Self-hosted AI workspace.
This report summarizes scanner evidence for odysseus-dev/odysseus, a Python project with 92,749 GitHub stars. SynthScan examined 720,150 lines of code across 2299 source files, recording 16984 pattern matches distributed across 23 syntactic categories. The legacy adjusted pattern signal is 33.3 (High pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 11804 finding(s).
Are imports declared and package/API names verified? 1491 finding(s).
Are wrappers, guards, and repeated structures necessary? 14387 finding(s).
Which changes need focused human review? 16984 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 16984 distinct pattern matches across 23 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup.py | 55 | def _prompt_admin_credentials(): | CODE |
| LOW⚡ | app.py | 621 | async def session_not_found_handler(request: Request, exc: SessionNotFoundError): | CODE |
| LOW⚡ | app.py | 625 | async def invalid_file_upload_handler(request: Request, exc: InvalidFileUploadError): | CODE |
| LOW⚡ | app.py | 629 | async def llm_service_error_handler(request: Request, exc: LLMServiceError): | CODE |
| LOW | app.py | 20 | def register_static_mime_types() -> None: | CODE |
| LOW | app.py | 1076 | def _docker_default_gateway_ip() -> str: | CODE |
| LOW | core/auth.py | 185 | def _drop_reserved_loaded_users(self): | CODE |
| LOW | core/auth.py | 210 | def _migrate_legacy_admin_role(self): | CODE |
| LOW | core/auth.py | 512 | def totp_get_provisioning_uri(self, username: str, secret: str) -> str: | CODE |
| LOW⚡ | core/models.py | 25 | def set_session_manager_instance(manager: "SessionManager"): | CODE |
| LOW⚡ | core/models.py | 31 | def get_session_manager_instance() -> Optional["SessionManager"]: | CODE |
| LOW⚡ | core/models.py | 41 | def _history_grants_chat_session_approval( | CODE |
| LOW⚡ | core/platform_compat.py | 360 | def get_wsl_windows_user_profile() -> Optional[str]: | CODE |
| LOW | core/platform_compat.py | 457 | def run_wsl_windows_powershell( | CODE |
| LOW⚡ | core/database.py | 973 | def _migrate_add_memory_extraction_enabled_column(): | CODE |
| LOW⚡ | core/database.py | 995 | def _migrate_add_skill_injection_enabled_column(): | CODE |
| LOW⚡ | core/database.py | 1017 | def _migrate_add_memory_injection_enabled_column(): | CODE |
| LOW⚡ | core/database.py | 1039 | def _migrate_add_session_generation_settings_columns(): | CODE |
| LOW⚡ | core/database.py | 1087 | def _migrate_add_owner_column(): | CODE |
| LOW⚡ | core/database.py | 1134 | def _migrate_add_hidden_models_column(): | CODE |
| LOW⚡ | core/database.py | 1157 | def _migrate_add_model_endpoint_owner_column(): | CODE |
| LOW⚡ | core/database.py | 1189 | def _migrate_add_provider_auth_id_column(): | CODE |
| LOW⚡ | core/database.py | 1214 | def _migrate_add_model_type_column(): | CODE |
| LOW⚡ | core/database.py | 1237 | def _migrate_add_model_endpoint_refresh_columns(): | CODE |
| LOW⚡ | core/database.py | 1265 | def _migrate_add_task_run_model_column(): | CODE |
| LOW⚡ | core/database.py | 1288 | def _migrate_add_supports_tools_column(): | CODE |
| LOW⚡ | core/database.py | 1312 | def _migrate_add_model_tool_modes_column(): | CODE |
| LOW⚡ | core/database.py | 1336 | def _migrate_add_cached_models_column(): | CODE |
| LOW⚡ | core/database.py | 1358 | def _migrate_add_pinned_models_column(): | CODE |
| LOW⚡ | core/database.py | 1381 | def _migrate_add_notes_sort_order(): | CODE |
| LOW⚡ | core/database.py | 1436 | def _migrate_add_folder_column(): | CODE |
| LOW⚡ | core/database.py | 1459 | def _migrate_add_session_cwd_column(): | CODE |
| LOW⚡ | core/database.py | 1482 | def _migrate_add_session_endpoint_id_column(): | CODE |
| LOW⚡ | core/database.py | 1519 | def _migrate_add_total_cost_usd(): | CODE |
| LOW⚡ | core/database.py | 1542 | def _migrate_add_owner_to_table(table_name: str, index_name: str): | CODE |
| LOW⚡ | core/database.py | 1566 | def _migrate_add_multiuser_owner_columns(): | CODE |
| LOW⚡ | core/database.py | 1601 | def _migrate_add_api_token_scopes_column(): | CODE |
| LOW⚡ | core/database.py | 1629 | def _migrate_assign_legacy_owner(): | CODE |
| LOW⚡ | core/database.py | 1780 | def _migrate_add_tidy_verdict(): | CODE |
| LOW⚡ | core/database.py | 1793 | def _migrate_add_doc_source_email_cols(): | CODE |
| LOW⚡ | core/database.py | 1932 | def _migrate_add_oauth_config(): | CODE |
| LOW⚡ | core/database.py | 1944 | def _migrate_add_disabled_tools(): | CODE |
| LOW⚡ | core/database.py | 1956 | def _migrate_add_mcp_oauth_tokens_column(): | CODE |
| LOW⚡ | core/database.py | 2014 | def _migrate_add_notifications_enabled(): | CODE |
| LOW⚡ | core/database.py | 2027 | def _migrate_add_crew_member_id(): | CODE |
| LOW⚡ | core/database.py | 2640 | def _migrate_encrypt_endpoint_keys(): | CODE |
| LOW⚡ | core/database.py | 2664 | def _migrate_encrypt_signatures(): | CODE |
| LOW⚡ | core/database.py | 2696 | def _migrate_encrypt_email_passwords(): | CODE |
| LOW⚡ | core/database.py | 2756 | def _migrate_add_calendar_origin(): | CODE |
| LOW⚡ | core/database.py | 2783 | def _migrate_add_calendar_account_id(): | CODE |
| LOW⚡ | core/database.py | 2809 | def _migrate_add_caldav_sync_columns(): | CODE |
| LOW⚡ | core/database.py | 2861 | def _migrate_add_calendar_recurrence_exdates(): | CODE |
| LOW⚡ | core/database.py | 2882 | def _migrate_add_note_gallery_id(): | CODE |
| LOW | core/database.py | 513 | def lock_email_account_owner_mutations(db, *owners: str) -> None: | CODE |
| LOW | core/database.py | 928 | def _migrate_add_last_message_at_column(): | CODE |
| LOW | core/database.py | 1063 | def _migrate_add_document_archived_column(): | CODE |
| LOW | core/database.py | 1495 | def _migrate_add_token_columns(): | CODE |
| LOW | core/database.py | 1578 | def _migrate_add_gallery_caption_column(): | CODE |
| LOW | core/database.py | 1753 | def _migrate_backfill_document_owner_from_session(): | CODE |
| LOW | core/database.py | 1818 | def _migrate_add_calendar_source_email_cols(): | CODE |
| 10586 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | core/database.py | 590 | # is the historical default. When non-null, the model picker only shows | COMMENT |
| HIGH⚡ | tests/test_memory_skills_sidebar_split.py | 75 | assert "tab.hidden || tab.classList.contains('hidden')" in MEMORY_JS | CODE |
| HIGH⚡ | tests/test_document_ai_preview_refresh_js.py | 44 | refresh = "markdownPreviewWasVisible && _refreshMarkdownPreviewIfVisible(docId, newContent)" | CODE |
| HIGH | tests/test_document_ai_preview_refresh_js.py | 60 | assert "if (isRichTextUpdate && updatedDocForRichText)" in body | CODE |
| HIGH | tests/test_execution_bridge.py | 20 | @pytest.mark.parametrize("content", ['{"path":"/workspace/x"}', '{"path":"/workspace/x","content":null}', | CODE |
| HIGH⚡ | tests/test_document_rich_text_tools.py | 108 | assert "e.defaultPrevented || e.target?.closest?.('#doc-editor-pane, [contenteditable=\"true\"]')" in app_js | CODE |
| HIGH⚡ | tests/test_document_rich_text_tools.py | 179 | assert "mod && key === 'enter'" in rich_wiring | CODE |
| HIGH | tests/test_preset_local_storage_js.py | 21 | }}[key] ?? null; | CODE |
| HIGH⚡ | tests/test_runtime_evidence_contract.py | 30 | 'cd /workspace && python3 -m unittest', 'pytest -q tests/test_app.py', | CODE |
| HIGH⚡ | tests/test_runtime_evidence_contract.py | 38 | 'echo python -m unittest', 'echo "pytest passed"', 'false && pytest', | CODE |
| HIGH⚡ | tests/test_runtime_evidence_contract.py | 39 | 'pytest; true', 'pytest || true', 'pytest | cat', 'python -c "print(\'pytest\')"', | CODE |
| HIGH⚡ | tests/test_runtime_evidence_contract.py | 531 | ('"$runner" -m pytest || true', False), | CODE |
| HIGH⚡ | tests/test_runtime_evidence_contract.py | 546 | @pytest.mark.parametrize('command, expected', [('pytest -q', True), ('pytest || true', False)]) | CODE |
| HIGH | tests/test_runtime_evidence_contract.py | 390 | _, result = await execute_tool_block(ToolBlock('bash', 'mkdir nested && printf changed > nested/app.py'), | CODE |
| HIGH⚡ | tests/test_editor_layer_groups_js.py | 50 | clearRect(){operations.push([tag,'clear']);}, | CODE |
| HIGH⚡ | tests/test_editor_layer_groups_js.py | 51 | drawImage(image,x=0,y=0){operations.push([tag,'draw',image.tag,x,y,this._alpha,this._gco]);}, | CODE |
| HIGH | tests/test_editor_layer_groups_js.py | 117 | const makeCtx=tag=>({tag,_alpha:1,_gco:'source-over',clearRect(){},drawImage(image){operations.push([tag,'draw', | CODE |
| HIGH | tests/test_editor_layer_groups_js.py | 139 | const makeCtx=tag=>({tag,_alpha:1,_gco:'source-over',clearRect(){},drawImage(image){operations.push([tag,'draw', | CODE |
| HIGH⚡ | tests/test_editor_layer_groups_js.py | 158 | clearRect(){operations.push('clear');}, | CODE |
| HIGH⚡ | tests/test_editor_layer_groups_js.py | 159 | drawImage(){operations.push('draw');}, | CODE |
| HIGH⚡ | tests/test_editor_layer_groups_js.py | 164 | drawGroupedLayers(ctx,state,layer=>({tag:layer.id}),null,null,()=>false); | CODE |
| HIGH | tests/test_editor_brush_engine_js.py | 32 | emit: sample => samples.push(sample), | CODE |
| HIGH | tests/test_editor_brush_engine_js.py | 63 | const storage = {{ getItem:key => values.get(key) || null, setItem:(key,value) => values.set(key,value) }}; | CODE |
| HIGH | tests/test_document_rich_keyboard_shortcuts.py | 38 | let block = null; | CODE |
| HIGH | tests/test_local_endpoint_api_key_js.py | 59 | class FormData {{ append(k, v) {{ appended.push([k, String(v)]); }} }} | CODE |
| HIGH | tests/test_local_endpoint_api_key_js.py | 62 | if (!(id in FIELDS)) return null; | CODE |
| HIGH | tests/test_local_endpoint_api_key_js.py | 75 | let _recentlyAddedEpId = null; | CODE |
| HIGH | tests/test_editor_layer_geometry_js.py | 22 | globalThis.document = {{activeElement:null}}; | CODE |
| HIGH⚡ | tests/test_editor_layer_geometry_js.py | 65 | transformActive:false,transformLayer:null,transformOrigOffset:null, | CODE |
| HIGH⚡ | tests/test_editor_layer_geometry_js.py | 69 | activeLayer:()=>layer,saveState:label=>labels.push(label),composite:()=>{}, | CODE |
| HIGH | tests/test_editor_layer_geometry_js.py | 105 | activeLayer:()=>layer,saveState:label=>labels.push(label),composite:()=>{}, | CODE |
| HIGH | tests/test_editor_layer_geometry_js.py | 106 | onPositionChange:(_layer,_before,next)=>positions.push(next), | CODE |
| HIGH | tests/test_editor_layer_geometry_js.py | 136 | const controller=createLayerGeometryController({activeLayer:()=>layer,saveState:label=>labels.push(label),compos | CODE |
| HIGH | tests/test_editor_layer_geometry_js.py | 137 | const tool=createMoveTool({activeLayer:()=>layer,saveState:label=>labels.push(label),composite:()=>{}}); | CODE |
| HIGH | tests/test_editor_layer_geometry_js.py | 167 | const tool=createMoveTool({activeLayer:()=>layer,saveState:label=>labels.push(label),composite:()=>{}}); | CODE |
| HIGH | tests/test_editor_layer_geometry_js.py | 173 | layer.activeMaskId=null; | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 37 | addElement(id, { statusText = null } = {}) { | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 44 | status: null, | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 49 | return sel === '[data-session-list-status]' ? this.status : null; | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 52 | if (statusText !== null) el.status = { textContent: statusText }; | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 70 | globalThis.document = { getElementById: (id) => byId.get(id) || null }; | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 72 | globalThis.requestAnimationFrame = (fn) => { frames.push(fn); return frames.length; }; | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 73 | globalThis.setTimeout = (fn, ms) => { timers.push({ fn, ms }); return timers.length; }; | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 87 | opacity: loader.style.opacity ?? null, | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 88 | pointerEvents: loader.style.pointerEvents ?? null, | CODE |
| HIGH⚡ | tests/test_startup_shell_js.py | 89 | ariaHidden: loader.getAttribute('aria-hidden') ?? null, | CODE |
| HIGH | tests/test_startup_shell_js.py | 238 | const succeeded = await shell.settleSessionHydration(null); | CODE |
| HIGH⚡ | tests/test_calendar_utils_dates_js.py | 29 | addNull: _addDays(null, 1), | STRING |
| HIGH⚡ | tests/test_calendar_utils_dates_js.py | 31 | shiftNull: _shiftDT(null, 1), | STRING |
| HIGH⚡ | tests/test_calendar_utils_dates_js.py | 33 | localNull: _localDateOf(null), | STRING |
| HIGH⚡ | tests/test_chatgpt_subscription_usage_js.py | 350 | toggleBtn.querySelector = sel => sel.includes('chevron') ? chevron : null; | CODE |
| HIGH⚡ | tests/test_chatgpt_subscription_usage_js.py | 351 | toggleBtn.closest = sel => sel.includes('admin-user-row') ? row : null; | CODE |
| HIGH⚡ | tests/test_chatgpt_subscription_usage_js.py | 355 | reconnectBtn.closest = sel => sel.includes('admin-user-row') ? row : null; | CODE |
| HIGH⚡ | tests/test_chatgpt_subscription_usage_js.py | 366 | return null; | CODE |
| HIGH⚡ | tests/test_chatgpt_subscription_usage_js.py | 376 | async url => {{ urls.push(url); return {{ ok: true, json: async () => ({{available: true, usage: {{limits: []}}} | CODE |
| HIGH⚡ | tests/test_chatgpt_subscription_usage_js.py | 378 | async (provider, options) => {{ operations.push(Object.fromEntries(options.formData)); return {{ status: 'author | CODE |
| HIGH⚡ | tests/test_chatgpt_subscription_usage_js.py | 494 | toggleBtn.querySelector = sel => sel.includes('chevron') ? chevron : null; | CODE |
| HIGH⚡ | tests/test_chatgpt_subscription_usage_js.py | 495 | toggleBtn.closest = sel => sel.includes('admin-user-row') ? row : null; | CODE |
| HIGH⚡ | tests/test_chatgpt_subscription_usage_js.py | 499 | reconnectBtn.closest = sel => sel.includes('admin-user-row') ? row : null; | CODE |
| HIGH | tests/test_chatgpt_subscription_usage_js.py | 250 | async url => {{ urls.push(url); return {{ ok: true, json: async () => ({{available: true, usage: {{limits: []}}} | CODE |
| 655 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | core/auth.py | 251 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/auth.py | 253 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/auth.py | 492 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/auth.py | 494 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/auth.py | 577 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/auth.py | 579 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/platform_compat.py | 39 | # ── procfs ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/platform_compat.py | 52 | # ── File permissions ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/platform_compat.py | 70 | # ── Account home ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/platform_compat.py | 90 | # ── Process detach / liveness / teardown ──────────────────────────────────── | COMMENT |
| MEDIUM | core/platform_compat.py | 166 | # ── Shell / executable resolution ─────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/session_manager.py | 433 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | core/session_manager.py | 435 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | core/session_manager.py | 662 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | core/session_manager.py | 664 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | core/session_manager.py | 727 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | core/session_manager.py | 729 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/session_manager.py | 82 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/session_manager.py | 84 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/session_manager.py | 237 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/session_manager.py | 239 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/session_manager.py | 758 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | core/session_manager.py | 760 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | tests/test_redos_xml_tool_parsers.py | 45 | # ── correctness is preserved ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_redos_xml_tool_parsers.py | 118 | # ── pathological inputs no longer blow up ─────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_workspace_confine.py | 82 | # ── the central binding: the safety net ───────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_workspace_confine.py | 320 | # ── no leak across calls ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_workspace_confine.py | 328 | # ── tool selection: an active workspace is the file-work signal ───────── | COMMENT |
| MEDIUM⚡ | tests/test_workspace_confine.py | 505 | # ── bind-time vetting of the workspace root ───────────────────────────── | COMMENT |
| MEDIUM | tests/test_workspace_confine.py | 63 | # ── the resolver helper ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_workspace_confine.py | 107 | # ── end-to-end via execute_tool_block (sets + resets the binding) ─────── | COMMENT |
| MEDIUM | tests/test_workspace_confine.py | 309 | # ── get_workspace tool ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_workspace_confine.py | 484 | # ── browse route is admin-gated ───────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_workspace_confine.py | 571 | # ── send-time privilege gate (no path oracle for non-admins) ──────────── | COMMENT |
| MEDIUM | tests/test_skill_index_toolset_gating.py | 15 | # ── module-load stubbing (matches other tests in this repo) ────────── | COMMENT |
| MEDIUM⚡ | tests/test_imap_leak_fixes.py | 42 | # ── email_helpers ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_imap_leak_fixes.py | 109 | # ── email_server ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_imap_leak_fixes.py | 234 | # ── connect-time leak: _imap_connect / _open_imap_connection (#3174) ────────── | COMMENT |
| MEDIUM⚡ | tests/test_calendar_recurrence.py | 16 | # ── _resolve_base_uid ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_calendar_recurrence.py | 45 | # ── _expand_rrule ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_process_ownership.py | 46 | # ── Verdicts, against real processes ──────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_process_ownership.py | 114 | # ── An unavailable mechanism is a failure, not a default ──────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_process_ownership.py | 178 | # ── Mechanism selection ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_process_ownership.py | 234 | # ── The process tree ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_security_regressions.py | 118 | # ── secure-by-default deployment + integration storage ───────── | COMMENT |
| MEDIUM⚡ | tests/test_security_regressions.py | 248 | # ── provider auth error normalization ────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_security_regressions.py | 285 | # ── compose-upload path traversal block ───────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_security_regressions.py | 873 | # ── web_fetch SSRF guard (PR #111 merge gate) ─────────────────────── | COMMENT |
| MEDIUM | tests/test_security_regressions.py | 24 | # ── prompt-injection context wrapper ──────────────────────────── | COMMENT |
| MEDIUM | tests/test_security_regressions.py | 46 | # ── secret_storage ───────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_security_regressions.py | 210 | # ── _q IMAP mailbox quoter ───────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_security_regressions.py | 513 | # ── require_user dependency rejects anon callers ──────────────── | COMMENT |
| MEDIUM | tests/test_security_regressions.py | 1280 | # ── DNS rebinding (audit finding 8.1) ──────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_email_oauth.py | 37 | # ── OAuth state signing ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/test_email_oauth.py | 774 | # ── Password-account regression ─────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_email_oauth.py | 137 | # ── XOAUTH2 SASL framing ───────────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_email_oauth.py | 151 | # ── Helpers for in-memory DB fixtures ──────────────────────────── | COMMENT |
| MEDIUM | tests/test_email_oauth.py | 191 | # ── Token encryption at rest ───────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_email_oauth.py | 259 | # ── Real OAuth callback route ───────────────────────────────────── | COMMENT |
| MEDIUM | tests/test_email_oauth.py | 425 | # ── Redirect URI scheme ─────────────────────────────────────────── | COMMENT |
| 802 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | app.py | 1381 | except Exception: | CODE |
| HIGH | app.py | 1365 | except asyncio.CancelledError: | CODE |
| HIGH | app.py | 1376 | except asyncio.CancelledError: | CODE |
| HIGH | launcher.py | 115 | except Exception: | CODE |
| HIGH | launcher.py | 128 | except Exception: | CODE |
| HIGH | launcher.py | 69 | except Exception: | CODE |
| HIGH | core/platform_compat.py | 368 | except Exception: | CODE |
| HIGH | core/platform_compat.py | 379 | except Exception: | CODE |
| HIGH | core/platform_compat.py | 328 | except Exception: | CODE |
| HIGH | core/database.py | 1658 | except Exception: | CODE |
| HIGH | core/database.py | 545 | except IntegrityError: | CODE |
| HIGH | core/database.py | 970 | except Exception: | CODE |
| HIGH | core/database.py | 992 | except Exception: | CODE |
| HIGH | core/database.py | 1014 | except Exception: | CODE |
| HIGH | core/database.py | 1036 | except Exception: | CODE |
| HIGH | core/database.py | 1083 | except Exception: | CODE |
| HIGH | core/database.py | 1108 | except Exception: | CODE |
| HIGH | core/database.py | 1131 | except Exception: | CODE |
| HIGH | core/database.py | 1154 | except Exception: | CODE |
| HIGH | core/database.py | 1185 | except Exception: | CODE |
| HIGH | core/database.py | 1210 | except Exception: | CODE |
| HIGH | core/database.py | 1234 | except Exception: | CODE |
| HIGH | core/database.py | 1262 | except Exception: | CODE |
| HIGH | core/database.py | 1285 | except Exception: | CODE |
| HIGH | core/database.py | 1308 | except Exception: | CODE |
| HIGH | core/database.py | 1332 | except Exception: | CODE |
| HIGH | core/database.py | 1355 | except Exception: | CODE |
| HIGH | core/database.py | 1378 | except Exception: | CODE |
| HIGH | core/database.py | 1410 | except Exception: | CODE |
| HIGH | core/database.py | 1433 | except Exception: | CODE |
| HIGH | core/database.py | 1456 | except Exception: | CODE |
| HIGH | core/database.py | 1479 | except Exception: | CODE |
| HIGH | core/database.py | 1516 | except Exception: | CODE |
| HIGH | core/database.py | 1539 | except Exception: | CODE |
| HIGH | core/database.py | 1563 | except Exception: | CODE |
| HIGH | core/database.py | 1597 | except Exception: | CODE |
| HIGH | core/database.py | 1626 | except Exception: | CODE |
| HIGH | core/database.py | 1699 | except Exception: | CODE |
| HIGH | core/database.py | 2574 | except Exception: | CODE |
| HIGH | core/database.py | 2636 | except Exception: | CODE |
| HIGH | core/database.py | 2752 | except Exception: | CODE |
| HIGH | core/database.py | 2779 | except Exception: | CODE |
| HIGH | core/database.py | 2805 | except Exception: | CODE |
| HIGH | core/database.py | 2857 | except Exception: | CODE |
| HIGH | core/database.py | 2879 | except Exception: | CODE |
| HIGH | core/session_manager.py | 60 | except (json.JSONDecodeError, ValueError): | CODE |
| HIGH | core/atomic_io.py | 84 | except OSError: | CODE |
| HIGH | core/atomic_io.py | 105 | except OSError: | CODE |
| HIGH | core/middleware.py | 72 | except Exception: | CODE |
| HIGH | tests/test_imap_leak_fixes.py | 120 | except Exception: | CODE |
| HIGH | tests/test_imap_leak_fixes.py | 143 | except Exception: | CODE |
| HIGH | tests/test_imap_leak_fixes.py | 164 | except RuntimeError: | CODE |
| HIGH | tests/test_imap_leak_fixes.py | 188 | except RuntimeError: | CODE |
| HIGH | tests/test_imap_leak_fixes.py | 207 | except RuntimeError: | CODE |
| HIGH | tests/test_imap_leak_fixes.py | 225 | except RuntimeError: | CODE |
| HIGH | tests/test_session_list_owner_scope.py | 35 | except ImportError: | CODE |
| HIGH | tests/test_security_regressions.py | 1370 | except _socket.timeout: | CODE |
| HIGH | tests/conftest.py | 29 | except ImportError: | CODE |
| HIGH | tests/_shards.py | 154 | except (OSError, ValueError): | CODE |
| HIGH | tests/test_caldav_redirect_hardening.py | 73 | except Exception: | CODE |
| 466 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup.py | 221 | except Exception: | CODE |
| LOW | setup.py | 268 | except Exception as e: | CODE |
| LOW | setup.py | 278 | except Exception as e: | CODE |
| MEDIUM | app.py | 218 | def _stop_background(): | CODE |
| MEDIUM | app.py | 657 | def _stop_background(): | CODE |
| MEDIUM | app.py | 1076 | def _docker_default_gateway_ip() -> str: | CODE |
| MEDIUM | app.py | 1151 | def _startup_mcp_connections(): | CODE |
| LOW⚡ | app.py | 1262 | except Exception as e: | CODE |
| LOW⚡ | app.py | 1269 | except Exception as e: | CODE |
| LOW⚡ | app.py | 1271 | except Exception as e: | CODE |
| LOW⚡ | app.py | 1381 | except Exception: | CODE |
| LOW⚡ | app.py | 1386 | except Exception as e: | CODE |
| LOW⚡ | app.py | 1391 | except Exception as e: | CODE |
| LOW | app.py | 121 | except Exception as e: | CODE |
| LOW | app.py | 221 | except Exception: | CODE |
| LOW | app.py | 240 | except Exception: | CODE |
| LOW | app.py | 401 | except Exception as _e: | CODE |
| LOW | app.py | 458 | except Exception as _e: | CODE |
| LOW | app.py | 468 | except Exception: | CODE |
| LOW | app.py | 539 | except Exception as _e: | CODE |
| LOW | app.py | 662 | except Exception: | CODE |
| LOW | app.py | 973 | except Exception: | CODE |
| LOW | app.py | 992 | except Exception: | CODE |
| LOW | app.py | 1015 | except Exception: | CODE |
| LOW | app.py | 1088 | except Exception: | CODE |
| LOW | app.py | 1125 | except Exception as e: | CODE |
| LOW | app.py | 1147 | except Exception as _e: | CODE |
| LOW | app.py | 1206 | except Exception as e: | CODE |
| LOW | app.py | 1208 | except Exception as e: | CODE |
| LOW | app.py | 1225 | except Exception as e: | CODE |
| LOW | app.py | 1240 | except Exception as e: | CODE |
| LOW | app.py | 1286 | except Exception as e: | CODE |
| LOW | app.py | 1305 | except Exception as e: | CODE |
| LOW | app.py | 1328 | except Exception as e: | CODE |
| LOW | app.py | 1370 | except Exception as e: | CODE |
| LOW | launcher.py | 69 | except Exception: | CODE |
| LOW | launcher.py | 115 | except Exception: | CODE |
| LOW | launcher.py | 128 | except Exception: | CODE |
| MEDIUM | launcher.py | 100 | def setup_system_tray(url): | CODE |
| LOW | core/auth.py | 132 | except Exception as e: | CODE |
| LOW | core/auth.py | 148 | except Exception as e: | CODE |
| LOW | core/auth.py | 158 | except Exception as e: | CODE |
| LOW | core/auth.py | 314 | except Exception: | CODE |
| MEDIUM | core/auth.py | 114 | def _load(self): | CODE |
| LOW | core/platform_compat.py | 328 | except Exception: | CODE |
| LOW⚡ | core/platform_compat.py | 356 | except Exception: | CODE |
| LOW⚡ | core/platform_compat.py | 368 | except Exception: | CODE |
| LOW | core/platform_compat.py | 379 | except Exception: | CODE |
| LOW⚡ | core/database.py | 965 | except Exception as e: | CODE |
| LOW⚡ | core/database.py | 970 | except Exception: | CODE |
| LOW⚡ | core/database.py | 987 | except Exception as e: | CODE |
| LOW⚡ | core/database.py | 992 | except Exception: | CODE |
| LOW⚡ | core/database.py | 1009 | except Exception as e: | CODE |
| LOW⚡ | core/database.py | 1014 | except Exception: | CODE |
| LOW⚡ | core/database.py | 1031 | except Exception as e: | CODE |
| LOW⚡ | core/database.py | 1036 | except Exception: | CODE |
| LOW⚡ | core/database.py | 1078 | except Exception as e: | CODE |
| LOW⚡ | core/database.py | 1083 | except Exception: | CODE |
| LOW⚡ | core/database.py | 1126 | except Exception as e: | CODE |
| LOW⚡ | core/database.py | 1131 | except Exception: | CODE |
| 2040 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | core/auth.py | 13 | CODE | |
| LOW | core/models.py | 19 | CODE | |
| LOW | core/platform_compat.py | 14 | CODE | |
| LOW | core/constants.py | 11 | CODE | |
| LOW | core/constants.py | 12 | CODE | |
| LOW | core/session_manager.py | 25 | CODE | |
| LOW | core/session_manager.py | 25 | CODE | |
| LOW | core/__init__.py | 12 | CODE | |
| LOW | core/__init__.py | 12 | CODE | |
| LOW | core/__init__.py | 12 | CODE | |
| LOW | core/__init__.py | 12 | CODE | |
| LOW | core/__init__.py | 12 | CODE | |
| LOW | core/__init__.py | 12 | CODE | |
| LOW | core/__init__.py | 20 | CODE | |
| LOW | core/__init__.py | 21 | CODE | |
| LOW | core/__init__.py | 22 | CODE | |
| LOW | core/__init__.py | 23 | CODE | |
| LOW | core/__init__.py | 23 | CODE | |
| LOW | core/__init__.py | 23 | CODE | |
| LOW | core/__init__.py | 23 | CODE | |
| LOW | core/__init__.py | 29 | CODE | |
| LOW | core/__init__.py | 29 | CODE | |
| LOW | core/__init__.py | 30 | CODE | |
| LOW | core/atomic_io.py | 14 | CODE | |
| LOW | tests/test_redos_xml_tool_parsers.py | 26 | CODE | |
| LOW | tests/test_redos_xml_tool_parsers.py | 28 | CODE | |
| LOW | tests/test_redos_xml_tool_parsers.py | 29 | CODE | |
| LOW | tests/test_browser_lifecycle.py | 9 | CODE | |
| LOW | tests/test_document_ai_preview_refresh_js.py | 4 | CODE | |
| LOW | tests/test_notes_fail_closed_auth.py | 27 | CODE | |
| LOW | tests/test_webhook_routes_shim.py | 5 | CODE | |
| LOW | tests/test_document_editor_background_static.py | 1 | CODE | |
| LOW | tests/test_hwfit_quant_formats.py | 9 | CODE | |
| LOW | tests/test_codeql_python_residual_closure.py | 12 | CODE | |
| LOW | tests/test_codeql_python_residual_closure.py | 13 | CODE | |
| LOW | tests/test_plain_ui_control_open_panel.py | 1 | CODE | |
| LOW | tests/test_imap_leak_fixes.py | 17 | CODE | |
| LOW | tests/test_runtime_evidence_contract.py | 18 | CODE | |
| LOW | tests/test_session_list_owner_scope.py | 12 | CODE | |
| LOW | tests/test_session_list_owner_scope.py | 33 | CODE | |
| LOW | tests/test_calendar_recurrence.py | 8 | CODE | |
| LOW | tests/test_review_docx_async_identity.py | 3 | CODE | |
| LOW | tests/test_vault_routes_shim.py | 5 | CODE | |
| LOW | tests/test_security_regressions.py | 1348 | CODE | |
| LOW | tests/test_run_order_report.py | 9 | CODE | |
| LOW | tests/test_email_polly_imap_leak.py | 41 | CODE | |
| LOW | tests/test_skill_index_prompt_injection.py | 25 | CODE | |
| LOW | tests/test_tool_parsing_hermes_json.py | 11 | CODE | |
| LOW | tests/test_effect_resource_bindings.py | 2 | CODE | |
| LOW | tests/test_scheduler_restart_doublefire.py | 15 | CODE | |
| LOW | tests/test_scheduler_restart_doublefire.py | 16 | CODE | |
| LOW | tests/test_memory_routes_shim.py | 15 | CODE | |
| LOW | tests/test_select_dropdown_theme_css.py | 1 | CODE | |
| LOW | tests/test_search_routes_shim.py | 5 | CODE | |
| LOW | tests/test_imap_move_uid.py | 9 | CODE | |
| LOW | tests/test_imap_move_uid.py | 10 | CODE | |
| LOW | tests/conftest.py | 61 | CODE | |
| LOW | tests/conftest.py | 25 | CODE | |
| LOW | tests/conftest.py | 26 | CODE | |
| LOW | tests/conftest.py | 27 | CODE | |
| 660 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup.py | 240 | CODE | |
| LOW | app.py | 517 | CODE | |
| LOW | app.py | 1008 | CODE | |
| LOW | app.py | 1076 | CODE | |
| LOW | app.py | 1106 | CODE | |
| LOW | app.py | 368 | CODE | |
| LOW | core/platform_compat.py | 320 | CODE | |
| LOW | core/platform_compat.py | 360 | CODE | |
| LOW | core/database.py | 1629 | CODE | |
| LOW | core/database.py | 1793 | CODE | |
| LOW | core/database.py | 1818 | CODE | |
| LOW | core/database.py | 1840 | CODE | |
| LOW | core/database.py | 1913 | CODE | |
| LOW | core/database.py | 1973 | CODE | |
| LOW | core/database.py | 1993 | CODE | |
| LOW | core/database.py | 2197 | CODE | |
| LOW | core/database.py | 2640 | CODE | |
| LOW | core/database.py | 2664 | CODE | |
| LOW | core/database.py | 2696 | CODE | |
| LOW | core/session_manager.py | 86 | CODE | |
| LOW | core/session_manager.py | 762 | CODE | |
| LOW | core/atomic_io.py | 28 | CODE | |
| LOW | core/atomic_io.py | 30 | CODE | |
| LOW | core/atomic_io.py | 32 | CODE | |
| LOW | tests/test_codeql_python_residual_closure.py | 133 | CODE | |
| LOW | tests/test_security_regressions.py | 1341 | CODE | |
| LOW | tests/test_security_regressions.py | 1359 | CODE | |
| LOW | tests/test_effect_resource_bindings.py | 255 | CODE | |
| LOW | tests/test_effect_resource_bindings.py | 266 | CODE | |
| LOW | tests/test_local_endpoint_api_key_js.py | 27 | CODE | |
| LOW | tests/test_remote_resource_identity.py | 229 | CODE | |
| LOW | tests/test_turn_contract_integration.py | 137 | CODE | |
| LOW | tests/test_turn_contract_integration.py | 276 | CODE | |
| LOW | tests/test_model_routes.py | 1580 | CODE | |
| LOW | tests/test_skill_importer_dns_pinning.py | 154 | CODE | |
| LOW | tests/test_skill_importer_dns_pinning.py | 171 | CODE | |
| LOW | tests/test_tool_index_schema_parity.py | 18 | CODE | |
| LOW | tests/test_fenced_inline_args.py | 145 | CODE | |
| LOW | tests/test_task_scheduler_endpoint_authority.py | 27 | CODE | |
| LOW | tests/test_redos_core_parsers.py | 489 | CODE | |
| LOW | tests/test_task_scheduler_cancel.py | 57 | CODE | |
| LOW | tests/test_task_scheduler_cancel.py | 73 | CODE | |
| LOW | tests/test_tool_execution_bridge_security.py | 130 | CODE | |
| LOW | tests/test_owned_resource_identity.py | 123 | CODE | |
| LOW | tests/test_null_owner_gates.py | 30 | CODE | |
| LOW | tests/test_procfs_scan_guard.py | 60 | CODE | |
| LOW | tests/test_review_regressions.py | 1494 | CODE | |
| LOW | tests/test_toast_dismiss_pointer_events.py | 30 | CODE | |
| LOW | tests/test_toast_dismiss_pointer_events.py | 51 | CODE | |
| LOW | tests/test_toast_dismiss_pointer_events.py | 108 | CODE | |
| LOW | tests/test_tool_implementations_shim.py | 115 | CODE | |
| LOW | tests/test_browser_resource_identity.py | 301 | CODE | |
| LOW | tests/test_chat_route_tool_policy.py | 125 | CODE | |
| LOW | tests/test_chat_route_tool_policy.py | 153 | CODE | |
| LOW | tests/test_clean_v3_native_workspace.py | 95 | CODE | |
| LOW | tests/test_app_config_shared_fetch_js.py | 215 | CODE | |
| LOW | tests/test_product_turn_contract_route.py | 42 | CODE | |
| LOW | tests/test_document_diff_discard_on_update_js.py | 30 | CODE | |
| LOW | tests/test_webhook_trigger_auth_exempt.py | 30 | CODE | |
| LOW | tests/test_email_library_module_graph_js.py | 111 | CODE | |
| 681 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | requirements.txt | 18 | # Vector store + local embeddings for RAG, semantic memory, and tool | COMMENT |
| MEDIUM | build-macos-app.sh | 138 | # Wait for readiness (first run downloads an embedding model — allow ~2 min). | COMMENT |
| MEDIUM | requirements-optional.txt | 7 | # Note: chromadb-client + fastembed moved to requirements.txt — RAG, semantic | COMMENT |
| MEDIUM | requirements-optional.txt | 41 | # RAG index). markitdown (MIT, Microsoft) converts .docx/.xlsx/.pptx/.xls/.epub | COMMENT |
| MEDIUM | app.py | 37 | # 1463]), so the ONNX embedding model fails to load. huggingface_hub reads this | COMMENT |
| MEDIUM | app.py | 562 | # ========= RAG (vector document RAG) ========= | COMMENT |
| MEDIUM | start-macos.sh | 190 | # ChromaDB backs the tool index and vector RAG. chromadb ships in the venv, so | COMMENT |
| MEDIUM | plans/ODYSSEUS_TOOL_HARDENING_PLAN.md | 210 | ### G. Regular-model legacy RAG and tool coverage | COMMENT |
| MEDIUM | specs/documents-rag-uploads.md | 1 | # Documents, RAG, And Uploads | COMMENT |
| MEDIUM | specs/documents-rag-uploads.md | 132 | ## Personal Docs And RAG | COMMENT |
| MEDIUM | tests/test_task_shell_tools.py | 3 | Regression for #4163: the task runner built `relevant_tools` from RAG output | STRING |
| MEDIUM⚡ | tests/test_task_shell_tools.py | 40 | assert "web_fetch" in tools # RAG-selected tool kept | CODE |
| MEDIUM | tests/test_task_shell_tools.py | 103 | # Degraded-index stand-in that still returns one RAG hit, so we can prove | COMMENT |
| MEDIUM | tests/test_task_shell_tools.py | 147 | # rest of the shell/file defaults and the RAG hit survive. | COMMENT |
| MEDIUM | tests/test_task_shell_tools.py | 153 | assert "web_fetch" in offered # RAG-selected tool preserved | CODE |
| MEDIUM | …/test_fenced_example_not_executed_for_native_models.py | 49 | # Skip RAG/tool-index, MCP, and settings lookups; keep the real loop body, | COMMENT |
| MEDIUM | tests/test_kv_cache_invalidation_2927.py | 97 | # in real life, minus any per-turn dynamic content (RAG/memory/web), which | COMMENT |
| MEDIUM | tests/test_nested_invocation_ownership.py | 527 | # The outer adapter still has orchestration work after an inner DONE. | COMMENT |
| MEDIUM⚡ | tests/test_agent_rounds_exhausted.py | 39 | # Skip RAG/tool-index, MCP, and settings lookups; keep the real loop body, | COMMENT |
| MEDIUM⚡ | tests/test_agent_rounds_exhausted.py | 45 | # supplying its context window instead of probing the dummy endpoint. | COMMENT |
| MEDIUM | tests/test_context_budget.py | 1 | """Issue #1170 — the agent input-token budget adapts to the model context window. | STRING |
| MEDIUM | tests/test_rag_remove_directory_scope.py | 1 | """Regression guard for #1660 — removing one RAG directory must delete only that | STRING |
| MEDIUM | tests/test_tool_rag_keyword_hints.py | 1 | """Regression for issue #1707 — the agent tool-RAG force-included the entire | STRING |
| MEDIUM | static/js/MODULE_SUMMARY.md | 105 | ## 6. Knowledge, Memory, and RAG | COMMENT |
| MEDIUM | static/js/calendar.js | 1307 | // Drag on an empty cell to scaffold a new event for that range. | COMMENT |
| MEDIUM | routes/personal_routes.py | 283 | # Remove from RAG vector store (best-effort). | COMMENT |
| MEDIUM | routes/personal_routes.py | 401 | # Remove chunks from RAG vector store (best-effort) | COMMENT |
| MEDIUM | routes/auth_routes.py | 552 | # direct personal RAG uploads live in per-owner directories and the | COMMENT |
| MEDIUM⚡ | routes/embedding_routes.py | 302 | # Reset the RAG singleton so it picks up the new endpoint | COMMENT |
| MEDIUM⚡ | routes/embedding_routes.py | 346 | # Reset the RAG singleton so it falls back to fastembed | COMMENT |
| MEDIUM | routes/session_routes.py | 1421 | # all 100+ chats to one LLM call blows the context window, makes | COMMENT |
| MEDIUM | routes/chat_routes.py | 2584 | # lexical intent classifier: that recreated the same per-turn RAG gate | COMMENT |
| MEDIUM | routes/chat_routes.py | 2849 | # every other model continues through the legacy RAG path. | COMMENT |
| MEDIUM | routes/chat_routes.py | 2987 | # A compact turn resolves its typed context window once, here, with | COMMENT |
| MEDIUM | routes/chat_routes.py | 3161 | # bypass the contract and let tool RAG replace (for example) a browser | COMMENT |
| MEDIUM | routes/chat_routes.py | 4524 | # drowned out by lexical RAG (for example, the word | COMMENT |
| MEDIUM | routes/chat_helpers.py | 1125 | # or personal-doc RAG on every turn pulls in keyword-matched but off-topic | COMMENT |
| MEDIUM | routes/chat_helpers.py | 1131 | # Use RAG? | COMMENT |
| MEDIUM | routes/skills_routes.py | 2394 | # candidates so the event-driven Skills Audit pipeline still runs. | COMMENT |
| MEDIUM | routes/note/note_routes.py | 232 | # prose=True strips untagged "The user wants me to…" chain-of-thought. | COMMENT |
| MEDIUM | routes/document/document_routes.py | 1119 | # Detect email-scaffold stubs: "To: \nSubject: \n---\n" style | COMMENT |
| MEDIUM | routes/email/email_pollers.py | 1198 | # sometimes hallucinate a map URL | STRING |
| MEDIUM | services/memory/skill_extractor.py | 221 | # chain-of-thought BEFORE the JSON output even when asked for | COMMENT |
| MEDIUM | src/teacher_escalation.py | 670 | # tried. The appended note leads with the user request text so RAG | COMMENT |
| MEDIUM | src/personal_docs.py | 220 | self.excluded_files: Set[str] = set() # Files removed from RAG listing | CODE |
| MEDIUM | src/personal_docs.py | 301 | # If RAG manager is available, index the directory immediately. | COMMENT |
| MEDIUM | src/tool_index.py | 55 | # of topic. Without this, RAG drops it and the agent falls back to | COMMENT |
| MEDIUM | src/tool_index.py | 85 | # check-ins and proactive tasks, in addition to RAG-selected tools. | COMMENT |
| MEDIUM | src/tool_index.py | 250 | # Without this, upsert leaves them in place and RAG keeps | COMMENT |
| MEDIUM | src/tool_index.py | 327 | # Include server identity in the indexed text so RAG can | COMMENT |
| MEDIUM⚡ | src/task_scheduler.py | 1722 | # RAG-select relevant tools for this prompt + always-available assistant tools. | COMMENT |
| MEDIUM | src/task_scheduler.py | 42 | # setting turns them off). The RAG tool selector + ASSISTANT_ALWAYS_AVAILABLE | COMMENT |
| MEDIUM | src/task_scheduler.py | 1760 | # Strip the model's chain-of-thought before saving/delivering. Task | COMMENT |
| MEDIUM | src/context_compactor.py | 94 | COMPACT_THRESHOLD = 0.85 # Trigger compaction at 85% of context window | CODE |
| MEDIUM | src/context_compactor.py | 336 | # Priority: keep first system msg (preset prompt), drop others (memory, RAG, memo). | COMMENT |
| MEDIUM⚡ | src/ai_interaction.py | 602 | # RAG management tool | COMMENT |
| MEDIUM | src/app_initializer.py | 88 | # Initialize memory vector store (share embedding model with RAG if available) | COMMENT |
| MEDIUM | src/chat_processor.py | 90 | # Minimum similarity score for RAG results to be injected | COMMENT |
| MEDIUM | src/chat_processor.py | 379 | # RAG: search if enabled and rag_manager available, inject only above threshold | COMMENT |
| MEDIUM | src/constants.py | 116 | # init and all vector features (RAG, semantic memory, tool index) silently degrade. | COMMENT |
| 11 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app.py | 124 | logger = logging.getLogger(__name__) | CODE |
| LOW | core/auth.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | core/database.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | core/session_manager.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | core/__init__.py | 32 | __all__ = [ | CODE |
| LOW | scripts/index_documents.py | 33 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/signature_routes.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/tts_routes.py | 11 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/chatgpt_subscription_routes.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/backup_routes.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/copilot_routes.py | 40 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/cookbook_helpers.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | routes/personal_routes.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/shell_routes.py | 125 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/editor_draft_routes.py | 32 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/auth_routes.py | 41 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/embedding_routes.py | 14 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/stt_routes.py | 9 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/cookbook_routes.py | 47 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/cookbook_routes.py | 723 | def set_flag(flag: str, value: str) -> None: | CODE |
| LOW | routes/cookbook_routes.py | 791 | def set_flag(flag: str, value: str) -> None: | CODE |
| LOW | routes/preset_routes.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/upload_routes.py | 34 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/session_routes.py | 242 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/diagnostics_routes.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/emoji_routes.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/chat_routes.py | 106 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/chat_routes.py | 2130 | def _set_user_time_from_request(request: Request) -> None: | CODE |
| LOW | routes/model_routes.py | 51 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/chat_helpers.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/calendar_routes.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/skills_routes.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | routes/research/research_routes.py | 72 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/webhook/webhook_routes.py | 16 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | routes/note/note_routes.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/memory/memory_routes.py | 35 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/gallery/gallery_helpers.py | 16 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/gallery/gallery_routes.py | 31 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/contacts/contacts_routes.py | 31 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/mcp/mcp_routes.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/document/document_routes.py | 21 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/document/document_helpers.py | 19 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/search/search_routes.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/cleanup/cleanup_routes.py | 8 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | routes/task/task_routes.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | routes/history/history_routes.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/compare/compare_routes.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/email/email_pollers.py | 46 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | routes/email/email_routes.py | 112 | def _set_email_writing_style_for_account(settings: dict, style: str, account_id: str | None = None) -> None: | CODE |
| LOW | routes/email/email_routes.py | 72 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/email/email_routes.py | 136 | def _set_email_view_inline_images(settings: dict, enabled: bool, account_id: str | None = None) -> None: | CODE |
| LOW | routes/email/email_helpers.py | 43 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/vault/vault_routes.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | routes/admin_wipe/admin_wipe_routes.py | 36 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/__init__.py | 42 | __all__ = [ | CODE |
| LOW | services/research/research_handler.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/research/__init__.py | 7 | __all__ = [ | CODE |
| LOW | services/memory/memory_extractor.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/memory/skill_extractor.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/memory/memory_vector.py | 5 | __all__ = ["MemoryVectorStore"] | CODE |
| 118 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | requirements.txt | 21 | # chromadb-client is the lightweight HTTP client (talks to a standalone | COMMENT |
| LOW | docker-compose.gpu-nvidia.yml | 1 | # Standalone NVIDIA GPU Compose file for stack-management UIs (Portainer, | COMMENT |
| LOW | build-macos-app.sh | 1 | #!/bin/bash | COMMENT |
| LOW | requirements-optional.txt | 1 | # Optional dependencies — install only if you use the corresponding feature. | COMMENT |
| LOW | requirements-optional.txt | 21 | # Python 3.13+ (including the Python 3.14 container image). Kokoro declares | COMMENT |
| LOW | requirements-optional.txt | 41 | # RAG index). markitdown (MIT, Microsoft) converts .docx/.xlsx/.pptx/.xls/.epub | COMMENT |
| LOW | docker-compose.gpu-amd.yml | 1 | # Standalone AMD ROCm GPU Compose file for stack-management UIs (Portainer, | COMMENT |
| LOW | app.py | 161 | # `text/event-stream` by default, so the SSE streams (chat, shell, research, | COMMENT |
| LOW | docker-compose.yml | 81 | - GOOGLE_API_KEY=${GOOGLE_API_KEY:-} | COMMENT |
| LOW | start-macos.sh | 1 | #!/bin/bash | COMMENT |
| LOW | start-macos.sh | 81 | cands="python3 python3.13 python3.12 python3.11" | COMMENT |
| LOW | docker/gpu.amd.yml | 1 | # AMD ROCm GPU overlay. Enable by setting COMPOSE_FILE in .env: | COMMENT |
| LOW | docker/gpu.nvidia.yml | 1 | # NVIDIA GPU overlay. Enable by setting COMPOSE_FILE in .env: | COMMENT |
| LOW | docker/entrypoint.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/entrypoint.sh | 101 | # such as /app/.cache/vllm and /app/.cache/flashinfer can be created without | COMMENT |
| LOW | docker/build-realesrgan-wheels.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | core/auth.py | 441 | # flag must be flipped while the stored map is safe to expose — | COMMENT |
| LOW | core/database.py | 201 | max_tokens_override = Column(Integer, nullable=True, default=None) | COMMENT |
| LOW | core/database.py | 581 | # schemas + emit `tool_calls`. Auto-detected at Cookbook auto- | COMMENT |
| LOW | licenses/docx-8.5.0-NOTICES.txt | 101 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | COMMENT |
| LOW | licenses/docx-8.5.0-NOTICES.txt | 701 | // The above copyright notice and this permission notice shall be included | COMMENT |
| LOW | licenses/docx-8.5.0-NOTICES.txt | 721 | // persons to whom the Software is furnished to do so, subject to the | COMMENT |
| LOW | licenses/mammoth-1.8.0-NOTICES.txt | 441 | // (C) 1995-2013 Jean-loup Gailly and Mark Adler | COMMENT |
| LOW | tests/test_memory_store_unreadable_no_wipe.py | 161 | COMMENT | |
| LOW | tests/test_email_library_module_graph_js.py | 61 | names.add(name) | COMMENT |
| LOW | static/app.js | 1221 | // navigation visible alongside the fullscreen email view. | COMMENT |
| LOW | static/app.js | 1541 | } | COMMENT |
| LOW | static/app.js | 4321 | COMMENT | |
| LOW | static/sw.js | 1 | // static/sw.js — Odysseus PWA Service Worker | COMMENT |
| LOW | static/sw.js | 21 | 'Size1-Regular', 'Size2-Regular', 'Size3-Regular', 'Size4-Regular', | COMMENT |
| LOW | static/css/04-memory.css | 701 | #doclib-arc-bulk, | COMMENT |
| LOW | static/css/email-calendar-notes-tasks.css | 41 | #email-lib-grid.email-selecting .email-card-favorite, | COMMENT |
| LOW | static/css/05-documents.css | 1001 | it's unaffected). Slightly narrower type picker buys a little more room. */ | COMMENT |
| LOW | static/css/17-research.css | 2661 | #cookbook-modal .modal-content, | COMMENT |
| LOW | static/css/17-research.css | 2701 | COMMENT | |
| LOW | static/css/17-research.css | 2721 | ) { | COMMENT |
| LOW | static/js/chatRenderer.js | 3461 | } | COMMENT |
| LOW | static/js/galleryEditor.js | 361 | }, true); | COMMENT |
| LOW | static/js/galleryEditor.js | 381 | // Last seed click so the tolerance slider can re-run the wand live. | COMMENT |
| LOW | static/js/galleryEditor.js | 401 | // Resolved per-stroke at pointerdown: state.inpaintEraseMode XOR (Ctrl+Alt). | COMMENT |
| LOW | static/js/galleryEditor.js | 981 | } | COMMENT |
| LOW | static/js/galleryEditor.js | 2961 | if (state.gradientActive) return _gradientTool.end(e); | COMMENT |
| LOW | static/js/galleryEditor.js | 2981 | // Clone Stamp painter — stamps circular samples from the source | COMMENT |
| LOW | static/js/galleryEditor.js | 3981 | // ── Magic Wand ── | COMMENT |
| LOW | static/js/galleryEditor.js | 5721 | inpaintSection.style.display = 'none'; | COMMENT |
| LOW | static/js/galleryEditor.js | 5941 | wireSliderUx({ registerDocClickAway: _registerDocClickAway }); | COMMENT |
| LOW | static/js/galleryEditor.js | 6161 | precisionGuides: _precisionGuides, | COMMENT |
| LOW | static/js/modalSnap.js | 1 | // Right-edge snap docking for draggable modals. | COMMENT |
| LOW | static/js/cookbookServe.js | 1561 | // are read together. .hwfit-backend-llamacpp visibility class | COMMENT |
| LOW | static/js/cookbookServe.js | 1601 | panelHtml += `</div>`; | COMMENT |
| LOW | static/js/cookbookServe.js | 1641 | // Everything below the fold is tuning users only touch occasionally: | COMMENT |
| LOW | static/js/cookbookServe.js | 1721 | // shared checkbox maps to different runtime flags. | COMMENT |
| LOW | static/js/cookbookServe.js | 3681 | if (!_proceed) { _restoreLaunchBtn(); return; } | COMMENT |
| LOW | static/js/ui.js | 1061 | // Escape-stack entry); unregistered ones (email/dep) just get removed. | COMMENT |
| LOW | static/js/ui.js | 1381 | if (e.key !== 'Escape' || e.defaultPrevented) return; | COMMENT |
| LOW | static/js/cookbook.js | 1201 | // Kept the variable so downstream concat code stays the same. | COMMENT |
| LOW | static/js/cookbook.js | 1521 | list.querySelectorAll('.cookbook-dep-install:not(.cookbook-dep-recipe-run):not(.cookbook-dep-install-sysdeps)').forE | COMMENT |
| LOW | static/js/cookbook.js | 2421 | if (dlBtn && dlInput) { | COMMENT |
| LOW | static/js/notes.js | 3741 | // Save. Prevent the button from stealing focus on press: on mobile, the | COMMENT |
| LOW | static/js/cookbookSchedule.js | 1 | // Cookbook Schedule — opens a small inline form (styled with the app's | COMMENT |
| 123 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | build-macos-app.sh | 34 | # let sips emit the .icns directly: more robust across macOS versions than | COMMENT |
| MEDIUM | app.py | 1168 | # harness deployments can wait for the explicit readiness state. | COMMENT |
| LOW | start-macos.sh | 76 | # (or non-mac) we just use whatever Python 3.11+ is on PATH. | COMMENT |
| MEDIUM | core/database.py | 339 | # Library + search. Owning the row directly is robust against that. | COMMENT |
| MEDIUM | core/database.py | 2974 | """Get comprehensive database statistics including file size""" | STRING |
| MEDIUM | tests/test_effect_resource_bindings.py | 54 | """The registry the dispatcher resolves at call time (robust to reloads).""" | STRING |
| MEDIUM | tests/test_css_computed_style_snapshot.py | 39 | # One conflicting selector used to prove the harness is actually sensitive to | COMMENT |
| MEDIUM⚡ | tests/test_markdown_rendering_js.py | 450 | # same way; they need KaTeX/sanitizer conditions this harness doesn't set up. | COMMENT |
| MEDIUM | tests/test_companion_readonly.py | 24 | # import is robust regardless of collection order. | COMMENT |
| MEDIUM | tests/test_clean_agent_preview.py | 4376 | # Probe a tool whose compact description the harness does not | STRING |
| MEDIUM | tests/test_clean_agent_preview.py | 4377 | # replace; manage_notes now carries a full harness-owned override. | STRING |
| MEDIUM | tests/test_backup_import_skills_dedup.py | 18 | # via monkeypatch — robust to import order and reverted at teardown. (Stubbing | COMMENT |
| MEDIUM | tests/test_source_question_routing.py | 140 | # by the harness, including when the model ignores the offered tools. | COMMENT |
| MEDIUM | tests/test_chat_metrics.py | 23 | # --- captured-stream harness (mirrors test_llm_core_streaming.py) ----------- | COMMENT |
| MEDIUM | static/js/spinner.js | 216 | // Rotating a single continuous spiral keeps the loop seamless: the start | COMMENT |
| MEDIUM | static/js/windowResize.js | 10 | // inner element. Absolutely-positioned handle children would scroll away | COMMENT |
| MEDIUM | static/js/slashCommands.js | 2377 | // via .closest(selector) — more robust than t.contains(e.target) when | COMMENT |
| MEDIUM | scripts/build_v66_calendar_heldout_cases.py | 53 | # marker cleanup in the existing smoke harness. | COMMENT |
| MEDIUM | scripts/odysseus_conversation_qa.py | 628 | # verdict is not coverage: no model/harness behavior was observed. | COMMENT |
| MEDIUM | scripts/odysseus_conversation_qa.py | 722 | # mutates fixture memory, and is not part of tool-harness scoring. | COMMENT |
| MEDIUM | scripts/odysseus_conversation_qa.py | 744 | # toggle off made those rows authorization tests, not model/harness QA. | COMMENT |
| MEDIUM | scripts/odysseus_conversation_qa.py | 1022 | # If the flow explicitly names the expected tool, the harness offered it, | COMMENT |
| MEDIUM | scripts/odysseus_conversation_qa.py | 1091 | # miss where the required tool was available. The harness owns the flow | COMMENT |
| MEDIUM | scripts/run_sft_overnight_fixture_flows.py | 626 | # Keep the latest clean result for a case id. This makes resume robust | COMMENT |
| MEDIUM | scripts/add_hwfit_models.py | 324 | # Next-to-last resort: parse config.json. This is robust against | COMMENT |
| MEDIUM | routes/cookbook_routes.py | 1138 | # also breaks robust resume on flaky transfers — the blob-based hub | COMMENT |
| MEDIUM | routes/chat_routes.py | 2848 | # harness ownership follows that model, not the endpoint alias; | COMMENT |
| LOW | routes/history/history_routes.py | 362 | # parsed multimodal content and the _db_id edit/delete keys it just set. | COMMENT |
| MEDIUM | services/search/service.py | 69 | # `fetch_content` is accepted for API compatibility; the comprehensive | COMMENT |
| MEDIUM | services/search/core.py | 877 | # does not preserve bad SERP choices after a harness fix. | COMMENT |
| MEDIUM | services/search/core.py | 1020 | """Perform comprehensive web search with content fetching and advanced filtering.""" | STRING |
| MEDIUM | src/generation_budget.py | 43 | # VL uses at least 656 tokens for the small image previews the harness injects; | COMMENT |
| MEDIUM | src/generation_budget.py | 74 | # robust to the observed tokenizer drift. | COMMENT |
| MEDIUM | src/clean_agent_preview.py | 300 | # Keep the selected schema; validate completion in the harness. | COMMENT |
| MEDIUM | src/clean_agent_preview.py | 5113 | # harness-owned completion recovery. Persisting that empty assistant | COMMENT |
| MEDIUM | src/clean_agent_preview.py | 5195 | # no model output or tool proposal could have reached the harness. | COMMENT |
| MEDIUM | src/clean_agent_preview.py | 6590 | # are not visible in the harness process. Use declared | COMMENT |
| MEDIUM | src/constants.py | 13 | # service claiming an older harness build. | COMMENT |
| MEDIUM | src/document_actions.py | 69 | # Documents now carry their own owner column (robust to a deleted | COMMENT |
| MEDIUM | src/llm_core.py | 1280 | # harness size. Character presets can ask for a warmer voice, but | COMMENT |
| MEDIUM⚡ | src/deep_research.py | 1739 | """Let the LLM decide whether the report is comprehensive enough.""" | STRING |
| LOW | src/agent_tools/session_tools.py | 336 | # just return a clickable anchor link the user can click. The | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_skills_manager_owner_isolation.py | 0 | \ --- name: {name} description: original description version: 1.0.0 category: {category} tags: [] status: draft confiden | STRING |
| HIGH | tests/test_skills_routes_owner_update.py | 0 | \ --- name: {name} description: original description version: 1.0.0 category: {category} tags: [] status: draft confiden | STRING |
| HIGH | tests/test_skills_delete_owner.py | 0 | \ --- name: {name} description: original description version: 1.0.0 category: {category} tags: [] status: draft confiden | STRING |
| HIGH | tests/test_skill_save_no_rename.py | 0 | \ --- name: {name} description: original description version: 1.0.0 category: {category} tags: [] status: draft confiden | STRING |
| HIGH | tests/test_provider_detection_host_match.py | 0 | provider detection tests — build_chat_url / build_models_url routing (re: #768). these import the *real* helpers from `` | STRING |
| HIGH | tests/test_provider_detection_detect.py | 0 | provider detection tests — build_chat_url / build_models_url routing (re: #768). these import the *real* helpers from `` | STRING |
| HIGH | tests/test_provider_detection_builders.py | 0 | provider detection tests — build_chat_url / build_models_url routing (re: #768). these import the *real* helpers from `` | STRING |
| HIGH | tests/test_email_owner_scope.py | 0 | insert or replace into email_summaries (message_id, owner, uid, folder, subject, sender, summary, model_used, created_at | STRING |
| HIGH | routes/email/email_pollers.py | 0 | insert or replace into email_summaries (message_id, owner, uid, folder, subject, sender, summary, model_used, created_at | STRING |
| HIGH | routes/email/email_routes.py | 0 | insert or replace into email_summaries (message_id, owner, uid, folder, subject, sender, summary, model_used, created_at | STRING |
| HIGH | tests/test_email_owner_scope.py | 0 | insert or replace into email_ai_replies (message_id, owner, uid, folder, reply, model_used, created_at) values (?, ?, ?, | STRING |
| HIGH | routes/email/email_pollers.py | 0 | insert or replace into email_ai_replies (message_id, owner, uid, folder, reply, model_used, created_at) values (?, ?, ?, | STRING |
| HIGH | routes/email/email_routes.py | 0 | insert or replace into email_ai_replies (message_id, owner, uid, folder, reply, model_used, created_at) values (?, ?, ?, | STRING |
| HIGH | scripts/build_odysseus_v55_web_synthesis_teacher_sft.py | 0 | select name, base_url, api_key, cached_models from model_endpoints where lower(name) like '%deepseek%' and coalesce(is_e | STRING |
| HIGH | scripts/build_odysseus_v54_live_gap_teacher_sft.py | 0 | select name, base_url, api_key, cached_models from model_endpoints where lower(name) like '%deepseek%' and coalesce(is_e | STRING |
| HIGH | scripts/build_odysseus_v56_broad_web_teacher_sft.py | 0 | select name, base_url, api_key, cached_models from model_endpoints where lower(name) like '%deepseek%' and coalesce(is_e | STRING |
| HIGH | scripts/build_odysseus_web_teacher_sft.py | 0 | select name, base_url, api_key, cached_models from model_endpoints where lower(name) like '%deepseek%' and coalesce(is_e | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_imap_leak_fixes.py | 51 | result = helpers._fetch_sender_thread_context("user@example.com") | CODE |
| LOW⚡ | tests/test_imap_leak_fixes.py | 68 | result = helpers._fetch_sender_thread_context("user@example.com") | CODE |
| LOW⚡ | tests/test_imap_leak_fixes.py | 255 | "imap_user": "user@example.com", | CODE |
| LOW | tests/test_imap_leak_fixes.py | 308 | "imap_user": "user@example.com", "imap_password": "wrong", | CODE |
| LOW | tests/test_imap_leak_fixes.py | 358 | "smtp_security": security, "smtp_user": "user@example.com", | CODE |
| LOW | tests/test_email_imap_timeout.py | 111 | "imap_user": "user@example.com", | CODE |
| LOW | tests/test_email_imap_timeout.py | 125 | assert captured["login"] == ("user@example.com", "pw") | CODE |
| LOW⚡ | tests/test_email_oauth.py | 42 | state = make_oauth_state("acct-123", "user@example.com") | CODE |
| LOW⚡ | tests/test_email_oauth.py | 47 | assert payload["o"] == "user@example.com" | CODE |
| LOW⚡ | tests/test_email_oauth.py | 62 | state = make_oauth_state("acct-123", "user@example.com") | CODE |
| LOW⚡ | tests/test_email_oauth.py | 77 | state = make_oauth_state("acct-123", "user@example.com") | CODE |
| LOW⚡ | tests/test_model_context.py | 87 | api_key="fake-key", | CODE |
| LOW | tests/test_model_context.py | 268 | api_key="fake-key", | CODE |
| LOW⚡ | tests/test_model_routes.py | 485 | ep = SimpleNamespace(endpoint_kind="auto", api_key="fake-key") | CODE |
| LOW⚡ | tests/test_model_routes.py | 2016 | api_key="fake-key", | CODE |
| LOW⚡ | tests/test_model_routes.py | 2025 | "api_key": "fake-key", | CODE |
| LOW⚡ | tests/test_model_routes.py | 2073 | "api_key": "fake-key", | CODE |
| LOW⚡ | tests/test_model_routes.py | 2088 | api_key="fake-key", | CODE |
| LOW | tests/test_model_routes.py | 535 | result = _ping_endpoint("http://100.117.136.97:34521/v1", "fake-key", timeout=1) | CODE |
| LOW | tests/test_model_routes.py | 1778 | api_key="fake-key", | CODE |
| LOW | tests/test_model_routes.py | 1811 | api_key="fake-key", | CODE |
| LOW | tests/test_model_routes.py | 1836 | api_key="fake-key", | CODE |
| LOW | tests/test_model_routes.py | 1860 | api_key="fake-key", | CODE |
| LOW | tests/test_model_routes.py | 2055 | api_key="fake-key", | CODE |
| LOW | tests/test_model_routes.py | 2119 | "api_key": "fake-key", | CODE |
| LOW | tests/test_model_routes.py | 2169 | api_key="fake-key", | CODE |
| LOW⚡ | tests/test_odysseus_conversation_qa.py | 643 | assert "placeholder" in str(exc) | CODE |
| LOW⚡ | tests/test_tool_routing_experiment.py | 286 | 'person@example.org', '/workspace/local/report.pdf', '3.14159', | CODE |
| LOW | tests/test_tool_routing_experiment.py | 314 | assert not evaluate_preview_call('send_email', {'to': 'test@example.org'}, 'do it', **kwargs).allowed | CODE |
| LOW | tests/test_agent_evidence.py | 892 | (tmp_path / "score_chart.png").write_text("placeholder") | CODE |
| LOW⚡ | tests/test_sender_signature_skip_roles.py | 20 | assert _skipped("admin@example.org") | CODE |
| LOW⚡ | tests/test_shell_routes.py | 824 | assert _ssh_base_argv("user@example.com", None) == [ | CODE |
| LOW⚡ | tests/test_shell_routes.py | 830 | "user@example.com", | CODE |
| LOW⚡ | tests/test_email_send_only_no_inbox.py | 26 | "smtp_user": "noreply@example.org", | CODE |
| LOW⚡ | tests/test_email_send_only_no_inbox.py | 33 | "from_address": "noreply@example.org", | CODE |
| LOW⚡ | tests/test_api_token_routes.py | 290 | fake_token = SimpleNamespace(id="abcd1234", owner="alice", name="test") | CODE |
| LOW⚡ | tests/test_api_token_routes.py | 292 | fake_session.query.return_value.filter.return_value.first.return_value = fake_token | CODE |
| LOW⚡ | tests/test_api_token_routes.py | 301 | fake_session.delete.assert_called_once_with(fake_token) | CODE |
| LOW⚡ | tests/test_api_token_routes.py | 454 | fake_token = SimpleNamespace(id="tok123", owner="alice", name="alice-token") | CODE |
| LOW⚡ | tests/test_api_token_routes.py | 456 | fake_session.query.return_value.filter.return_value.first.return_value = fake_token | CODE |
| LOW⚡ | tests/test_api_token_routes.py | 494 | fake_token = SimpleNamespace(id="tok123", owner="alice", name="alice-token") | CODE |
| LOW⚡ | tests/test_api_token_routes.py | 496 | fake_session.query.return_value.filter.return_value.first.return_value = fake_token | CODE |
| LOW⚡ | tests/test_api_token_routes.py | 504 | fake_session.delete.assert_called_once_with(fake_token) | CODE |
| LOW⚡ | tests/test_issue_description_check.py | 149 | assert revision["attributes"]["placeholder"] == "1fef4929cf1d (2026-08-11)" | STRING |
| LOW | tests/test_hwfit_container_visibility_warning.py | 80 | out = hardware._attach_probe_context(result, host="user@example.com") | CODE |
| LOW | static/app.js | 2458 | textarea.setAttribute('placeholder', 'Swipe to toggle plan'); | CODE |
| LOW | static/app.js | 2461 | textarea.setAttribute('placeholder', width < PLACEHOLDER_COMPACT_WIDTH ? 'Message...' : 'Message Odysseus...'); | CODE |
| LOW | static/lib/highlight.min.js | 317 | }),re=["a","abbr","address","article","aside","audio","b","blockquote","body","button","canvas","caption","cite","code", | CODE |
| LOW | src/clean_agent_preview.py | 3318 | 'unknown', 'placeholder', '1', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_model_routes.py | 1664 | CODE | |
| LOW | tests/test_model_routes.py | 721 | CODE | |
| LOW | tests/test_model_routes.py | 741 | CODE | |
| LOW | tests/test_turn_contract.py | 105 | CODE | |
| LOW | tests/test_chat_route_tool_policy.py | 474 | CODE | |
| LOW | tests/test_model_defaults.py | 131 | CODE | |
| LOW | scripts/diffusion_server.py | 763 | CODE | |
| LOW | scripts/sft_email_overseer.py | 381 | CODE | |
| LOW | scripts/demo_email/seed_demo_emails.py | 109 | CODE | |
| LOW | mcp_servers/email_server.py | 2787 | CODE | |
| LOW | routes/shell_routes.py | 1209 | CODE | |
| LOW | routes/hwfit_routes.py | 217 | CODE | |
| LOW | routes/hwfit_routes.py | 345 | CODE | |
| LOW | routes/hwfit_routes.py | 439 | CODE | |
| LOW | routes/session_routes.py | 520 | CODE | |
| LOW | routes/chat_routes.py | 240 | CODE | |
| LOW | routes/model_routes.py | 2134 | CODE | |
| LOW | routes/chat_helpers.py | 104 | CODE | |
| LOW | routes/chat_helpers.py | 1006 | CODE | |
| LOW | routes/chat_helpers.py | 1520 | CODE | |
| LOW | routes/chat_helpers.py | 1676 | CODE | |
| LOW | routes/gallery/gallery_routes.py | 689 | CODE | |
| LOW | routes/mcp/mcp_routes.py | 159 | CODE | |
| LOW | routes/compare/compare_routes.py | 71 | CODE | |
| LOW | routes/email/email_pollers.py | 494 | CODE | |
| LOW | routes/email/email_pollers.py | 565 | CODE | |
| LOW | routes/email/email_pollers.py | 633 | CODE | |
| LOW | routes/email/email_routes.py | 2748 | CODE | |
| LOW | services/memory/skills.py | 142 | CODE | |
| LOW | services/memory/skills.py | 364 | CODE | |
| LOW | services/search/core.py | 1008 | CODE | |
| LOW | src/teacher_escalation.py | 570 | CODE | |
| LOW | src/text_helpers.py | 143 | CODE | |
| LOW | src/clean_agent_preview.py | 3495 | CODE | |
| LOW | src/clean_agent_preview.py | 5235 | CODE | |
| LOW | src/research_handler.py | 256 | CODE | |
| LOW | src/research_handler.py | 961 | CODE | |
| LOW | src/model_capabilities.py | 486 | CODE | |
| LOW | src/chat_processor.py | 269 | CODE | |
| LOW | src/turn_contract.py | 6353 | CODE | |
| LOW | src/preset_manager.py | 135 | CODE | |
| LOW | src/visual_report.py | 102 | CODE | |
| LOW | src/llm_core.py | 2571 | CODE | |
| LOW | src/llm_core.py | 2900 | CODE | |
| LOW | src/llm_core.py | 2926 | CODE | |
| LOW | src/tool_execution.py | 1616 | CODE | |
| LOW | src/tool_execution.py | 1915 | CODE | |
| LOW | src/tool_approvals.py | 375 | CODE | |
| LOW | src/deep_research.py | 345 | CODE | |
| LOW | src/model_capability_readers/llamacpp.py | 247 | CODE | |
| LOW | src/agent_tools/web_tools.py | 2276 | CODE | |
| LOW | src/agent_runtime/authority.py | 364 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | static/js/cookbookDownload.js | 173 | elif t>=1048576: ds=f'{s.n/1048576:.1f}';ts=f'{t/1048576:.1f}MB';ss=f'{sp/1048576:.1f}MB/s' | CODE |
| HIGH | static/js/cookbookDownload.js | 176 | print(f'FILE {d} [{bar}] {p}% {ds}/{ts} {ss}',flush=True) | CODE |
| HIGH⚡ | static/js/cookbookDownload.js | 196 | print(f'START {repo}',flush=True) | CODE |
| HIGH⚡ | static/js/cookbookDownload.js | 199 | print(f'DONE {path}',flush=True) | CODE |
| HIGH⚡ | static/js/cookbookDownload.js | 201 | print(f'ERROR {e}',file=sys.stderr,flush=True);sys.exit(1) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL⚡ | tests/test_effect_resource_bindings.py | 111 | run.journal.effects.path.parent.mkdir() # the record is written; only its directory entry fails | CODE |
| CRITICAL⚡ | tests/test_session_mode_helpers.py | 56 | sess.query.return_value.filter.return_value.update.assert_called_once_with({"mode": "agent"}) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 413 | // Step 1: Initial state - 0 fetches before expand | COMMENT |
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 416 | // Step 2: Expand A -> fetches A only, updates aria-expanded and chevron | COMMENT |
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 425 | // Step 3: Collapse A -> 0 extra fetches, updates aria-expanded and chevron | COMMENT |
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 429 | // Step 4: Re-open A -> 0 extra fetches (cached DOM reused) | COMMENT |
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 433 | // Step 5: Refresh A -> forces fetch with ?refresh=1 | COMMENT |
| LOW | static/js/group.js | 528 | // Step 2: Character assignment | COMMENT |
| LOW | static/js/documentLibrary.js | 1241 | // Step 1: switch session if needed and wait for it to load | COMMENT |
| LOW | static/js/editor/tools/lasso-mask.js | 75 | // Step 1: draw hard mask | COMMENT |
| LOW | static/js/editor/tools/lasso-mask.js | 111 | // Step 2: pixel data and distance-based feather. | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 525 | # Step 1: prerequisites | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 533 | # Step 2: signing key | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 541 | # Step 3: apt repository | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 550 | # Step 4: install toolkit | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 558 | # Step 5: configure Docker runtime | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 565 | # Step 6: restart Docker | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 587 | # Step 7: verification | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 593 | # Step 8: enable overlay (only if passthrough verified) | COMMENT |
| LOW | src/deep_research.py | 318 | - Then the detailed steps: ## Step 1: ..., ## Step 2: ... | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 413 | // Step 1: Initial state - 0 fetches before expand | COMMENT |
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 416 | // Step 2: Expand A -> fetches A only, updates aria-expanded and chevron | COMMENT |
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 425 | // Step 3: Collapse A -> 0 extra fetches, updates aria-expanded and chevron | COMMENT |
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 429 | // Step 4: Re-open A -> 0 extra fetches (cached DOM reused) | COMMENT |
| LOW⚡ | tests/test_chatgpt_subscription_usage_js.py | 433 | // Step 5: Refresh A -> forces fetch with ?refresh=1 | COMMENT |
| LOW | static/js/group.js | 528 | // Step 2: Character assignment | COMMENT |
| LOW | static/js/documentLibrary.js | 1241 | // Step 1: switch session if needed and wait for it to load | COMMENT |
| LOW | static/js/editor/tools/lasso-mask.js | 75 | // Step 1: draw hard mask | COMMENT |
| LOW | static/js/editor/tools/lasso-mask.js | 111 | // Step 2: pixel data and distance-based feather. | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 525 | # Step 1: prerequisites | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 533 | # Step 2: signing key | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 541 | # Step 3: apt repository | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 550 | # Step 4: install toolkit | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 558 | # Step 5: configure Docker runtime | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 565 | # Step 6: restart Docker | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 587 | # Step 7: verification | COMMENT |
| LOW⚡ | scripts/check-docker-gpu.sh | 593 | # Step 8: enable overlay (only if passthrough verified) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | core/database.py | 1858 | # Check if prompt/schedule/scheduled_time are still NOT NULL — need table rebuild | COMMENT |
| LOW | tests/test_api_key_manager_atomic_save.py | 65 | # Close the file then raise | COMMENT |
| LOW | tests/test_tts_service_enforce_cache_limit.py | 27 | # Set limit to 100 bytes. 80% target capacity will be 80 bytes. | COMMENT |
| LOW | tests/test_chat_route_tool_policy.py | 144 | # Check if 'body' appears in the value | COMMENT |
| LOW | scripts/diffusion_server.py | 529 | # Check if it's a HF repo with a single safetensors file | COMMENT |
| LOW | scripts/diffusion_server.py | 900 | # Check if the main pipeline IS already an inpaint pipeline | COMMENT |
| LOW | scripts/index_documents.py | 54 | # Check if directory exists | COMMENT |
| LOW | scripts/index_documents.py | 87 | # Display results | COMMENT |
| LOW | routes/shell_routes.py | 852 | # Set master to non-blocking | COMMENT |
| LOW | routes/shell_routes.py | 1057 | # Check if tmux session is still alive | COMMENT |
| LOW | routes/cookbook_routes.py | 4440 | # Check if session is alive + capture output | COMMENT |
| LOW | routes/cookbook_routes.py | 2157 | ps_lines.append('# Check if ollama is available') | CODE |
| LOW | routes/mcp/mcp_routes.py | 263 | # Check if OAuth token already exists — skip connection attempt if not | COMMENT |
| LOW | routes/document/document_routes.py | 869 | # Check if we can coalesce with the latest version | COMMENT |
| LOW | src/config.py | 194 | # Check if LLM host is reachable if specified | COMMENT |
| LOW | src/config.py | 199 | # Check if API keys are set when needed | COMMENT |
| LOW | src/memory.py | 395 | # Check if this is an identity memory (contains name patterns or identity indicators) | COMMENT |
| LOW | src/upload_handler.py | 1306 | # Check if file type is safe | COMMENT |
| LOW | src/integrations.py | 797 | # Check if a miniflux integration already exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | launcher.py | 24 | # Define a dummy NullWriter to suppress standard stream crashes (isatty etc.) in GUI mode | COMMENT |
| MEDIUM | tests/test_tts_service_enforce_cache_limit.py | 80 | # Create a file to evict | COMMENT |
| MEDIUM | tests/test_rag_search_signature.py | 8 | # Create a mock instance for VectorRAG | COMMENT |
| MEDIUM | tests/test_skills_delete_owner.py | 46 | # Create an owner-scoped skill (owner="alice") | STRING |
| MEDIUM | tests/test_skills_delete_owner.py | 71 | # Create an owner-scoped skill (owner="alice") | STRING |
| MEDIUM | src/task_scheduler.py | 823 | # Create the run record with status="queued" BEFORE waiting on the | COMMENT |
| MEDIUM | src/task_scheduler.py | 2768 | # Create the singleton session first (CrewMember.session_id links to it). | COMMENT |
| MEDIUM | src/task_scheduler.py | 2785 | # Create the assistant CrewMember. | COMMENT |
| MEDIUM | src/turn_contract.py | 5679 | # Creating a local artifact does not replace the explicitly named | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | core/database.py | 395 | ai_tags = Column(Text, nullable=True, default="") # AI-generated tags (comma-separated) | CODE |
| HIGH | static/js/notes.js | 3181 | // Going Goal→Todo keeps the AI-generated steps as a plain checklist. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_workspace_confine.py | 421 | CODE | |
| MEDIUM | tests/test_delete_user_revokes_api_tokens.py | 125 | CODE | |
| MEDIUM | tests/test_tool_policy.py | 2047 | CODE | |
| MEDIUM | tests/test_agent_rounds_exhausted.py | 52 | CODE | |
| MEDIUM | tests/test_scheduler_prompt_cache_time.py | 54 | CODE | |
| MEDIUM | tests/test_external_context_tool_gate.py | 1371 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_security_regressions.py | 1424 | def handle_request(self, req): | CODE |
| LOW | tests/test_skill_importer_dns_pinning.py | 79 | def handle_request(self, request): | CODE |
| LOW | services/memory/skill_importer.py | 195 | def handle_request(self, request: httpx.Request) -> httpx.Response: | CODE |
| LOW | src/outbound_fetch.py | 181 | def handle_request(self, request: httpx.Request) -> httpx.Response: | CODE |