Git. Ship. Done - Core
This report summarizes scanner evidence for open-gsd/gsd-core, a JavaScript project with 10,392 GitHub stars. SynthScan examined 295,314 lines of code across 1925 source files, recording 933 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 4.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 839 finding(s).
Are imports declared and package/API names verified? 15 finding(s).
Are wrappers, guards, and repeated structures necessary? 175 finding(s).
Which changes need focused human review? 933 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 933 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | agents/gsd-project-researcher.md | 480 | ## Step 1: Receive Research Scope | COMMENT |
| LOW⚡ | agents/gsd-project-researcher.md | 484 | ## Step 2: Identify Research Domains | COMMENT |
| LOW⚡ | agents/gsd-project-researcher.md | 491 | ## Step 3: Execute Research | COMMENT |
| LOW⚡ | agents/gsd-project-researcher.md | 495 | ## Step 4: Quality Check | COMMENT |
| LOW⚡ | agents/gsd-project-researcher.md | 499 | ## Step 5: Write Output Files | COMMENT |
| LOW | agents/gsd-project-researcher.md | 525 | ## Step 6: Return Structured Result | COMMENT |
| LOW | agents/gsd-debug-session-manager.compact.md | 39 | ## Step 1: Read Debug File | COMMENT |
| LOW | agents/gsd-debug-session-manager.compact.md | 51 | ## Step 2: Spawn gsd-debugger Agent | COMMENT |
| LOW | agents/gsd-debug-session-manager.compact.md | 120 | ## Step 3: Handle Agent Return | COMMENT |
| LOW | agents/gsd-debug-session-manager.compact.md | 286 | ## Step 4: Return Compact Summary | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.md | 78 | ## Step 1: Receive Scope and Load Context | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.md | 86 | ## Step 2: Classify Files | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.md | 95 | ## Step 3: Find Closest Analogs | COMMENT |
| LOW | agents/gsd-pattern-mapper.md | 130 | ## Step 4: Extract Patterns from Analogs | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.md | 151 | ## Step 5: Identify Shared Patterns | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.md | 160 | ## Step 6: Write PATTERNS.md | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.md | 166 | ## Step 7: Return Structured Result | COMMENT |
| LOW | agents/gsd-research-synthesizer.md | 55 | ## Step 1: Read Research Files | COMMENT |
| LOW | agents/gsd-research-synthesizer.md | 74 | ## Step 2: Synthesize Executive Summary | COMMENT |
| LOW | agents/gsd-research-synthesizer.md | 83 | ## Step 3: Extract Key Findings | COMMENT |
| LOW | agents/gsd-research-synthesizer.md | 103 | ## Step 4: Derive Roadmap Implications | COMMENT |
| LOW | agents/gsd-research-synthesizer.md | 122 | ## Step 5: Assess Confidence | COMMENT |
| LOW | agents/gsd-research-synthesizer.md | 133 | ## Step 6: Write SUMMARY.md | COMMENT |
| LOW | agents/gsd-research-synthesizer.md | 153 | ## Step 7: Commit All Research | COMMENT |
| LOW | agents/gsd-research-synthesizer.md | 162 | ## Step 8: Return Summary | COMMENT |
| LOW⚡ | agents/gsd-code-fixer.md | 410 | # Step 2: drop the worktree. If this succeeds and the process is then | COMMENT |
| LOW⚡ | agents/gsd-code-fixer.md | 419 | # Step 3: delete the temp branch ONLY if the fast-forward succeeded. If | COMMENT |
| LOW⚡ | agents/gsd-code-fixer.md | 425 | # Step 4: drop the recovery sentinel ONLY after `git worktree remove` | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.compact.md | 69 | ## Step 1: Receive Scope and Load Context | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.compact.md | 75 | ## Step 2: Classify Files | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.compact.md | 84 | ## Step 3: Find Closest Analogs | COMMENT |
| LOW | agents/gsd-pattern-mapper.compact.md | 103 | ## Step 4: Extract Patterns from Analogs | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.compact.md | 120 | ## Step 5: Identify Shared Patterns | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.compact.md | 124 | ## Step 6: Write PATTERNS.md | COMMENT |
| LOW⚡ | agents/gsd-pattern-mapper.compact.md | 128 | ## Step 7: Return Structured Result | COMMENT |
| LOW | agents/gsd-ui-researcher.md | 269 | ## Step 1: Load Context | COMMENT |
| LOW | agents/gsd-ui-researcher.md | 276 | ## Step 2: Scout Existing UI | COMMENT |
| LOW⚡ | agents/gsd-ui-researcher.md | 294 | ## Step 3: shadcn Gate | COMMENT |
| LOW⚡ | agents/gsd-ui-researcher.md | 299 | ## Step 4: Design Contract Questions | COMMENT |
| LOW⚡ | agents/gsd-ui-researcher.md | 308 | ## Step 5: Compile UI-SPEC.md | COMMENT |
| LOW | agents/gsd-ui-researcher.md | 327 | ## Step 6: Commit (optional) | COMMENT |
| LOW | agents/gsd-ui-researcher.md | 334 | ## Step 7: Return Structured Result | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.md | 204 | ### Step 1: Orientation | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.md | 211 | ### Step 2: Stack Detection | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.md | 219 | ### Step 3: File Graph | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.md | 230 | ### Step 4: API Surface | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.md | 239 | ### Step 5: Dependencies | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.md | 248 | ### Step 6: Architecture | COMMENT |
| LOW | agents/gsd-intel-updater.md | 268 | ### Step 7: Snapshot | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.compact.md | 141 | ### Step 1: Orientation | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.compact.md | 144 | ### Step 2: Stack Detection | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.compact.md | 152 | ### Step 3: File Graph | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.compact.md | 156 | ### Step 4: API Surface | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.compact.md | 159 | ### Step 5: Dependencies | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.compact.md | 162 | ### Step 6: Architecture | COMMENT |
| LOW⚡ | agents/gsd-intel-updater.compact.md | 168 | ### Step 7: Snapshot | COMMENT |
| LOW⚡ | agents/gsd-ui-researcher.compact.md | 149 | ## Step 1: Load Context | COMMENT |
| LOW⚡ | agents/gsd-ui-researcher.compact.md | 152 | ## Step 2: Scout Existing UI | COMMENT |
| LOW⚡ | agents/gsd-ui-researcher.compact.md | 161 | ## Step 3: shadcn Gate | COMMENT |
| LOW⚡ | agents/gsd-ui-researcher.compact.md | 164 | ## Step 4: Design Contract Questions | COMMENT |
| 203 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .coderabbit.yaml | 1 | # CodeRabbit configuration — open-gsd/gsd-core | COMMENT |
| LOW | .coderabbit.yaml | 21 | # checks, line-level findings) which we want to keep. | COMMENT |
| LOW | bin/install.js | 41 | // consentRequired, hostPrecedenceRank) instead of the id being re-derived | COMMENT |
| LOW | bin/install.js | 61 | const { composeWorkflow } = require('../gsd-core/bin/lib/workflow-fragments.cjs'); | COMMENT |
| LOW | bin/install.js | 141 | 'max_threads', | COMMENT |
| LOW | bin/install.js | 181 | const CODEX_HOOKS_FEATURE_ALL_KEYS = [CODEX_HOOKS_FEATURE_KEY, ...CODEX_HOOKS_FEATURE_LEGACY_KEYS]; | COMMENT |
| LOW | bin/install.js | 201 | const GSD_CLAUDE_ALLOW_PERMISSIONS = Object.freeze([ | COMMENT |
| LOW | bin/install.js | 221 | 'Read(.env)', | COMMENT |
| LOW | bin/install.js | 301 | } | COMMENT |
| LOW | bin/install.js | 341 | // sessionStart → gsd-cursor-session-start.js (context injection) | COMMENT |
| LOW | bin/install.js | 381 | // (local) or ~/.codeium/windsurf/hooks.json (global) with the shape | COMMENT |
| LOW | bin/install.js | 401 | const GSD_WINDSURF_HOOK_SCRIPTS = hooksSurface.GSD_WINDSURF_HOOK_SCRIPTS; | COMMENT |
| LOW | bin/install.js | 501 | return name; | COMMENT |
| LOW | bin/install.js | 561 | isAnthropicFlavoredModel: gsdIsAnthropicFlavoredModel, | COMMENT |
| LOW | bin/install.js | 601 | } = require(path.join(_gsdLibDir, 'install-profiles.cjs')); | COMMENT |
| LOW | bin/install.js | 881 | const hasPortableHooks = args.includes('--portable-hooks') || process.env.GSD_PORTABLE_HOOKS === '1'; | COMMENT |
| LOW | bin/install.js | 901 | const hasRelativeIncludes = args.includes('--relative-includes') || process.env.GSD_RELATIVE_INCLUDES === '1'; | COMMENT |
| LOW | bin/install.js | 1041 | // selectRuntimesFromArgs above no longer recognizes it, so it never lands in | COMMENT |
| LOW | bin/install.js | 1121 | // entry. (The prior inner `if (!isGlobal) return "'.agents'"` was unreachable: | COMMENT |
| LOW | bin/install.js | 1241 | // OpenCode always uses the absolute path (#2376 Windows, #2831 macOS/Linux). | COMMENT |
| LOW | bin/install.js | 1261 | // writeKimiHooksToml / removeKimiHooksToml: kimi's native config.toml [[hooks]] | COMMENT |
| LOW | bin/install.js | 1281 | const computePathPrefix = runtimeArtifactConversion._computePathPrefix; | COMMENT |
| LOW | bin/install.js | 1501 | // readGsdEffectiveModelOverrides / readGsdRuntimeProfileResolver, plus the | COMMENT |
| LOW | bin/install.js | 2621 | // #2931 (ADR-1508): single-sourced in runtimeArtifactConversion, bound near | COMMENT |
| LOW | bin/install.js | 2661 | // consumes only the instruction-filename tail, leaving that prefix stale | COMMENT |
| LOW | bin/install.js | 2681 | // trace above): `copyWithPathReplacement` runs a GENERIC dot-claude-slash | COMMENT |
| LOW | bin/install.js | 2941 | // ── End Cline converters ───────────────────────────────────────────────────── | COMMENT |
| LOW | bin/install.js | 2961 | // | COMMENT |
| LOW | bin/install.js | 3701 | COMMENT | |
| LOW | bin/install.js | 3761 | COMMENT | |
| LOW | bin/install.js | 3801 | converted = converted.replace(/\/clear\s*,?\s*then:?\s*\n?/gi, ''); | COMMENT |
| LOW | bin/install.js | 4081 | */ | COMMENT |
| LOW | bin/install.js | 4101 | // parsing of its own (no third copy of that extraction) — it takes the | COMMENT |
| LOW | bin/install.js | 4121 | const lines = [ | COMMENT |
| LOW | bin/install.js | 4161 | } | COMMENT |
| LOW | bin/install.js | 4181 | _warnCodexResolverModelOmitted(); | COMMENT |
| LOW | bin/install.js | 5281 | // ≥0.124 — purging is the only path to a loadable config. | COMMENT |
| LOW | bin/install.js | 5481 | ); | COMMENT |
| LOW | bin/install.js | 5841 | // regex uses (?:_?\d)* rather than [\d_]* so `1__0`, `1_.0`, and `1._0` | COMMENT |
| LOW | bin/install.js | 5881 | */ | COMMENT |
| LOW | bin/install.js | 6461 | const normalizedGsdBlock = mergedGsdBlock.replace(/\r?\n/g, eol); | COMMENT |
| LOW | bin/install.js | 6481 | // post-marker region is passed through stripLeakedGsdCodexSections: GSD's own previously- | COMMENT |
| LOW | bin/install.js | 6801 | // ── Cline directory-form rules + hooks + AGENTS.md (issue #787) ──────────────── | COMMENT |
| LOW | bin/install.js | 6861 | // Location: | COMMENT |
| LOW | bin/install.js | 7041 | ) { | COMMENT |
| LOW | bin/install.js | 7061 | // | COMMENT |
| LOW | bin/install.js | 7081 | // Compute the Codex GSD install path (absolute, so subagents with empty $HOME work — #820) | COMMENT |
| LOW | bin/install.js | 7101 | // $ARGUMENTS → {{GSD_ARGS}}, /clear removal, anchored and bare .claude/ | COMMENT |
| LOW | bin/install.js | 7121 | COMMENT | |
| LOW | bin/install.js | 7521 | COMMENT | |
| LOW | bin/install.js | 7861 | // BEFORE any per-runtime rewrite so a `.claude/` -> `.windsurf/` regex | COMMENT |
| LOW | bin/install.js | 7881 | // #3072: the scoping predicate itself now lives in ONE place — | COMMENT |
| LOW | bin/install.js | 7901 | // (`${CLAUDE_CONFIG_DIR:-$HOME/.claude}/gsd-core/bin/...`, one per | COMMENT |
| LOW | bin/install.js | 7921 | // is satisfied by ANY non-word character, including '-' — so for a | COMMENT |
| LOW | bin/install.js | 8281 | COMMENT | |
| LOW | bin/install.js | 8321 | // runtimeLabel is now the single-source getRuntimeLabel lookup (ADR-1239 | COMMENT |
| LOW | bin/install.js | 8661 | // Remove legacy commands/gsd/ subdirectory if it still exists (pre-#1367 layout). | COMMENT |
| LOW | bin/install.js | 8701 | } | COMMENT |
| LOW | bin/install.js | 8721 | // recoverOrphanedUserArtifacts on the next run. | COMMENT |
| LOW | bin/install.js | 8741 | // symlinked user artifact is recreated AS a symlink in the staging | COMMENT |
| 353 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | bin/install.js | 2941 | // ── End Cline converters ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bin/install.js | 2943 | // ── Hermes converters (#2284) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bin/install.js | 2943 | // ── Hermes converters (#2284) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bin/install.js | 13876 | // ─── Update banner (#2795) ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bin/install.js | 13876 | // ─── Update banner (#2795) ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 2867 | // ── Cline converters ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 3760 | // ── End Hermes converters ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 6801 | // ── Cline directory-form rules + hooks + AGENTS.md (issue #787) ──────────────── | COMMENT |
| MEDIUM | bin/install.js | 6801 | // ── Cline directory-form rules + hooks + AGENTS.md (issue #787) ──────────────── | COMMENT |
| MEDIUM | bin/install.js | 6851 | // ── Cursor hooks.json reconciler (issue #777) ──────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 6851 | // ── Cursor hooks.json reconciler (issue #777) ──────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 9764 | // ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 9766 | // ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bin/install.js | 12835 | // ── Codex extended hook events (#772, #2088) — REMOVED by #2586 ────── | COMMENT |
| MEDIUM | bin/install.js | 12835 | // ── Codex extended hook events (#772, #2088) — REMOVED by #2586 ────── | COMMENT |
| MEDIUM | bin/install.js | 12870 | // ── end Codex extended hook events ──────────────────────────────────── | COMMENT |
| MEDIUM | .opencode/plugins/gsd-core.js | 17 | * ── Two distribution shapes, one adapter (issue #1914) ───────────────────── | COMMENT |
| MEDIUM | .opencode/plugins/gsd-core.js | 538 | // ── Config: register commands / agents / skills paths ────────────── | COMMENT |
| MEDIUM | .opencode/plugins/gsd-core.js | 587 | // ── shell.env ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .opencode/plugins/gsd-core.js | 593 | // ── tool.execute.before — PreToolUse hooks ───────────────────────── | COMMENT |
| MEDIUM | .opencode/plugins/gsd-core.js | 672 | // ── tool.execute.after — PostToolUse hooks ───────────────────────── | COMMENT |
| MEDIUM | .opencode/plugins/gsd-core.js | 731 | // ── experimental.session.compacting — PreCompact ─────────────────── | COMMENT |
| MEDIUM | .opencode/plugins/gsd-core.js | 749 | // ── General event subscriptions ───────────────────────────────────── | COMMENT |
| MEDIUM | .kilo/plugins/gsd-core.js | 17 | * ── Two distribution shapes, one adapter (issue #1914) ───────────────────── | COMMENT |
| MEDIUM | .kilo/plugins/gsd-core.js | 538 | // ── Config: register commands / agents / skills paths ────────────── | COMMENT |
| MEDIUM | .kilo/plugins/gsd-core.js | 587 | // ── shell.env ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .kilo/plugins/gsd-core.js | 593 | // ── tool.execute.before — PreToolUse hooks ───────────────────────── | COMMENT |
| MEDIUM | .kilo/plugins/gsd-core.js | 672 | // ── tool.execute.after — PostToolUse hooks ───────────────────────── | COMMENT |
| MEDIUM | .kilo/plugins/gsd-core.js | 731 | // ── experimental.session.compacting — PreCompact ─────────────────── | COMMENT |
| MEDIUM | .kilo/plugins/gsd-core.js | 749 | // ── General event subscriptions ───────────────────────────────────── | COMMENT |
| MEDIUM | docs/TESTING-SUITES.md | 67 | // ──────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/TESTING-SUITES.md | 69 | // ──────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ers/plans/2026-03-18-materialize-new-project-config.md | 82 | // ─── config-new-project ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ers/plans/2026-03-18-materialize-new-project-config.md | 82 | // ─── config-new-project ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | hooks/gsd-cursor-subagent-start.js | 354 | // ─── #3897 rung 2: per-install runtime marker, single canonical owner ──────── | COMMENT |
| MEDIUM | hooks/gsd-cursor-subagent-start.js | 354 | // ─── #3897 rung 2: per-install runtime marker, single canonical owner ──────── | COMMENT |
| MEDIUM | hooks/gsd-agent-isolation-guard.js | 123 | // ─── #3897 rung 2: per-install runtime marker, single canonical owner ──────── | COMMENT |
| MEDIUM | hooks/gsd-agent-isolation-guard.js | 123 | // ─── #3897 rung 2: per-install runtime marker, single canonical owner ──────── | COMMENT |
| MEDIUM | scripts/secret-scan-lint.sh | 37 | # ─── Argument Parsing ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/secret-scan-lint.sh | 78 | # ─── Date Helpers ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/secret-scan-lint.sh | 94 | # ─── Annotation Parser ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/secret-scan-lint.sh | 120 | # ─── Main Lint Logic ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/secret-scan-lint.sh | 149 | # ── Case 1: No preceding comment at all ──────────────────────────────────── | COMMENT |
| MEDIUM | scripts/secret-scan-lint.sh | 216 | # ─── Summary ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/base64-scan.sh | 20 | # ─── Exit-code registry (ADR-3889, #3908) ──────────────────────────────────── | COMMENT |
| MEDIUM | scripts/base64-scan.sh | 35 | # ── Locale hardening (#116) ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/base64-scan.sh | 103 | # ─── Injection Patterns (decoded content) ──────────────────────────────────── | COMMENT |
| MEDIUM | scripts/base64-scan.sh | 127 | # ─── Ignorelist ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/base64-scan.sh | 156 | # ─── Skip Rules ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/base64-scan.sh | 191 | # ─── File Collection ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/base64-scan.sh | 271 | # ─── Scanner ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/base64-scan.sh | 365 | # ─── Main ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/prompt-injection-scan.sh | 17 | # ─── Exit-code registry (ADR-3889, #3908) ──────────────────────────────────── | COMMENT |
| MEDIUM | scripts/prompt-injection-scan.sh | 32 | # ─── Patterns ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/prompt-injection-scan.sh | 113 | # ─── Allowlist ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/prompt-injection-scan.sh | 212 | # ─── File Collection ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/prompt-injection-scan.sh | 292 | # ─── Scanner ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/prompt-injection-scan.sh | 321 | # ─── Main ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/secret-scan.sh | 44 | # ─── Exit-code registry (ADR-3889, #3908) ──────────────────────────────────── | COMMENT |
| MEDIUM | scripts/secret-scan.sh | 59 | # ─── Global mode flag ───────────────────────────────────────────────────────── | COMMENT |
| 19 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | CONTEXT.md | 30 | Module owning phase-effort estimation and its calibration against measured reality (ADR-2629, epic #1952). Pure — no I/O | CODE |
| MEDIUM | CONTEXT.md | 97 | Generic, dependency-free greedy first-fit file-overlap partitioner (#3674), extracted from `claude-orchestration.cts`'s | CODE |
| MEDIUM | CONTEXT.md | 421 | Generated description of what the five-step loop (Discuss → Plan → Execute → Verify → Ship) exposes as extension points: | CODE |
| MEDIUM | CONTEXT.md | 439 | Human-facing discoverability catalog (`docs/registries/eos-registry.md`, generated from `docs/registries/eos.json`; issu | CODE |
| MEDIUM | CONTEXT.md | 468 | Default-off, BETA, claude-only Capability (`capabilities/claude-orchestration/`, `role: feature`, `runtimeCompat.support | CODE |
| MEDIUM | CONTEXT.md | 1012 | `SESSION.2026-05-16=[multi-PR triage wave (#3577/3581/3640/3641/3642/3648/3649/3637/3639). Established global PreToolUse | CODE |
| MEDIUM | CHANGELOG.md | 1199 | - **A default-off, BETA, claude-only "Claude orchestration" capability** — adopts Claude Code's Workflow tool (`/effort | CODE |
| MEDIUM | CHANGELOG.md | 1343 | - **`phase.add` no longer silently mistakes a goal-shaped description for a phase title** — a long or multi-sentence des | CODE |
| MEDIUM | CHANGELOG.md | 1474 | - **A default-off, BETA, claude-only "Claude orchestration" capability** — adopts Claude Code's Workflow tool (`/effort | CODE |
| MEDIUM | capabilities/claude-orchestration/capability.json | 6 | "description": "Default-off, BETA, claude-only capability that adopts Claude Code's Workflow tool (the engine behind / | CODE |
| MEDIUM | …pabilities/claude-orchestration/fragments/plan-post.md | 1 | # Claude orchestration — ultraplan plan-offload ownership (BETA) | COMMENT |
| MEDIUM | …claude-orchestration/docs/workflow-backend-dispatch.md | 1 | # Claude orchestration — Workflow execution backend (BETA) | COMMENT |
| MEDIUM | …geset/archived/3806-cjs-bundle-drift-w005-w006-i001.md | 5 | **`validate health` no longer emits W005/W006/I001 false positives for multi-digit phase prefixes, milestone-archive pha | CODE |
| MEDIUM | .changeset/archived/help-passthrough.md | 5 | **`gsd-sdk query <subcommand> --help` now reaches the handler instead of returning top-level usage.** The query argv par | CODE |
| MEDIUM | docs/CONTEXT-INDEX.json | 1432 | "value": "[multi-PR triage wave (#3577/3581/3640/3641/3642/3648/3649/3637/3639). Established global PreToolUse hoo | CODE |
| MEDIUM | docs/contributor-standards.md | 126 | **1. In-place dated section (the default; use this first).** For an addition that stays within the ADR's existing decisi | CODE |
| MEDIUM | docs/INVENTORY.md | 580 | | `file-overlap-partitioner.cjs` | Generic greedy first-fit file-overlap partitioner (#3674) — `partitionByFileOverlap(i | CODE |
| MEDIUM | docs/CONFIGURATION.md | 511 | | `workflow.smart_zone_tokens` | number | `100000` | Smart-zone token budget for phase-effort estimation (#2630, [ADR-26 | CODE |
| MEDIUM | docs/CONFIGURATION.md | 519 | | `workflow.compact_content` | boolean | `false` | Compact content mode (#4139, [ADR-4139](adr/4139-compact-content-seam | CODE |
| MEDIUM | docs/whats-new-1.7.0.md | 57 | - A default-off, BETA, Claude-only **Claude orchestration capability** that adopts Claude Code's Workflow tool (#1143) — | CODE |
| MEDIUM | docs/FEATURES.md | 43 | - [Multi-Agent Orchestration](#25-multi-agent-orchestration) | CODE |
| MEDIUM | docs/FEATURES.md | 43 | - [Multi-Agent Orchestration](#25-multi-agent-orchestration) | CODE |
| MEDIUM | docs/FEATURES.md | 162 | - [Issue-Driven Orchestration Guide](#129-issue-driven-orchestration-guide) | CODE |
| MEDIUM | docs/FEATURES.md | 184 | - [Embeddable Orchestration System (Host-Integration Interface)](#149-embeddable-orchestration-system-host-integration | CODE |
| MEDIUM | docs/FEATURES.md | 189 | - [Claude Orchestration Capability (BETA)](#154-claude-orchestration-capability-beta) | CODE |
| MEDIUM | docs/AGENTS.md | 811 | - **Extraction discipline (#1578):** few-shot input→output exemplars plus a terminal schema restatement; marks a field a | CODE |
| MEDIUM | docs/AGENTS.md | 831 | - **Extraction discipline (#1578):** few-shot exemplars plus a terminal schema restatement and a mark-absent (no-fabrica | CODE |
| MEDIUM | docs/adr/1671-dynamic-context-management-platform.md | 51 | *The grounds are this ADR's own, not a borrowed citation.* MCP is runtime-partial (see **External practice** above, o | COMMENT |
| MEDIUM | docs/adr/550-spec-phase-probe-contract.md | 112 | > **PR-review flag — PROPOSED, renamable conventions (zero live consumers).** Both **`GSD_PROHIB_SUBJECT`** and **`Check | CODE |
| MEDIUM | docs/adr/1239-gsd-embeddable-orchestration-engine.md | 388 | - **Phase 2 — the shared file-overlap wave partitioner.** [#3674](https://github.com/open-gsd/gsd-core/issues/3674). Beh | CODE |
| MEDIUM | docs/adr/1143-claude-orchestration-capability.md | 1 | # ADR-1143: Claude orchestration capability — Workflow tool (ultracode) as a runtime-gated loop execution backend [Propo | COMMENT |
| MEDIUM | docs/adr/1143-claude-orchestration-capability.md | 12 | Confirmed shipped, on-tree: the capability is real and registered, not vaporware. `capabilities/claude-orchestration/cap | CODE |
| MEDIUM | docs/adr/1143-claude-orchestration-capability.md | 134 | ## Amendment (2026-09-14): the `execute:wave:*` contribution is removed — orchestration is not an agent contribution | COMMENT |
| MEDIUM | …adr/443-opus48-unified-effort-and-fast-mode-routing.md | 17 | **The maintainer call above has been made: path (a).** Raised by #2475 — reviewer CLIs invoked as subprocesses by the re | CODE |
| MEDIUM | …adr/443-opus48-unified-effort-and-fast-mode-routing.md | 46 | **Why the original (b) wording does not fit, and what replaces it.** The unblock condition offered (b) as *"if the ADR's | CODE |
| MEDIUM | …adr/443-opus48-unified-effort-and-fast-mode-routing.md | 50 | **Why no consumer was invented to satisfy the gate.** The unblock condition is a proxy for design maturity; wiring a cal | CODE |
| MEDIUM | docs/explanation/multi-agent-orchestration.md | 1 | # Multi-agent orchestration in GSD Core | COMMENT |
| MEDIUM | docs/explanation/claude-orchestration-capability.md | 1 | # Claude orchestration capability (BETA) | COMMENT |
| MEDIUM | …how-to/enable-claude-orchestration-workflow-backend.md | 1 | # How to enable and use the Claude orchestration backend (BETA) | COMMENT |
| MEDIUM | docs/ja-JP/FEATURES.md | 154 | - [issue-driven-orchestration ガイド](#129-issue-driven-orchestration-ガイド) | CODE |
| MEDIUM | docs/ja-JP/FEATURES.md | 2757 | ### 129. issue-driven-orchestration ガイド | COMMENT |
| MEDIUM | docs/zh-CN/FEATURES.md | 37 | - [多智能体编排](#25-multi-agent-orchestration) | CODE |
| MEDIUM | docs/zh-CN/FEATURES.md | 37 | - [多智能体编排](#25-multi-agent-orchestration) | CODE |
| MEDIUM | docs/zh-CN/FEATURES.md | 154 | - [Issue 驱动编排指南](#129-issue-driven-orchestration-guide) | CODE |
| MEDIUM | docs/ko-KR/FEATURES.md | 37 | - [멀티 에이전트 오케스트레이션](#25-multi-agent-orchestration) | CODE |
| MEDIUM | docs/ko-KR/FEATURES.md | 37 | - [멀티 에이전트 오케스트레이션](#25-multi-agent-orchestration) | CODE |
| MEDIUM | examples/dynamic-context-management/CONTEXT-INDEX.json | 1712 | "value": "[multi-PR triage wave (#3577/3581/3640/3641/3642/3648/3649/3637/3639). Established global PreToolUse hoo | CODE |
| MEDIUM | .github/workflows/dismiss-unauthorized-pr-approvals.yml | 9 | # approves them — so the event-driven path never fires for the very | COMMENT |
| MEDIUM | gsd-core/references/worktree-path-safety.md | 201 | # scaffold — is normalized lexically and must still PASS when it sits under the worktree. Never | COMMENT |
| MEDIUM | gsd-core/references/planning-config.md | 287 | | `workflow.smart_zone_tokens` | number | `100000` | Any positive integer | Smart-zone token budget for phase-effort est | CODE |
| MEDIUM | gsd-core/workflows/plan-phase.md | 102 | **#2401 — `prior_verify_commands` is NOT part of that enrichment and is never gated on `CONTEXT_WINDOW`.** It is a handf | CODE |
| MEDIUM | gsd-core/workflows/plan-phase.md | 104 | Parse JSON for: `researcher_model`, `planner_model`, `checker_model`, `research_enabled`, `plan_checker_enabled`, `nyqui | CODE |
| MEDIUM | gsd-core/workflows/fast.md | 61 | # fast writes no planning artifacts (its own guardrails forbid PLAN.md/SUMMARY.md); .planning/ | COMMENT |
| MEDIUM | gsd-core/workflows/ingest-docs.md | 269 | **Routing gate (#3827): approval to classify documents is not approval to write the planning scaffold.** Before delegati | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | bin/install.js | 13883 | function buildUpdateBannerPromptText() { | CODE |
| LOW | bin/install.js | 105 | function shouldNormalizeHyphenNamespaceInAgentBody(runtime) { | CODE |
| LOW | bin/install.js | 116 | function normalizeAgentBodyForRuntime(content, runtime, cmdNames) { | CODE |
| LOW | bin/install.js | 480 | function resolveSharedHooksDirName(runtime) { | CODE |
| LOW | bin/install.js | 1303 | function rewriteLegacyManagedNodeHookCommands(settings, absoluteRunner, opts) { | CODE |
| LOW | bin/install.js | 1343 | function ensureCodexHooksJsonSessionStart(targetDir, opts = {}) { | CODE |
| LOW | bin/install.js | 1359 | function removeCodexHooksJsonEvent(targetDir, eventName) { | CODE |
| LOW | bin/install.js | 1363 | function removeCodexHooksJsonSessionStart(targetDir) { | CODE |
| LOW | bin/install.js | 1387 | function resolveOpencodeConfigPath(configDir) { | CODE |
| LOW | bin/install.js | 1672 | function convertAntigravityToolName(claudeTool) { | CODE |
| LOW | bin/install.js | 1727 | function mapClaudeToolsToKimiTools(claudeTools, options = {}) { | CODE |
| LOW | bin/install.js | 1799 | function convertClaudeToKiloPermissionTool(claudeTool) { | CODE |
| LOW | bin/install.js | 1807 | function buildKiloAgentPermissionBlock(claudeTools) { | CODE |
| LOW | bin/install.js | 1829 | function replaceRelativePathReference(content, fromPath, toPath) { | CODE |
| LOW | bin/install.js | 1867 | function convertClaudeToCopilotContent(content, isGlobal = false) { | CODE |
| LOW | bin/install.js | 1897 | function convertClaudeCommandToCopilotSkill(content, skillName, _runtime = null, _cmdNames = null, isGlobal = false) { | CODE |
| LOW | bin/install.js | 1990 | function convertClaudeCommandToClaudeSkill(content, skillName, runtime = null, cmdNames = null) { | CODE |
| LOW | bin/install.js | 2071 | function convertGsdCommandReferencesToKimiSkillInvocations(content, cmdNames) { | CODE |
| LOW | bin/install.js | 2091 | function convertClaudeCommandToKimiSkill(content, skillName, _runtime = null, cmdNames = null) { | CODE |
| LOW | bin/install.js | 2173 | function mapKimiAgentContractTools(toolNames, diagnostics, sourceName) { | CODE |
| LOW | bin/install.js | 2179 | function neutralizeKimiAgentPrompt(content) { | CODE |
| LOW | bin/install.js | 2361 | function convertClaudeAgentToCopilotAgent(content, isGlobal = false) { | CODE |
| LOW | bin/install.js | 2399 | function convertClaudeToAntigravityContent(content, isGlobal = false) { | CODE |
| LOW | bin/install.js | 2442 | function convertClaudeCommandToAntigravitySkill(content, skillName, _runtime = null, _cmdNames = null, isGlobal = false) | CODE |
| LOW | bin/install.js | 2460 | function convertClaudeAgentToAntigravityAgent(content, isGlobal = false) { | CODE |
| LOW | bin/install.js | 2505 | function extractFrontmatterAndBody(content) { | CODE |
| LOW | bin/install.js | 2524 | function convertSlashCommandsToCursorSkillMentions(content) { | CODE |
| LOW | bin/install.js | 2530 | function convertClaudeToCursorMarkdown(content) { | CODE |
| LOW | bin/install.js | 2554 | function getCursorSkillAdapterHeader(skillName) { | CODE |
| LOW | bin/install.js | 2580 | function convertClaudeCommandToCursorSkill(content, skillName) { | CODE |
| LOW | bin/install.js | 2606 | function convertClaudeAgentToCursorAgent(content) { | CODE |
| LOW | bin/install.js | 2645 | function convertSlashCommandsToTraeSkillMentions(content) { | CODE |
| LOW | bin/install.js | 2651 | function convertClaudeToTraeMarkdown(content) { | CODE |
| LOW | bin/install.js | 2731 | function convertClaudeCommandToTraeSkill(content, skillName) { | CODE |
| LOW | bin/install.js | 2757 | function convertClaudeAgentToTraeAgent(content) { | CODE |
| LOW | bin/install.js | 2771 | function convertSlashCommandsToCodebuddySkillMentions(content) { | CODE |
| LOW | bin/install.js | 2777 | function convertClaudeToCodebuddyMarkdown(content) { | CODE |
| LOW | bin/install.js | 2796 | function convertClaudeCommandToCodebuddySkill(content, skillName) { | CODE |
| LOW | bin/install.js | 2832 | function convertClaudeCommandToCodebuddyCommand(content, commandName) { | CODE |
| LOW | bin/install.js | 2853 | function convertClaudeAgentToCodebuddyAgent(content) { | CODE |
| LOW | bin/install.js | 2869 | function convertClaudeToCliineMarkdown(content) { | CODE |
| LOW | bin/install.js | 2892 | function convertClaudeAgentToClineAgent(content) { | CODE |
| LOW | bin/install.js | 2912 | function convertClaudeCommandToClineSkill(content, skillName, runtime = null, cmdNames = null) { | CODE |
| LOW | bin/install.js | 3589 | function projectNamedDispatchToStructuralDelegate(content, dispatch, toolConfig) { | CODE |
| LOW | bin/install.js | 3742 | function convertClaudeToHermesMarkdown(content, ctx) { | CODE |
| LOW | bin/install.js | 3762 | function convertSlashCommandsToCodexSkillMentions(content) { | CODE |
| LOW | bin/install.js | 3786 | function rewriteBareGsdToolsCommandsForCodex(content) { | CODE |
| LOW | bin/install.js | 3794 | function convertClaudeToCodexMarkdown(content) { | CODE |
| LOW | bin/install.js | 3828 | function getCodexSkillAdapterHeader(skillName) { | CODE |
| LOW | bin/install.js | 3958 | function convertClaudeCommandToCodexSkill(content, skillName) { | CODE |
| LOW | bin/install.js | 3980 | function convertClaudeAgentToCodexAgent(content) { | CODE |
| LOW | bin/install.js | 4264 | function cleanupCodexSkillMetadataSidecars(skillsDir) { | CODE |
| LOW | bin/install.js | 4310 | function cleanupWindsurfLegacyDevinSkills(workspaceDir) { | CODE |
| LOW | bin/install.js | 4365 | function cleanupMovedSkillsOldLocation(oldSkillsDir, prefix) { | CODE |
| LOW | bin/install.js | 4475 | function extractCodexUserAgentsScalars(content) { | CODE |
| LOW | bin/install.js | 4523 | function stripCodexGsdAgentSections(content) { | CODE |
| LOW | bin/install.js | 4738 | function findMultilineBasicStringClose(line, startIndex) { | CODE |
| LOW | bin/install.js | 4755 | function advanceTomlMultilineStringState(line, multilineState) { | CODE |
| LOW | bin/install.js | 5129 | function stripCodexHooksFeatureAssignments(content, ownership = null) { | CODE |
| LOW | bin/install.js | 5207 | function getManagedCodexHooksOwnership(content) { | CODE |
| 36 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | agents/gsd-plan-checker.md | 432 | - `"future enhancement"`, `"placeholder"`, `"basic version"`, `"minimal"` | CODE |
| LOW | agents/gsd-executor.md | 713 | - Placeholder text: "not available", "coming soon", "placeholder", "TODO", "FIXME" | CODE |
| LOW | agents/gsd-planner.md | 83 | - "future enhancement", "placeholder", "basic version", "minimal implementation" | CODE |
| LOW | docs/FEATURES.md | 3037 | - REQ-SKETCH-04: Sketches MUST use real-ish content, not lorem ipsum | CODE |
| LOW | docs/features/sketch-command.md | 15 | - REQ-SKETCH-04: Sketches MUST use real-ish content, not lorem ipsum | CODE |
| LOW | docs/ja-JP/FEATURES.md | 2536 | - REQ-SKETCH-04: スケッチはリアルに近いコンテンツを使用しなければならない（ lorem ipsum ではない） | CODE |
| LOW | docs/zh-CN/FEATURES.md | 2552 | - REQ-SKETCH-04：Sketch 必须使用真实感内容，而非 lorem ipsum | CODE |
| LOW | docs/zh-CN/references/verification-patterns.md | 34 | grep -E "placeholder|lorem ipsum|coming soon|under construction" "$file" -i | CODE |
| LOW | docs/zh-CN/references/verification-patterns.md | 70 | grep -E "return.*<" "$component_path" | grep -v "return.*null" | grep -v "placeholder" -i | CODE |
| LOW | gsd-core/references/verification-patterns.md | 34 | grep -E "placeholder|lorem ipsum|coming soon|under construction" "$file" -i | CODE |
| LOW | gsd-core/references/verification-patterns.md | 70 | grep -E "return.*<" "$component_path" | grep -v "return.*null" | grep -v "placeholder" -i | CODE |
| LOW | gsd-core/references/planner-antipatterns.md | 92 | - "future enhancement", "placeholder", "basic version", "minimal implementation" | CODE |
| LOW | gsd-core/workflows/sketch.md | 238 | - Real-ish content, not lorem ipsum (use real field names from spike context if available) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | hooks/gsd-agent-isolation-guard.js | 348 | // #4734: a harness worktree can never be created in a directory that is not | COMMENT |
| MEDIUM | .github/workflows/release.yml | 650 | # and a nested reusable workflow can only downgrade, never elevate. | COMMENT |
| MEDIUM | .github/workflows/test.yml | 248 | # see tests/run-tests-harness.test.cjs's "selectShard reserved-weight | COMMENT |
| MEDIUM | .github/workflows/test.yml | 324 | # #4070 (see tests/run-tests-harness.test.cjs's "selectShard | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/zh-CN/references/verification-patterns.md | 330 | DATABASE_URL=your-database-url-here | CODE |
| HIGH | gsd-core/references/verification-patterns.md | 343 | DATABASE_URL=your-database-url-here | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | hooks/lib/gsd-graphify-rebuild.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/secret-scan-lint.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/base64-scan.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/setup-branch-protection.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/prompt-injection-scan.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/secret-scan.sh | 4 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | gsd-core/references/few-shot-examples/verifier.md | 109 | **Why this is bad:** The verifier stopped at Level 1. The file has 142 lines but could contain `// TODO: implement all c | CODE |
| LOW | gsd-core/templates/verification-report.md | 86 | | src/app/api/chat/route.ts | 12 | `// TODO: implement` | ⚠️ Warning | Indicates incomplete | | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/base64-scan.sh | 331 | # Check if decoded content is mostly printable text (not random binary) | COMMENT |