop_mcp_user_test.go	270	// ── Other channel backward compat ──────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	15	// ─── uniquifyToolCallIDs ──────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	90	// ─── shouldShareKnowledgeGraph ───────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	113	// ─── shouldShareSessions ──────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	146	// ─── InvalidateUserWorkspace ──────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	166	// ─── ProviderName ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	182	// ─── expandWorkspace ──────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	209	// ─── buildChannelMeta ─────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	247	// ─── agentToolPolicyWithMCP ───────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	286	// ─── agentToolPolicyWithWorkspace ─────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_utils_test.go	328	// ─── buildTeamMD ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/extractive_memory_test.go	10	// ─── ExtractiveMemoryFallback ─────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/extractive_memory_test.go	116	// ─── dedup ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/extractive_memory_test.go	151	// ─── appendIfAbsent ───────────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/loop_user_mcp_tools_surface_test.go	38	// ─── Per-user MCP tools appear in the LLM tool list ───────────────────────	COMMENT
MEDIUM	internal/agent/loop_user_mcp_tools_surface_test.go	68	// ─── Duplicate per-user tool names emit only one def ──────────────────────	COMMENT
MEDIUM	internal/agent/pruning_test.go	12	// ─── resolvePruningSettings ───────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/pruning_test.go	83	// ─── findAssistantCutoff ──────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/pruning_test.go	138	// ─── takeHead / takeTail ──────────────────────────────────────────────────	COMMENT
MEDIUM	internal/agent/pruning_test.go	178	// ─── estimateMessageChars ─────────────────────────────────────────────────	COMMENT
93 more matches not shown…

Over-Commented Block363 hits · 363 pts

Severity	File	Line	Snippet	Context
LOW	docker-compose.selfservice.yml	1	# Self-service overlay — adds separate nginx web dashboard UI.	COMMENT
LOW	docker-compose.browser.yml	1	# Browser sidecar overlay — adds headless Chrome for the browser automation tool.	COMMENT
LOW	docker-compose.postgres.yml	1	# PostgreSQL overlay — pgvector for multi-tenant storage.	COMMENT
LOW	docker-compose.upgrade.yml	1	# Upgrade overlay — one-shot database upgrade service.	COMMENT
LOW	docker-compose.lightpanda.yml	1	# Lightpanda sidecar overlay — lightweight CDP browser.	COMMENT
LOW	docker-compose.sandbox.yml	1	# Sandbox overlay — enables Docker-based sandbox for agent code execution.	COMMENT
LOW	docker-compose.forkdev.yml	1	# Local-build overlay for the "fork-dev" integration branch.	COMMENT
LOW	docker-entrypoint.sh	1	#!/bin/sh	COMMENT
LOW	docker-compose.cloudflared.yml	1	# Cloudflare Tunnel (cloudflared) — expose the gateway via Cloudflare without opening host ports.	COMMENT
LOW	docker-compose.yml	1	# Base docker-compose — shared service definition.	COMMENT
LOW	…pages/channels/bitrix24/bitrix-portal-help-section.tsx	1	import { useState } from "react";	COMMENT
LOW	cmd/gateway.go	921	// the legacy mcp_server_name + mcp_base_url pair — in their	COMMENT
LOW	cmd/gateway_lifecycle.go	361	// Compiled via build tags: `go build -tags tsnet` to enable.	COMMENT
LOW	cmd/gateway_consumer_normal.go	321	extraPrompt += "\n\n"	COMMENT
LOW	cmd/gateway_consumer_normal.go	461		COMMENT
LOW	cmd/gateway_cron.go	21	)	COMMENT
LOW	cmd/gateway_cron.go	121	defer cancelCron()	COMMENT
LOW	docker/requirements-base.txt	1	# Base Python dependencies — installed when ENABLE_PYTHON=true or ENABLE_FULL_SKILLS=true.	COMMENT
LOW	compose.options/13-upgrade.yml	1	# Upgrade overlay — one-shot database upgrade service.	COMMENT
LOW	compose.options/11-postgres.yml	1	# PostgreSQL overlay — pgvector for multi-tenant storage.	COMMENT
LOW	compose.options/12-selfservice.yml	1	# Self-service overlay — adds separate nginx web dashboard UI.	COMMENT
LOW	compose.options/14-browser.yml	1	# Browser sidecar overlay — adds headless Chrome for the browser automation tool.	COMMENT
LOW	compose.options/17-sandbox.yml	1	# Sandbox overlay — enables Docker-based sandbox for agent code execution.	COMMENT
LOW	…tegration/telegram_group_write_file_permission_test.go	1	//go:build integration	COMMENT
LOW	tests/integration/git_adapter_ssh_test.go	1	//go:build integration	COMMENT
LOW	tests/integration/hooks_capability_tier_test.go	21	// - non-builtin scripts returning updatedInput have it stripped (FireResult	COMMENT
LOW	tests/integration/v3_test_helper.go	181		COMMENT
LOW	tests/integration/packages_apk_test.go	1	//go:build apk_e2e	COMMENT
LOW	tests/integration/githttp_helper_test.go	1	//go:build integration	COMMENT
LOW	tests/integration/git_adapter_pat_test.go	1	//go:build integration	COMMENT
LOW	tests/integration/hooks_ws_end_to_end_test.go	21	// Phase 08 — F bucket: WS end-to-end equivalence.	COMMENT
LOW	internal/workstation/security/normalize.go	1	// Package security provides input normalization and allowlist matching for	COMMENT
LOW	internal/workstation/security/normalize.go	21	// - U+00AD SOFT HYPHEN	COMMENT
LOW	internal/workstation/security/allowlist.go	61		COMMENT
LOW	internal/mediabudget/mediabudget.go	1	// Package mediabudget estimates the token cost of media payloads that are	COMMENT
LOW	internal/mediabudget/mediabudget.go	61	// maxTokenEstimate: clamp so overflowed or implausible arithmetic never surfaces as a negative charge (read as free by	COMMENT
LOW	internal/pipeline/deps.go	41		COMMENT
LOW	internal/pipeline/deps.go	101	// When any tool call in a batch matches, ToolStage uses ExecuteToolCall for the	COMMENT
LOW	internal/pipeline/deps.go	161		COMMENT
LOW	internal/pipeline/tool_stage_authorize_test.go	141	t.Error("denied tool must not be added to AllowedTools")	COMMENT
LOW	internal/pipeline/compaction_pressure_e2e_test.go	1	package pipeline	COMMENT
LOW	internal/pipeline/compaction_pressure_e2e_test.go	21	// the flag as `_ bool` and never asserts it, so hardcoding `false` at the	COMMENT
LOW	internal/pipeline/substates.go	21	// ContextStage and read by PruneStage on every iteration. Zero means "no	COMMENT
LOW	internal/pipeline/substates.go	81	// has produced a final answer but before the run finalizes. The pipeline	COMMENT
LOW	internal/pipeline/think_stage.go	81	return fmt.Errorf("CallLLM callback not configured")	COMMENT
LOW	internal/pipeline/think_stage.go	181	// Skip if raw content present (Anthropic thinking passback) to avoid desync.	COMMENT
LOW	internal/tracing/collector.go	101		COMMENT
LOW	internal/tracing/collector.go	161	// on success, bypassing the 5s OnFlush buffer for low-latency status events.	COMMENT
LOW	internal/tracing/cost.go	1	package tracing	COMMENT
LOW	internal/crypto/env_denylist.go	81	}	COMMENT
LOW	internal/eventbus/validate_agent_id.go	1	package eventbus	COMMENT
LOW	internal/upgrade/hooks.go	1	package upgrade	COMMENT
LOW	internal/upgrade/hook_web_search_migrate.go	1	// Package upgrade provides data migration hooks for Go-level data transformations.	COMMENT
LOW	internal/upgrade/hook_workspace_normalize.go	21	// A workspace is considered stale when it is non-portable on the new host:	COMMENT
LOW	internal/tools/media_provider_chain_pool_test.go	121	// so HasRegisteredProviders() == true → we get a router. Adjust test to check	COMMENT
LOW	internal/tools/vault_read.go	441	}	COMMENT
LOW	internal/tools/credentialed_exec.go	41	// Examples: "/usr/bin/gh" → "gh", "./GH" → "gh", " Gh " → "gh".	COMMENT
LOW	internal/tools/credentialed_exec.go	321		COMMENT
LOW	internal/tools/credentialed_exec.go	621	for _, key := range required {	COMMENT
LOW	internal/tools/credential_ephemeral.go	1	package tools	COMMENT
303 more matches not shown…

Structural Annotation Overuse154 hits · 300 pts

Severity	File	Line	Snippet	Context
LOW⚡	cmd/setup_cmd.go	28	// Step 1: Providers	COMMENT
LOW⚡	cmd/setup_cmd.go	31	// Step 2: Agent	COMMENT
LOW⚡	cmd/setup_cmd.go	34	// Step 3: Channel (optional)	COMMENT
LOW⚡	cmd/agent.go	133	// Step 1: Agent key	COMMENT
LOW⚡	cmd/agent.go	140	// Step 2: Display name	COMMENT
LOW⚡	cmd/agent.go	147	// Step 3: Agent type	COMMENT
LOW	cmd/agent.go	158	// Step 4: Provider (fetched from gateway)	COMMENT
LOW	cmd/agent.go	180	// Step 5: Model (fetched from selected provider)	COMMENT
LOW	cmd/channels_cmd.go	94	// Step 1: Channel type	COMMENT
LOW⚡	cmd/channels_cmd.go	106	// Step 2: Name	COMMENT
LOW⚡	cmd/channels_cmd.go	113	// Step 3: Credentials per type	COMMENT
LOW	cmd/channels_cmd.go	145	// Step 4: Bind to agent	COMMENT
LOW	cmd/pairing.go	199	// Step 1: Send connect handshake	COMMENT
LOW	cmd/pairing.go	228	// Step 2: Send the RPC call	COMMENT
LOW	cmd/providers_cmd.go	123	// Step 1: Provider type	COMMENT
LOW⚡	cmd/providers_cmd.go	140	// Step 2: Name	COMMENT
LOW⚡	cmd/providers_cmd.go	147	// Step 3: API key	COMMENT
LOW⚡	cmd/providers_cmd.go	154	// Step 4: Base URL (pre-fill per type, editable)	COMMENT
LOW	tests/integration/v3_mcp_oauth_flow_test.go	154	// Step 1: callback to persist token.	COMMENT
LOW⚡	tests/integration/v3_mcp_oauth_flow_test.go	167	// Step 2: revoke (no-auth fallback → admin/MasterTenantID).	COMMENT
LOW⚡	tests/integration/v3_mcp_oauth_flow_test.go	176	// Step 3: verify token gone.	COMMENT
LOW⚡	internal/workstation/security/normalize.go	43	// Step 1: NFKC normalization — collapses fullwidth, ligatures, decomposed forms.	COMMENT
LOW⚡	internal/workstation/security/normalize.go	46	// Step 2: Strip zero-width / invisible characters.	COMMENT
LOW⚡	internal/tasks/task_ticker.go	94	// Step 1: Batch followups with own timeout (before recovery — recovery resets	COMMENT
LOW⚡	internal/tasks/task_ticker.go	101	// Step 2: Batch recovery — single query across all v2 active teams.	COMMENT
LOW	internal/tasks/task_ticker.go	125	// Step 3: Batch mark stale — pending tasks older than 2h.	COMMENT
LOW	internal/tasks/task_ticker.go	141	// Step 4: Mark in_review tasks stale after 4 hours.	COMMENT
LOW	internal/tasks/task_ticker.go	157	// Step 5: Fix orphaned blocked tasks where all blockers are terminal.	COMMENT
LOW	internal/tasks/task_ticker.go	169	// Step 6: Prune old cooldown entries to prevent memory leak.	COMMENT
LOW	internal/tools/credentialed_exec.go	247	// NOTE: This function does not respect quoting — use detectUnquotedShellOperators	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	364	// Step 0: Reject NUL bytes (defense-in-depth — also checked in Execute()).	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	369	// Step 1: Check for shell operators in the ORIGINAL command (preserves quoting).	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	377	// Step 2: Per-binary deny check (deny_args)	COMMENT
LOW	internal/tools/credentialed_exec.go	402	// Step 3: Decrypt env vars from store (already decrypted by store layer).	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	427	// Step 4: Register credential values for output scrubbing	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	432	// Step 5: Resolve binary to absolute path and verify against config	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	442	// Step 6: Determine timeout	COMMENT
LOW	internal/tools/credentialed_exec.go	505	// Step 7: Execute — sandbox or host	COMMENT
LOW	internal/tools/policy.go	139	// Step 8: Capability-based deny (v3 RBAC)	COMMENT
LOW⚡	internal/tools/policy.go	217	// Step 1: Global profile	COMMENT
LOW⚡	internal/tools/policy.go	220	// Step 2: Provider-level profile override	COMMENT
LOW⚡	internal/tools/policy.go	227	// Step 3: Global allow list (restricts to only these)	COMMENT
LOW⚡	internal/tools/policy.go	232	// Step 4: Provider-level allow override	COMMENT
LOW⚡	internal/tools/policy.go	239	// Step 5: Per-agent allow	COMMENT
LOW⚡	internal/tools/policy.go	244	// Step 6: Per-agent per-provider allow	COMMENT
LOW⚡	internal/tools/policy.go	251	// Step 7: Group-level allow	COMMENT
LOW	internal/tools/gemini_file_api.go	27	// Step 1: Initiate resumable upload.	COMMENT
LOW	internal/tools/gemini_file_api.go	58	// Step 2: Upload file bytes.	COMMENT
LOW	internal/tools/gemini_file_api.go	271	// Step 1: Initiate resumable upload.	COMMENT
LOW	internal/tools/gemini_file_api.go	302	// Step 2: Upload file stream.	COMMENT
LOW⚡	internal/tools/filesystem_write_deliver_test.go	156	// Step 1: write_file delivers the file and marks it.	COMMENT
LOW⚡	internal/tools/filesystem_write_deliver_test.go	166	// Step 2: message(MEDIA:path) for same file must be blocked.	COMMENT
LOW⚡	internal/tools/send_file_test.go	282	// Step 1: send_file delivers and marks the file.	COMMENT
LOW⚡	internal/tools/send_file_test.go	290	// Step 2: message(MEDIA:path) for same file — must be blocked by self-send guard.	COMMENT
LOW	internal/tools/send_file_test.go	341	// Step 1: write_file deliver=true creates + marks the file.	COMMENT
LOW	internal/tools/send_file_test.go	352	// Step 2: send_file for same path — must be blocked.	COMMENT
LOW⚡	internal/bootstrap/seed_store_test.go	356	// Step 1: Seed initial files (new user, skipIfAnyExist=false)	COMMENT
LOW⚡	internal/bootstrap/seed_store_test.go	361	// Step 2: Simulate auto-cleanup — BOOTSTRAP.md deleted, USER.md remains	COMMENT
LOW⚡	internal/bootstrap/seed_store_test.go	364	// Step 3: skipIfAnyExist=true (existing profile) → must NOT re-seed	COMMENT
LOW⚡	internal/bootstrap/seed_store_test.go	373	// Step 4: skipIfAnyExist=false (force) → SHOULD re-seed missing BOOTSTRAP.md	COMMENT
94 more matches not shown…

Verbosity Indicators100 hits · 196 pts

Severity	File	Line	Snippet	Context
LOW⚡	cmd/setup_cmd.go	28	// Step 1: Providers	COMMENT
LOW⚡	cmd/setup_cmd.go	31	// Step 2: Agent	COMMENT
LOW⚡	cmd/setup_cmd.go	34	// Step 3: Channel (optional)	COMMENT
LOW⚡	cmd/agent.go	133	// Step 1: Agent key	COMMENT
LOW⚡	cmd/agent.go	140	// Step 2: Display name	COMMENT
LOW⚡	cmd/agent.go	147	// Step 3: Agent type	COMMENT
LOW	cmd/agent.go	158	// Step 4: Provider (fetched from gateway)	COMMENT
LOW	cmd/agent.go	180	// Step 5: Model (fetched from selected provider)	COMMENT
LOW	cmd/channels_cmd.go	94	// Step 1: Channel type	COMMENT
LOW⚡	cmd/channels_cmd.go	106	// Step 2: Name	COMMENT
LOW⚡	cmd/channels_cmd.go	113	// Step 3: Credentials per type	COMMENT
LOW	cmd/channels_cmd.go	145	// Step 4: Bind to agent	COMMENT
LOW	cmd/pairing.go	199	// Step 1: Send connect handshake	COMMENT
LOW	cmd/pairing.go	228	// Step 2: Send the RPC call	COMMENT
LOW	cmd/providers_cmd.go	123	// Step 1: Provider type	COMMENT
LOW⚡	cmd/providers_cmd.go	140	// Step 2: Name	COMMENT
LOW⚡	cmd/providers_cmd.go	147	// Step 3: API key	COMMENT
LOW⚡	cmd/providers_cmd.go	154	// Step 4: Base URL (pre-fill per type, editable)	COMMENT
LOW	tests/integration/v3_mcp_oauth_flow_test.go	154	// Step 1: callback to persist token.	COMMENT
LOW⚡	tests/integration/v3_mcp_oauth_flow_test.go	167	// Step 2: revoke (no-auth fallback → admin/MasterTenantID).	COMMENT
LOW⚡	tests/integration/v3_mcp_oauth_flow_test.go	176	// Step 3: verify token gone.	COMMENT
LOW⚡	internal/workstation/security/normalize.go	43	// Step 1: NFKC normalization — collapses fullwidth, ligatures, decomposed forms.	COMMENT
LOW⚡	internal/workstation/security/normalize.go	46	// Step 2: Strip zero-width / invisible characters.	COMMENT
LOW⚡	internal/tasks/task_ticker.go	94	// Step 1: Batch followups with own timeout (before recovery — recovery resets	COMMENT
LOW⚡	internal/tasks/task_ticker.go	101	// Step 2: Batch recovery — single query across all v2 active teams.	COMMENT
LOW	internal/tasks/task_ticker.go	125	// Step 3: Batch mark stale — pending tasks older than 2h.	COMMENT
LOW	internal/tasks/task_ticker.go	141	// Step 4: Mark in_review tasks stale after 4 hours.	COMMENT
LOW	internal/tasks/task_ticker.go	157	// Step 5: Fix orphaned blocked tasks where all blockers are terminal.	COMMENT
LOW	internal/tasks/task_ticker.go	169	// Step 6: Prune old cooldown entries to prevent memory leak.	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	364	// Step 0: Reject NUL bytes (defense-in-depth — also checked in Execute()).	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	369	// Step 1: Check for shell operators in the ORIGINAL command (preserves quoting).	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	377	// Step 2: Per-binary deny check (deny_args)	COMMENT
LOW	internal/tools/credentialed_exec.go	402	// Step 3: Decrypt env vars from store (already decrypted by store layer).	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	427	// Step 4: Register credential values for output scrubbing	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	432	// Step 5: Resolve binary to absolute path and verify against config	COMMENT
LOW⚡	internal/tools/credentialed_exec.go	442	// Step 6: Determine timeout	COMMENT
LOW	internal/tools/credentialed_exec.go	505	// Step 7: Execute — sandbox or host	COMMENT
LOW	internal/tools/policy.go	139	// Step 8: Capability-based deny (v3 RBAC)	COMMENT
LOW⚡	internal/tools/policy.go	217	// Step 1: Global profile	COMMENT
LOW⚡	internal/tools/policy.go	220	// Step 2: Provider-level profile override	COMMENT
LOW⚡	internal/tools/policy.go	227	// Step 3: Global allow list (restricts to only these)	COMMENT
LOW⚡	internal/tools/policy.go	232	// Step 4: Provider-level allow override	COMMENT
LOW⚡	internal/tools/policy.go	239	// Step 5: Per-agent allow	COMMENT
LOW⚡	internal/tools/policy.go	244	// Step 6: Per-agent per-provider allow	COMMENT
LOW⚡	internal/tools/policy.go	251	// Step 7: Group-level allow	COMMENT
LOW	internal/tools/gemini_file_api.go	27	// Step 1: Initiate resumable upload.	COMMENT
LOW	internal/tools/gemini_file_api.go	58	// Step 2: Upload file bytes.	COMMENT
LOW	internal/tools/gemini_file_api.go	271	// Step 1: Initiate resumable upload.	COMMENT
LOW	internal/tools/gemini_file_api.go	302	// Step 2: Upload file stream.	COMMENT
LOW⚡	internal/tools/filesystem_write_deliver_test.go	156	// Step 1: write_file delivers the file and marks it.	COMMENT
LOW⚡	internal/tools/filesystem_write_deliver_test.go	166	// Step 2: message(MEDIA:path) for same file must be blocked.	COMMENT
LOW⚡	internal/tools/send_file_test.go	282	// Step 1: send_file delivers and marks the file.	COMMENT
LOW⚡	internal/tools/send_file_test.go	290	// Step 2: message(MEDIA:path) for same file — must be blocked by self-send guard.	COMMENT
LOW	internal/tools/send_file_test.go	341	// Step 1: write_file deliver=true creates + marks the file.	COMMENT
LOW	internal/tools/send_file_test.go	352	// Step 2: send_file for same path — must be blocked.	COMMENT
LOW⚡	internal/bootstrap/seed_store_test.go	356	// Step 1: Seed initial files (new user, skipIfAnyExist=false)	COMMENT
LOW⚡	internal/bootstrap/seed_store_test.go	361	// Step 2: Simulate auto-cleanup — BOOTSTRAP.md deleted, USER.md remains	COMMENT
LOW⚡	internal/bootstrap/seed_store_test.go	364	// Step 3: skipIfAnyExist=true (existing profile) → must NOT re-seed	COMMENT
LOW⚡	internal/bootstrap/seed_store_test.go	373	// Step 4: skipIfAnyExist=false (force) → SHOULD re-seed missing BOOTSTRAP.md	COMMENT
LOW⚡	internal/agent/loop_utils.go	105	// Step 1: Create/resolve profile → get isNew + workspace	COMMENT
40 more matches not shown…

Hyper-Verbose Identifiers125 hits · 127 pts

Severity	File	Line	Snippet	Context
LOW	ui/web/src/types/provider.ts	80	export function normalizeChatGPTOAuthStrategy(	CODE
LOW	ui/web/src/types/provider.ts	95	export function normalizeReasoningFallback(	CODE
LOW	ui/web/src/types/provider.ts	105	export function deriveLegacyThinkingLevel(effort: string): string {	CODE
LOW	ui/web/src/types/provider.ts	120	export function getProviderReasoningDefaults(	CODE
LOW	ui/web/src/types/provider.ts	134	export function getChatGPTOAuthProviderRouting(	CODE
LOW	ui/web/src/types/provider.ts	151	export function buildProviderSettingsWithChatGPTOAuthRouting(	CODE
LOW	ui/web/src/types/provider.ts	170	export function buildProviderSettingsWithReasoningDefaults(	CODE
LOW	ui/web/src/constants/providers.ts	51	export function suggestUniqueProviderAlias(	CODE
LOW	ui/web/src/adapters/provider-pool.adapter.ts	14	export function resolveProviderAvailability(	CODE
LOW	…c/components/layout/system-settings-embedding-card.tsx	32	export function SystemSettingsEmbeddingCard({	CODE
LOW	…/components/layout/system-settings-compaction-card.tsx	21	export function SystemSettingsCompactionCard({	CODE
LOW	ui/web/src/components/providers/ws-provider.tsx	140	function WsTenantRevocationListener() {	CODE
LOW	ui/web/src/components/graph/graph-node-colors.ts	3	export function resolveGraphNodeDisplayColor(attrs: Record<string, unknown>, isDark: boolean): string {	CODE
LOW	ui/web/src/lib/think-tag-stream.ts	14	export function createThinkTagStreamFilterState(): ThinkTagStreamFilterState {	CODE
LOW	ui/web/src/lib/think-tag-stream.ts	18	export function appendFilteredThinkingChunk(	CODE
LOW	ui/web/src/lib/think-tag-stream.ts	64	export function splitThinkingTagsFromText(content: string, existingThinking = ""): { content: string; thinking?: string	CODE
LOW	ui/web/src/lib/think-tag-stream.ts	78	function splitTrailingThinkTagPrefix(input: string, prefixes: string[]): { answer: string; pending: string } {	CODE
LOW	ui/web/src/lib/media-cache.ts	35	export async function getOrFetchUrl(signedUrl: string): Promise<string> {	CODE
LOW	ui/web/src/api/tts-capabilities.ts	78	export function parseCapabilitiesResponse(raw: unknown): ProviderCapabilities[] {	CODE
LOW	ui/web/src/api/tts-capabilities.ts	100	export function buildCapabilitiesQueryOptions(fetcher: CapabilitiesFetcher) {	CODE
LOW	…ages/workstations/workstation-create-dialog-helpers.ts	38	export function buildWorkstationCreatePayload(	CODE
LOW	ui/web/src/pages/traces/trace-filter-params.ts	69	export function getActiveTraceFilterChips(filters: TraceFilters): TraceFilterChip[] {	CODE
LOW	…s/config/sections/behavior-pending-compaction-card.tsx	28	export function BehaviorPendingCompactionCard({ value, onChange }: Props) {	CODE
LOW	…pages/config/sections/behavior-passive-memory-card.tsx	15	export function BehaviorPassiveMemoryCard() {	CODE
LOW	…pages/config/sections/system-messages-section-utils.ts	25	export function systemMessageDefinitionsFromSchema(schema: Record<string, any> \| null \| undefined): SystemMessageDefinit	CODE
LOW⚡	…pages/config/sections/system-messages-section-utils.ts	63	export function localizedSystemMessageLabel(definition: SystemMessageDefinition, locale: string \| undefined): string {	CODE
LOW⚡	…pages/config/sections/system-messages-section-utils.ts	67	export function localizedSystemMessageDescription(definition: SystemMessageDefinition, locale: string \| undefined): stri	CODE
LOW⚡	…pages/config/sections/system-messages-section-utils.ts	71	export function normalizeSystemMessagesDraft(	CODE
LOW	…eb/src/pages/config/sections/branding-section-utils.ts	51	export function withUploadedBrandingAssetURL(draft: BrandingData, field: BrandingAssetField, url: string): BrandingData	CODE
LOW	…eb/src/pages/config/sections/branding-section-utils.ts	55	export function validateBrandingAssetFile(file: Pick<File, "name" \| "size">): string \| null {	CODE
LOW	…/src/pages/providers/provider-standard-form-fields.tsx	21	export function ProviderStandardFormFields({	CODE
LOW	ui/web/src/pages/providers/provider-utils.tsx	32	export function getChatGPTOAuthPoolOwnership(	CODE
LOW	ui/web/src/pages/providers/provider-utils.tsx	93	export function sortProvidersForPoolHierarchy(	CODE
LOW	…ers/provider-detail/provider-pool-activity-section.tsx	44	export function ProviderPoolActivitySection({	CODE
LOW	…ers/provider-detail/provider-oauth-account-section.tsx	22	export function ProviderOAuthAccountSection({	CODE
LOW	…s/providers/hooks/use-chatgpt-oauth-provider-quotas.ts	68	export function useChatGPTOAuthProviderQuotas(providerNames: string[], enabled = true) {	CODE
LOW	…providers/hooks/use-chatgpt-oauth-provider-statuses.ts	19	export function useChatGPTOAuthProviderStatuses(providers: ProviderData[], enabled = true) {	CODE
LOW	…es/providers/hooks/use-provider-codex-pool-activity.ts	34	export function useProviderCodexPoolActivity(	CODE
LOW	…b/src/pages/agents/agent-identity-and-model-fields.tsx	36	export function AgentIdentityAndModelFields({	CODE
LOW	…b/src/pages/agents/agent-detail/agent-display-utils.ts	60	export function normalizeChatGPTOAuthRouting(	CODE
LOW	…b/src/pages/agents/agent-detail/agent-display-utils.ts	113	export function hasActiveChatGPTOAuthRouting(	CODE
LOW	…b/src/pages/agents/agent-detail/agent-display-utils.ts	123	export function normalizeChatGPTOAuthRoutingInput(	CODE
LOW	…b/src/pages/agents/agent-detail/agent-display-utils.ts	138	export function resolveEffectiveChatGPTOAuthRouting(	CODE
LOW	…b/src/pages/agents/agent-detail/agent-display-utils.ts	241	export function buildAgentOtherConfigWithChatGPTOAuthRouting(	CODE
LOW	…agent-detail/chatgpt-oauth-quota-readiness-section.tsx	90	export function ChatGPTOAuthQuotaReadinessSection({	CODE
LOW	…ages/agents/agent-detail/codex-pool-activity-panel.tsx	182	export function CodexPoolRecentRequestsPanel({	CODE
LOW	…ages/agents/agent-detail/agent-advanced-state-utils.ts	158	export function buildAdvancedUpdatePayload(	CODE
LOW	…ages/agents/agent-detail/agent-advanced-state-utils.ts	232	function buildContextPruningPayload(	CODE
LOW	…ages/agents/agent-detail/agent-advanced-state-utils.ts	241	function buildOtherConfigWithDeliveryBehavior(	CODE
LOW	…ages/agents/agent-detail/agent-advanced-state-utils.ts	255	function buildOtherConfigWithInboundDebounce(	CODE
LOW	…ages/agents/agent-detail/agent-advanced-state-utils.ts	273	function normalizeModelFallbackForPayload(config: ModelFallbackConfig): ModelFallbackConfig {	CODE
LOW	…gents/agent-detail/codex-pool-recent-requests-list.tsx	11	export function CodexPoolRecentRequestsList({	CODE
LOW	…es/agents/agent-detail/agent-instance-display-utils.ts	38	export function getAgentInstanceResolveIds(instances: AgentInstanceLike[]): string[] {	CODE
LOW	…es/agents/agent-detail/agent-instance-display-utils.ts	49	export function buildAgentInstanceDisplay(	CODE
LOW	…iew-sections/chatgpt-oauth-routing-summary-section.tsx	40	export function ChatGPTOAuthRoutingSummarySection({	CODE
LOW	…ges/agents/agent-detail/file-sections/file-sidebar.tsx	15	function estimateTokensFromContent(content: string): number {	CODE
LOW	…tail/config-sections/chatgpt-oauth-routing-section.tsx	67	export function ChatGPTOAuthRoutingSection({	CODE
LOW	…t-detail/evolution-tab/evolution-suggestions-table.tsx	33	export function EvolutionSuggestionsTable({ suggestions, loading, onUpdateStatus }: Props) {	CODE
LOW	…c/pages/builtin-tools/builtin-tool-settings-dialog.tsx	52	export function BuiltinToolSettingsDialog({	CODE
LOW	…pages/builtin-tools/web-fetch-extractor-chain-form.tsx	168	export function WebFetchExtractorChainForm({ initialSettings, onSave, onCancel }: Props) {	CODE
65 more matches not shown…

Excessive Try-Catch Wrapping63 hits · 102 pts

Severity	File	Line	Snippet	Context
LOW	skills/xlsx/scripts/recalc.py	66	except Exception:	CODE
LOW	skills/xlsx/scripts/recalc.py	160	except Exception as e:	CODE
MEDIUM	skills/xlsx/scripts/recalc.py	32	def has_gtimeout():	CODE
LOW	skills/pdf/reference.md	484	except Exception as e:	CODE
LOW	skills/pdf/reference.md	504	except Exception as e:	CODE
LOW	skills/pdf/reference.md	578	except Exception as e:	CODE
MEDIUM	skills/skill-creator/eval-viewer/generate_review.py	408	print(f"Error: {workspace} is not a directory", file=sys.stderr)	CODE
LOW	skills/skill-creator/scripts/run_eval.py	223	except Exception as e:	CODE
MEDIUM	skills/skill-creator/scripts/run_eval.py	276	print(f"Error: No SKILL.md found at {skill_path}", file=sys.stderr)	CODE
LOW	skills/skill-creator/scripts/init_skill.py	276	except Exception as e:	CODE
LOW	skills/skill-creator/scripts/init_skill.py	292	except Exception as e:	CODE
LOW	skills/skill-creator/scripts/init_skill.py	319	except Exception as e:	CODE
LOW	skills/skill-creator/scripts/package_skill.py	113	except Exception as e:	CODE
MEDIUM	skills/skill-creator/scripts/improve_description.py	204	print(f"Error: No SKILL.md found at {skill_path}", file=sys.stderr)	CODE
MEDIUM	skills/skill-creator/scripts/run_loop.py	269	print(f"Error: No SKILL.md found at {skill_path}", file=sys.stderr)	CODE
MEDIUM	skills/pptx/scripts/clean.py	276	print(f"Error: {unpacked_dir} not found", file=sys.stderr)	CODE
MEDIUM	skills/pptx/scripts/add_slide.py	40	print(f"Error: {layout_path} not found", file=sys.stderr)	CODE
MEDIUM	skills/pptx/scripts/add_slide.py	97	print(f"Error: {source_slide} not found", file=sys.stderr)	CODE
MEDIUM	skills/pptx/scripts/add_slide.py	187	print(f"Error: {unpacked_dir} not found", file=sys.stderr)	CODE
MEDIUM	skills/pptx/scripts/thumbnail.py	66	print(f"Error: Invalid PowerPoint file: {args.input}", file=sys.stderr)	CODE
MEDIUM	skills/pptx/scripts/thumbnail.py	79	print("Error: No slides found", file=sys.stderr)	CODE
LOW	skills/pptx/scripts/thumbnail.py	90	except Exception as e:	CODE
MEDIUM	skills/pptx/scripts/thumbnail.py	91	print(f"Error: {e}", file=sys.stderr)	CODE
LOW	skills/pptx/scripts/thumbnail.py	246	except Exception:	CODE
LOW	skills/_shared/office/pack.py	126	except Exception as e:	CODE
MEDIUM	skills/_shared/office/validate.py	94	print(f"Error: Validation not supported for file type {file_extension}")	CODE
LOW⚡	skills/_shared/office/unpack.py	82	except Exception as e:	CODE
LOW⚡	skills/_shared/office/unpack.py	91	except Exception:	CODE
LOW⚡	skills/_shared/office/unpack.py	101	except Exception:	CODE
LOW⚡	skills/_shared/office/validators/docx.py	174	except Exception as e:	CODE
MEDIUM⚡	skills/_shared/office/validators/docx.py	175	print(f"Error counting paragraphs in unpacked document: {e}")	CODE
LOW	skills/_shared/office/validators/docx.py	197	except Exception as e:	CODE
MEDIUM	skills/_shared/office/validators/docx.py	198	print(f"Error counting paragraphs in original document: {e}")	CODE
LOW	skills/_shared/office/validators/docx.py	287	except Exception:	CODE
LOW	skills/_shared/office/validators/docx.py	439	except Exception:	CODE
LOW	skills/_shared/office/validators/redlining.py	56	except Exception:	CODE
LOW	skills/_shared/office/validators/redlining.py	65	except Exception as e:	CODE
LOW	skills/_shared/office/validators/pptx.py	195	except Exception as e:	CODE
LOW	skills/_shared/office/validators/base.py	138	except Exception:	CODE
LOW	skills/_shared/office/validators/base.py	154	except Exception as e:	CODE
LOW	skills/_shared/office/validators/base.py	357	except Exception as e:	CODE
LOW	skills/_shared/office/validators/base.py	454	except Exception as e:	CODE
LOW	skills/_shared/office/validators/base.py	564	except Exception:	CODE
LOW	skills/_shared/office/validators/base.py	583	except Exception as e:	CODE
LOW	skills/_shared/office/validators/base.py	784	except Exception as e:	CODE
LOW	skills/_shared/office/helpers/simplify_redlines.py	43	except Exception as e:	CODE
LOW	skills/_shared/office/helpers/merge_runs.py	38	except Exception as e:	CODE
LOW	skills/docx/scripts/accept_changes.py	52	except Exception as e:	CODE
LOW	skills/docx/scripts/accept_changes.py	116	except Exception as e:	CODE
LOW	skills/anysearch/scripts/generate.py	234	except Exception as e:	CODE
MEDIUM⚡	skills/anysearch/scripts/anysearch_cli.py	261	print("Error: --domain requires --sub_domain (or use --tag)", file=sys.stderr)	CODE
MEDIUM⚡	skills/anysearch/scripts/anysearch_cli.py	264	print("Error: --tag and --sub_domain must match when both are provided", file=sys.stderr)	CODE
MEDIUM⚡	skills/anysearch/scripts/anysearch_cli.py	268	print("Error: --domain must match the prefix of --tag/--sub_domain", file=sys.stderr)	CODE
MEDIUM⚡	skills/anysearch/scripts/anysearch_cli.py	275	print("Error: --params must be valid JSON or key=value pairs", file=sys.stderr)	CODE
MEDIUM	skills/anysearch/scripts/anysearch_cli.py	296	print("Error: provide --domain or --domains", file=sys.stderr)	CODE
MEDIUM	skills/anysearch/scripts/anysearch_cli.py	299	print("Error: get_sub_domains supports a maximum of 5 domains", file=sys.stderr)	CODE
MEDIUM	skills/anysearch/scripts/anysearch_cli.py	310	print("Error: url is required", file=sys.stderr)	CODE
MEDIUM⚡	skills/anysearch/scripts/anysearch_cli.py	406	print("Error: batch_search supports a maximum of 5 queries", file=sys.stderr)	CODE
MEDIUM⚡	skills/anysearch/scripts/anysearch_cli.py	415	print(f"Error: file not found: {file_path}", file=sys.stderr)	CODE
MEDIUM⚡	skills/anysearch/scripts/anysearch_cli.py	424	print("Error: queries must contain at least 1 item", file=sys.stderr)	CODE
3 more matches not shown…

Empty Error Handlers20 hits · 100 pts

Severity	File	Line	Snippet	Context
HIGH	skills/skill-creator/eval-viewer/generate_review.py	303	except subprocess.TimeoutExpired:	CODE
HIGH	skills/skill-creator/eval-viewer/generate_review.py	231	except (json.JSONDecodeError, OSError, KeyError):	CODE
HIGH	skills/skill-creator/eval-viewer/generate_review.py	428	except (json.JSONDecodeError, OSError):	CODE
HIGH	skills/skill-creator/eval-viewer/generate_review.py	97	except (json.JSONDecodeError, OSError):	CODE
HIGH	skills/skill-creator/eval-viewer/generate_review.py	135	except (json.JSONDecodeError, OSError):	CODE
HIGH	skills/skill-creator/eval-viewer/generate_review.py	111	except OSError:	CODE
HIGH	skills/skill-creator/eval-viewer/generate_review.py	299	except (ProcessLookupError, ValueError):	CODE
HIGH	skills/skill-creator/eval-viewer/generate_review.py	340	except (json.JSONDecodeError, OSError):	CODE
HIGH	skills/skill-creator/scripts/aggregate_benchmark.py	146	except json.JSONDecodeError:	CODE
HIGH	skills/skill-creator/scripts/encoding_utils.py	25	except AttributeError:	CODE
HIGH	skills/pptx/scripts/clean.py	122	except ValueError:	CODE
HIGH	skills/pptx/scripts/clean.py	165	except ValueError:	CODE
HIGH	skills/_shared/office/unpack.py	91	except Exception:	CODE
HIGH	skills/_shared/office/unpack.py	101	except Exception:	CODE
HIGH	skills/_shared/office/validators/docx.py	287	except Exception:	CODE
HIGH	skills/_shared/office/validators/docx.py	439	except Exception:	CODE
HIGH	skills/_shared/office/validators/redlining.py	56	except Exception:	CODE
HIGH	skills/_shared/office/validators/redlining.py	193	except (subprocess.CalledProcessError, FileNotFoundError, Exception):	CODE
HIGH	skills/_shared/office/validators/base.py	138	except Exception:	CODE
HIGH	skills/docx/scripts/comment.py	116	except ValueError:	CODE

Fake / Example Data67 hits · 76 pts

Severity	File	Line	Snippet	Context
LOW	ui/web/src/i18n/locales/vi/memory.json	101	"placeholder": "Tìm kiếm thực thể...",	CODE
LOW	ui/web/src/i18n/locales/vi/channels.json	796	"placeholder": "Chọn portal...",	CODE
LOW	ui/web/src/i18n/locales/vi/tts.json	253	"placeholder": "Nhập văn bản để nghe thử…",	CODE
LOW⚡	ui/web/src/i18n/locales/vi/packages.json	15	"placeholder": "Tên gói (vd: github-cli)"	CODE
LOW⚡	ui/web/src/i18n/locales/vi/packages.json	19	"placeholder": "Tên gói (vd: pandas)"	CODE
LOW⚡	ui/web/src/i18n/locales/vi/packages.json	23	"placeholder": "Tên gói (vd: typescript)"	CODE
LOW⚡	ui/web/src/i18n/locales/vi/packages.json	27	"placeholder": "owner/repo[@tag] (vd: cli/cli@v2.45.0)",	CODE
LOW	ui/web/src/i18n/locales/ru/memory.json	101	"placeholder": "Поиск сущностей...",	CODE
LOW	ui/web/src/i18n/locales/ru/channels.json	738	"placeholder": "Выберите портал...",	CODE
LOW	ui/web/src/i18n/locales/ru/tts.json	253	"placeholder": "Введите текст, чтобы прослушать…",	CODE
LOW⚡	ui/web/src/i18n/locales/ru/packages.json	15	"placeholder": "Имя пакета (напр. github-cli)"	CODE
LOW⚡	ui/web/src/i18n/locales/ru/packages.json	19	"placeholder": "Имя пакета (напр. pandas)"	CODE
LOW⚡	ui/web/src/i18n/locales/ru/packages.json	23	"placeholder": "Имя пакета (напр. typescript)"	CODE
LOW⚡	ui/web/src/i18n/locales/ru/packages.json	27	"placeholder": "owner/repo[@tag] (напр. cli/cli@v2.45.0)",	CODE
LOW	ui/web/src/i18n/locales/zh/memory.json	101	"placeholder": "搜索实体...",	CODE
LOW	ui/web/src/i18n/locales/zh/channels.json	796	"placeholder": "选择门户...",	CODE
LOW	ui/web/src/i18n/locales/zh/tts.json	253	"placeholder": "输入文本以试听…",	CODE
LOW⚡	ui/web/src/i18n/locales/zh/packages.json	15	"placeholder": "包名（例如 github-cli）"	CODE
LOW⚡	ui/web/src/i18n/locales/zh/packages.json	19	"placeholder": "包名（例如 pandas）"	CODE
LOW⚡	ui/web/src/i18n/locales/zh/packages.json	23	"placeholder": "包名（例如 typescript）"	CODE
LOW⚡	ui/web/src/i18n/locales/zh/packages.json	27	"placeholder": "owner/repo[@tag]（例如 cli/cli@v2.45.0）",	CODE
LOW	ui/web/src/i18n/locales/ko/memory.json	101	"placeholder": "엔티티 검색...",	CODE
LOW⚡	ui/web/src/i18n/locales/ko/packages.json	15	"placeholder": "패키지 이름 (예: github-cli)"	CODE
LOW⚡	ui/web/src/i18n/locales/ko/packages.json	19	"placeholder": "패키지 이름 (예: pandas)"	CODE
LOW⚡	ui/web/src/i18n/locales/ko/packages.json	23	"placeholder": "패키지 이름 (예: typescript)"	CODE
LOW	ui/web/src/i18n/locales/en/memory.json	101	"placeholder": "Search entities...",	CODE
LOW	ui/web/src/i18n/locales/en/channels.json	797	"placeholder": "Select a portal...",	CODE
LOW	ui/web/src/i18n/locales/en/tts.json	253	"placeholder": "Enter text to hear…",	CODE
LOW⚡	ui/web/src/i18n/locales/en/packages.json	15	"placeholder": "Package name (e.g. github-cli)"	CODE
LOW⚡	ui/web/src/i18n/locales/en/packages.json	19	"placeholder": "Package name (e.g. pandas)"	CODE
LOW⚡	ui/web/src/i18n/locales/en/packages.json	23	"placeholder": "Package name (e.g. typescript)"	CODE
LOW⚡	ui/web/src/i18n/locales/en/packages.json	27	"placeholder": "owner/repo[@tag] (e.g. cli/cli@v2.45.0)",	CODE
LOW	ui/desktop/frontend/src/i18n/en.json	13	"placeholder": "Type a message...",	CODE
LOW	ui/desktop/frontend/src/i18n/vi.json	13	"placeholder": "Nhập tin nhắn...",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/vi/memory.json	101	"placeholder": "Tìm kiếm thực thể...",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/vi/tts.json	236	"placeholder": "Nhập text để nghe thử...",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/vi/tts.json	267	"placeholder": "Nhập văn bản để nghe thử…",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/ru/memory.json	101	"placeholder": "Поиск сущностей...",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/ru/tts.json	236	"placeholder": "Введите текст, чтобы услышать образец…",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/ru/tts.json	267	"placeholder": "Введите текст, чтобы услышать…",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/zh/memory.json	101	"placeholder": "搜索实体...",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/zh/tts.json	236	"placeholder": "输入文本进行试听…",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/zh/tts.json	267	"placeholder": "输入文本以试听…",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/en/memory.json	101	"placeholder": "Search entities...",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/en/tts.json	236	"placeholder": "Enter text to hear a sample…",	CODE
LOW	ui/desktop/frontend/src/i18n/locales/en/tts.json	267	"placeholder": "Enter text to hear…",	CODE
LOW	internal/tools/create_image_native_path_test.go	583	creds := fakeCreds{key: "fake-key", base: server.URL}	CODE
LOW	internal/tools/create_image_native_path_test.go	725	creds := fakeCreds{key: "fake-key", base: server.URL}	CODE
LOW	internal/tools/create_image_native_path_test.go	780	creds := fakeCreds{key: "fake-key", base: server.URL}	CODE
LOW	internal/mcp/manager.go	872	slog.Debug("mcp.ListToolsForAgent.placeholder_entry", "server", info.Server.Name, "placeholder", placeholder)	CODE
LOW	internal/mcp/bridge_tool.go	377	"tool", t.registeredName, "arg", k, "value", s, "reason", "placeholder")	CODE
LOW	…rnal/http/channel_instance_context_capability_admin.go	37	scope := store.ChannelContextScope{ChannelInstanceName: "placeholder", ScopeType: scopeType, ScopeKey: scopeKey}	CODE
LOW	internal/http/secure_cli_agent_grants_test.go	90	ctx = store.WithUserID(ctx, "admin@example.com")	CODE
LOW	internal/http/secure_cli_agent_grants_test.go	99	ctx = store.WithUserID(ctx, "admin@example.com")	CODE
LOW	internal/hooks/audit_test.go	63	if strings.Contains(out, "user@example.com") {	CODE
LOW	internal/hooks/audit_test.go	118	if strings.Contains(row.Error, "user@example.com") {	CODE
LOW	internal/gateway/methods/config_defaults.go	42	Placeholder string `json:"placeholder"`	CODE
LOW	internal/store/validate_test.go	15	{"normal", "user@example.com", false},	CODE
LOW	internal/channels/pancake/comment_handler_test.go	350	SenderName: "John Doe",	CODE
LOW	internal/channels/feishu/larkclient_messaging_test.go	25	_, _ = w.Write([]byte(`{"code":0,"msg":"ok","tenant_access_token":"fake-token","expire":7200}`))	CODE
7 more matches not shown…

Deep Nesting50 hits · 47 pts

Severity	File	Line	Context
LOW	skills/xlsx/scripts/recalc.py	70	CODE
LOW	skills/pdf/scripts/fill_fillable_fields.py	11	CODE
LOW	skills/pdf/scripts/fill_fillable_fields.py	55	CODE
LOW	skills/pdf/scripts/extract_form_field_info.py	19	CODE
LOW	skills/pdf/scripts/extract_form_field_info.py	47	CODE
LOW	skills/pdf/scripts/extract_form_structure.py	20	CODE
LOW	skills/pdf/scripts/check_bounding_boxes.py	15	CODE
LOW	skills/skill-creator/eval-viewer/generate_review.py	85	CODE
LOW	skills/skill-creator/eval-viewer/generate_review.py	149	CODE
LOW	skills/skill-creator/eval-viewer/generate_review.py	288	CODE
LOW	skills/skill-creator/scripts/run_eval.py	35	CODE
LOW	skills/skill-creator/scripts/package_skill.py	30	CODE
LOW	skills/skill-creator/scripts/improve_description.py	19	CODE
LOW	skills/skill-creator/scripts/aggregate_benchmark.py	67	CODE
LOW	skills/skill-creator/scripts/generate_report.py	16	CODE
LOW	skills/skill-creator/scripts/utils.py	7	CODE
LOW	skills/pptx/scripts/clean.py	49	CODE
LOW	skills/pptx/scripts/clean.py	171	CODE
LOW	skills/_shared/office/pack.py	24	CODE
LOW	skills/_shared/office/pack.py	108	CODE
LOW	skills/_shared/office/unpack.py	34	CODE
LOW	skills/_shared/office/validators/docx.py	66	CODE
LOW	skills/_shared/office/validators/docx.py	112	CODE
LOW	skills/_shared/office/validators/docx.py	254	CODE
LOW	skills/_shared/office/validators/docx.py	298	CODE
LOW	skills/_shared/office/validators/docx.py	391	CODE
LOW	skills/_shared/office/validators/redlining.py	127	CODE
LOW	skills/_shared/office/validators/redlining.py	198	CODE
LOW	skills/_shared/office/validators/pptx.py	62	CODE
LOW	skills/_shared/office/validators/pptx.py	104	CODE
LOW	skills/_shared/office/validators/pptx.py	210	CODE
LOW	skills/_shared/office/validators/base.py	115	CODE
LOW	skills/_shared/office/validators/base.py	199	CODE
LOW	skills/_shared/office/validators/base.py	289	CODE
LOW	skills/_shared/office/validators/base.py	385	CODE
LOW	skills/_shared/office/validators/base.py	469	CODE
LOW	skills/_shared/office/validators/base.py	492	CODE
LOW	skills/_shared/office/validators/base.py	636	CODE
LOW	skills/_shared/office/validators/base.py	703	CODE
LOW	skills/_shared/office/helpers/simplify_redlines.py	149	CODE
LOW	skills/_shared/office/helpers/merge_runs.py	178	CODE
LOW	skills/docx/scripts/comment.py	98	CODE
LOW	skills/anysearch/scripts/generate.py	64	CODE
LOW	skills/anysearch/scripts/generate.py	110	CODE
LOW	skills/anysearch/scripts/generate.py	202	CODE
LOW	skills/anysearch/scripts/anysearch_cli.py	18	CODE
LOW	skills/anysearch/scripts/anysearch_cli.py	146	CODE
LOW	skills/anysearch/scripts/anysearch_cli.py	221	CODE
LOW	skills/anysearch/scripts/anysearch_cli.py	361	CODE
LOW	skills/anysearch/scripts/anysearch_cli.py	398	CODE

Example Usage Blocks20 hits · 30 pts

Severity	File	Line	Snippet	Context
LOW	docker-compose.selfservice.yml	7	# Usage:	COMMENT
LOW	docker-compose.redis.yml	3	# Usage:	COMMENT
LOW	docker-compose.browser.yml	3	# Usage:	COMMENT
LOW	docker-compose.upgrade.yml	3	# Usage:	COMMENT
LOW	docker-compose.lightpanda.yml	3	# Usage:	COMMENT
LOW	docker-compose.sandbox.yml	7	# Usage:	COMMENT
LOW	docker-compose.tailscale.yml	3	# Usage:	COMMENT
LOW	docker-compose.otel.yml	3	# Usage:	COMMENT
LOW	docker-compose.cloudflared.yml	3	# Usage:	COMMENT
LOW	docker-compose.claude-cli.yml	5	# Usage:	COMMENT
LOW	compose.options/13-upgrade.yml	3	# Usage:	COMMENT
LOW	compose.options/12-selfservice.yml	7	# Usage:	COMMENT
LOW	compose.options/18-tailscale.yml	3	# Usage:	COMMENT
LOW	compose.options/14-browser.yml	3	# Usage:	COMMENT
LOW	compose.options/17-sandbox.yml	7	# Usage:	COMMENT
LOW	compose.options/16-redis.yml	3	# Usage:	COMMENT
LOW	compose.options/15-otel.yml	3	# Usage:	COMMENT
LOW	scripts/setup-docker.sh	4	# Usage:	COMMENT
LOW	scripts/install.sh	4	# Usage:	COMMENT
LOW	scripts/install-lite.sh	4	# Usage:	COMMENT

Modern AI Meta-Vocabulary6 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker-compose.sandbox.yml	5	# 2. Ensure Docker socket is accessible (required for container orchestration)	COMMENT
MEDIUM	docker-compose.sandbox.yml	30	# Docker socket requires overriding base cap_drop to allow container orchestration.	COMMENT
MEDIUM	…nts/agent-detail/evolution-tab/agent-evolution-tab.tsx	35	// Parse guardrails from agent other_config, fallback to defaults.	COMMENT
MEDIUM	compose.options/17-sandbox.yml	5	# 2. Ensure Docker socket is accessible (required for container orchestration)	COMMENT
MEDIUM	compose.options/17-sandbox.yml	30	# Docker socket requires overriding base cap_drop to allow container orchestration.	COMMENT
MEDIUM	internal/agent/evolution_guardrails.go	90	// Raise retrieval threshold by MaxDeltaPerCycle (bounded by guardrails).	COMMENT

Synthetic Comment Markers2 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	internal/pipeline/run_state.go	142	// Prompt is the generation prompt for AI-generated media (e.g. create_image).	COMMENT
HIGH	internal/agent/loop_types.go	715	// Prompt is the generation prompt for AI-generated media (e.g. create_image).	COMMENT

AI Slop Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	internal/tools/cron.go	424	// Re-marshal and unmarshal to leverage JSON tags	COMMENT
MEDIUM	internal/tools/filesystem_windows.go	48	// On Windows, this is more robust than temporary file creation and avoids artifact leakage.	COMMENT
MEDIUM	internal/providers/openai_request.go	18	// We check providerType, name, apiBase, and the model string (robust detection for proxies/OpenRouter).	COMMENT
MEDIUM	internal/mcp/session_reset_test.go	26	// Case-insensitive matching keeps detection robust to upstream	COMMENT

Self-Referential Comments2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/dev-beta-release.yaml	511	# Create the key file with a tight umask so it is born at 0600 —	COMMENT
MEDIUM	skills/skill-creator/scripts/package_skill.py	77	# Create the zip file	COMMENT

Magic Placeholder Names1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	skills/anysearch/scripts/shared/doc_spec.md	230	{{LANG_INVOKE}} search "climate change policy 2025" --api_key <your_api_key> --max_results 3	CODE

Unused Imports4 hits · 4 pts

Severity	File	Line	Context
LOW	skills/_shared/office/validators/__init__.py	5	CODE
LOW	skills/_shared/office/validators/__init__.py	6	CODE
LOW	skills/_shared/office/validators/__init__.py	7	CODE
LOW	skills/_shared/office/validators/__init__.py	8	CODE

Modern Structural Boilerplate3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	skills/pptx/scripts/clean.py	221	def update_content_types(unpacked_dir: Path, removed_files: list[str]) -> None:	CODE
LOW	skills/_shared/office/validators/__init__.py	10	__all__ = [	CODE
LOW	skills/docx/scripts/accept_changes.py	14	logger = logging.getLogger(__name__)	CODE

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	skills/skill-creator/scripts/init_skill.py	267	# Check if directory already exists	COMMENT

nextlevelbuilder/goclaw

Open-Source Code Quality, Security and Technical Debt Review