Self-hosted TypeScript agent runtime with durable approvals and verifiable run records. Own it, approve it, audit it.
This report summarizes scanner evidence for open-multi-agent/open-multi-agent, a TypeScript project with 7,039 GitHub stars. SynthScan examined 154,708 lines of code across 574 source files, recording 279 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 2.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 244 finding(s).
Are imports declared and package/API names verified? 29 finding(s).
Are wrappers, guards, and repeated structures necessary? 114 finding(s).
Which changes need focused human review? 279 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 279 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/core/tests/process-backend-lifecycle.test.ts | 78 | function exitedParentDescendantScript(markerPath: string): string { | CODE |
| LOW | packages/core/tests/tool-result-compression.test.ts | 54 | function buildErrorRegistryAndExecutor(): { registry: ToolRegistry; executor: ToolExecutor } { | CODE |
| LOW | packages/core/tests/tool-result-compression.test.ts | 70 | function extractToolResultContents(messages: LLMMessage[]): string[] { | CODE |
| LOW | packages/core/tests/checkpoint.test.ts | 121 | async function deleteNonCheckpointEntries(store: MemoryStore): Promise<void> { | CODE |
| LOW | packages/core/tests/structured-output.test.ts | 212 | function buildMockAgentWithAdapter(config: AgentConfig, adapter: LLMAdapter): Agent { | CODE |
| LOW | packages/core/tests/journal-context-replace.test.ts | 106 | function expectDerivedBlocksReproduce( | CODE |
| LOW | packages/core/tests/helpers/eval-store-contract.ts | 74 | export function runEvalStoreContractSuite( | CODE |
| LOW | packages/core/tests/helpers/trace-store-contract.ts | 90 | export function runTraceStoreContractSuite(name: string, createStore: TraceStoreContractFactory): void { | CODE |
| LOW | packages/core/tests/helpers/memory-store-contract.ts | 69 | export function runMemoryStoreContractSuite( | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 396 | function extractGithubRepoFullNames(value: unknown): string[] { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 425 | function textContainsNormalizedPhrase(text: string, phrase: string): boolean { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 453 | function nonOfficialClaimNearTarget(text: string, target: string | undefined): boolean { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 572 | function normalizeDatasetCandidate(raw: string, evidenceKind: DatasetEvidenceKind): string | undefined { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 625 | function datasetEvidenceBaseConfidence(evidenceKind: DatasetEvidenceKind): number { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 640 | function datasetEvidenceConfidence( | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 658 | function makeDatasetCandidateEvidence( | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 675 | function extractDatasetCandidateEvidenceFromText( | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 701 | function extractDatasetCandidateEvidenceFromPaths(paths: string[]): DatasetCandidateEvidence[] { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 725 | function summarizeDatasetCandidates( | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 765 | function extractDatasetMentionsFromAstaSnippets(value: unknown): string[] { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 922 | function buildDatasetCluesFromRepos(repoEvidence: Array<Record<string, unknown> | undefined>): Array<Record<string, unkn | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1003 | function isUnavailableSourcePayload(value: unknown): boolean { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1033 | function hasSuccessfulSourcePayload(value: unknown): boolean { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1047 | function collectSourceEvidenceStrings(value: unknown, acc: string[] = []): string[] { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1073 | function hasReproductionFeedbackSignal(record: Record<string, unknown>): boolean { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1078 | function sourceHasReproductionFeedbackSignal(value: unknown): boolean { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1095 | function findDatasetRestrictionEvidence(text: string): string | undefined { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1141 | function extractedUnscopedEvidence( | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1244 | function liveUnscopedEvidenceFields( | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1317 | function summarizeRelationshipHints(value: unknown): string[] { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1333 | function scoreRepositoryForReplication(repo: Record<string, unknown>): number { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1382 | function compactRepositoryEvidenceForCodeAgent(repo: Record<string, unknown>): Record<string, unknown> { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1408 | function repoHasTrainingOrEvalPath(repo: Record<string, unknown>): boolean { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 1427 | function repoHasUnofficialImplementationSignal(repo: Record<string, unknown>): boolean { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 2567 | function assertPlannerDetectedConflicts(plan: ReplicationPlan, mode: SourceMode): void { | CODE |
| LOW | …ges/core/examples/cookbook/paper-replication-triage.ts | 2585 | function verifySourceTasksStartedTogether(resultTasks: readonly TaskExecutionRecord[]): void { | CODE |
| LOW⚡ | packages/core/examples/cookbook/contract-review-dag.ts | 39 | function getAndIncrementAttempt(agentName: string): number { | CODE |
| LOW | …xamples/cookbook/commission-reconciliation-recovery.ts | 480 | function readInitialDependencyEvidence(prompt: string): InitialEvidence { | CODE |
| LOW | …xamples/cookbook/commission-reconciliation-recovery.ts | 729 | export async function runCommissionReconciliation( | CODE |
| LOW | packages/core/src/journal/tail-replay.ts | 168 | export function restoreConversationLineage( | CODE |
| LOW | packages/core/src/llm/bedrock.ts | 102 | function toBedrockToolResultContent( | CODE |
| LOW | packages/core/src/llm/azure-openai.ts | 76 | function resolveAzureDeploymentName(model: string): string { | CODE |
| LOW | packages/core/src/llm/anthropic.ts | 109 | function toAnthropicContentBlockParams( | CODE |
| LOW | packages/core/src/llm/anthropic.ts | 281 | function fromAnthropicContentBlock( | CODE |
| LOW | packages/core/src/llm/reasoning-fallback.ts | 124 | export function resolveReasoningOutboundMaxChars( | CODE |
| LOW | packages/core/src/llm/reasoning-fallback.ts | 176 | export function reasoningBlockToInlineText( | CODE |
| LOW | packages/core/src/llm/adapter.ts | 63 | function configuredProviderBaseURL( | CODE |
| LOW | packages/core/src/llm/openai-common.ts | 45 | export function toOpenAISdkReasoningEffort( | CODE |
| LOW | packages/core/src/llm/openai-common.ts | 127 | function toOpenAIToolAttachmentPart(part: Exclude<ToolResultContentPart, { type: 'text' }>): OpenAIUserContentPart { | CODE |
| LOW | packages/core/src/llm/egress.ts | 202 | export function rejectUnresolvedEgressTarget( | CODE |
| LOW | packages/core/src/llm/ai-sdk.ts | 53 | export function llmMessagesToAiSdkModelMessages( | CODE |
| LOW | packages/core/src/llm/ai-sdk.ts | 214 | function buildLlmResponseFromGenerateText(result: { | CODE |
| LOW | packages/core/src/agent/input.ts | 30 | function assertStructuredInputSupported( | CODE |
| LOW | packages/core/src/agent/structured-output.ts | 22 | export function buildStructuredOutputInstruction(schema: ZodSchema): string { | CODE |
| LOW | packages/core/src/agent/runner.ts | 407 | function stripMediaBlocksForSummary(messages: LLMMessage[]): LLMMessage[] { | CODE |
| LOW | packages/core/src/agent/runner.ts | 508 | function prependSyntheticPrefixToFirstUser( | CODE |
| LOW | packages/core/src/cli/oma.ts | 120 | export function renderCapturedRunDashboard( | CODE |
| LOW | packages/core/src/cli/oma.ts | 144 | export async function exportCurrentRunDashboard( | CODE |
| LOW | packages/core/src/observability/processors.ts | 65 | export class SensitiveDataProcessor extends DelegatingSink { | CODE |
| LOW | packages/core/src/image/openai.ts | 40 | export function isOpenAIContentPolicyError(body: ProviderErrorBody): boolean { | CODE |
| 48 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | CHANGELOG.md | 884 | - **Observability v2: trace spans and run identity** (#371, #373 by @JackChen-me). Every run now carries a stable `runId | CODE |
| MEDIUM⚡ | CHANGELOG.md | 886 | - **Observability v2: sink and exporter lifecycle** (#374 by @JackChen-me). The new `@open-multi-agent/core/observabilit | CODE |
| MEDIUM⚡ | CHANGELOG.md | 888 | - **Observability v2: trace stores** (#375, #384 by @JackChen-me). A storage-independent `TraceStore` contract (append, | CODE |
| MEDIUM⚡ | CHANGELOG.md | 890 | - **New package: @open-multi-agent/otel 0.1.0** (#376, #385 by @JackChen-me). A separately installable adapter that maps | CODE |
| MEDIUM⚡ | CHANGELOG.md | 892 | - **Per-call tool gate** (#377 by @scarab-systems). Optional `onToolCall` on `AgentConfig` / `OrchestratorConfig` runs a | CODE |
| MEDIUM⚡ | CHANGELOG.md | 894 | - **Generic process backend** (#378 by @scarab-systems). The new `@open-multi-agent/core/process` subpath runs a local c | CODE |
| MEDIUM⚡ | CHANGELOG.md | 896 | - **Bash command risk classifier** (#382 by @JackChen-me). `classifyBashCommand` behind the `@open-multi-agent/core/clas | CODE |
| MEDIUM | CHANGELOG.md | 927 | - **External coding agents over ACP** (#360 by @JackChen-me). OMA can now orchestrate an external coding agent over the | CODE |
| MEDIUM | CHANGELOG.md | 927 | - **External coding agents over ACP** (#360 by @JackChen-me). OMA can now orchestrate an external coding agent over the | CODE |
| MEDIUM | CHANGELOG.md | 1034 | - **Deterministic model routing** (#286 by @cat0825). Opt-in `modelRouting` sends different orchestration calls (coordin | CODE |
| MEDIUM | CHANGELOG.md | 1195 | #### Plan-only orchestration | COMMENT |
| MEDIUM | README.md | 129 | - **[CodingScaffold](https://github.com/JRS1986/CodingScaffold)**: Agentic-coding scaffold that lists OMA as an optional | CODE |
| MEDIUM | README_zh.md | 126 | - **[CodingScaffold](https://github.com/JRS1986/CodingScaffold)**:agentic-coding 脚手架,把 OMA 列为可选编排后端,附带 `runTeam` 工作流模板。 | CODE |
| MEDIUM | AGENTS.md | 21 | npm run test:scaffold # End-to-end create-oma-app scaffold smoke test | CODE |
| MEDIUM | docs/durable-approvals.md | 236 | [#313](https://github.com/open-multi-agent/open-multi-agent/issues/313). | CODE |
| MEDIUM | docs/glossary.md | 36 | | **Task DAG** | The directed acyclic graph of tasks a run executes, with edges from each task's `dependsOn`. It is prod | CODE |
| MEDIUM | docs/checkpoint.md | 365 | Append-only transition replay shipped as the opt-in [run journal](run-journal.md) ([#527](https://github.com/open-multi- | CODE |
| MEDIUM | docs/README.md | 29 | ## Control orchestration | COMMENT |
| MEDIUM | docs/tool-configuration.md | 247 | **Custom / runtime tools are exempt from the grant requirement** — registering them _is_ the grant. Tools passed via `cu | CODE |
| MEDIUM | packages/core/README_zh.md | 221 | 内置工具默认拒绝,且每个对模型可见的工具结果都会发送给你的模型 provider,读取与执行权限应审慎授予。工具可通过 `modelOutput` 将应用自有数据与发送给模型的文本、图片或文件内容分开;完整契约见[工具配置指南](https | CODE |
| MEDIUM | packages/core/AGENTS.md | 1 | # @open-multi-agent/core agent rules | COMMENT |
| MEDIUM | packages/core/examples/README.md | 68 | ## patterns — orchestration patterns | COMMENT |
| MEDIUM | packages/core/src/agent/agent.ts | 177 | // External backend: it runs its own agentic loop, so none of the | COMMENT |
| MEDIUM | packages/core/src/agent/runner.ts | 1228 | // Main agentic loop — `while (true)` until end_turn or maxTurns | COMMENT |
| MEDIUM | packages/otel/README.md | 1 | # `@open-multi-agent/otel` | COMMENT |
| MEDIUM | packages/create-oma-app/AGENTS.md | 5 | - **npm publishes an enumerated subset of `template/`.** `package.json#files` includes `templates` wholesale but only sp | CODE |
| MEDIUM | .github/CONTRIBUTING.md | 19 | npm run dev # Watch-mode compilation for @open-multi-agent/core | CODE |
| MEDIUM | .github/CONTRIBUTING.md | 24 | npm run test:scaffold # End-to-end create-oma-app scaffold smoke test | CODE |
| MEDIUM⚡ | .github/workflows/release-smoke.yml | 5 | # scaffolds the recommended PR-review starter, the @open-multi-agent/core it | COMMENT |
| MEDIUM⚡ | .github/workflows/release-smoke.yml | 9 | # The second job covers @open-multi-agent/otel, which rides its own version | COMMENT |
| MEDIUM⚡ | .github/workflows/release-smoke.yml | 15 | # anything. The pre-merge equivalents (`scaffold-e2e` and the `package` job's | COMMENT |
| MEDIUM | .github/workflows/release-smoke.yml | 138 | # @open-multi-agent/otel rides its own version track and carries no git | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/core/examples/basics/multi-model-team.ts | 185 | // Step 1: researcher fetches the rates | COMMENT |
| LOW | packages/core/examples/basics/multi-model-team.ts | 205 | // Step 2: analyst writes the briefing, receiving the researcher output as context | COMMENT |
| LOW | packages/core/examples/patterns/fan-out-aggregate.ts | 118 | // Step 1: Fan-out — run all 3 analysts in parallel | COMMENT |
| LOW | packages/core/examples/patterns/fan-out-aggregate.ts | 148 | // Step 2: Aggregate — synthesizer reads all 3 analyses | COMMENT |
| LOW | …ges/core/examples/patterns/cross-provider-reasoning.ts | 53 | // Step 1: a reasoning-capable OpenAI model produces a turn that includes | COMMENT |
| LOW | …ges/core/examples/patterns/cross-provider-reasoning.ts | 83 | // Step 2: swap the model to Anthropic mid-conversation. Without | COMMENT |
| LOW⚡ | packages/core/examples/cookbook/contract-review-dag.ts | 46 | // Step 1: Agent configurations (4 agents) | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 127 | // Step 2: Task configurations (4 tasks) | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 143 | // Step 3: Progress tracking | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 218 | // Step 4: Parallelism verification | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 247 | // Step 5: Orchestrator and Team configuration | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 263 | // Step 6: Read contract text | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 317 | // Step 7: Run the DAG | COMMENT |
| LOW | packages/core/examples/cookbook/meeting-summarizer.ts | 155 | // Step 1: Parallel fan-out with per-agent timing | COMMENT |
| LOW | packages/core/examples/cookbook/meeting-summarizer.ts | 205 | // Step 2: Parallelism assertion | COMMENT |
| LOW | packages/core/examples/cookbook/meeting-summarizer.ts | 223 | // Step 3: Aggregate into Markdown report | COMMENT |
| LOW | …/core/examples/cookbook/translation-backtranslation.ts | 229 | // Step 1: Agent A translates | COMMENT |
| LOW | …/core/examples/cookbook/translation-backtranslation.ts | 248 | // Step 2: Agent B back-translates | COMMENT |
| LOW | …/core/examples/cookbook/translation-backtranslation.ts | 265 | // Step 3: Agent C reviews semantic drift | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 42 | // Step 1: Agent configurations (5 agents) | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 153 | // Step 2: Task configurations (5 tasks) | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 169 | // Step 3: Progress tracking | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 244 | // Step 4: Parallelism verification | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 275 | // Step 5: Orchestrator and Team configuration | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 314 | // Step 6: Read fixture files | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 373 | // Step 7: Run the DAG | COMMENT |
| LOW | …integrations/with-tencentdb-memory/team-with-memory.ts | 122 | // Step 1: recall long-term memory from previous runs | COMMENT |
| LOW | …integrations/with-tencentdb-memory/team-with-memory.ts | 199 | // Step 2: run the team — shared-memory writes are captured into TDAM | COMMENT |
| LOW | …integrations/with-tencentdb-memory/team-with-memory.ts | 239 | // Step 3: flush extraction so captures become searchable | COMMENT |
| LOW | …integrations/with-tencentdb-memory/team-with-memory.ts | 253 | // Step 4: verify — search the distilled long-term memories | COMMENT |
| LOW⚡ | …ore/examples/integrations/with-engram/research-team.ts | 167 | // Step 1: Research | COMMENT |
| LOW⚡ | …ore/examples/integrations/with-engram/research-team.ts | 175 | // Step 2: Fact-check | COMMENT |
| LOW⚡ | …ore/examples/integrations/with-engram/research-team.ts | 184 | // Step 3: Write briefing | COMMENT |
| LOW | packages/core/src/llm/copilot.ts | 117 | // Step 1: Request a device code | COMMENT |
| LOW⚡ | packages/core/src/llm/copilot.ts | 134 | // Step 2: Prompt the user via callback | COMMENT |
| LOW⚡ | packages/core/src/llm/copilot.ts | 137 | // Step 3: Poll for the user to complete auth | COMMENT |
| LOW | packages/core/src/agent/runner.ts | 1484 | // Step 1: Call the LLM and collect the full response for this turn. | COMMENT |
| LOW | packages/core/src/agent/runner.ts | 1508 | // Step 2: Build the assistant message from the response content. | COMMENT |
| LOW | packages/core/src/agent/runner.ts | 1613 | // Step 3: Decide whether to continue looping. | COMMENT |
| LOW | packages/core/src/orchestrator/orchestrator.ts | 1699 | // Step 1: Coordinator decomposes goal into tasks | COMMENT |
| LOW | packages/core/src/orchestrator/orchestrator.ts | 1783 | // Step 2: Parse tasks from coordinator output | COMMENT |
| LOW⚡ | packages/core/src/orchestrator/orchestrator.ts | 1949 | // Step 3: Auto-assign any unassigned tasks | COMMENT |
| LOW⚡ | packages/core/src/orchestrator/orchestrator.ts | 1956 | // Step 4: Build pool and execute | COMMENT |
| LOW | packages/core/src/orchestrator/orchestrator.ts | 2175 | // Step 5: Coordinator synthesises final result | COMMENT |
| LOW | packages/core/src/orchestrator/orchestrator.ts | 2875 | // Step 2: run proposer(s); accumulate usage and honour the budget before judging. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/core/examples/basics/multi-model-team.ts | 185 | // Step 1: researcher fetches the rates | COMMENT |
| LOW | packages/core/examples/basics/multi-model-team.ts | 205 | // Step 2: analyst writes the briefing, receiving the researcher output as context | COMMENT |
| LOW | packages/core/examples/patterns/fan-out-aggregate.ts | 118 | // Step 1: Fan-out — run all 3 analysts in parallel | COMMENT |
| LOW | packages/core/examples/patterns/fan-out-aggregate.ts | 148 | // Step 2: Aggregate — synthesizer reads all 3 analyses | COMMENT |
| LOW | …ges/core/examples/patterns/cross-provider-reasoning.ts | 53 | // Step 1: a reasoning-capable OpenAI model produces a turn that includes | COMMENT |
| LOW | …ges/core/examples/patterns/cross-provider-reasoning.ts | 83 | // Step 2: swap the model to Anthropic mid-conversation. Without | COMMENT |
| LOW⚡ | packages/core/examples/cookbook/contract-review-dag.ts | 46 | // Step 1: Agent configurations (4 agents) | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 127 | // Step 2: Task configurations (4 tasks) | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 143 | // Step 3: Progress tracking | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 218 | // Step 4: Parallelism verification | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 247 | // Step 5: Orchestrator and Team configuration | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 263 | // Step 6: Read contract text | COMMENT |
| LOW | packages/core/examples/cookbook/contract-review-dag.ts | 317 | // Step 7: Run the DAG | COMMENT |
| LOW | packages/core/examples/cookbook/meeting-summarizer.ts | 155 | // Step 1: Parallel fan-out with per-agent timing | COMMENT |
| LOW | packages/core/examples/cookbook/meeting-summarizer.ts | 205 | // Step 2: Parallelism assertion | COMMENT |
| LOW | packages/core/examples/cookbook/meeting-summarizer.ts | 223 | // Step 3: Aggregate into Markdown report | COMMENT |
| LOW | …/core/examples/cookbook/translation-backtranslation.ts | 229 | // Step 1: Agent A translates | COMMENT |
| LOW | …/core/examples/cookbook/translation-backtranslation.ts | 248 | // Step 2: Agent B back-translates | COMMENT |
| LOW | …/core/examples/cookbook/translation-backtranslation.ts | 265 | // Step 3: Agent C reviews semantic drift | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 42 | // Step 1: Agent configurations (5 agents) | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 153 | // Step 2: Task configurations (5 tasks) | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 169 | // Step 3: Progress tracking | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 244 | // Step 4: Parallelism verification | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 275 | // Step 5: Orchestrator and Team configuration | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 314 | // Step 6: Read fixture files | COMMENT |
| LOW | …ages/core/examples/cookbook/incident-postmortem-dag.ts | 373 | // Step 7: Run the DAG | COMMENT |
| LOW | …integrations/with-tencentdb-memory/team-with-memory.ts | 122 | // Step 1: recall long-term memory from previous runs | COMMENT |
| LOW | …integrations/with-tencentdb-memory/team-with-memory.ts | 199 | // Step 2: run the team — shared-memory writes are captured into TDAM | COMMENT |
| LOW | …integrations/with-tencentdb-memory/team-with-memory.ts | 239 | // Step 3: flush extraction so captures become searchable | COMMENT |
| LOW | …integrations/with-tencentdb-memory/team-with-memory.ts | 253 | // Step 4: verify — search the distilled long-term memories | COMMENT |
| LOW⚡ | …ore/examples/integrations/with-engram/research-team.ts | 167 | // Step 1: Research | COMMENT |
| LOW⚡ | …ore/examples/integrations/with-engram/research-team.ts | 175 | // Step 2: Fact-check | COMMENT |
| LOW⚡ | …ore/examples/integrations/with-engram/research-team.ts | 184 | // Step 3: Write briefing | COMMENT |
| LOW | packages/core/src/llm/copilot.ts | 117 | // Step 1: Request a device code | COMMENT |
| LOW⚡ | packages/core/src/llm/copilot.ts | 134 | // Step 2: Prompt the user via callback | COMMENT |
| LOW⚡ | packages/core/src/llm/copilot.ts | 137 | // Step 3: Poll for the user to complete auth | COMMENT |
| LOW | packages/core/src/agent/runner.ts | 1484 | // Step 1: Call the LLM and collect the full response for this turn. | COMMENT |
| LOW | packages/core/src/agent/runner.ts | 1508 | // Step 2: Build the assistant message from the response content. | COMMENT |
| LOW | packages/core/src/agent/runner.ts | 1613 | // Step 3: Decide whether to continue looping. | COMMENT |
| LOW | packages/core/src/orchestrator/orchestrator.ts | 1699 | // Step 1: Coordinator decomposes goal into tasks | COMMENT |
| LOW | packages/core/src/orchestrator/orchestrator.ts | 1783 | // Step 2: Parse tasks from coordinator output | COMMENT |
| LOW⚡ | packages/core/src/orchestrator/orchestrator.ts | 1949 | // Step 3: Auto-assign any unassigned tasks | COMMENT |
| LOW⚡ | packages/core/src/orchestrator/orchestrator.ts | 1956 | // Step 4: Build pool and execute | COMMENT |
| LOW | packages/core/src/orchestrator/orchestrator.ts | 2175 | // Step 5: Coordinator synthesises final result | COMMENT |
| LOW | packages/core/src/orchestrator/orchestrator.ts | 2875 | // Step 2: run proposer(s); accumulate usage and honour the budget before judging. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/core/tests/context-strategy.test.ts | 296 | const FILLER = 'lorem ipsum dolor sit amet '.repeat(50) // ~1.3k chars | CODE |
| LOW | packages/core/tests/context-strategy.test.ts | 296 | const FILLER = 'lorem ipsum dolor sit amet '.repeat(50) // ~1.3k chars | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 58 | ['anthropic', () => new AnthropicAdapter('dummy-key'), 'own-issued' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 59 | ['gemini', () => new GeminiAdapter('dummy-key'), 'own-issued' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 60 | ['openai', () => new OpenAIAdapter('dummy-key'), 'never' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 61 | ['azure-openai', () => new AzureOpenAIAdapter('dummy-key', 'https://example.openai.azure.com'), 'never' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 62 | ['copilot', () => new CopilotAdapter('dummy-token'), 'never' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 63 | ['deepseek', () => new DeepSeekAdapter('dummy-key'), 'tool-use-only' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 64 | ['grok', () => new GrokAdapter('dummy-key'), 'never' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 65 | ['qiniu', () => new QiniuAdapter('dummy-key'), 'never' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 66 | ['minimax', () => new MiniMaxAdapter('dummy-key'), 'tool-use-only' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 67 | ['mimo', () => new MiMoAdapter('dummy-key'), 'tool-use-only' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 68 | ['hunyuan', () => new HunyuanAdapter('dummy-key'), 'tool-use-only' as const], | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 81 | const parent = new OpenAIAdapter('dummy-key').capabilities | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 82 | expect(new GrokAdapter('dummy-key').capabilities).toEqual(parent) | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 83 | expect(new QiniuAdapter('dummy-key').capabilities).toEqual(parent) | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 92 | expect(new DeepSeekAdapter('dummy-key').capabilities).toEqual({ | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 95 | expect(new MiMoAdapter('dummy-key').capabilities).toEqual({ | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 98 | expect(new HunyuanAdapter('dummy-key').capabilities).toEqual({ | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 101 | expect(new DeepSeekAdapter('dummy-key').capabilities).not.toEqual( | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 102 | new OpenAIAdapter('dummy-key').capabilities, | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 104 | expect(new MiMoAdapter('dummy-key').capabilities).not.toEqual( | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 105 | new OpenAIAdapter('dummy-key').capabilities, | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 107 | expect(new HunyuanAdapter('dummy-key').capabilities).not.toEqual( | CODE |
| LOW⚡ | packages/core/tests/llm-adapter-capabilities.test.ts | 108 | new OpenAIAdapter('dummy-key').capabilities, | CODE |
| LOW | packages/core/tests/hunyuan-adapter.test.ts | 48 | const adapter = new HunyuanAdapter('dummy-key') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …core/tests/e2e/coordinator-dependency-widening.test.ts | 153 | // ── Bug cases: brief declarations must not be widened ────────────────── | COMMENT |
| MEDIUM | …core/tests/e2e/coordinator-dependency-widening.test.ts | 169 | // ── Known-good: exhaustive declarations must still be fully wired ────── | COMMENT |
| MEDIUM | packages/core/examples/providers/gemma4-local.ts | 102 | // ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | packages/core/examples/providers/gemma4-local.ts | 104 | // ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | packages/core/examples/providers/gemma4-local.ts | 155 | // ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | packages/core/examples/providers/gemma4-local.ts | 157 | // ═══════════════════════════════════════════════════════════════════════════ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/providers-atlascloud.md | 34 | export ATLASCLOUD_API_KEY=your-api-key | CODE |
| HIGH | docs/providers-atlascloud_zh.md | 34 | export ATLASCLOUD_API_KEY=your-api-key | CODE |
| HIGH | …/examples/integrations/with-tencentdb-memory/README.md | 120 | -e MODEL_API_KEY="your-api-key" \ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/core/examples/basics/multi-model-team.ts | 101 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | …ges/core/examples/patterns/cross-provider-reasoning.ts | 21 | * Prerequisites: | COMMENT |
| LOW | …e/examples/cookbook/rare-disease-information-triage.ts | 501 | // Production source adapter sketch | COMMENT |
| LOW | …examples/cookbook/narrative-puzzle-hint-arbitration.ts | 561 | // Lore: load from game CMS with versioned narrative content | COMMENT |
| LOW | …kages/core/examples/cookbook/competitive-monitoring.ts | 441 | // | COMMENT |
| LOW | …examples/integrations/with-vercel-ai-sdk/next-env.d.ts | 1 | /// <reference types="next" /> | COMMENT |
| LOW | packages/core/src/llm/openai.ts | 81 | COMMENT | |
| LOW | packages/core/src/llm/openai-common.ts | 321 | } else if (block.type === 'reasoning') { | COMMENT |
| LOW | packages/core/src/llm/ai-sdk.ts | 261 | readonly name = 'ai-sdk' | COMMENT |
| LOW | packages/core/src/llm/hunyuan.ts | 41 | // `reasoning_content` to be backfilled on every follow-up request that | COMMENT |
| LOW | packages/release-bot/src/orchestrator.ts | 121 | // replace it because it is only checked after a call returns. | COMMENT |
| LOW | .github/workflows/release-smoke.yml | 1 | name: Release smoke | COMMENT |
| LOW | .github/workflows/supply-chain-audit.yml | 1 | name: Supply chain audit | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/core/tests/keywords.test.ts | 87 | // in the other direction, which is why agent selection stays robust | COMMENT |