Pattern Findings

The scanner identified 1815 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers1461 hits · 1506 pts

Severity	File	Line	Snippet	Context
LOW	…bundles/pstack/skills/poteto-mode/scripts/bootstrap.ts	25	export function ensureDependenciesInstalled(): void {	CODE
LOW	…s/pstack/skills/poteto-mode/scripts/watch-pr/policy.ts	237	export function selectTierMajorStackDecision(	CODE
LOW	scripts/dev-slack-tunnels.ts	40	export function readSlackDevelopmentValues(text: string, environment: NodeJS.ProcessEnv): Record<string, string> {	CODE
LOW	scripts/host-installation.ts	25	export function hostExecutableRequirement(name: string): string {	CODE
LOW	scripts/seed-dev-state.ts	326	export async function isDevelopmentProfileActive(	CODE
LOW	scripts/seed-dev-state.ts	364	export async function cleanupSeedOwnedTransfers(profilePath: string, homeDirectory = homedir()): Promise<string[]> {	CODE
LOW	scripts/seed-dev-state.ts	731	function spreadsheetNumberFormatsXlsx(): Uint8Array {	CODE
LOW	scripts/seed-dev-state.ts	1631	async function replaceDevelopmentProfile(target: string, staging: string, homeDirectory: string): Promise<void> {	CODE
LOW	scripts/seed-dev-state.ts	1665	async function readSeedTransferDirectories(profilePath: string): Promise<string[]> {	CODE
LOW	scripts/seed-dev-state.ts	1678	async function removeTransferDirectories(homeDirectory: string, directories: string[]): Promise<string[]> {	CODE
LOW	scripts/windows-home-install-update-e2e.ts	209	async function runEarlierUninstallerAsUpdate(): Promise<number> {	CODE
LOW	scripts/windows-home-install-update-e2e.ts	220	async function installEarlierInHomeFolder(): Promise<void> {	CODE
LOW	scripts/windows-home-install-update-e2e.ts	261	async function earlierUninstallerDeletesWorkspaces(): Promise<void> {	CODE
LOW	scripts/windows-home-install-update-e2e.ts	271	async function newInstallerMovesTheInstallation(): Promise<void> {	CODE
LOW	scripts/publish-production-catalog.ts	309	export function parsePublicationArguments(args: string[]): { apply: boolean; target: "local" \| "production" } {	CODE
LOW	scripts/dev-verify.ts	156	function createVerificationCommandPlan(	CODE
LOW	scripts/dev-verify.ts	245	async function createDevVerificationState(	CODE
LOW	scripts/dev-verify.ts	308	export async function createDevVerificationReport(projectRoot = process.cwd()): Promise<DevVerificationReport> {	CODE
LOW⚡	scripts/native-runtime-lock.ts	108	export function createRemoteDesktopInputDigest(lock: NativeRuntimeLock): string {	CODE
LOW⚡	scripts/native-runtime-lock.ts	118	export function createRemoteDesktopReleaseTag(inputDigest: string): string {	CODE
LOW⚡	scripts/native-runtime-lock.ts	122	export function hasPinnedRemoteDesktopArtifacts(lock: NativeRuntimeLock): boolean {	CODE
LOW⚡	scripts/native-runtime-lock.ts	129	async function validateRemoteDesktopInputFiles(lock: NativeRuntimeLock, sourceRoot: string): Promise<void> {	CODE
LOW	scripts/native-runtime-lock.ts	147	export function createRemoteDesktopSourceManifest(lock: NativeRuntimeLock) {	CODE
LOW	scripts/dev-storybook.ts	62	export function createStorybookStackRecord(port: number, supervisorPid: number, startedAt: number): DevStackRecord {	CODE
LOW	scripts/verify-remote-desktop-runtime.ts	119	function verifyBundledLibraryLicenses(libraries: string[], distributionChecksums: { name: string }[]): void {	CODE
LOW	scripts/browser-smoke-electron.ts	2410	async function runRedirectNavigationScenario(browser: BrowserHost, origin: string): Promise<void> {	CODE
LOW	scripts/browser-smoke-electron.ts	3826	async function waitForPersistenceSnapshot(browser: BrowserHost, tabId: string): Promise<PersistenceSnapshot> {	CODE
LOW	scripts/deploy-auth-api.ts	200	function readCloudflareEnvironment(args: string[]): string \| null {	CODE
LOW	scripts/mac-runtime-dylibs.ts	123	export function bundleMacDynamicLibraries(executable: string, frameworks: string): BundledLibrary[] {	CODE
LOW	scripts/provider-account-reload-e2e.ts	21	export async function checkProviderAccountReload(): Promise<void> {	CODE
LOW	scripts/electron-spawn-env.ts	18	export function withoutElectronRuntimeFlags(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv {	CODE
LOW	scripts/build-remote-desktop-runtime.ts	145	async function packageCorrespondingSource(	CODE
LOW	scripts/build-remote-desktop-runtime.ts	245	function requiredSunshineSubmodules(targetPlatform: "darwin" \| "win32" \| "linux"): string[] {	CODE
LOW	scripts/build-remote-desktop-runtime.ts	335	function moonlightCargoEnvironment(): NodeJS.ProcessEnv {	CODE
LOW	scripts/build-remote-desktop-runtime.ts	392	function bundleMacRuntimeDependencies(root: string): { libraries: BundledLibrary[]; signTargets: string[] } {	CODE
LOW	scripts/build-remote-desktop-runtime.ts	409	function bundleLinuxRuntimeDependencies(root: string): BundledLibrary[] {	CODE
LOW	scripts/prepare-dev-environment.ts	40	export function prepareDevelopmentEnvironment(input: DevelopmentPreparationInput = {}): DevelopmentStateOutcome {	CODE
LOW	scripts/prepare-dev-environment.ts	159	export function prepareDevelopmentWorktree(input: DevelopmentPreparationInput = {}): DevelopmentStateOutcome {	CODE
LOW	scripts/prepare-dev-environment.ts	217	export function assertSupportedBunVersion(version: string): void {	CODE
LOW	scripts/provider-history-reimport-e2e.ts	69	async function runProviderHistoryReimportCheck(outputPath: string): Promise<Report> {	CODE
LOW	scripts/discord-mobile-release-announcement.ts	41	export function mobileAnnouncementProblems(announcement: string, version: string): string[] {	CODE
LOW	scripts/dev-services.ts	82	export function developmentEnvironmentForTarget(	CODE
LOW	scripts/dev-services.ts	114	export function createDevelopmentServiceSpec(	CODE
LOW	scripts/dev-services.ts	381	export function developmentInstanceIdForStart(input: {	CODE
LOW	scripts/dev-services.ts	597	export function configureSiteHostingDevelopmentEnvironment(environment: NodeJS.ProcessEnv, apiPort: number): void {	CODE
LOW	scripts/dev-services.ts	603	export function configureMobileConnectDevelopmentNetwork(	CODE
LOW	scripts/dev-services.ts	630	export function selectMobileConnectLanAddress(interfaces: DevelopmentNetworkInterfaces): string \| null {	CODE
LOW	scripts/build-plugin-catalog.ts	39	export function defaultPluginCatalogPaths(root: string = projectRoot): PluginCatalogPaths {	CODE
LOW	scripts/install-remote-desktop-runtime.ts	31	export async function installRemoteDesktopRuntime(	CODE
LOW	scripts/development-state-paths.ts	4	export function resolveDevelopmentAppDataRoot(	CODE
LOW	scripts/verify-macos-package.ts	237	async function verifyPackagedIconCatalog(packagedPath: string, sourcePath: string): Promise<void> {	CODE
LOW	scripts/verify-macos-package.ts	385	async function verifySecondInstanceExits(	CODE
LOW	scripts/development-environment.ts	19	export async function loadSharedDevelopmentEnvironment(	CODE
LOW	scripts/development-environment.ts	58	export async function loadDevelopmentEnvironment(	CODE
LOW	scripts/development-environment.ts	78	export async function loadTestDeploymentEnvironment(	CODE
LOW	scripts/development-environment.ts	158	export function developmentChildEnvironment(	CODE
LOW	scripts/development-environment.ts	179	export function developmentSettingsForService(	CODE
LOW	scripts/verify-linux-package.ts	409	async function verifySecondInstanceExits(	CODE
LOW	scripts/verify-windows-package.ts	360	async function verifySecondInstanceExits(	CODE
LOW	scripts/backup-model-failover-e2e.ts	549	async function verifyHistoryKeepsRequests(agentId: string) {	CODE
1401 more matches not shown…

Over-Commented Block238 hits · 238 pts

Severity	File	Line	Snippet	Context
LOW	bunfig.toml	1	[install]	COMMENT
LOW	tools/vitest/hermetic-environment.ts	1	import { join } from "node:path";	COMMENT
LOW	docker/compose.yaml	21	- openbot-data:/data	COMMENT
LOW	docker/instances/lxcfs.yaml	1	# Added to compose.yaml by `openbot-instance` when LXCFS runs on the host (see lxcfs_ready). LXCFS	COMMENT
LOW	…es/pstack/skills/poteto-mode/scripts/worktree-audit.sh	1	#!/usr/bin/env bash	COMMENT
LOW	scripts/channel-usage-limit-e2e.ts	1	// Checks that channel work moves to the backup model when the agent's model is at its usage limit, in	COMMENT
LOW	scripts/ui-foundation-check.ts	181	/role=["'](?:dialog\|alertdialog\|menu\|tablist\|tab\|tabpanel\|listbox\|option)["']/gu,	COMMENT
LOW	scripts/dev-slack-tunnels.ts	1	// `bun run dev:slack`: the dev stack, reachable by Slack. Slack accepts only public HTTPS addresses,	COMMENT
LOW	scripts/agent-threads-parallel-e2e.ts	1	// Runs an approval in the agent's own chat and one in a side thread at the same time, in this worktree's	COMMENT
LOW	scripts/codex-missing-rollout-e2e.ts	1	// Checks the Codex history backfill at startup for sessions that the reading process has no rollout	COMMENT
LOW	scripts/team-api-routes-e2e.ts	1	// Drives the real `TeamApiServer` on a loopback port over HTTP, as a remote client does. The team	COMMENT
LOW	scripts/i18n-check.ts	1	import { mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";	COMMENT
LOW	scripts/install-server.sh	1	#!/bin/bash	COMMENT
LOW	scripts/windows-home-install-update-e2e.ts	1	// Drives the real Windows installers on a Windows computer that has no OpenBot, such as a CI	COMMENT
LOW	scripts/chat-visual-e2e.ts	1	// Checks what a visual reply's page can do in the desktop app, with a real provider turn.	COMMENT
LOW	scripts/mobile-share-sender-e2e.ts	1	// Builds the page that the iOS share extension runs (`bun scripts/mobile-share-sender.ts`), opens it	COMMENT
LOW	scripts/cursor-usage-e2e.ts	1	// Reads the Cursor plan usage end to end on the real Cursor driver and ACP client, with a fake	COMMENT
LOW	scripts/channel-hide-handoff-e2e.ts	1	// Checks channel work when the user hides an agent or changes its provider, in this worktree's	COMMENT
LOW	scripts/agent-threads-isolation-e2e.ts	1	// Runs an agent's own chat and two side threads at the same time in this worktree's running dev app,	COMMENT
LOW	scripts/compose-review-prompt.ts	1	// Appends the `AGENTS.md` files and the domain review fragments for the directories the PR diff	COMMENT
LOW	scripts/stuck-running-deliveries-e2e.ts	1	// Checks that a failed turn end does not leave a delivery `running` and the agent's queue blocked	COMMENT
LOW	scripts/mac-runtime-dylibs.ts	1	// What a Mach-O binary loads at runtime, and how to make those loads survive leaving the machine	COMMENT
LOW	scripts/agent-threads-branch-e2e.ts	1	// Drives "Branch from here" in this worktree's running dev app, through the real UI, preload bridge,	COMMENT
LOW	scripts/linux-password-store-e2e.ts	1	// Runs the real Electron with the Linux password store choice of `src/main/linux-password-store.ts`	COMMENT
LOW	scripts/image-lightbox-zoom-e2e.ts	1	// Checks the zoom of the image viewer in the desktop app, with no provider turn.	COMMENT
LOW	scripts/record-provider-transcript.ts	1	// Records a redacted transcript of one real provider CLI, for `provider-transcript-replay-e2e.ts`.	COMMENT
LOW	scripts/discord-mobile-release-announcement.ts	1	// The Discord post of a mobile release. Android and iOS review a build on their own, often days	COMMENT
LOW	scripts/landing-demo-e2e.ts	1	// End-to-end check of the app demo on the home page (the `/app-preview` iframe).	COMMENT
LOW	scripts/voice-pane-e2e.ts	1	// Drives the Voice pane in this worktree's two-client harness (`bun run dev:test-client`). The	COMMENT
LOW	scripts/github-workflow-e2e.ts	1	// Checks the GitHub triggers of workflows on the real SQLite and the real workflow service, on a	COMMENT
LOW	scripts/ui-foundation-check.test.ts	61	// The dead-rule scan reports once per class, so its whole branch set lives in one	COMMENT
LOW	scripts/ui-foundation-check.test.ts	81	budget("untokenized transition durations", 2),	COMMENT
LOW	scripts/dev-services.ts	241	// saying so.	COMMENT
LOW	scripts/provider-exit-session-e2e.ts	1	// Checks that an agent keeps its provider session when OpenBot's child processes stop under it.	COMMENT
LOW	scripts/plan-continuation-e2e.ts	1	// Checks the automatic plan continuation: a turn of the agent's own chat or of a side thread that	COMMENT
LOW	scripts/channel-stuck-tasks-e2e.ts	1	// Checks stopped and unassignable channel work, in this worktree's running dev app with real provider	COMMENT
LOW	scripts/mailbox-reconcile-e2e.ts	1	// Checks that reading a conversation page writes nothing when nothing changed (#2224), in this	COMMENT
LOW	scripts/analytics-redaction-e2e.ts	1	// Seeds one random marker into everything a user can type that analytics could read: a custom	COMMENT
LOW	scripts/channel-tools-e2e.ts	1	// Checks the OpenBot tools that a member agent uses in a channel turn, in this worktree's running	COMMENT
LOW	scripts/web-client-perf-e2e.ts	1	// Measures the web client at `/app` in three phases and writes .openbot-build/<out>/report.json.	COMMENT
LOW	scripts/agent-threads-messaging-e2e.ts	1	// Checks messages between agents and provider subagents together with side threads, in this worktree's	COMMENT
LOW	scripts/agent-threads-messaging-e2e.ts	21	// 8. A deletes a side thread after B's answer. B's own chat keeps the request and the answer, and A's	COMMENT
LOW	scripts/channel-notifications-e2e.ts	1	// Checks the channel notifications of the desktop and the channel-attention-v1 fields of the Team API.	COMMENT
LOW	scripts/chat-scroll-streaming-e2e.ts	1	// Checks that the reader can scroll away from a reply that is still arriving, and from new messages	COMMENT
LOW	scripts/codex-code-mode-mcp-e2e.ts	1	// Runs issue #2897 end to end on the real `codex app-server`: a code-mode-only model, as Codex	COMMENT
LOW	scripts/staged-typecheck.ts	1	// Runs the `typecheck:*` scripts whose project can see a staged file, one at a time.	COMMENT
LOW	scripts/channel-concurrency-e2e.ts	1	// Runs channel work end to end in this worktree's running dev app, with real provider turns. Start	COMMENT
LOW	scripts/memory-review-e2e.ts	1	// Checks the background memory review: after every 20 completed turns of an agent's own chat or of	COMMENT
LOW	scripts/memory-review-e2e.ts	21	// 10. An agent on a model that costs more than the provider's default model is reviewed on the	COMMENT
LOW	scripts/channel-many-responders-e2e.ts	1	// Checks that more than one member can answer one channel request, in this worktree's running dev app	COMMENT
LOW	scripts/team-api-legacy-clients-e2e.ts	1	// Checks that a host of this build still serves the released Team API v1, v2 and v3 clients. A real	COMMENT
LOW	scripts/agent-tasks-e2e.ts	1	// Runs agent tasks end to end in this worktree's running dev app, through the real preload bridge,	COMMENT
LOW	scripts/opencode-usage-metering-e2e.ts	1	// Checks that token usage through OpenCode is metered once per turn, with each count. Runs the real	COMMENT
LOW	scripts/channel-file-link-e2e.ts	1	// Checks that file links open from a channel (#2816), in this worktree's running dev app with a real	COMMENT
LOW	scripts/instance-resource-guard-e2e.ts	1	// End-to-end check of the resource handling of agent processes on a server (docs/docker.md#cpu-and-memory-of-the-instan	COMMENT
LOW	scripts/voice-server-smoke.ts	1	// Sets up a voice server in Settings → Voice of a running dev app, and checks that dictation and	COMMENT
LOW	scripts/instance-backup-e2e.ts	1	// End-to-end check of `openbot-instance backup`, `verify`, `restore` and `backups`	COMMENT
LOW	scripts/conversation-mailbox-rewrite-e2e.ts	1	// Checks that a queue change writes no unchanged chat rows again. Runs the real SQLite, mailbox	COMMENT
LOW	scripts/agent-threads-e2e.ts	1	// Drives the thread tabs of an agent's chat in this worktree's running dev app, through the real UI,	COMMENT
LOW	scripts/remote-network-route-e2e.ts	1	// Checks the private network route of remote connections against the desktop app and the web client.	COMMENT
178 more matches not shown…

AI Slop Vocabulary36 hits · 92 pts

Severity	File	Line	Snippet	Context
MEDIUM	src/backend/agent-service.ts	3892	return this.#providers.reloadCustomProviderConfig(harness);	CODE
MEDIUM⚡	src/backend/agent-service.ts	3903	this.#endpoints.waitsForHarness(harness)	CODE
MEDIUM⚡	src/backend/agent-service.ts	3904	? this.#providers.ensureProvider(harness).pipe(	CODE
MEDIUM⚡	src/backend/agent-service.ts	3907	Effect.andThen(this.#endpoints.abandonMovesTo(harness)),	CODE
MEDIUM⚡	src/backend/agent/provider-runtime.ts	1877	this.#environmentReloadPending.delete(harness);	CODE
MEDIUM⚡	src/backend/agent/provider-runtime.ts	1878	if (!this.#clients.has(harness)) return "not-running";	CODE
MEDIUM⚡	src/backend/agent/provider-runtime.ts	1879	if (this.#hooks.isProviderBusy(harness)) {	CODE
MEDIUM⚡	src/backend/agent/provider-runtime.ts	1880	this.#environmentReloadPending.add(harness);	CODE
MEDIUM⚡	src/backend/agent/provider-runtime.ts	1884	this.#runProviderConnectionCommand(harness, () => this.#reprobeProvider(harness)),	CODE
MEDIUM⚡	src/backend/agent/provider-runtime.ts	1886	if (Result.isFailure(result) && this.#hooks.isProviderBusy(harness)) {	CODE
MEDIUM⚡	src/backend/agent/provider-runtime.ts	1887	this.#environmentReloadPending.add(harness);	CODE
MEDIUM⚡	src/backend/agent/custom-endpoints.ts	145	#release(providerId: string, harness: CustomProviderHarness): Record<CustomProviderHarness, number \| undefined> {	COMMENT
MEDIUM⚡	src/backend/agent/custom-endpoints.ts	301	#harnessFallback(harness: CustomProviderHarness, remaining: AgentModelOption[]): AgentModelOption \| null {	COMMENT
MEDIUM⚡	src/backend/agent/custom-endpoints.ts	148	const saved = this.#hooks.endpointHarness(providerId) ?? harness;	CODE
MEDIUM⚡	src/backend/agent/custom-endpoints.ts	157	if (revision !== undefined) this.#released[harness].set(providerId, revision);	CODE
MEDIUM⚡	src/backend/agent/custom-endpoints.ts	158	else this.#released[harness].delete(providerId);	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	258	#recordMoves(endpointId: string, from: CustomProviderHarness, harness: CustomProviderHarness): void {	COMMENT
MEDIUM⚡	src/backend/agent/custom-endpoints.ts	294	this.#harnessFallback(harness, remaining);	CODE
MEDIUM⚡	src/backend/agent/custom-endpoints.ts	296	yield* this.#moveAgents(affected, harness, fallback);	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	530	#waitingFor(harness: CustomProviderHarness): AgentSummary[] {	COMMENT
MEDIUM	src/backend/agent/custom-endpoints.ts	541	#pendingMove(agent: AgentSummary): { endpointId: string; harness: CustomProviderHarness } \| null {	COMMENT
MEDIUM	src/backend/agent/custom-endpoints.ts	96	readonly #pendingMoves = new Map<string, { endpointId: string; harness: CustomProviderHarness }>();	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	117	if (CUSTOM_PROVIDER_HARNESSES.every((harness) => this.#released[harness].size === 0))	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	191	const previous = this.#release(providerId, harness);	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	235	const previous = this.#release(providerId, harness);	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	247	if (from !== null && from !== harness) this.#recordMoves(providerId, from, harness);	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	261	this.#pendingMoves.set(agent.id, { endpointId, harness });	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	463	const released = this.#released[harness];	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	485	for (const agent of this.#waitingFor(harness)) {	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	514	for (const agent of this.#waitingFor(harness)) {	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	526	return this.#waitingFor(harness).length > 0;	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	547	this.#hooks.endpointHarness(move.endpointId) === move.harness;	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	589	const fallback = this.#harnessFallback(harness, remaining);	CODE
MEDIUM	src/backend/agent/custom-endpoints.ts	593	yield* this.#moveAgents(affected, harness, fallback);	CODE
MEDIUM	src/main/provider-runtime-manager.ts	837	if (!this.#isProviderOn(harness)) return Effect.void;	CODE
MEDIUM	src/main/provider-runtime-manager.ts	838	return this.#startMissingCli(harness).pipe(Effect.ignore, Effect.forkIn(this.#scope), Effect.asVoid);	CODE

Cross-Language Confusion (JS/TS)15 hits · 75 pts

Severity	File	Line	Snippet	Context
HIGH	scripts/stripe-flows-e2e.ts	1020	print(`${pass ? "PASS" : "FAIL"} [${scenario}] ${step}`);	CODE
HIGH	scripts/stripe-flows-e2e.ts	1493	print(`PORTAL_CANCEL ${(await account.portal("cancel", sub)).url}`);	CODE
HIGH	scripts/stripe-flows-e2e.ts	1516	print(`PORTAL_UPDATE ${(await account.portal("update", sub)).url}`);	CODE
HIGH	scripts/stripe-flows-e2e.ts	1587	print("SKIP [refund] sales facts: the Worker has no OpenPanel client");	CODE
HIGH	scripts/stripe-flows-e2e.ts	1655	print("SKIP [dispute] sales facts: the Worker has no OpenPanel client");	CODE
HIGH	scripts/stripe-flows-e2e.ts	1683	print("SKIP [welcome] send count: the remote Worker log is not available");	CODE
HIGH	scripts/stripe-flows-e2e.ts	1718	print(`Checkout paid; returned to ${returned}`);	CODE
HIGH	scripts/stripe-flows-e2e.ts	2592	print("SKIP [order-bundle] the Worker sells the license promotion: start it with LICENSE_TRIAL_END=");	CODE
HIGH	scripts/stripe-flows-e2e.ts	2696	print("SKIP [order-bundle] sales facts: the Worker has no OpenPanel client");	CODE
HIGH	scripts/stripe-flows-e2e.ts	2769	print("SKIP [license-team-year] sales facts: the Worker has no OpenPanel client");	CODE
HIGH	scripts/stripe-flows-e2e.ts	3083	print("SKIP [license-trial] the Worker sells no license promotion: set LICENSE_TRIAL_END");	CODE
HIGH	scripts/stripe-flows-e2e.ts	3131	print("SKIP [order-trial] the Worker sells no license promotion: set LICENSE_TRIAL_END");	CODE
HIGH	scripts/stripe-flows-e2e.ts	3216	print(SCENARIOS.map(userId).join(","));	CODE
HIGH	scripts/stripe-flows-e2e.ts	3257	print(`Report: ${REPORT}`);	CODE
HIGH	scripts/hosting/hosted-database-durability-e2e.ts	153	print(json.dumps(result))	CODE

Structural Annotation Overuse32 hits · 48 pts

Severity	File	Line	Snippet	Context
LOW	plans/005-invite-acceptance-keeps-members-and-epoch.md	134	### Step 1: Write the E2E first, and see it fail	COMMENT
LOW	plans/005-invite-acceptance-keeps-members-and-epoch.md	180	### Step 2: Read the existing membership with its status	COMMENT
LOW	plans/005-invite-acceptance-keeps-members-and-epoch.md	189	### Step 3: Apply the policy before the batch	COMMENT
LOW	plans/005-invite-acceptance-keeps-members-and-epoch.md	218	### Step 4: Make the single-use cap one statement	COMMENT
LOW	plans/005-invite-acceptance-keeps-members-and-epoch.md	229	### Step 5: Wire CI and write the release note	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	415	### Step 0: Freeze the threat model and the contract	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	436	### Step 1: Add the Bun + Elysia package	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	481	### Step 2: Add PostgreSQL and versioned migrations	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	508	### Step 3: Implement registration, verification, sessions and password reset	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	540	### Step 4: Add Ed25519, JWKS and the host-scoped token	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	564	### Step 5: Add the central session to Electron main	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	615	### Step 6: Move TeamStore to the v2 whitelist	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	650	### Step 7: Replace host auth with token and whitelist verification	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	679	### Step 8: Move the remote client to the host-scoped token	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	716	### Step 9: Change the account, host and join UI	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	748	### Step 10: Add a safe migration of the host data	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	775	### Step 11: Add deployment, CI and privacy documentation	COMMENT
LOW	plans/001-central-auth-api-and-host-whitelist.md	807	### Step 12: Run the full flow test	COMMENT
LOW	plans/006-provider-loss-ends-only-its-own-work.md	142	### Step 1: Write the E2E and see it fail	COMMENT
LOW	plans/006-provider-loss-ends-only-its-own-work.md	173	### Step 2: Scope the compaction release	COMMENT
LOW	plans/006-provider-loss-ends-only-its-own-work.md	181	### Step 3: Scope the browser control end	COMMENT
LOW	plans/006-provider-loss-ends-only-its-own-work.md	198	### Step 4: Run the neighbors and write the release note	COMMENT
LOW	…s/008-mailbox-single-delivery-reads-skip-full-sorts.md	141	### Step 1: Add checks and timings to the scale E2E	COMMENT
LOW	…s/008-mailbox-single-delivery-reads-skip-full-sorts.md	171	### Step 2: Compute one position without a sort	COMMENT
LOW	…s/008-mailbox-single-delivery-reads-skip-full-sorts.md	199	### Step 3: Index once in the list reads	COMMENT
LOW	…s/008-mailbox-single-delivery-reads-skip-full-sorts.md	222	### Step 4: Lint and release note	COMMENT
LOW	plans/007-web-client-trims-inactive-conversations.md	151	### Step 1: Make the bench show older-page reads, and write the E2E	COMMENT
LOW	plans/007-web-client-trims-inactive-conversations.md	182	### Step 2: Add the trim	COMMENT
LOW	plans/007-web-client-trims-inactive-conversations.md	206	### Step 3: Run neighbors and write the release note	COMMENT
LOW	plans/009-https-session-end-closes-browser-view.md	125	### Step 1: Write the E2E (it fails first)	COMMENT
LOW	plans/009-https-session-end-closes-browser-view.md	169	### Step 2: Close browser views on both routes	COMMENT
LOW	plans/009-https-session-end-closes-browser-view.md	187	### Step 3: Lint and release note	COMMENT

Hallucination Indicators4 hits · 40 pts

Severity	File	Line	Snippet	Context
CRITICAL	scripts/build-remote-desktop-runtime.ts	186	join(sourceOutput, lock.remoteDesktop.sunshine.patch.path.split("/").at(-1) ?? "sunshine-openbot.patch"),	CODE
CRITICAL	scripts/build-remote-desktop-runtime.ts	190	join(sourceOutput, lock.remoteDesktop.moonlightWeb.patch.path.split("/").at(-1) ?? "moonlight-openbot.patch"),	CODE
CRITICAL	…/ui/src/features/settings/SettingsMobileConnectTab.tsx	212	const phones = () => props.store.state.devices.devices.filter((device) => device.via === "link").length;	CODE
CRITICAL	…kages/ui/src/features/marketplace/MarketplaceCards.tsx	60	const view = props.scope.nav.state.stack.at(-1);	CODE

Fake / Example Data25 hits · 25 pts

Severity	File	Line	Snippet	Context
LOW	resources/plugin-catalog/render/1.0.0.json	36	"placeholder": "rnd_…",	CODE
LOW	resources/plugin-catalog/posthog/1.0.0.json	36	"placeholder": "phx_…",	CODE
LOW	resources/plugin-catalog/composio/1.1.0.json	35	"placeholder": "https://connect.composio.dev/mcp",	CODE
LOW	resources/plugin-catalog/composio/1.1.0.json	42	"placeholder": "ck_…",	CODE
LOW	marketplace/plugin-catalog/plugins/render/plugin.json	36	"placeholder": "rnd_…",	CODE
LOW	marketplace/plugin-catalog/plugins/posthog/plugin.json	36	"placeholder": "phx_…",	CODE
LOW	marketplace/plugin-catalog/plugins/composio/plugin.json	35	"placeholder": "https://connect.composio.dev/mcp",	CODE
LOW	marketplace/plugin-catalog/plugins/composio/plugin.json	42	"placeholder": "ck_…",	CODE
LOW	scripts/build-plugin-catalog.ts	444	for (const optional of ["prefix", "placeholder", "hint"] as const) {	CODE
LOW	scripts/memory-review-e2e.ts	363	const filler = " Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed eiusmod tempor.".repeat(5);	CODE
LOW	scripts/memory-review-e2e.ts	363	const filler = " Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed eiusmod tempor.".repeat(5);	CODE
LOW	scripts/claude-windows-cmd-e2e.ts	122	const bin = join(root, "Jane Doe", "npm");	CODE
LOW	scripts/provider-fakes/transcript-redaction.test.ts	227	expect(() => assertRedacted('{"to":"someone@example.org"}', [])).toThrow();	CODE
LOW	…ui/src/features/conversation/ui-blocks/UiFormBlock.tsx	130	placeholder={"placeholder" in field ? field.placeholder : undefined}	CODE
LOW	…ui/src/features/conversation/ui-blocks/UiFormBlock.tsx	163	placeholder={"placeholder" in field ? field.placeholder : undefined}	CODE
LOW	apps/auth-api/scripts/smtp-stall-e2e.ts	142	{ email: "user@example.com", code: "ABCD-EFGH", expiresAt: Date.now() + 10 * 60_000 },	CODE
LOW	…/mobile/src/features/support/model/support-log.test.ts	17	expect(text).not.toContain("user@example.com");	CODE
LOW	src/renderer/src/preview/mock-vault.ts	84	username: "user@example.com",	CODE
LOW	src/backend/browser-fill-fields.ts	83	const fingerprint = JSON.stringify([this.localName, this.type \|\| '', this.getAttribute('autocomplete'), this.form?.get	CODE
LOW	src/backend/browser-card-fill.ts	70	placeholder: this.getAttribute('placeholder') ?? '',	CODE
LOW	src/backend/browser-cdp-snapshot.ts	284	const label = node.getAttribute?.('aria-label') \|\| node.getAttribute?.('placeholder') \|\| node.id \|\| '';	CODE
LOW	src/preload/app-decoding.test.ts	69	email: "user@example.com",	CODE
LOW	src/preload/app-decoding.test.ts	137	user: { id: "user-1", email: "user@example.com", name: null, avatarUrl: null },	CODE
LOW	src/preload/app-decoding.test.ts	145	user: { id: "user-1", email: "user@example.com", name: null, avatarUrl: null, analyticsEnabled: true },	CODE
LOW	src/preload/app-decoding.test.ts	275	user: { id: "user-1", email: "user@example.com", name: null, avatarUrl: null, analyticsEnabled: "yes" },	CODE

Magic Placeholder Names2 hits · 12 pts

Severity	File	Line	Snippet	Context
HIGH	packages/logging/src/redaction.test.ts	104	"https://example.com/docs?key=YOUR_API_KEY",	CODE
HIGH	packages/logging/src/index.ts	72	// query parameter. The value must hold a digit, so a placeholder such as `YOUR_API_KEY` in a skill	COMMENT

Excessive Try-Catch Wrapping2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	scripts/hosting/hosted-database-durability-e2e.ts	108	except Exception:	CODE
LOW	scripts/hosting/hosted-database-durability-e2e.ts	151	except Exception as error:	CODE

nightly-labs/openbot

Open-Source Code Quality, Security and Technical Debt Review

Risk Review · Payload v1

What These Metrics Mean

Pattern-Signal History

Severity Breakdown

Directory Score Breakdown

Pattern Findings