A multi-model AI agent desktop client — connect any AI provider, extend with MCP & skills, control from your phone. Built with Electron + Next.js.
This report presents the forensic synthetic code analysis of op7418/CodePilot, a TypeScript project with 6,435 GitHub stars. SynthScan v2.0 examined 454,481 lines of code across 2160 source files, recording 2223 pattern matches distributed across 9 syntactic categories. The overall adjusted score of 9.9 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2223 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 27 | // ── 1. 提取代码块,用占位符保护,处理后再还原 ───────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 33 | // ── 2. 标题降级 ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 43 | // ── 3. 连续标题间增加段落间距 ─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 45 | // ── 4. 表格前后增加段落间距 ───────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 61 | // ── 5. 还原代码块,并在前后追加 <br> ────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 67 | // ── 5. 还原代码块(无 <br>)─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 72 | // ── 6. 压缩多余空行(3 个以上连续换行 → 2 个)──────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 41 | // ── Isolated app data dir (BEFORE any @/lib import) ───────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 49 | // ── Credential loading (READ-ONLY on the real DB) ─────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 95 | // ── Contract fact extraction ──────────────────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 159 | // ── Runner ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 207 | // ── Scenarios ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 439 | // ── Report ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 461 | // ── Mechanical comparison ─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/after-sign.js | 153 | // ── No certificate — ad-hoc signing fallback ───────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase4-mcp-poc.ts | 28 | // ── Isolated app data dir (BEFORE any @/lib import) ───────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase3-poc.ts | 32 | // ── Isolated app data dir (BEFORE any @/lib import) ───────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase3-poc.ts | 41 | // ── Credential loading (READ-ONLY on the real DB) ─────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase3-poc.ts | 88 | // ── Scenario harness ──────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 56 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 63 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 91 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 102 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 166 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 171 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 201 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 203 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 334 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 336 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | electron/main.ts | 2229 | // ── Single-instance lock (Windows multi-tray / multi-process feedback) ────── | COMMENT |
| MEDIUM | src/app/api/chat/route.ts | 127 | // ─── Phase 2 Step 3 — early resolver gate ─────────────────────── | COMMENT |
| MEDIUM | src/app/api/chat/route.ts | 215 | // ── /compact command handler ──────────────────────────────────── | COMMENT |
| MEDIUM | src/app/api/chat/route.ts | 625 | // ── Context compression check ─────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 106 | // ── 1. Provider connectivity ───────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 141 | // ── 2. 执行引擎 / CLI ───────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 205 | // ── 3. Default model validity ──────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 287 | // ── 4. Models exposure ─────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 336 | // ── 5. Assistant workspace / local environment ─────────────── | COMMENT |
| MEDIUM | src/components/settings/AppearanceSection.tsx | 25 | // ── Theme Mode Pill Selector ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/AppearanceSection.tsx | 69 | // ── Shiki Code Preview ────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/AppearanceSection.tsx | 124 | // ── UI Token Preview ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/AppearanceSection.tsx | 145 | // ── Main Appearance Section ───────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 11 | // ── Root container ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 42 | // ── Search input ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 74 | // ── Scrollable items area ─────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 89 | // ── Single item ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 153 | // ── Group with label header ───────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 180 | // ── Footer ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 194 | // ── Footer action button ──────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 215 | // ── Empty state ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/chat/WidgetRenderer.tsx | 71 | // ── postMessage handler ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/chat/WidgetRenderer.tsx | 174 | // ── Streaming updates ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/chat/WidgetRenderer.tsx | 191 | // ── Finalize ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/chat/WidgetRenderer.tsx | 213 | // ── Theme sync ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/bridge/WeixinBridgeSection.tsx | 136 | // ── QR Login Flow ─────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/ai-elements/shiki-worker-client.ts | 185 | // ── Real-worker singleton ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/components/ai-elements/code-block.tsx | 45 | // ── Collapse/expand constants ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/components/ai-elements/code-block.tsx | 49 | // ── Terminal language detection ──────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/components/ai-elements/code-block.tsx | 52 | // ── Language icon mapping ────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/ai-elements/code-block.tsx | 1025 | // ── InlineCode ───────────────────────────────────────────────────────── | COMMENT |
| 1051 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | 资料/weixin-openclaw-package/package/src/runtime.ts | 53 | export async function resolveWeixinChannelRuntime(params: { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/pairing.ts | 35 | export function resolveFrameworkAllowFromPath(accountId: string): string { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/pairing.ts | 50 | export function readFrameworkAllowFromList(accountId: string): string[] { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/pairing.ts | 78 | export async function registerUserInFrameworkStore(params: { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/accounts.ts | 48 | export function listIndexedWeixinAccountIds(): string[] { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/accounts.ts | 229 | export async function triggerWeixinChannelReload(): Promise<void> {} | CODE |
| LOW | …eixin-openclaw-package/package/src/storage/sync-buf.ts | 21 | function getLegacySyncBufDefaultJsonPath(): string { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/cdn/upload.ts | 30 | export async function downloadRemoteImageToTemp(url: string, destDir: string): Promise<string> { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/cdn/upload.ts | 143 | export async function uploadFileAttachmentToWeixin(params: { | CODE |
| LOW | …ixin-openclaw-package/package/src/messaging/inbound.ts | 129 | export function weixinMessageToMsgContext( | CODE |
| LOW | …ixin-openclaw-package/package/src/messaging/inbound.ts | 169 | export function getContextTokenFromMsgContext(ctx: WeixinMsgContext): string | undefined { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/media/mime.ts | 68 | export function getExtensionFromContentTypeOrUrl(contentType: string | null, url: string): string { | CODE |
| LOW | …/feishu-openclaw-plugin/package/src/tools/auto-auth.js | 607 | export async function handleInvokeErrorWithAutoAuth(err, cfg) { | CODE |
| LOW | …-openclaw-plugin/package/src/tools/oauth-batch-auth.js | 31 | export function registerFeishuOAuthBatchAuthTool(api) { | CODE |
| LOW | …penclaw-plugin/package/src/tools/oauth-batch-auth.d.ts | 11 | export declare function registerFeishuOAuthBatchAuthTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …eishu-openclaw-plugin/package/src/tools/auto-auth.d.ts | 56 | export declare function handleInvokeErrorWithAutoAuth(err: unknown, cfg: ClawdbotConfig): Promise<{ | CODE |
| LOW | …feishu-openclaw-plugin/package/src/tools/mcp/shared.js | 73 | function readMcpUrlFromOpenclawJson() { | CODE |
| LOW | …shu-openclaw-plugin/package/src/tools/mcp/doc/index.js | 17 | export function registerFeishuMcpDocTools(api) { | CODE |
| LOW | …u-openclaw-plugin/package/src/tools/mcp/doc/index.d.ts | 12 | export declare function registerFeishuMcpDocTools(api: OpenClawPluginApi): void; | CODE |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 44 | export function createFeishuClientFromConfig(config) { | CODE |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 245 | export function formatTimestampToBeijingTime(timestamp) { | CODE |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 270 | export function formatTimestampMsToBeijingTime(timestamp) { | CODE |
| LOW | …hu-openclaw-plugin/package/src/tools/oapi/helpers.d.ts | 38 | export declare function createFeishuClientFromConfig(config: ClawdbotConfig): LarkClient; | CODE |
| LOW | …hu-openclaw-plugin/package/src/tools/oapi/helpers.d.ts | 131 | export declare function formatTimestampToBeijingTime(timestamp: string | number): string; | CODE |
| LOW | …hu-openclaw-plugin/package/src/tools/oapi/helpers.d.ts | 144 | export declare function formatTimestampMsToBeijingTime(timestamp: string | number): string; | CODE |
| LOW | …ugin/package/src/tools/oapi/bitable/app-table-field.js | 67 | export function registerFeishuBitableAppTableFieldTool(api) { | CODE |
| LOW | …law-plugin/package/src/tools/oapi/bitable/app-table.js | 78 | export function registerFeishuBitableAppTableTool(api) { | CODE |
| LOW | …penclaw-plugin/package/src/tools/oapi/bitable/app.d.ts | 18 | export declare function registerFeishuBitableAppTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …gin/package/src/tools/oapi/bitable/app-table-record.js | 127 | export function registerFeishuBitableAppTableRecordTool(api) { | CODE |
| LOW | …lugin/package/src/tools/oapi/bitable/app-table-view.js | 70 | export function registerFeishuBitableAppTableViewTool(api) { | CODE |
| LOW | …gin/package/src/tools/oapi/bitable/app-table-view.d.ts | 17 | export declare function registerFeishuBitableAppTableViewTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …in/package/src/tools/oapi/bitable/app-table-field.d.ts | 16 | export declare function registerFeishuBitableAppTableFieldTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …n/package/src/tools/oapi/bitable/app-table-record.d.ts | 20 | export declare function registerFeishuBitableAppTableRecordTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …w-plugin/package/src/tools/oapi/bitable/app-table.d.ts | 19 | export declare function registerFeishuBitableAppTableTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …-openclaw-plugin/package/src/tools/oapi/bitable/app.js | 59 | export function registerFeishuBitableAppTool(api) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/calendar/event.js | 287 | function normalizeCalendarTimeValue(value) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/calendar/event.js | 322 | function normalizeEventListTimeFields(events) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/calendar/event.js | 330 | export function registerFeishuCalendarEventTool(api) { | CODE |
| LOW | …law-plugin/package/src/tools/oapi/calendar/freebusy.js | 36 | export function registerFeishuCalendarFreebusyTool(api) { | CODE |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 96 | export function registerFeishuCalendarEventAttendeeTool(api) { | CODE |
| LOW | …in/package/src/tools/oapi/calendar/event-attendee.d.ts | 16 | export declare function registerFeishuCalendarEventAttendeeTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …claw-plugin/package/src/tools/oapi/calendar/event.d.ts | 16 | export declare function registerFeishuCalendarEventTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …w-plugin/package/src/tools/oapi/calendar/freebusy.d.ts | 13 | export declare function registerFeishuCalendarFreebusyTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …w-plugin/package/src/tools/oapi/calendar/calendar.d.ts | 15 | export declare function registerFeishuCalendarCalendarTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …law-plugin/package/src/tools/oapi/calendar/calendar.js | 45 | export function registerFeishuCalendarCalendarTool(api) { | CODE |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/index.js | 14 | export function registerFeishuSheetsTools(api) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/sheets/index.d.ts | 12 | export declare function registerFeishuSheetsTools(api: OpenClawPluginApi): void; | CODE |
| LOW | …openclaw-plugin/package/src/tools/oapi/wiki/space.d.ts | 15 | export declare function registerFeishuWikiSpaceTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …nclaw-plugin/package/src/tools/oapi/wiki/space-node.js | 127 | export function registerFeishuWikiSpaceNodeTool(api) { | CODE |
| LOW | …law-plugin/package/src/tools/oapi/wiki/space-node.d.ts | 17 | export declare function registerFeishuWikiSpaceNodeTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …u-openclaw-plugin/package/src/tools/oapi/wiki/space.js | 53 | export function registerFeishuWikiSpaceTool(api) { | CODE |
| LOW | …openclaw-plugin/package/src/tools/oapi/search/index.js | 14 | export function registerFeishuSearchTools(api) { | CODE |
| LOW | …w-plugin/package/src/tools/oapi/search/doc-search.d.ts | 13 | export declare function registerFeishuSearchDocWikiTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …law-plugin/package/src/tools/oapi/search/doc-search.js | 113 | function normalizeSearchResultTimeFields(value, converted) { | CODE |
| LOW | …law-plugin/package/src/tools/oapi/search/doc-search.js | 138 | export function registerFeishuSearchDocWikiTool(api) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/search/index.d.ts | 12 | export declare function registerFeishuSearchTools(api: OpenClawPluginApi): void; | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/task/subtask.d.ts | 14 | export declare function registerFeishuTaskSubtaskTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …openclaw-plugin/package/src/tools/oapi/task/subtask.js | 53 | export function registerFeishuTaskSubtaskTool(api) { | CODE |
| LOW | …-openclaw-plugin/package/src/tools/oapi/task/task.d.ts | 16 | export declare function registerFeishuTaskTaskTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …hu-openclaw-plugin/package/src/tools/oapi/task/task.js | 158 | export function registerFeishuTaskTaskTool(api) { | CODE |
| 580 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | next.config.ts | 1 | import type { NextConfig } from "next"; | COMMENT |
| LOW | next.config.ts | 21 | // Without this, Next walks upward looking for the nearest lockfile | COMMENT |
| LOW | next.config.ts | 41 | // worktrees this cache can grow to multi-GB under `.next/dev/cache` and | COMMENT |
| LOW | next.config.ts | 61 | // as a child process. When Next.js bundles the SDK, the standalone build | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/doctor.js | 381 | // basicInfoOk: basicInfoResult.apiOk, | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 61 | const scopeDesc = formatScopeDescription(scope, isBatchAuth, totalAppScopes, alreadyGranted, batchInfo, filteredScop | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 81 | // color: "orange", | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 181 | message += `\n\n${batchInfo}`; | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 241 | template: "green", | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 261 | // elements: [ | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 321 | // tag: "column_set", | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 341 | // content: "授权未完成", | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 401 | if (!acct.configured) { | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 421 | // } | COMMENT |
| LOW | …feishu-openclaw-plugin/package/src/tools/oapi/index.js | 61 | registerFeishuDriveTools(api); | COMMENT |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 361 | // return json({ | COMMENT |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 381 | // (link ? `\n权限管理链接:${link}` : ""), | COMMENT |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 401 | // return json({ | COMMENT |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 421 | // if (err instanceof NeedAuthorizationError) { | COMMENT |
| LOW | …n/package/src/tools/oapi/bitable/app-table-record.d.ts | 21 | //# sourceMappingURL=app-table-record.d.ts.map | COMMENT |
| LOW | …law-plugin/package/src/tools/oapi/calendar/calendar.js | 121 | //# sourceMappingURL=calendar.js.map | COMMENT |
| LOW | …aw-plugin/package/src/tools/oapi/im/format-messages.js | 161 | //# sourceMappingURL=format-messages.js.map | COMMENT |
| LOW | …shu-openclaw-plugin/package/src/card/markdown-style.js | 41 | } | COMMENT |
| LOW | …penclaw-plugin/package/src/core/app-scope-checker.d.ts | 81 | //# sourceMappingURL=app-scope-checker.d.ts.map | COMMENT |
| LOW | …enclaw-plugin/package/src/core/app-owner-fallback.d.ts | 21 | //# sourceMappingURL=app-owner-fallback.d.ts.map | COMMENT |
| LOW | …penclaw-plugin/package/src/workspace/task-tracker.d.ts | 41 | //# sourceMappingURL=task-tracker.d.ts.map | COMMENT |
| LOW | …/feishu-openclaw-plugin/package/src/commands/doctor.js | 361 | // 3. 检查应用权限 | COMMENT |
| LOW | …claw-plugin/package/src/messaging/converters/folder.js | 21 | //# sourceMappingURL=folder.js.map | COMMENT |
| LOW | …enclaw-plugin/package/src/messaging/converters/file.js | 21 | //# sourceMappingURL=file.js.map | COMMENT |
| LOW | …ugin/package/src/messaging/converters/merge-forward.js | 221 | //# sourceMappingURL=merge-forward.js.map | COMMENT |
| LOW | …law-plugin/package/src/messaging/inbound/dispatch.d.ts | 41 | //# sourceMappingURL=dispatch.d.ts.map | COMMENT |
| LOW | …nclaw-plugin/package/src/messaging/inbound/enrich.d.ts | 101 | //# sourceMappingURL=enrich.d.ts.map | COMMENT |
| LOW | …enclaw-plugin/package/src/messaging/outbound/typing.js | 141 | //# sourceMappingURL=typing.js.map | COMMENT |
| LOW | …claw-plugin/package/src/messaging/outbound/typing.d.ts | 61 | //# sourceMappingURL=typing.d.ts.map | COMMENT |
| LOW | docs/research/provider-registry-comparison.md | 181 | ## 对 CodePilot 的改进建议 | COMMENT |
| LOW | .github/workflows/preview-build.yml | 1 | name: Preview Build (manual · artifacts only · no release) | COMMENT |
| LOW | .github/workflows/build.yml | 1 | name: Build & Package | COMMENT |
| LOW | electron/main.ts | 1801 | // half-height of the macOS traffic-light cluster (~14px tall); | COMMENT |
| LOW | electron/main.ts | 1961 | // read the diagnostic line, no DevTools needed. | COMMENT |
| LOW | electron/main.ts | 2121 | // First time the sanitizer runs in a given logs dir, rename the | COMMENT |
| LOW | electron/main.ts | 2221 | console.error = (...args: unknown[]) => { logWriter.write(fmt('error', args)); origError(...args); }; | COMMENT |
| LOW | electron/main.ts | 3641 | `The internal server could not start.\n\n${err instanceof Error ? err.message : String(err)}\n\nPlease try restart | COMMENT |
| LOW | src/app/settings/runtime/page.tsx | 1 | // Server component that derives the capability matrix per Runtime and | COMMENT |
| LOW | src/app/chat/page.tsx | 21 | // Chat first-paint memory contract (2026-05-09): NewChatPage must NOT | COMMENT |
| LOW | src/app/chat/page.tsx | 81 | ); | COMMENT |
| LOW | src/app/chat/page.tsx | 181 | // Phase 6 Phase 3 — per-source split (attachment / mention / directory). | COMMENT |
| LOW | src/app/chat/page.tsx | 201 | // and the resolver has landed on (codex_account, gpt-5.5). | COMMENT |
| LOW | src/app/chat/page.tsx | 221 | // Everything else still requires the legacy "provider set up" | COMMENT |
| LOW | src/app/chat/page.tsx | 241 | // - currentProviderId === '' → genuinely no provider reachable | COMMENT |
| LOW | src/app/chat/page.tsx | 261 | // | COMMENT |
| LOW | src/app/chat/page.tsx | 281 | // memory cut moves global health (provider count / models enabled / | COMMENT |
| LOW | src/app/chat/page.tsx | 401 | }, [currentProviderId]); | COMMENT |
| LOW | src/app/chat/page.tsx | 441 | setModelReady(true); | COMMENT |
| LOW | src/app/chat/page.tsx | 481 | } else if (resolved.status === 'invalid-default') { | COMMENT |
| LOW | src/app/chat/page.tsx | 621 | // Sync provider/model, applying global default model for new conversations. | COMMENT |
| LOW | src/app/chat/page.tsx | 821 | message: t('error.providerUnavailable'), | COMMENT |
| LOW | src/app/chat/page.tsx | 841 | // unavailable" banner + a disabled composer at the same time — | COMMENT |
| LOW | src/app/chat/page.tsx | 861 | // working route. `hasProvider` stays purely as the | COMMENT |
| LOW | src/app/chat/page.tsx | 881 | firstSendInFlightRef.current = true; | COMMENT |
| LOW | src/app/chat/page.tsx | 1001 | requestError.reason = err?.reason; | COMMENT |
| 281 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 193 | // Step 1: List all attendees to get attendee_id (user_...) from open_id (ou_...) | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 206 | // Step 2: Map open_id to attendee_id (user_...) and track organizers | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 226 | // Step 3: Find attendee_ids for the given open_ids | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 245 | // Step 4: Call batch_delete API with attendee_ids (user_...) | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 523 | // Step 1: 创建电子表格 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 538 | // Step 2: 如果有 headers 或 data,写入初始数据 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 589 | // Step 1: 创建导出任务 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 604 | // Step 2: 轮询等待完成 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 629 | // Step 3: 下载(如果指定了 output_path) | COMMENT |
| LOW | …u-openclaw-plugin/package/src/card/reply-dispatcher.js | 304 | // Step 1: Create card entity | COMMENT |
| LOW | …u-openclaw-plugin/package/src/card/reply-dispatcher.js | 316 | // Step 2: Send IM message referencing card_id | COMMENT |
| LOW⚡ | docs/exec-plans/completed/v0.48-post-release-issues.md | 531 | // Step 1: 先尝试从 DB 回填(若 apiKey 缺失或是 mask) | COMMENT |
| LOW⚡ | docs/exec-plans/completed/v0.48-post-release-issues.md | 538 | // Step 2: 再做 NO_CREDENTIALS 校验 | COMMENT |
| LOW⚡ | docs/exec-plans/completed/v0.48-post-release-issues.md | 543 | // Step 3: 正常走 testProviderConnection | COMMENT |
| LOW | scripts/after-pack.js | 42 | // Step 1: Explicitly rebuild standalone native modules for the target | COMMENT |
| LOW⚡ | scripts/after-pack.js | 90 | // Step 2: Verify every rebuilt .node file. | COMMENT |
| LOW⚡ | scripts/after-pack.js | 99 | // Step 3: Find and replace all target .node files in standalone resources. | COMMENT |
| LOW⚡ | scripts/after-sign.js | 160 | // Step 1: Sign all native binaries (.node, .dylib, .so) | COMMENT |
| LOW⚡ | scripts/after-sign.js | 170 | // Step 2: Sign executable helper binaries inside frameworks before signing | COMMENT |
| LOW⚡ | scripts/after-sign.js | 183 | // Step 3: Sign all Frameworks | COMMENT |
| LOW⚡ | scripts/after-sign.js | 193 | // Step 4: Sign all Helper apps | COMMENT |
| LOW⚡ | scripts/after-sign.js | 203 | // Step 5: Sign the main app bundle | COMMENT |
| LOW | electron/main.ts | 2691 | // Step 1: Install Claude Code via native installer | COMMENT |
| LOW | electron/main.ts | 2809 | // Step 2: Verify claude is available | COMMENT |
| LOW | src/app/api/settings/qq/verify/route.ts | 33 | // Step 1: Get access token | COMMENT |
| LOW | src/app/api/settings/qq/verify/route.ts | 49 | // Step 2: Verify gateway is reachable | COMMENT |
| LOW | src/app/api/providers/test/route.ts | 37 | // Step 1: back-fill real api_key from DB when the caller sends no key or a | COMMENT |
| LOW | src/app/api/providers/test/route.ts | 53 | // Step 2: credential check (after back-fill) | COMMENT |
| LOW | src/lib/bridge/adapters/telegram-media.ts | 202 | // Step 1: Get file path from Telegram | COMMENT |
| LOW | src/lib/bridge/adapters/telegram-media.ts | 230 | // Step 2: Download the file | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 252 | // Step 3: Read buffer and validate actual size | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 259 | // Step 4: Determine MIME type | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 262 | // Step 5: Convert to base64 and build FileAttachment | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 193 | // Step 1: List all attendees to get attendee_id (user_...) from open_id (ou_...) | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 206 | // Step 2: Map open_id to attendee_id (user_...) and track organizers | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 226 | // Step 3: Find attendee_ids for the given open_ids | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 245 | // Step 4: Call batch_delete API with attendee_ids (user_...) | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 523 | // Step 1: 创建电子表格 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 538 | // Step 2: 如果有 headers 或 data,写入初始数据 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 589 | // Step 1: 创建导出任务 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 604 | // Step 2: 轮询等待完成 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 629 | // Step 3: 下载(如果指定了 output_path) | COMMENT |
| LOW | …u-openclaw-plugin/package/src/card/reply-dispatcher.js | 304 | // Step 1: Create card entity | COMMENT |
| LOW | …u-openclaw-plugin/package/src/card/reply-dispatcher.js | 316 | // Step 2: Send IM message referencing card_id | COMMENT |
| LOW | scripts/after-pack.js | 42 | // Step 1: Explicitly rebuild standalone native modules for the target | COMMENT |
| LOW⚡ | scripts/after-pack.js | 90 | // Step 2: Verify every rebuilt .node file. | COMMENT |
| LOW⚡ | scripts/after-pack.js | 99 | // Step 3: Find and replace all target .node files in standalone resources. | COMMENT |
| LOW⚡ | scripts/after-sign.js | 160 | // Step 1: Sign all native binaries (.node, .dylib, .so) | COMMENT |
| LOW⚡ | scripts/after-sign.js | 170 | // Step 2: Sign executable helper binaries inside frameworks before signing | COMMENT |
| LOW⚡ | scripts/after-sign.js | 183 | // Step 3: Sign all Frameworks | COMMENT |
| LOW⚡ | scripts/after-sign.js | 193 | // Step 4: Sign all Helper apps | COMMENT |
| LOW⚡ | scripts/after-sign.js | 203 | // Step 5: Sign the main app bundle | COMMENT |
| LOW | electron/main.ts | 2691 | // Step 1: Install Claude Code via native installer | COMMENT |
| LOW | electron/main.ts | 2809 | // Step 2: Verify claude is available | COMMENT |
| LOW | src/app/api/settings/qq/verify/route.ts | 33 | // Step 1: Get access token | COMMENT |
| LOW | src/app/api/settings/qq/verify/route.ts | 49 | // Step 2: Verify gateway is reachable | COMMENT |
| LOW | src/app/api/providers/test/route.ts | 37 | // Step 1: back-fill real api_key from DB when the caller sends no key or a | COMMENT |
| LOW | src/app/api/providers/test/route.ts | 53 | // Step 2: credential check (after back-fill) | COMMENT |
| LOW | src/lib/bridge/adapters/telegram-media.ts | 202 | // Step 1: Get file path from Telegram | COMMENT |
| LOW | src/lib/bridge/adapters/telegram-media.ts | 230 | // Step 2: Download the file | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 252 | // Step 3: Read buffer and validate actual size | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 259 | // Step 4: Determine MIME type | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 262 | // Step 5: Convert to base64 and build FileAttachment | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/app/api/workspace/quick-actions/route.ts | 77 | // 4. Dynamic AI-generated suggestions (cached for 10 minutes) | COMMENT |
| HIGH | src/components/layout/panels/PreviewPanel.tsx | 330 | // because that's the common case for previewing AI-generated | COMMENT |
| HIGH | src/components/cli-tools/CliToolsManager.tsx | 144 | // displayName + id + AI-generated description (extra/custom). The | COMMENT |
| HIGH | src/__tests__/unit/inline-html-csp.test.ts | 85 | // Codex review finding: AI-generated HTML / code fence content | COMMENT |
| HIGH | src/lib/claude-client.ts | 2334 | // only to CodePilot's transcript payload as requested-model | COMMENT |
| HIGH | src/lib/inline-html-csp.ts | 41 | // https://...img.png from an AI-generated artifact is allowed; the | COMMENT |
| HIGH | src/lib/db.ts | 1178 | // CLI tools: persisted AI-generated descriptions | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …plugin/package/src/messaging/converters/interactive.js | 558 | const paths = ["content", "text", "title", "label", "placeholder"]; | CODE |
| LOW | docs/exec-plans/active/automatic-chat-titles.md | 74 | - [x] 「首轮」的判定复用 fallback CAS 的返回值而不是数消息。→ `route.ts` 把 `updateSessionTitle(..., expectOrigin: ['placeholder'])` 的返回值存成 ` | CODE |
| LOW | src/app/api/chat/route.ts | 400 | // The CAS on 'placeholder' is what makes this safe to run on every | COMMENT |
| LOW | src/app/api/chat/route.ts | 412 | expectOrigin: ['placeholder'], | CODE |
| LOW | src/__tests__/functional-test.ts | 170 | const placeholder = await chatInput.getAttribute('placeholder') || ''; | CODE |
| LOW | src/__tests__/unit/conversation-title.test.ts | 258 | for (const origin of ['placeholder', 'fallback', 'generated', 'manual', 'system', 'import']) { | CODE |
| LOW | src/__tests__/unit/title-generation-trigger.test.ts | 99 | updateSessionTitle(s.id, 'Fallback title', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW | src/__tests__/unit/native-timeout-reasons.test.ts | 17 | * 4. 反例 (anti-fake-data): with budgets configured but generous, a normal | COMMENT |
| LOW | src/__tests__/unit/native-timeout-reasons.test.ts | 453 | // 反例 1 (anti-fake-data): budgets configured but generous → normal turn, | COMMENT |
| LOW | src/__tests__/unit/agent-loop-error-event.test.ts | 7 | * normal-vs-trigger difference required by the project's anti-fake-data rule. | COMMENT |
| LOW | src/__tests__/unit/xai-oauth-manager.test.ts | 71 | const idToken = jwt({ email: 'user@example.com', sub: 'account-1' }); | CODE |
| LOW | src/__tests__/unit/xai-oauth-manager.test.ts | 81 | assert.equal(bundle.email, 'user@example.com'); | CODE |
| LOW | src/__tests__/unit/bridge-delivery-visibility.test.ts | 92 | setSetting('telegram_bot_token', 'fake-token'); | CODE |
| LOW | src/__tests__/unit/bridge-delivery-visibility.test.ts | 118 | setSetting('telegram_bot_token', 'fake-token'); | CODE |
| LOW | src/__tests__/unit/session-title-wiring.test.ts | 77 | assert.match(branch, /expectOrigin: \['placeholder'\]/); | CODE |
| LOW | src/__tests__/unit/xai-oauth.test.ts | 75 | assert.deepEqual(parseJwtClaims(jwt({ exp: 123, email: 'user@example.com', sub: 'acct' })), { | CODE |
| LOW | src/__tests__/unit/xai-oauth.test.ts | 77 | email: 'user@example.com', | CODE |
| LOW | src/__tests__/unit/xai-oauth.test.ts | 109 | id_token: jwt({ nonce: 'nonce-1', email: 'user@example.com' }), | CODE |
| LOW | src/__tests__/unit/codex-account-state.test.ts | 75 | account: { type: 'chatgpt', email: 'user@example.com', planType: 'pro' }, | CODE |
| LOW | src/__tests__/unit/codex-account-state.test.ts | 82 | email: 'user@example.com', | CODE |
| LOW | src/__tests__/unit/title-generation.test.ts | 84 | updateSessionTitle(s.id, fallback, 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW | src/__tests__/unit/title-generation.test.ts | 702 | assert.equal(getSession(s.id)!.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 47 | assert.equal(s.title_origin, 'placeholder'); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 71 | const ok = updateSessionTitle(s.id, 'Fix login', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 80 | updateSessionTitle(s.id, 'First message', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 81 | const ok = updateSessionTitle(s.id, 'Second message', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 89 | const ok = updateSessionTitle(s.id, 'clobbered', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 99 | updateSessionTitle(s.id, 'auto title', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 110 | assert.equal(updateSessionTitle(s.id, 'ghost', 'fallback', { expectOrigin: ['placeholder'] }), false); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 127 | updateSessionTitle(s.id, 'fallback title', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 258 | assert.equal(untitled?.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 259 | assert.equal(empty?.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 272 | assert.equal(again.getSession('legacy-untitled')?.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 315 | assert.equal(recovered.getSession('half-untitled')?.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 326 | for (const origin of ['placeholder', 'fallback', 'generated', 'manual', 'system', 'import'] as const) { | CODE |
| LOW | src/__tests__/e2e/chat.spec.ts | 67 | const placeholder = await input.getAttribute('placeholder'); | CODE |
| LOW | src/__tests__/e2e/chat-enhanced.spec.ts | 145 | const placeholder = await input.getAttribute('placeholder'); | CODE |
| LOW | src/lib/db.ts | 661 | // ALTER ... DEFAULT 'placeholder' would silently stamp every legacy row | COMMENT |
| LOW | src/lib/db.ts | 671 | // 'New Chat' / '' → 'placeholder': never had a real title, so the next | COMMENT |
| LOW | src/lib/db.ts | 2049 | * caller that passed no title gets 'placeholder' (a fallback may fill it | COMMENT |
| LOW | src/lib/db.ts | 683 | SET title_origin = CASE WHEN title = '' OR title = 'New Chat' THEN 'placeholder' ELSE 'manual' END | CODE |
| LOW | src/lib/db.ts | 2062 | const originValue: TitleOrigin = titleOrigin ?? (title ? 'manual' : 'placeholder'); | CODE |
| LOW | src/lib/conversation-title.ts | 24 | | 'placeholder' | CODE |
| LOW | src/lib/conversation-title.ts | 37 | 'placeholder', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/__tests__/unit/harness-extension-fragment.test.ts | 100 | assert.match(out, /## Your harness extensions/); | CODE |
| MEDIUM | src/__tests__/unit/harness-extension-fragment.test.ts | 178 | /## Your harness extensions/.test(base.systemPromptAppend), | CODE |
| MEDIUM | src/__tests__/unit/harness-extension-fragment.test.ts | 192 | assert.match(out.systemPromptAppend, /## Your harness extensions/); | CODE |
| MEDIUM | src/__tests__/unit/heartbeat-copy-honesty.test.ts | 53 | // bundles are flat key→string objects, so this is robust enough. | COMMENT |
| MEDIUM | …/__tests__/unit/codex-builtin-no-anti-patterns.test.ts | 101 | // This guard is more nuanced: OPENAI_API_KEY may legitimately be | COMMENT |
| MEDIUM | src/__tests__/unit/session-runtime-immunity.test.ts | 1006 | // Counting the flag inside dep arrays is the cheapest robust | COMMENT |
| MEDIUM | src/__tests__/unit/context-compressor-handoff.test.ts | 304 | // monotonically increasing per insert, so this is robust even when writes | COMMENT |
| MEDIUM | …ests__/unit/extract-token-usage-context-window.test.ts | 92 | // faster and more robust. | COMMENT |
| MEDIUM | src/lib/harness/runtime-adapter.ts | 160 | * ## Your harness extensions | COMMENT |
| MEDIUM | src/lib/harness/runtime-adapter.ts | 203 | const lines: string[] = ['## Your harness extensions', '']; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/research/sub-agent-system.md | 414 | // 4. 执行 agentic loop | COMMENT |
| MEDIUM | …plans/completed/context-accounting-runtime-contract.md | 498 | - 2026-05-20(**v4 P2 deferred → tech-debt #22**):selectedSkills 仍是 `readonly string[]`。同名 skill 在 project + global 重复时按 | CODE |
| MEDIUM | …/exec-plans/active/development-harness-optimization.md | 217 | ### Step 4 — 把"必读"扩到 guardrails/ 八类高风险入口 🔄 部分完成 | COMMENT |
| MEDIUM | src/components/settings/UsageStatsSection.tsx | 224 | // Derive cost-by-day series — same date scaffold as the bar chart so | COMMENT |
| MEDIUM | src/components/chat/RunCockpit.tsx | 177 | // v0.56.x Phase 2 (#632) — only show a percentage when the context window | COMMENT |
| MEDIUM | src/__tests__/unit/codex-proxy-foundation.test.ts | 424 | // scaffold returned. Codex's HTTP client reads | COMMENT |
| MEDIUM | src/lib/claude-client.ts | 1061 | // #632: trust the SDK-reported context window only for a first-party | COMMENT |