A multi-model AI agent desktop client — connect any AI provider, extend with MCP & skills, control from your phone. Built with Electron + Next.js.
This report summarizes scanner evidence for op7418/CodePilot, a TypeScript project with 6,498 GitHub stars. SynthScan examined 474,900 lines of code across 2300 source files, recording 2291 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 9.6 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1134 finding(s).
Are imports declared and package/API names verified? 44 finding(s).
Are wrappers, guards, and repeated structures necessary? 1825 finding(s).
Which changes need focused human review? 2291 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2291 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 27 | // ── 1. 提取代码块，用占位符保护，处理后再还原 ───────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 33 | // ── 2. 标题降级 ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 43 | // ── 3. 连续标题间增加段落间距 ─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 45 | // ── 4. 表格前后增加段落间距 ───────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 61 | // ── 5. 还原代码块，并在前后追加 <br> ────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 67 | // ── 5. 还原代码块（无 <br>）─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …shu-openclaw-plugin/package/src/card/markdown-style.js | 72 | // ── 6. 压缩多余空行（3 个以上连续换行 → 2 个）──────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 41 | // ── Isolated app data dir (BEFORE any @/lib import) ───────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 49 | // ── Credential loading (READ-ONLY on the real DB) ─────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 95 | // ── Contract fact extraction ──────────────────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 159 | // ── Runner ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 207 | // ── Scenarios ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 439 | // ── Report ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase5-decision.ts | 461 | // ── Mechanical comparison ─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | scripts/after-sign.js | 153 | // ── No certificate — ad-hoc signing fallback ───────────────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase4-mcp-poc.ts | 28 | // ── Isolated app data dir (BEFORE any @/lib import) ───────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase3-poc.ts | 32 | // ── Isolated app data dir (BEFORE any @/lib import) ───────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase3-poc.ts | 41 | // ── Credential loading (READ-ONLY on the real DB) ─────────────── | COMMENT |
| MEDIUM | scripts/smoke-ai-sdk7-phase3-poc.ts | 88 | // ── Scenario harness ──────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 56 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 63 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 91 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 102 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 166 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 171 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 201 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 203 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 334 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/preview-build.yml | 336 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | electron/main.ts | 2309 | // ── Single-instance lock (Windows multi-tray / multi-process feedback) ────── | COMMENT |
| MEDIUM | src/app/api/chat/route.ts | 175 | // ─── Phase 2 Step 3 — early resolver gate ─────────────────────── | COMMENT |
| MEDIUM | src/app/api/chat/route.ts | 249 | // ── /compact command handler ──────────────────────────────────── | COMMENT |
| MEDIUM | src/app/api/chat/route.ts | 637 | // ── Context compression check ─────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 106 | // ── 1. Provider connectivity ───────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 141 | // ── 2. 执行引擎 / CLI ───────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 205 | // ── 3. Default model validity ──────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 287 | // ── 4. Models exposure ─────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/HealthSection.tsx | 336 | // ── 5. Assistant workspace / local environment ─────────────── | COMMENT |
| MEDIUM | src/components/settings/AppearanceSection.tsx | 25 | // ── Theme Mode Pill Selector ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/AppearanceSection.tsx | 69 | // ── Shiki Code Preview ────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/AppearanceSection.tsx | 124 | // ── UI Token Preview ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/settings/AppearanceSection.tsx | 145 | // ── Main Appearance Section ───────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 11 | // ── Root container ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 42 | // ── Search input ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 74 | // ── Scrollable items area ─────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 89 | // ── Single item ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 153 | // ── Group with label header ───────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 180 | // ── Footer ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 194 | // ── Footer action button ──────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/patterns/CommandList.tsx | 215 | // ── Empty state ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/chat/WidgetRenderer.tsx | 71 | // ── postMessage handler ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/chat/WidgetRenderer.tsx | 174 | // ── Streaming updates ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/chat/WidgetRenderer.tsx | 191 | // ── Finalize ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/chat/WidgetRenderer.tsx | 213 | // ── Theme sync ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/bridge/WeixinBridgeSection.tsx | 136 | // ── QR Login Flow ─────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/ai-elements/shiki-worker-client.ts | 185 | // ── Real-worker singleton ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/components/ai-elements/code-block.tsx | 45 | // ── Collapse/expand constants ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/components/ai-elements/code-block.tsx | 49 | // ── Terminal language detection ──────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/components/ai-elements/code-block.tsx | 52 | // ── Language icon mapping ────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/components/ai-elements/code-block.tsx | 1025 | // ── InlineCode ───────────────────────────────────────────────────────── | COMMENT |
| 1053 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | 资料/weixin-openclaw-package/package/src/runtime.ts | 53 | export async function resolveWeixinChannelRuntime(params: { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/pairing.ts | 35 | export function resolveFrameworkAllowFromPath(accountId: string): string { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/pairing.ts | 50 | export function readFrameworkAllowFromList(accountId: string): string[] { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/pairing.ts | 78 | export async function registerUserInFrameworkStore(params: { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/accounts.ts | 48 | export function listIndexedWeixinAccountIds(): string[] { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/auth/accounts.ts | 229 | export async function triggerWeixinChannelReload(): Promise<void> {} | CODE |
| LOW | …eixin-openclaw-package/package/src/storage/sync-buf.ts | 21 | function getLegacySyncBufDefaultJsonPath(): string { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/cdn/upload.ts | 30 | export async function downloadRemoteImageToTemp(url: string, destDir: string): Promise<string> { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/cdn/upload.ts | 143 | export async function uploadFileAttachmentToWeixin(params: { | CODE |
| LOW | …ixin-openclaw-package/package/src/messaging/inbound.ts | 129 | export function weixinMessageToMsgContext( | CODE |
| LOW | …ixin-openclaw-package/package/src/messaging/inbound.ts | 169 | export function getContextTokenFromMsgContext(ctx: WeixinMsgContext): string | undefined { | CODE |
| LOW | 资料/weixin-openclaw-package/package/src/media/mime.ts | 68 | export function getExtensionFromContentTypeOrUrl(contentType: string | null, url: string): string { | CODE |
| LOW | …/feishu-openclaw-plugin/package/src/tools/auto-auth.js | 607 | export async function handleInvokeErrorWithAutoAuth(err, cfg) { | CODE |
| LOW | …-openclaw-plugin/package/src/tools/oauth-batch-auth.js | 31 | export function registerFeishuOAuthBatchAuthTool(api) { | CODE |
| LOW | …penclaw-plugin/package/src/tools/oauth-batch-auth.d.ts | 11 | export declare function registerFeishuOAuthBatchAuthTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …eishu-openclaw-plugin/package/src/tools/auto-auth.d.ts | 56 | export declare function handleInvokeErrorWithAutoAuth(err: unknown, cfg: ClawdbotConfig): Promise<{ | CODE |
| LOW | …feishu-openclaw-plugin/package/src/tools/mcp/shared.js | 73 | function readMcpUrlFromOpenclawJson() { | CODE |
| LOW | …shu-openclaw-plugin/package/src/tools/mcp/doc/index.js | 17 | export function registerFeishuMcpDocTools(api) { | CODE |
| LOW | …u-openclaw-plugin/package/src/tools/mcp/doc/index.d.ts | 12 | export declare function registerFeishuMcpDocTools(api: OpenClawPluginApi): void; | CODE |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 44 | export function createFeishuClientFromConfig(config) { | CODE |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 245 | export function formatTimestampToBeijingTime(timestamp) { | CODE |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 270 | export function formatTimestampMsToBeijingTime(timestamp) { | CODE |
| LOW | …hu-openclaw-plugin/package/src/tools/oapi/helpers.d.ts | 38 | export declare function createFeishuClientFromConfig(config: ClawdbotConfig): LarkClient; | CODE |
| LOW | …hu-openclaw-plugin/package/src/tools/oapi/helpers.d.ts | 131 | export declare function formatTimestampToBeijingTime(timestamp: string | number): string; | CODE |
| LOW | …hu-openclaw-plugin/package/src/tools/oapi/helpers.d.ts | 144 | export declare function formatTimestampMsToBeijingTime(timestamp: string | number): string; | CODE |
| LOW | …ugin/package/src/tools/oapi/bitable/app-table-field.js | 67 | export function registerFeishuBitableAppTableFieldTool(api) { | CODE |
| LOW | …law-plugin/package/src/tools/oapi/bitable/app-table.js | 78 | export function registerFeishuBitableAppTableTool(api) { | CODE |
| LOW | …penclaw-plugin/package/src/tools/oapi/bitable/app.d.ts | 18 | export declare function registerFeishuBitableAppTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …gin/package/src/tools/oapi/bitable/app-table-record.js | 127 | export function registerFeishuBitableAppTableRecordTool(api) { | CODE |
| LOW | …lugin/package/src/tools/oapi/bitable/app-table-view.js | 70 | export function registerFeishuBitableAppTableViewTool(api) { | CODE |
| LOW | …gin/package/src/tools/oapi/bitable/app-table-view.d.ts | 17 | export declare function registerFeishuBitableAppTableViewTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …in/package/src/tools/oapi/bitable/app-table-field.d.ts | 16 | export declare function registerFeishuBitableAppTableFieldTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …n/package/src/tools/oapi/bitable/app-table-record.d.ts | 20 | export declare function registerFeishuBitableAppTableRecordTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …w-plugin/package/src/tools/oapi/bitable/app-table.d.ts | 19 | export declare function registerFeishuBitableAppTableTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …-openclaw-plugin/package/src/tools/oapi/bitable/app.js | 59 | export function registerFeishuBitableAppTool(api) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/calendar/event.js | 287 | function normalizeCalendarTimeValue(value) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/calendar/event.js | 322 | function normalizeEventListTimeFields(events) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/calendar/event.js | 330 | export function registerFeishuCalendarEventTool(api) { | CODE |
| LOW | …law-plugin/package/src/tools/oapi/calendar/freebusy.js | 36 | export function registerFeishuCalendarFreebusyTool(api) { | CODE |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 96 | export function registerFeishuCalendarEventAttendeeTool(api) { | CODE |
| LOW | …in/package/src/tools/oapi/calendar/event-attendee.d.ts | 16 | export declare function registerFeishuCalendarEventAttendeeTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …claw-plugin/package/src/tools/oapi/calendar/event.d.ts | 16 | export declare function registerFeishuCalendarEventTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …w-plugin/package/src/tools/oapi/calendar/freebusy.d.ts | 13 | export declare function registerFeishuCalendarFreebusyTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …w-plugin/package/src/tools/oapi/calendar/calendar.d.ts | 15 | export declare function registerFeishuCalendarCalendarTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …law-plugin/package/src/tools/oapi/calendar/calendar.js | 45 | export function registerFeishuCalendarCalendarTool(api) { | CODE |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/index.js | 14 | export function registerFeishuSheetsTools(api) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/sheets/index.d.ts | 12 | export declare function registerFeishuSheetsTools(api: OpenClawPluginApi): void; | CODE |
| LOW | …openclaw-plugin/package/src/tools/oapi/wiki/space.d.ts | 15 | export declare function registerFeishuWikiSpaceTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …nclaw-plugin/package/src/tools/oapi/wiki/space-node.js | 127 | export function registerFeishuWikiSpaceNodeTool(api) { | CODE |
| LOW | …law-plugin/package/src/tools/oapi/wiki/space-node.d.ts | 17 | export declare function registerFeishuWikiSpaceNodeTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …u-openclaw-plugin/package/src/tools/oapi/wiki/space.js | 53 | export function registerFeishuWikiSpaceTool(api) { | CODE |
| LOW | …openclaw-plugin/package/src/tools/oapi/search/index.js | 14 | export function registerFeishuSearchTools(api) { | CODE |
| LOW | …w-plugin/package/src/tools/oapi/search/doc-search.d.ts | 13 | export declare function registerFeishuSearchDocWikiTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …law-plugin/package/src/tools/oapi/search/doc-search.js | 113 | function normalizeSearchResultTimeFields(value, converted) { | CODE |
| LOW | …law-plugin/package/src/tools/oapi/search/doc-search.js | 138 | export function registerFeishuSearchDocWikiTool(api) { | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/search/index.d.ts | 12 | export declare function registerFeishuSearchTools(api: OpenClawPluginApi): void; | CODE |
| LOW | …enclaw-plugin/package/src/tools/oapi/task/subtask.d.ts | 14 | export declare function registerFeishuTaskSubtaskTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …openclaw-plugin/package/src/tools/oapi/task/subtask.js | 53 | export function registerFeishuTaskSubtaskTool(api) { | CODE |
| LOW | …-openclaw-plugin/package/src/tools/oapi/task/task.d.ts | 16 | export declare function registerFeishuTaskTaskTool(api: OpenClawPluginApi): void; | CODE |
| LOW | …hu-openclaw-plugin/package/src/tools/oapi/task/task.js | 158 | export function registerFeishuTaskTaskTool(api) { | CODE |
| 652 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | next.config.ts | 1 | import type { NextConfig } from "next"; | COMMENT |
| LOW | next.config.ts | 21 | cacheHandler: path.join(import.meta.dirname, 'cache-handler.js'), | COMMENT |
| LOW | next.config.ts | 41 | // resources (HMR, fonts) unless the host is explicitly allowed. | COMMENT |
| LOW | next.config.ts | 61 | // serverExternalPackages: keep these in node_modules at runtime instead of bundling. | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/doctor.js | 381 | // basicInfoOk: basicInfoResult.apiOk, | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 61 | const scopeDesc = formatScopeDescription(scope, isBatchAuth, totalAppScopes, alreadyGranted, batchInfo, filteredScop | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 81 | // color: "orange", | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 181 | message += `\n\n${batchInfo}`; | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 241 | template: "green", | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 261 | // elements: [ | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 321 | // tag: "column_set", | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 341 | // content: "授权未完成", | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 401 | if (!acct.configured) { | COMMENT |
| LOW | 资料/feishu-openclaw-plugin/package/src/tools/oauth.js | 421 | // } | COMMENT |
| LOW | …feishu-openclaw-plugin/package/src/tools/oapi/index.js | 61 | registerFeishuDriveTools(api); | COMMENT |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 361 | // return json({ | COMMENT |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 381 | // (link ? `\n权限管理链接：${link}` : ""), | COMMENT |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 401 | // return json({ | COMMENT |
| LOW | …ishu-openclaw-plugin/package/src/tools/oapi/helpers.js | 421 | // if (err instanceof NeedAuthorizationError) { | COMMENT |
| LOW | …n/package/src/tools/oapi/bitable/app-table-record.d.ts | 21 | //# sourceMappingURL=app-table-record.d.ts.map | COMMENT |
| LOW | …law-plugin/package/src/tools/oapi/calendar/calendar.js | 121 | //# sourceMappingURL=calendar.js.map | COMMENT |
| LOW | …aw-plugin/package/src/tools/oapi/im/format-messages.js | 161 | //# sourceMappingURL=format-messages.js.map | COMMENT |
| LOW | …shu-openclaw-plugin/package/src/card/markdown-style.js | 41 | } | COMMENT |
| LOW | …penclaw-plugin/package/src/core/app-scope-checker.d.ts | 81 | //# sourceMappingURL=app-scope-checker.d.ts.map | COMMENT |
| LOW | …enclaw-plugin/package/src/core/app-owner-fallback.d.ts | 21 | //# sourceMappingURL=app-owner-fallback.d.ts.map | COMMENT |
| LOW | …penclaw-plugin/package/src/workspace/task-tracker.d.ts | 41 | //# sourceMappingURL=task-tracker.d.ts.map | COMMENT |
| LOW | …/feishu-openclaw-plugin/package/src/commands/doctor.js | 361 | // 3. 检查应用权限 | COMMENT |
| LOW | …claw-plugin/package/src/messaging/converters/folder.js | 21 | //# sourceMappingURL=folder.js.map | COMMENT |
| LOW | …enclaw-plugin/package/src/messaging/converters/file.js | 21 | //# sourceMappingURL=file.js.map | COMMENT |
| LOW | …ugin/package/src/messaging/converters/merge-forward.js | 221 | //# sourceMappingURL=merge-forward.js.map | COMMENT |
| LOW | …law-plugin/package/src/messaging/inbound/dispatch.d.ts | 41 | //# sourceMappingURL=dispatch.d.ts.map | COMMENT |
| LOW | …nclaw-plugin/package/src/messaging/inbound/enrich.d.ts | 101 | //# sourceMappingURL=enrich.d.ts.map | COMMENT |
| LOW | …enclaw-plugin/package/src/messaging/outbound/typing.js | 141 | //# sourceMappingURL=typing.js.map | COMMENT |
| LOW | …claw-plugin/package/src/messaging/outbound/typing.d.ts | 61 | //# sourceMappingURL=typing.d.ts.map | COMMENT |
| LOW | docs/research/provider-registry-comparison.md | 181 | ## 对 CodePilot 的改进建议 | COMMENT |
| LOW | .github/workflows/preview-build.yml | 1 | name: Preview Build (manual · artifacts only · no release) | COMMENT |
| LOW | .github/workflows/build.yml | 1 | name: Build & Package | COMMENT |
| LOW | electron/main.ts | 741 | } else { | COMMENT |
| LOW | electron/main.ts | 1881 | // see Phase 7c plan D-3 — actual AppKit offset may be ±2px so | COMMENT |
| LOW | electron/main.ts | 2041 | // read the diagnostic line, no DevTools needed. | COMMENT |
| LOW | electron/main.ts | 2201 | // First time the sanitizer runs in a given logs dir, rename the | COMMENT |
| LOW | electron/main.ts | 2301 | console.error = (...args: unknown[]) => { logWriter.write(fmt('error', args)); origError(...args); }; | COMMENT |
| LOW | electron/main.ts | 3721 | `The internal server could not start.\n\n${err instanceof Error ? err.message : String(err)}\n\nPlease try restart | COMMENT |
| LOW | src/app/settings/runtime/page.tsx | 1 | // Server component that derives the capability matrix per Runtime and | COMMENT |
| LOW | src/app/chat/page.tsx | 21 | import { OnboardingWizard } from '@/components/assistant/OnboardingWizard'; | COMMENT |
| LOW | src/app/chat/page.tsx | 181 | const [streamingToolOutput, setStreamingToolOutput] = useState(''); | COMMENT |
| LOW | src/app/chat/page.tsx | 201 | // overlay so a Codex-Account-only user (no traditional | COMMENT |
| LOW | src/app/chat/page.tsx | 221 | // (`/api/openai-oauth/status`-managed). | COMMENT |
| LOW | src/app/chat/page.tsx | 241 | // - currentProviderId is a DB provider → hasProvider true (we | COMMENT |
| LOW | src/app/chat/page.tsx | 261 | // Round-1 review fix — derive the chat-runtime param up front so | COMMENT |
| LOW | src/app/chat/page.tsx | 281 | // numbers". That coupling cost the chat first paint a fan-out of | COMMENT |
| LOW | src/app/chat/page.tsx | 401 | }).catch(() => { | COMMENT |
| LOW | src/app/chat/page.tsx | 421 | // Fetch models filtered by the **current** session runtime param — | COMMENT |
| LOW | src/app/chat/page.tsx | 441 | const savedModel = localStorage.getItem('codepilot:last-model') || 'sonnet'; | COMMENT |
| LOW | src/app/chat/page.tsx | 481 | setCurrentModel(''); | COMMENT |
| LOW | src/app/chat/page.tsx | 821 | // would resolve them via the env-default chain, silently bypassing | COMMENT |
| LOW | src/app/chat/page.tsx | 841 | // Pre-round-4 this branch hard-blocked sends whenever | COMMENT |
| LOW | src/app/chat/page.tsx | 861 | // click send and hit the legacy "no provider configured" wall. | COMMENT |
| LOW | src/app/chat/page.tsx | 1001 | // #4/#5 (Codex P2) — also mark the URL prefill consumed so the remount's | COMMENT |
| LOW | src/app/chat/page.tsx | 1181 | // Phase 5 extension-point; no producer currently (see | COMMENT |
| 276 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 193 | // Step 1: List all attendees to get attendee_id (user_...) from open_id (ou_...) | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 206 | // Step 2: Map open_id to attendee_id (user_...) and track organizers | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 226 | // Step 3: Find attendee_ids for the given open_ids | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 245 | // Step 4: Call batch_delete API with attendee_ids (user_...) | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 523 | // Step 1: 创建电子表格 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 538 | // Step 2: 如果有 headers 或 data，写入初始数据 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 589 | // Step 1: 创建导出任务 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 604 | // Step 2: 轮询等待完成 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 629 | // Step 3: 下载（如果指定了 output_path） | COMMENT |
| LOW | …u-openclaw-plugin/package/src/card/reply-dispatcher.js | 304 | // Step 1: Create card entity | COMMENT |
| LOW | …u-openclaw-plugin/package/src/card/reply-dispatcher.js | 316 | // Step 2: Send IM message referencing card_id | COMMENT |
| LOW⚡ | docs/exec-plans/completed/v0.48-post-release-issues.md | 531 | // Step 1: 先尝试从 DB 回填（若 apiKey 缺失或是 mask） | COMMENT |
| LOW⚡ | docs/exec-plans/completed/v0.48-post-release-issues.md | 538 | // Step 2: 再做 NO_CREDENTIALS 校验 | COMMENT |
| LOW⚡ | docs/exec-plans/completed/v0.48-post-release-issues.md | 543 | // Step 3: 正常走 testProviderConnection | COMMENT |
| LOW | scripts/after-pack.js | 42 | // Step 1: Explicitly rebuild standalone native modules for the target | COMMENT |
| LOW⚡ | scripts/after-pack.js | 90 | // Step 2: Verify every rebuilt .node file. | COMMENT |
| LOW⚡ | scripts/after-pack.js | 99 | // Step 3: Find and replace all target .node files in standalone resources. | COMMENT |
| LOW⚡ | scripts/after-sign.js | 160 | // Step 1: Sign all native binaries (.node, .dylib, .so) | COMMENT |
| LOW⚡ | scripts/after-sign.js | 170 | // Step 2: Sign executable helper binaries inside frameworks before signing | COMMENT |
| LOW⚡ | scripts/after-sign.js | 183 | // Step 3: Sign all Frameworks | COMMENT |
| LOW⚡ | scripts/after-sign.js | 193 | // Step 4: Sign all Helper apps | COMMENT |
| LOW⚡ | scripts/after-sign.js | 203 | // Step 5: Sign the main app bundle | COMMENT |
| LOW | electron/main.ts | 2771 | // Step 1: Install Claude Code via native installer | COMMENT |
| LOW | electron/main.ts | 2889 | // Step 2: Verify claude is available | COMMENT |
| LOW | src/app/api/settings/qq/verify/route.ts | 33 | // Step 1: Get access token | COMMENT |
| LOW | src/app/api/settings/qq/verify/route.ts | 49 | // Step 2: Verify gateway is reachable | COMMENT |
| LOW | src/app/api/providers/test/route.ts | 37 | // Step 1: back-fill real api_key from DB when the caller sends no key or a | COMMENT |
| LOW | src/app/api/providers/test/route.ts | 53 | // Step 2: credential check (after back-fill) | COMMENT |
| LOW | src/lib/bridge/adapters/telegram-media.ts | 202 | // Step 1: Get file path from Telegram | COMMENT |
| LOW | src/lib/bridge/adapters/telegram-media.ts | 230 | // Step 2: Download the file | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 252 | // Step 3: Read buffer and validate actual size | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 259 | // Step 4: Determine MIME type | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 262 | // Step 5: Convert to base64 and build FileAttachment | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 193 | // Step 1: List all attendees to get attendee_id (user_...) from open_id (ou_...) | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 206 | // Step 2: Map open_id to attendee_id (user_...) and track organizers | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 226 | // Step 3: Find attendee_ids for the given open_ids | COMMENT |
| LOW | …ugin/package/src/tools/oapi/calendar/event-attendee.js | 245 | // Step 4: Call batch_delete API with attendee_ids (user_...) | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 523 | // Step 1: 创建电子表格 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 538 | // Step 2: 如果有 headers 或 data，写入初始数据 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 589 | // Step 1: 创建导出任务 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 604 | // Step 2: 轮询等待完成 | COMMENT |
| LOW | …openclaw-plugin/package/src/tools/oapi/sheets/sheet.js | 629 | // Step 3: 下载（如果指定了 output_path） | COMMENT |
| LOW | …u-openclaw-plugin/package/src/card/reply-dispatcher.js | 304 | // Step 1: Create card entity | COMMENT |
| LOW | …u-openclaw-plugin/package/src/card/reply-dispatcher.js | 316 | // Step 2: Send IM message referencing card_id | COMMENT |
| LOW | scripts/after-pack.js | 42 | // Step 1: Explicitly rebuild standalone native modules for the target | COMMENT |
| LOW⚡ | scripts/after-pack.js | 90 | // Step 2: Verify every rebuilt .node file. | COMMENT |
| LOW⚡ | scripts/after-pack.js | 99 | // Step 3: Find and replace all target .node files in standalone resources. | COMMENT |
| LOW⚡ | scripts/after-sign.js | 160 | // Step 1: Sign all native binaries (.node, .dylib, .so) | COMMENT |
| LOW⚡ | scripts/after-sign.js | 170 | // Step 2: Sign executable helper binaries inside frameworks before signing | COMMENT |
| LOW⚡ | scripts/after-sign.js | 183 | // Step 3: Sign all Frameworks | COMMENT |
| LOW⚡ | scripts/after-sign.js | 193 | // Step 4: Sign all Helper apps | COMMENT |
| LOW⚡ | scripts/after-sign.js | 203 | // Step 5: Sign the main app bundle | COMMENT |
| LOW | electron/main.ts | 2771 | // Step 1: Install Claude Code via native installer | COMMENT |
| LOW | electron/main.ts | 2889 | // Step 2: Verify claude is available | COMMENT |
| LOW | src/app/api/settings/qq/verify/route.ts | 33 | // Step 1: Get access token | COMMENT |
| LOW | src/app/api/settings/qq/verify/route.ts | 49 | // Step 2: Verify gateway is reachable | COMMENT |
| LOW | src/app/api/providers/test/route.ts | 37 | // Step 1: back-fill real api_key from DB when the caller sends no key or a | COMMENT |
| LOW | src/app/api/providers/test/route.ts | 53 | // Step 2: credential check (after back-fill) | COMMENT |
| LOW | src/lib/bridge/adapters/telegram-media.ts | 202 | // Step 1: Get file path from Telegram | COMMENT |
| LOW | src/lib/bridge/adapters/telegram-media.ts | 230 | // Step 2: Download the file | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 252 | // Step 3: Read buffer and validate actual size | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 259 | // Step 4: Determine MIME type | COMMENT |
| LOW⚡ | src/lib/bridge/adapters/telegram-media.ts | 262 | // Step 5: Convert to base64 and build FileAttachment | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …plugin/package/src/messaging/converters/interactive.js | 558 | const paths = ["content", "text", "title", "label", "placeholder"]; | CODE |
| LOW | docs/exec-plans/active/automatic-chat-titles.md | 74 | - [x] 「首轮」的判定复用 fallback CAS 的返回值而不是数消息。→ `route.ts` 把 `updateSessionTitle(..., expectOrigin: ['placeholder'])` 的返回值存成 ` | CODE |
| LOW | src/app/api/chat/route.ts | 456 | // The CAS on 'placeholder' is what makes this safe to run on every | COMMENT |
| LOW | src/app/api/chat/route.ts | 468 | expectOrigin: ['placeholder'], | CODE |
| LOW | src/__tests__/functional-test.ts | 170 | const placeholder = await chatInput.getAttribute('placeholder') || ''; | CODE |
| LOW | src/__tests__/unit/conversation-title.test.ts | 258 | for (const origin of ['placeholder', 'fallback', 'generated', 'manual', 'system', 'import']) { | CODE |
| LOW | src/__tests__/unit/title-generation-trigger.test.ts | 99 | updateSessionTitle(s.id, 'Fallback title', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW | src/__tests__/unit/native-timeout-reasons.test.ts | 17 | * 4. 反例 (anti-fake-data): with budgets configured but generous, a normal | COMMENT |
| LOW | src/__tests__/unit/native-timeout-reasons.test.ts | 453 | // 反例 1 (anti-fake-data): budgets configured but generous → normal turn, | COMMENT |
| LOW | src/__tests__/unit/agent-loop-error-event.test.ts | 7 | * normal-vs-trigger difference required by the project's anti-fake-data rule. | COMMENT |
| LOW | src/__tests__/unit/xai-oauth-manager.test.ts | 71 | const idToken = jwt({ email: 'user@example.com', sub: 'account-1' }); | CODE |
| LOW | src/__tests__/unit/xai-oauth-manager.test.ts | 81 | assert.equal(bundle.email, 'user@example.com'); | CODE |
| LOW | src/__tests__/unit/bridge-delivery-visibility.test.ts | 92 | setSetting('telegram_bot_token', 'fake-token'); | CODE |
| LOW | src/__tests__/unit/bridge-delivery-visibility.test.ts | 118 | setSetting('telegram_bot_token', 'fake-token'); | CODE |
| LOW | src/__tests__/unit/session-title-wiring.test.ts | 77 | assert.match(branch, /expectOrigin: \['placeholder'\]/); | CODE |
| LOW | src/__tests__/unit/xai-oauth.test.ts | 75 | assert.deepEqual(parseJwtClaims(jwt({ exp: 123, email: 'user@example.com', sub: 'acct' })), { | CODE |
| LOW | src/__tests__/unit/xai-oauth.test.ts | 77 | email: 'user@example.com', | CODE |
| LOW | src/__tests__/unit/xai-oauth.test.ts | 109 | id_token: jwt({ nonce: 'nonce-1', email: 'user@example.com' }), | CODE |
| LOW | src/__tests__/unit/codex-account-state.test.ts | 75 | account: { type: 'chatgpt', email: 'user@example.com', planType: 'pro' }, | CODE |
| LOW | src/__tests__/unit/codex-account-state.test.ts | 82 | email: 'user@example.com', | CODE |
| LOW | src/__tests__/unit/title-generation.test.ts | 84 | updateSessionTitle(s.id, fallback, 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW | src/__tests__/unit/title-generation.test.ts | 702 | assert.equal(getSession(s.id)!.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 47 | assert.equal(s.title_origin, 'placeholder'); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 71 | const ok = updateSessionTitle(s.id, 'Fix login', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 80 | updateSessionTitle(s.id, 'First message', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 81 | const ok = updateSessionTitle(s.id, 'Second message', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 89 | const ok = updateSessionTitle(s.id, 'clobbered', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW⚡ | src/__tests__/unit/session-title-provenance.test.ts | 99 | updateSessionTitle(s.id, 'auto title', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 110 | assert.equal(updateSessionTitle(s.id, 'ghost', 'fallback', { expectOrigin: ['placeholder'] }), false); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 127 | updateSessionTitle(s.id, 'fallback title', 'fallback', { expectOrigin: ['placeholder'] }); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 258 | assert.equal(untitled?.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 259 | assert.equal(empty?.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 272 | assert.equal(again.getSession('legacy-untitled')?.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 315 | assert.equal(recovered.getSession('half-untitled')?.title_origin, 'placeholder'); | CODE |
| LOW | src/__tests__/unit/session-title-provenance.test.ts | 326 | for (const origin of ['placeholder', 'fallback', 'generated', 'manual', 'system', 'import'] as const) { | CODE |
| LOW | src/__tests__/e2e/chat.spec.ts | 67 | const placeholder = await input.getAttribute('placeholder'); | CODE |
| LOW | src/__tests__/e2e/chat-enhanced.spec.ts | 145 | const placeholder = await input.getAttribute('placeholder'); | CODE |
| LOW | src/lib/db.ts | 789 | // ALTER ... DEFAULT 'placeholder' would silently stamp every legacy row | COMMENT |
| LOW | src/lib/db.ts | 799 | // 'New Chat' / '' → 'placeholder': never had a real title, so the next | COMMENT |
| LOW | src/lib/db.ts | 2310 | * caller that passed no title gets 'placeholder' (a fallback may fill it | COMMENT |
| LOW | src/lib/db.ts | 811 | SET title_origin = CASE WHEN title = '' OR title = 'New Chat' THEN 'placeholder' ELSE 'manual' END | CODE |
| LOW | src/lib/db.ts | 2324 | const originValue: TitleOrigin = titleOrigin ?? (title ? 'manual' : 'placeholder'); | CODE |
| LOW | src/lib/conversation-title.ts | 24 | | 'placeholder' | CODE |
| LOW | src/lib/conversation-title.ts | 37 | 'placeholder', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/components/layout/panels/PreviewPanel.tsx | 330 | // because that's the common case for previewing AI-generated | COMMENT |
| HIGH | src/components/cli-tools/CliToolsManager.tsx | 144 | // displayName + id + AI-generated description (extra/custom). The | COMMENT |
| HIGH | src/__tests__/unit/inline-html-csp.test.ts | 85 | // Codex review finding: AI-generated HTML / code fence content | COMMENT |
| HIGH | src/lib/claude-client.ts | 2275 | // only to CodePilot's transcript payload as requested-model | COMMENT |
| HIGH | src/lib/inline-html-csp.ts | 41 | // https://...img.png from an AI-generated artifact is allowed; the | COMMENT |
| HIGH | src/lib/db.ts | 1306 | // CLI tools: persisted AI-generated descriptions | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/__tests__/unit/harness-extension-fragment.test.ts | 100 | assert.match(out, /## Your harness extensions/); | CODE |
| MEDIUM | src/__tests__/unit/harness-extension-fragment.test.ts | 178 | /## Your harness extensions/.test(base.systemPromptAppend), | CODE |
| MEDIUM | src/__tests__/unit/harness-extension-fragment.test.ts | 192 | assert.match(out.systemPromptAppend, /## Your harness extensions/); | CODE |
| MEDIUM | src/__tests__/unit/heartbeat-copy-honesty.test.ts | 53 | // bundles are flat key→string objects, so this is robust enough. | COMMENT |
| MEDIUM | …/__tests__/unit/codex-builtin-no-anti-patterns.test.ts | 101 | // This guard is more nuanced: OPENAI_API_KEY may legitimately be | COMMENT |
| MEDIUM | src/__tests__/unit/session-runtime-immunity.test.ts | 983 | // Counting the flag inside dep arrays is the cheapest robust | COMMENT |
| MEDIUM | src/__tests__/unit/context-compressor-handoff.test.ts | 304 | // monotonically increasing per insert, so this is robust even when writes | COMMENT |
| MEDIUM | …ests__/unit/extract-token-usage-context-window.test.ts | 92 | // faster and more robust. | COMMENT |
| MEDIUM | src/lib/harness/runtime-adapter.ts | 160 | * ## Your harness extensions | COMMENT |
| MEDIUM | src/lib/harness/runtime-adapter.ts | 203 | const lines: string[] = ['## Your harness extensions', '']; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/research/sub-agent-system.md | 414 | // 4. 执行 agentic loop | COMMENT |
| MEDIUM | …plans/completed/context-accounting-runtime-contract.md | 498 | - 2026-05-20（**v4 P2 deferred → tech-debt #22**）：selectedSkills 仍是 `readonly string[]`。同名 skill 在 project + global 重复时按 | CODE |
| MEDIUM | …/exec-plans/active/development-harness-optimization.md | 217 | ### Step 4 — 把"必读"扩到 guardrails/ 八类高风险入口 🔄 部分完成 | COMMENT |
| MEDIUM | src/components/settings/UsageStatsSection.tsx | 232 | // Derive cost-by-day series — same date scaffold as the bar chart so | COMMENT |
| MEDIUM | src/components/chat/RunCockpit.tsx | 177 | // v0.56.x Phase 2 (#632) — only show a percentage when the context window | COMMENT |
| MEDIUM | src/__tests__/unit/codex-proxy-foundation.test.ts | 424 | // scaffold returned. Codex's HTTP client reads | COMMENT |
| MEDIUM | src/lib/claude-client.ts | 999 | // #632: trust the SDK-reported context window only for a first-party | COMMENT |