Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞
This report presents the forensic synthetic code analysis of openclaw/openclaw, a TypeScript project with 387,911 GitHub stars. SynthScan v2.0 examined 9,670,756 lines of code across 33121 source files, recording 49133 pattern matches distributed across 22 syntactic categories. The overall adjusted score of 5.5 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 49133 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tsdown.config.ts | 208 | function workerRsyncReceiverBuildConfig(): UserConfig { | CODE |
| LOW | tsdown.config.ts | 228 | function nodeWorkspacePackageBuildConfig(packageDir: string, config: UserConfig = {}): UserConfig { | CODE |
| LOW | tsdown.config.ts | 276 | function withExternalPackageSubpaths(options: { neverBundle: string[] }) { | CODE |
| LOW⚡ | tsdown.config.ts | 308 | function shouldNeverBundleDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 312 | function shouldNeverBundleDeclarationDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 316 | function shouldAlwaysBundleDependency(id: string): boolean { | CODE |
| LOW | tsdown.config.ts | 337 | function listBundledPluginEntrySources( | CODE |
| LOW | tsdown.config.ts | 455 | function buildAgentCoreDistEntries(): Record<string, string> { | CODE |
| LOW | tsdown.config.ts | 475 | function buildPackageDistEntriesFromExports(packageDir: string): Record<string, string> { | CODE |
| LOW | tsdown.config.ts | 512 | function shouldExternalizeAgentCoreDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 528 | function shouldExternalizeGatewayProtocolDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 532 | function shouldExternalizeGatewayClientDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 538 | function shouldExternalizeNetPolicyDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 542 | function shouldExternalizeLlmCoreDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 546 | function shouldExternalizeMarkdownCoreDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 552 | function shouldExternalizeTerminalCoreDependency(id: string): boolean { | CODE |
| LOW | tsdown.config.ts | 621 | function partitionUnifiedEntryGroups( | CODE |
| LOW | tsdown.config.ts | 644 | function normalizeDeclarationEntrySource(source: string): string { | CODE |
| LOW | tsdown.config.ts | 649 | function buildUnifiedDeclarationPartitions( | CODE |
| LOW | ui/vite.config.ts | 62 | export function createControlUiPrecompressedAssetVariants( | CODE |
| LOW | ui/vite.config.ts | 183 | export function resolveControlUiBuildInfo( | CODE |
| LOW | ui/vite.config.ts | 267 | function resolveTsconfigTargetPath(target: string): string { | CODE |
| LOW | ui/vite.config.ts | 314 | export function resolveSourcePackageAliasesForVite(): ControlUiViteAlias[] { | CODE |
| LOW | ui/vite.config.ts | 333 | export function resolveExternalPackageAliasesForVite( | CODE |
| LOW | ui/vite.config.ts | 350 | export function resolveTsconfigPathAliasesForVite(): ControlUiViteAlias[] { | CODE |
| LOW | ui/vite.config.ts | 369 | function normalizeViteImporterPath(importer: string): string { | CODE |
| LOW | ui/vite.config.ts | 373 | export function controlUiBrowserOnlySharedModuleAliases(): Plugin { | CODE |
| LOW | ui/vite.config.ts | 396 | function controlUiServiceWorkerBuildIdPlugin(buildId: string, buildOutDir: string): Plugin { | CODE |
| LOW | ui/vite.config.ts | 415 | function controlUiPrecompressedAssetsPlugin(buildOutDir: string): Plugin { | CODE |
| LOW | ui/vite.config.ts | 433 | function collectControlUiAssetManifestEntries(buildOutDir: string): ControlUiAssetManifestEntry[] { | CODE |
| LOW | ui/vite.config.ts | 464 | function controlUiAssetManifestPlugin(buildOutDir: string): Plugin { | CODE |
| LOW | ui/vitest.config.ts | 131 | function resolveChromiumLaunchOptions(): { executablePath: string } | undefined { | CODE |
| LOW | ui/config/control-ui-locales.ts | 32 | export function controlUiLocaleModulesPlugin(): Plugin { | CODE |
| LOW | ui/config/control-ui-hover-guard.ts | 14 | export function controlUiHoverGuardPlugin(): Plugin { | CODE |
| LOW | ui/src/main.ts | 46 | function syncDocumentPublicAssetLinks() { | CODE |
| LOW | ui/src/app-session-route-paths.ts | 14 | export function withSidebarNavCollapseIntent(href: string): string { | CODE |
| LOW | ui/src/build-info.ts | 35 | export function controlUiBuildDiffersFrom(identity: { | CODE |
| LOW | ui/src/build-info.ts | 51 | function controlUiVersionDiffersFrom( | CODE |
| LOW | ui/src/build-info-normalizers.ts | 27 | function normalizeControlUiBuildTimestamp(value: unknown): string | null { | CODE |
| LOW | ui/src/build-info-normalizers.ts | 42 | function normalizeControlUiBuildId(value: unknown): string { | CODE |
| LOW | ui/src/build-info-normalizers.ts | 59 | export function normalizeControlUiBuildInfo(value: unknown): ControlUiBuildInfo { | CODE |
| LOW | ui/src/app-route-paths.ts | 215 | export function sessionRouteNamespaceFromPath(pathname: string, basePath = ""): BoardFace | null { | CODE |
| LOW | ui/src/app-route-paths.ts | 330 | export function inferBasePathFromPathname(pathname: string): string { | CODE |
| LOW | ui/src/app-navigation.ts | 152 | function settingsSearchHasWordPrefix(value: string, query: string): boolean { | CODE |
| LOW | ui/src/app-navigation.ts | 172 | export function settingsSearchTextMatches(value: string, query: string): boolean { | CODE |
| LOW | ui/src/app-navigation.ts | 225 | export function isSettingsNavigationRouteVisible( | CODE |
| LOW | ui/src/app-navigation.ts | 237 | export function visibleSettingsNavigationGroups( | CODE |
| LOW | ui/src/app-navigation.ts | 314 | export function isSettingsNavigationRoute(routeId: NavigationRouteId): boolean { | CODE |
| LOW | ui/src/app-navigation.ts | 318 | export function settingsNavigationOwnerRoute(routeId: NavigationRouteId): NavigationRouteId { | CODE |
| LOW | ui/src/app-navigation.ts | 469 | export function settingsNavigationLabelForRoute(routeId: NavigationRouteId): string { | CODE |
| LOW | ui/src/app/agent-selection.ts | 45 | export function createAgentSelectionCapability( | CODE |
| LOW | ui/src/app/device-scope-upgrade-availability.ts | 14 | export function readScopeUpgradeAvailability( | CODE |
| LOW | ui/src/app/notifications-auto-prompt.ts | 15 | export function hasActiveNotificationPromptGesture(): boolean { | CODE |
| LOW | ui/src/app/notifications-auto-prompt.ts | 21 | export function shouldAutoPromptNotificationsOnSend( | CODE |
| LOW | ui/src/app/notifications-auto-prompt.ts | 41 | export function autoPromptNotificationsOnSend(context: NotificationsContext): void { | CODE |
| LOW | ui/src/app/update-success-notice.ts | 25 | function takeRecordedUpdateSuccess(): string | null { | CODE |
| LOW | ui/src/app/update-success-notice.ts | 37 | export function announceVerifiedUpdateInstall(identity: UpdateInstallIdentity): void { | CODE |
| LOW | ui/src/app/update-success-notice.ts | 50 | export function announceRecordedUpdateSuccess(): void { | CODE |
| LOW | ui/src/app/session-placement-startup.ts | 52 | export function createApplicationPlacementStartup( | CODE |
| LOW | ui/src/app/gateway-store.ts | 670 | function normalizeCanvasPluginSurfaceUrl(value: string | undefined): string | null { | CODE |
| 47849 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | ui/src/pages/chat/chat-pane-session-menu.ts | 135 | const sidebarEntries = scope.context.navigation.snapshot.sidebarEntries.filter( | CODE |
| CRITICAL | ui/src/pages/memory-import/memory-import-page.test.ts | 451 | mutableContext.agents.state.agentsList.agents.push({ id: "writer", name: "Writer" }); | CODE |
| CRITICAL | ui/src/pages/profile/profile-page.ts | 117 | this.context.gateway.connection.token.trim() || | CODE |
| CRITICAL | ui/src/pages/profile/profile-page.ts | 118 | this.context.gateway.connection.password.trim(), | CODE |
| CRITICAL | test/scripts/validate-qa-runtime-pair-summary.test.ts | 481 | missingResult.runtimeParity.cells.codex.toolCalls.push({ | CODE |
| CRITICAL | extensions/memory-lancedb/index.test.ts | 2435 | expect(harness.logger.warn.mock.calls.map(([message]) => String(message))).toEqual([ | CODE |
| CRITICAL | extensions/discord/src/voice/voice-following.test.ts | 684 | expect(client.rest.get.mock.calls.slice(0, 31)).toEqual( | CODE |
| CRITICAL | extensions/discord/src/voice/voice-following.test.ts | 687 | expect(client.rest.get.mock.calls.slice(31)).toEqual( | CODE |
| CRITICAL | extensions/discord/src/voice/segment.test.ts | 226 | const idleHandler = entry.player.on.mock.calls.find(([event]) => event === "idle")?.[1]; | CODE |
| CRITICAL | extensions/device-pair/notify.ts | 231 | const adapter = await params.api.runtime.channel.outbound.loadAdapter("telegram"); | CODE |
| CRITICAL | extensions/device-pair/index.ts | 680 | const adapter = await params.api.runtime.channel.outbound.loadAdapter(params.ctx.channel); | CODE |
| CRITICAL | extensions/chutes/models.test.ts | 88 | const manifestIds = manifest.modelCatalog.providers.chutes.models.map((model) => model.id); | CODE |
| CRITICAL | extensions/codex/src/session-catalog-adoption.ts | 466 | const restored = await params.api.runtime.agent.session.patchSessionEntry({ | CODE |
| CRITICAL | extensions/codex/src/session-upstream-activity.ts | 207 | const entry = params.api.runtime.agent.session.getSessionEntry({ | CODE |
| CRITICAL | extensions/codex/src/session-catalog-node-adoption.ts | 188 | finalized = await params.api.runtime.agent.session.patchSessionEntry({ | CODE |
| CRITICAL | extensions/codex/src/session-catalog-node-adoption.ts | 220 | const currentEntry = params.api.runtime.agent.session.getSessionEntry({ | CODE |
| CRITICAL | extensions/codex/src/session-catalog-node-adoption.ts | 268 | const created = await params.api.runtime.agent.session.createSessionEntry({ | CODE |
| CRITICAL | extensions/deepseek/onboard.test.ts | 13 | manifest.modelCatalog.providers.deepseek.models.map((model) => model.id), | CODE |
| CRITICAL | extensions/openshell/src/backend.ts | 882 | ...this.params.execContext.config.providers.flatMap((provider) => ["--provider", provider]), | CODE |
| CRITICAL | extensions/acpx/src/pi-session-catalog-runtime.ts | 103 | const created = await params.api.runtime.agent.session.createSessionEntry({ | CODE |
| CRITICAL⚡ | extensions/diagnostics-otel/src/service.test.ts | 5929 | telemetryState.tracer.startSpan.mock.calls.filter((call) => call[0] === "openclaw.run"), | CODE |
| CRITICAL⚡ | extensions/diagnostics-otel/src/service.test.ts | 5932 | telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL⚡ | extensions/diagnostics-otel/src/service.test.ts | 5937 | telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL⚡ | extensions/diagnostics-otel/src/service.test.ts | 5942 | telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 1282 | const spanNames = telemetryState.tracer.startSpan.mock.calls.map((call) => call[0]); | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4166 | const modelUsageCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4511 | const skillSpanCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4574 | const spanNames = telemetryState.tracer.startSpan.mock.calls.map((call) => call[0]); | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4752 | const toolSpanCalls = telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5242 | const linkedSpanContexts = telemetryState.tracer.setSpanContext.mock.calls.map( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5251 | telemetryState.tracer.startSpan.mock.calls.map((call) => [ | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5344 | telemetryState.tracer.startSpan.mock.calls.map((call) => [ | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5394 | telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5399 | telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5446 | telemetryState.tracer.startSpan.mock.calls.map((call) => [ | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5649 | const modelUsageCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5840 | telemetryState.tracer.startSpan.mock.calls.map((call) => [call[0], call[2]]), | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5893 | telemetryState.tracer.startSpan.mock.calls.map((call) => [call[0], call[2]]), | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 6062 | const deliverySpanCalls = telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 6770 | const modelUsageCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/telegram/src/draft-stream.test.ts | 1511 | const pages = api.raw.sendRichMessage.mock.calls.map((call) => { | CODE |
| CRITICAL | extensions/telegram/src/draft-stream.test.ts | 1541 | const pages = api.raw.sendRichMessage.mock.calls.map((call) => { | CODE |
| CRITICAL | extensions/venice/onboard.test.ts | 12 | manifest.modelCatalog.providers.venice.models.map((model) => model.id), | CODE |
| CRITICAL | extensions/slack/src/outbound-payload.test.ts | 502 | const fallbackCalls = client.chat.postMessage.mock.calls.slice(1, -1); | CODE |
| CRITICAL | extensions/slack/src/outbound-payload.test.ts | 515 | expect(client.chat.postMessage.mock.calls.at(-1)?.[0]).toMatchObject({ | CODE |
| CRITICAL | extensions/slack/src/question-finalization.test.ts | 432 | client.chat.postMessage.mock.calls.filter(([request]) => | CODE |
| CRITICAL | extensions/slack/src/send.blocks.test.ts | 227 | const postedTexts = client.chat.postMessage.mock.calls.map((call) => call[0].text); | CODE |
| CRITICAL | extensions/slack/src/send.blocks.test.ts | 249 | const postedTexts = client.chat.postMessage.mock.calls.map((call) => call[0].text); | CODE |
| CRITICAL | extensions/slack/src/send.blocks.test.ts | 606 | const posts = client.chat.postMessage.mock.calls.map((_call, index) => | CODE |
| CRITICAL | extensions/slack/src/send.blocks.test.ts | 633 | const posts = client.chat.postMessage.mock.calls.map((_call, index) => | CODE |
| CRITICAL | extensions/slack/src/send.reconcile.test.ts | 281 | const requests = client.chat.postMessage.mock.calls.map( | CODE |
| CRITICAL | extensions/slack/src/send.reconcile.test.ts | 630 | const postedMetadata = client.chat.postMessage.mock.calls.map( | CODE |
| CRITICAL | extensions/slack/src/send.enterprise.test.ts | 271 | expect(client.chat.postMessage.mock.calls.map((call) => call[0]?.text)).toEqual([ | CODE |
| CRITICAL | extensions/slack/src/send.enterprise.test.ts | 342 | expect(listenerClient.chat.postMessage.mock.calls.map((call) => call[0]?.text)).toEqual([ | CODE |
| CRITICAL | …st/src/mattermost/monitor.inbound-system-event.test.ts | 2000 | const [recordCall] = runtimeCore.channel.session.recordInboundSession.mock.calls.at(0) ?? []; | CODE |
| CRITICAL | …st/src/mattermost/monitor.inbound-system-event.test.ts | 2084 | const [recordCall] = runtimeCore.channel.session.recordInboundSession.mock.calls.at(0) ?? []; | CODE |
| CRITICAL | extensions/cerebras/onboard.test.ts | 27 | manifest.modelCatalog.providers.cerebras.models.map((model) => model.id), | CODE |
| CRITICAL | extensions/cerebras/onboard.test.ts | 88 | manifest.modelCatalog.providers.cerebras.models.map((model) => model.id), | CODE |
| CRITICAL | extensions/cerebras/onboard.test.ts | 99 | manifest.modelCatalog.providers.cerebras.models.map((model) => model.id), | CODE |
| CRITICAL | extensions/active-memory/session-policy.ts | 201 | const entry = params.api.runtime.agent.session.getSessionEntry({ | CODE |
| 59 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ui/src/pages/agents/memory/view.ts | 16 | // ── Diary entry parser ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/agents/memory/view.ts | 179 | // ── Sub-tab state ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/agents/memory/view.ts | 312 | // ── Scene renderer ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/agents/memory/view.ts | 1345 | // ── Diary section renderer ──────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/logbook/src/service.ts | 166 | // ── Capture ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/logbook/src/service.ts | 313 | // ── Analysis ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/logbook/src/service.ts | 570 | // ── Q&A / standup ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/logbook/src/service.ts | 627 | // ── Introspection ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/file-consent.test.ts | 60 | // ─── isPrivateOrReservedIP ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/file-consent.test.ts | 115 | // ─── validateConsentUploadUrl ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/file-consent.test.ts | 271 | // ─── CONSENT_UPLOAD_HOST_ALLOWLIST ─────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/file-consent.test.ts | 306 | // ─── uploadToConsentUrl (integration with validation) ──────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/token.ts | 14 | // ── Credential types ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/token.ts | 35 | // ── Helpers ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/token.ts | 63 | // ── hasConfiguredMSTeamsCredentials ──────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/token.ts | 95 | // ── resolveMSTeamsCredentials ───────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/attachments/shared.test.ts | 135 | // ─── safeFetch ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ensions/mattermost/src/mattermost/interactions.test.ts | 98 | // ── HMAC token management ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …ensions/mattermost/src/mattermost/interactions.test.ts | 126 | // ── Token generation / verification ────────────────────────────────── | COMMENT |
| MEDIUM | …ensions/mattermost/src/mattermost/interactions.test.ts | 355 | // ── buildButtonProps attachments ──────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extensions/mattermost/src/mattermost/interactions.ts | 62 | // ── Callback URL registry ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/interactions.ts | 168 | // ── HMAC token management ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/interactions.ts | 236 | // ── Button builder helpers ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extensions/mattermost/src/mattermost/interactions.ts | 353 | // ── Request body reader ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extensions/mattermost/src/mattermost/interactions.ts | 362 | // ── HTTP handler ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 6 | // ─── Types ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 76 | // ─── MM API types ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 119 | // ─── Default commands ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 189 | // ─── Command registration ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 439 | // ─── Callback parsing ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 532 | // ─── Config resolution ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-state.ts | 50 | // ─── Per-account state ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 27 | // ── Helper: mock fetch that captures requests ──────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 147 | // ── normalizeMattermostBaseUrl ──────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 171 | // ── readMattermostError ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 203 | // ── createMattermostClient ─────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 595 | // ── createMattermostPost ───────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 829 | // ── updateMattermostPost ───────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/whatsapp/src/quoted-message.ts | 15 | // ── Inbound message metadata cache ────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/memory-core/src/dreaming-narrative.ts | 24 | // ── Types ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/memory-core/src/dreaming-narrative.ts | 71 | // ── Constants ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/memory-core/src/dreaming-narrative.ts | 310 | // ── Prompt building ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/memory-core/src/dreaming-narrative.ts | 419 | // ── Date formatting ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/memory-core/src/dreaming-narrative.ts | 439 | // ── DREAMS.md file I/O ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/memory-core/src/dreaming-narrative.ts | 822 | // ── Orchestrator ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/memory-core/src/dreaming-narrative.ts | 1044 | // ── Detached narrative concurrency limit ─────────────────────────────── | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 29 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 31 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 84 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 86 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | scripts/k8s/deploy.sh | 98 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | scripts/k8s/deploy.sh | 100 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | scripts/k8s/deploy.sh | 109 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | scripts/k8s/deploy.sh | 111 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 188 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 190 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 214 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 216 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 237 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/k8s/deploy.sh | 239 | # --------------------------------------------------------------------------- | COMMENT |
| 75 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | ui/src/components/markdown.test.ts | 372 | print(f"--- {ws.title} ---") | CODE |
| HIGH | ui/src/components/markdown.test.ts | 376 | print(row) | CODE |
| HIGH | ui/src/lib/chat/message-normalizer.test.ts | 465 | " return True", | CODE |
| HIGH | test/scripts/check-dependency-pins.test.ts | 53 | elif [ "$1" = "ls-files" ]; then | CODE |
| HIGH | test/scripts/telegram-user-driver.test.ts | 80 | return None, [] | CODE |
| HIGH | test/scripts/pr-merge.test.ts | 336 | elif [ -d "$OPENCLAW_TEST_SOURCE_REPO" ]; then | CODE |
| HIGH | test/scripts/pr-merge.test.ts | 338 | elif [ "\${1-}" = "rev-parse" ]; then | CODE |
| HIGH | test/scripts/pr-merge.test.ts | 380 | elif [ -e "$OPENCLAW_TEST_AUTO_STATE" ]; then | CODE |
| HIGH⚡ | test/scripts/test-helpers.ts | 30 | print(profile?.profileId ?? "none"); | CODE |
| HIGH⚡ | test/scripts/test-helpers.ts | 33 | print(Math.max(0, ...counts)); | CODE |
| HIGH⚡ | test/scripts/test-helpers.ts | 36 | print(Math.max(0, ...profiles.map((item) => item.expiresAt ?? 0))); | CODE |
| HIGH | test/scripts/install-sh.test.ts | 1571 | elif [[ "$1" == "Building OpenClaw" ]]; then | CODE |
| HIGH | test/scripts/telegram-user-observer.test.ts | 222 | print(json.dumps({ | CODE |
| HIGH | test/scripts/setup-pnpm-store-cache-ensure-node.test.ts | 76 | elif [[ -n "$output" ]]; then | CODE |
| HIGH | test/scripts/release-telegram-candidate-archive.test.ts | 391 | print(json.dumps({ | CODE |
| HIGH⚡ | test/scripts/test-install-sh-docker.test.ts | 2072 | elif [ "\${1:-}" = "--help" ]; then | CODE |
| HIGH⚡ | test/scripts/test-install-sh-docker.test.ts | 2074 | elif [ "\${1:-}" = "infer" ]; then | CODE |
| HIGH⚡ | test/scripts/test-install-sh-docker.test.ts | 2076 | elif [ "\${1:-}" = "status" ] || { [ "\${1:-}" = "plugins" ] && [ "\${2:-}" = "list" ]; }; then | CODE |
| HIGH⚡ | test/scripts/test-install-sh-docker.test.ts | 2078 | elif [ "\${1:-}" = "agent" ]; then | CODE |
| HIGH⚡ | test/scripts/test-install-sh-docker.test.ts | 2081 | elif [ "\${1:-}" = "gateway" ] && [ "\${2:-}" = "health" ]; then | CODE |
| HIGH⚡ | test/scripts/test-install-sh-docker.test.ts | 2083 | elif [ "\${1:-}" = "gateway" ]; then | CODE |
| HIGH⚡ | test/scripts/github-activity-helper.test.ts | 60 | elif $fixture.blockActivity and $args[0] == "api" and ($args[1] | startswith("users/") | not) then | CODE |
| HIGH⚡ | test/scripts/github-activity-helper.test.ts | 62 | elif $args[0] == "api" and ($args[1] | startswith("users/")) then | CODE |
| HIGH⚡ | test/scripts/github-activity-helper.test.ts | 66 | elif $args[0] == "api" and ($args[1] | startswith("search/")) then | CODE |
| HIGH⚡ | test/scripts/github-activity-helper.test.ts | 71 | elif $args[0] == "api" and $args[1] == "graphql" then | CODE |
| HIGH | test/scripts/plugins-assertions.test.ts | 345 | elif raw_stderr_mode="$(stat -c '%a' "$raw_stderr_file" 2>/dev/null)"; then | CODE |
| HIGH⚡ | test/e2e/qa-lab/runtime/gateway-protocol-artifacts.ts | 181 | print("gateway Swift generated-model compatibility passed") | CODE |
| HIGH | …e2e/qa-lab/runtime/webchat-media-artifacts.e2e.test.ts | 82 | "worker.py": "def ready():\n return True\n", | CODE |
| HIGH | …sions/qa-lab/src/mantis/slack-desktop-smoke.runtime.ts | 795 | elif [ "$hydrate_mode" = "prehydrated" ]; then | CODE |
| HIGH | …sions/qa-lab/src/mantis/slack-desktop-smoke.runtime.ts | 1072 | elif kill -0 "$watcher_pid" >/dev/null 2>&1; then | CODE |
| HIGH | …sions/qa-lab/src/mantis/slack-desktop-smoke.runtime.ts | 1127 | elif [ "$approval_checkpoints" = "1" ] && [ -s "$out/approval-checkpoints/slack-approval-exec-native-pending.png" ]; the | CODE |
| HIGH | …/qa-lab/src/mantis/telegram-desktop-builder.runtime.ts | 379 | elif [ "$hydrate_mode" = "prehydrated" ]; then | CODE |
| HIGH | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 301 | print(json.dumps(payload, separators=(",", ":")), flush=True) | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 350 | return False | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 353 | return True | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 355 | return True | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 358 | return True | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 361 | return True | CODE |
| HIGH | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 376 | return None | CODE |
| HIGH | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 393 | return None | CODE |
| HIGH | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 417 | return None | CODE |
| HIGH | extensions/openshell/src/backend.e2e.test-support.ts | 142 | print("remote-exec-overlapped-command-and-file")`; | CODE |
| HIGH | extensions/line/src/markdown-to-line.test.ts | 276 | print("done") | CODE |
| HIGH | scripts/control-ui-mock-attachments.ts | 222 | "worker.py": textAsset("def ready():\n return True\n", "text/x-python"), | CODE |
| HIGH | scripts/e2e/telegram-user-crabbox-proof.ts | 1994 | print((payload.get("session") or {}).get("id") or "") | CODE |
| HIGH⚡ | scripts/e2e/parallels/windows-git.ts | 54 | print(preferred_names[0]) | CODE |
| HIGH⚡ | scripts/e2e/parallels/windows-git.ts | 55 | print(fallback["browser_download_url"]) | CODE |
| HIGH⚡ | scripts/e2e/parallels/windows-git.ts | 56 | print(fallback["digest"]) | CODE |
| HIGH | scripts/e2e/parallels/windows-git.ts | 80 | elif "-arm64." in name: | CODE |
| HIGH | scripts/e2e/parallels/windows-git.ts | 82 | elif "-32-bit." in name: | CODE |
| HIGH⚡ | scripts/e2e/parallels/windows-git.ts | 97 | print(best["name"]) | CODE |
| HIGH⚡ | scripts/e2e/parallels/windows-git.ts | 98 | print(best["browser_download_url"]) | CODE |
| HIGH⚡ | scripts/e2e/parallels/windows-git.ts | 99 | print(digest)`, | CODE |
| HIGH | src/docker-setup.e2e.test-support.ts | 132 | elif [[ "\${1:-}" == "--kill-after" ]]; then | CODE |
| HIGH | src/infra/sqlite-readonly-location.test.ts | 128 | print(json.dumps(locks)) | CODE |
| HIGH⚡ | src/agents/sandbox/fs-bridge-mutation-helper.ts | 117 | " return None", | CODE |
| HIGH⚡ | src/agents/sandbox/fs-bridge-mutation-helper.ts | 120 | " return None", | CODE |
| HIGH | src/cli/completion-cli.ts | 445 | elif [[ "\${choice_flag}" == "=" ]]; then | CODE |
| HIGH | src/cli/update-cli/restart-helper.ts | 162 | elif systemctl is-active --quiet '${escaped}' || systemctl is-enabled --quiet '${escaped}'; then | CODE |
| HIGH | src/cli/update-cli/restart-helper.ts | 215 | elif ! launchctl kickstart -k 'gui/${uid}/${escaped}'; then | CODE |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/src/i18n/.i18n/raw-copy-baseline.json | 217 | "name": "placeholder", | CODE |
| LOW | ui/src/i18n/.i18n/raw-copy-baseline.json | 224 | "name": "placeholder", | CODE |
| LOW | ui/src/i18n/.i18n/raw-copy-baseline.json | 238 | "name": "placeholder", | CODE |
| LOW | ui/src/i18n/.i18n/raw-copy-baseline.json | 245 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 434 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 441 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 448 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 455 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 462 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 469 | "name": "placeholder", | CODE |
| LOW | …src/e2e/new-session-page.catalog-reconnect.e2e.test.ts | 942 | expect(await baseInput.getAttribute("placeholder")).toBe("Loading…"); | CODE |
| LOW | ui/src/e2e/memory-settings-defaults.e2e.test.ts | 156 | .poll(() => reloadedFrequencyRow.getByRole("textbox").getAttribute("placeholder")) | CODE |
| LOW | ui/src/e2e/new-session-page.github-projects.e2e.test.ts | 80 | expect(await baseRef.getAttribute("placeholder")).toBe("Base branch"); | CODE |
| LOW | ui/src/e2e/config-form-defaults.e2e.test.ts | 195 | .poll(() => retriesRow.getByRole("spinbutton").getAttribute("placeholder")) | CODE |
| LOW | ui/src/e2e/chat-composer-catalog.e2e.test.ts | 539 | await expect.poll(() => textarea.getAttribute("placeholder")).toContain("Message"); | CODE |
| LOW | ui/src/e2e/new-session-page.projects-places.e2e.test.ts | 218 | await expect.poll(() => pathInput.getAttribute("placeholder")).toBe("Gateway · local"); | CODE |
| LOW | ui/src/e2e/new-session-page.projects-places.e2e.test.ts | 222 | await expect.poll(() => pathInput.getAttribute("placeholder")).toBe("Gateway · QA-Gateway"); | CODE |
| LOW | ui/src/pages/chat/chat-view.test.ts | 3409 | expect(container.querySelector("textarea")?.getAttribute("placeholder")).toBe( | CODE |
| LOW⚡ | ui/src/pages/chat/chat-view.test.ts | 5585 | expect(textOnly.querySelector("textarea")?.getAttribute("placeholder")).toBe( | CODE |
| LOW⚡ | ui/src/pages/chat/chat-view.test.ts | 5590 | expect(ordinaryTextFile.querySelector("textarea")?.getAttribute("placeholder")).toBe( | CODE |
| LOW⚡ | ui/src/pages/chat/chat-view.test.ts | 5596 | expect(withImage.querySelector("textarea")?.getAttribute("placeholder")).toBe( | CODE |
| LOW | ui/src/pages/channels/wizard-view.busy.test.ts | 216 | expect(select.container.querySelector("wa-select")?.getAttribute("placeholder")).toBe( | CODE |
| LOW | test/scripts/openclaw-npm-publish.test.ts | 90 | writeFileSync(tarball, "placeholder", "utf8"); | CODE |
| LOW | test/scripts/npm-placeholder-publication.test.ts | 496 | expect(calls).toEqual([["dist-tag", "add", `${packageName}@0.0.0`, "placeholder"]]); | CODE |
| LOW | test/scripts/npm-placeholder-publication.test.ts | 505 | '{"__proto__":"2026.7.1","latest":"2026.7.2","placeholder":"0.0.0"}', | CODE |
| LOW | test/scripts/notarize-mac-artifact.test.ts | 38 | writeFileSync(artifact, "placeholder", "utf8"); | CODE |
| LOW | test/scripts/notarize-mac-artifact.test.ts | 54 | writeFileSync(artifact, "placeholder", "utf8"); | CODE |
| LOW | test/scripts/notarize-mac-artifact.test.ts | 83 | writeFileSync(artifact, "placeholder", "utf8"); | CODE |
| LOW | .agents/skills/crabbox/SKILL.md | 248 | history. No safe injection path? Report live auth blocked. No fake-key upgrade to | CODE |
| LOW | …s/skills/autoreview/tests/test_autoreview_hardening.py | 1048 | self.assertNotIn("placeholder", redacted) | STRING |
| LOW | docs/plugins/message-presentation.md | 315 | "placeholder": "Environment", | CODE |
| LOW | docs/plugins/manifest.md | 120 | "placeholder": "sk-or-v1-...", | CODE |
| LOW | docs/plugins/manifest.md | 708 | "placeholder": "sk-or-v1-...", | CODE |
| LOW | docs/plugins/manifest.md | 932 | "placeholder": "https://matrix.example.com" | CODE |
| LOW | docs/automation/imap.md | 54 | allowedSenders: ["trusted@example.com", "@example.org"], | CODE |
| LOW | docs/gateway/configuration-reference.md | 706 | "admin@example.com": ["operator.admin"], | CODE |
| LOW | docs/gateway/operator-scopes.md | 189 | "admin@example.com": ["operator.admin"], | CODE |
| LOW | docs/gateway/configuration-examples.md | 335 | imessage: ["user@example.com"], | CODE |
| LOW | docs/gateway/config-channels.md | 625 | allowFrom: ["+15555550123", "user@example.com", "chat_id:123"], | CODE |
| LOW | docs/gateway/trusted-proxy-auth.md | 162 | "admin@example.com": ["operator.admin"], | CODE |
| LOW | docs/channels/matrix-presentation.md | 27 | "placeholder": "Choose model", | CODE |
| LOW | docs/channels/line.md | 234 | address: "123 Main St", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 33 | "placeholder": "sk-proj-...", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 38 | "placeholder": "openai", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 43 | "placeholder": "text-embedding-3-small", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 48 | "placeholder": "https://api.openai.com/v1", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 54 | "placeholder": "1536", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 60 | "placeholder": "~/.openclaw/memory/lancedb", | CODE |
| LOW | extensions/memory-lancedb/openclaw.plugin.json | 79 | "placeholder": "500" | CODE |
| LOW | extensions/memory-lancedb/openclaw.plugin.json | 90 | "placeholder": "1000" | CODE |
| LOW | extensions/parallel/openclaw.plugin.json | 19 | "placeholder": "par-..." | CODE |
| LOW | …ions/parallel/src/parallel-web-search-provider.test.ts | 160 | "placeholder", | CODE |
| LOW | extensions/discord/src/components.test.ts | 768 | expect(modalPayload?.entry.fields?.[0]).not.toHaveProperty("placeholder"); | CODE |
| LOW | extensions/microsoft-foundry/index.test.ts | 405 | user: { name: "user@example.com" }, | CODE |
| LOW | extensions/google-meet/openclaw.plugin.json | 128 | "placeholder": "+15551234567" | CODE |
| LOW | …ensions/google-meet/src/response-body-boundary.test.ts | 39 | accessToken: "fake-token", | CODE |
| LOW | extensions/logbook/openclaw.plugin.json | 34 | "placeholder": "codex/gpt-5.6-sol", | CODE |
| LOW | extensions/sms/src/twilio.test.ts | 409 | ["relative", "placeholder"], | CODE |
| LOW | …b/src/live-transports/telegram/adapter.runtime.test.ts | 47 | driverToken: "placeholder", | CODE |
| LOW | …b/src/live-transports/telegram/adapter.runtime.test.ts | 48 | sutToken: "placeholder", | CODE |
| 263 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .crabbox.yaml | 1 | profile: openclaw-check | COMMENT |
| LOW | docker-compose.yml | 41 | CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY:-} | COMMENT |
| LOW | ui/config/control-ui-chunking.ts | 101 | // 640 KiB keeps the startup graph together; the previous 576 KiB boundary | COMMENT |
| LOW | ui/src/app/stale-chunk-reload.ts | 1 | // Stale hashed-chunk recovery for lazy routes and the entry stylesheet. | COMMENT |
| LOW | ui/src/app/update-schedule-dto.ts | 1 | // Normalizes the Gateway's update-availability and update-schedule payloads into | COMMENT |
| LOW | ui/src/styles/corner-shape.browser.test.ts | 181 | }, | COMMENT |
| LOW | ui/src/components/markdown-parser.ts | 161 | // with a file-extension blocklist to filter false positives at render time. | COMMENT |
| LOW | ui/src/lib/config/config-write-coordinator.ts | 421 | if (draftBelongsToPreviousConnection) { | COMMENT |
| LOW | ui/src/lib/config/config-gateway-operations.ts | 341 | } | COMMENT |
| LOW | ui/src/test-helpers/lit-settle.ts | 1 | type UpdatingElement = { updateComplete: Promise<boolean> }; | COMMENT |
| LOW | ui/src/e2e/chat-stream-runtime-budgets.e2e.test.ts | 21 | const suite = createChatFlowE2eSuite(); | COMMENT |
| LOW | ui/src/e2e/chat-stream-runtime-budgets.e2e.test.ts | 41 | const FRAME_SCHEDULED_MIN_RATIO = 0.9; | COMMENT |
| LOW | …rc/pages/chat/components/chat-transcript-projection.ts | 241 | transcript.setContentReady(!props.loading); | COMMENT |
| LOW | …pages/chat/components/chat-sidebar-rtl.browser.test.ts | 61 | // The quote bar, the list indent and the task-list checkbox gap are the | COMMENT |
| LOW | test/non-isolated-runner.ts | 361 | // the wipe hold one factory instance and later importers get a fresh one | COMMENT |
| LOW | test/jsdom-custom-elements.ts | 1 | // Jsdom custom elements keeps shared-worker element registrations in step with the module graph. | COMMENT |
| LOW | test/vitest/vitest.ui-e2e.sequencer.ts | 1 | // Duration-weighted sharding keeps serial Control UI E2E runners from | COMMENT |
| LOW | config/env-var-count-budget.txt | 1 | # Distinct OPENCLAW_* names in production source under src, packages, and extensions. | COMMENT |
| LOW | qa/scenarios/index.yaml | 1 | title: OpenClaw QA Scenario Pack | COMMENT |
| LOW | qa/scenarios/index.yaml | 21 | # `surface.feature`, with dashes allowed inside each segment | COMMENT |
| LOW | qa/scenarios/index.yaml | 41 | # `extended`, or `soak`; provider/model/auth/channel eligibility stays in | COMMENT |
| LOW | qa/scenarios/index.yaml | 61 | # soak | COMMENT |
| LOW | qa/scenarios/memory/memory-recall.yaml | 1 | title: Memory recall after context switch | COMMENT |
| LOW | qa/scenarios/agents/subagent-handoff.yaml | 61 | - throw: | COMMENT |
| LOW | docs/nodes/index.md | 741 | COMMENT | |
| LOW | …tensions/memory-lancedb/memory-capture-sanitization.ts | 481 | const afterDeliveryHints = stripLeadingMessageToolDeliveryHints(cleaned); | COMMENT |
| LOW | extensions/discord/src/thread-binding-api.ts | 1 | // Discord API module exposes the plugin public contract. | COMMENT |
| LOW | extensions/copilot/harness.ts | 341 | // conservative: any field whose change would invalidate the SDK | COMMENT |
| LOW | extensions/copilot/src/tool-bridge.test.ts | 1761 | // policies, before-tool-call hooks, two-phase plugin approvals via | COMMENT |
| LOW | extensions/copilot/src/tool-bridge.ts | 481 | // settle path. Errors thrown by the caller's handler must not | COMMENT |
| LOW | extensions/copilot/src/tool-bridge.ts | 681 | COMMENT | |
| LOW | extensions/copilot/src/replay-shim.ts | 1 | // Replay-shim for the GitHub Copilot agent runtime. | COMMENT |
| LOW | extensions/copilot/src/workspace-bootstrap.test.ts | 121 | // Readonly sandbox: bootstrap files live on the host workspace | COMMENT |
| LOW | extensions/copilot/src/attempt.test.ts | 4641 | }); | COMMENT |
| LOW | extensions/feishu/doctor-contract-api.ts | 1 | // Feishu API module exposes the plugin doctor contract. | COMMENT |
| LOW | extensions/feishu/src/docx-color-text.ts | 61 | */ | COMMENT |
| LOW | extensions/feishu/src/outbound.ts | 161 | } | COMMENT |
| LOW | extensions/feishu/src/outbound.ts | 1021 | const nextReplyMode = () => { | COMMENT |
| LOW | extensions/feishu/src/outbound.test.ts | 3581 | expect(sendMessageFeishuMock).toHaveBeenCalledTimes(2); | COMMENT |
| LOW | extensions/qa-lab/src/agentic-parity-report.ts | 201 | } | COMMENT |
| LOW | …nsions/qa-lab/src/providers/mock-openai/server.test.ts | 7401 | // tool-output evidence line, and a folded-back "Evidence" marker. | COMMENT |
| LOW | extensions/deepinfra/provider-models.ts | 221 | // `/v1/openai/models?sort_by=openclaw&filter=with_meta` projection is the | COMMENT |
| LOW | extensions/oc-path/src/cli.test.ts | 481 | // the per-kind emit boundary). The CLI handler must catch that | COMMENT |
| LOW | extensions/oc-path/src/oc-path/jsonl/parse.ts | 21 | // Detect the line-ending convention from the input. Windows-authored | COMMENT |
| LOW | extensions/mxc/src/windows-env.ts | 1 | // Windows process environment helpers for the MXC ProcessContainer backend. | COMMENT |
| LOW | extensions/mxc/src/windows-command.ts | 1 | // Windows command-line construction and cmd.exe quoting for the MXC | COMMENT |
| LOW | …ensions/codex/src/app-server/event-projector-result.ts | 141 | // shape `${turnId}:${kind}`. The mirror's idempotency key is derived | COMMENT |
| LOW | …ions/codex/src/app-server/context-engine-projection.ts | 121 | // fresh native thread at the rotation threshold, forcing the next turn to rotate | COMMENT |
| LOW | extensions/msteams/src/messenger.ts | 581 | // replyStyle === "top-level" — explicit "post at the top of the channel" | COMMENT |
| LOW | extensions/msteams/src/reply-stream-controller.ts | 101 | let nativeDeliveryClaimed = false; | COMMENT |
| LOW | extensions/msteams/src/delivery-trace.test.ts | 1 | // MSTeams delivery trace goldens: replayable wire-level lifecycle recordings. | COMMENT |
| LOW | extensions/msteams/src/thread-parent-context.ts | 1 | // Parent-message context injection for Teams channel thread replies. | COMMENT |
| LOW | extensions/browser/src/browser/screenshot-annotate.ts | 1 | // extensions/browser/src/browser/screenshot-annotate.ts | COMMENT |
| LOW | extensions/telegram/src/polling-session.ts | 121 | COMMENT | |
| LOW | extensions/googlechat/src/auth.proof.test.ts | 1 | // Proof: verifyGoogleChatRequest → fetchChatCerts through the REAL | COMMENT |
| LOW | extensions/slack/http-routes-api.ts | 1 | // Narrow entry point for registerSlackPluginHttpRoutes — avoids pulling in | COMMENT |
| LOW | extensions/slack/src/channel.lazy-seams.test.ts | 1 | // Regression tests for the lazy-loading boundaries introduced for Slack | COMMENT |
| LOW | extensions/slack/src/delivery-trace.test.ts | 1 | // Slack delivery trace goldens: replayable wire-level lifecycle recordings. | COMMENT |
| LOW | extensions/mattermost/channel-plugin-runtime.ts | 1 | // Private runtime-bearing plugin export for the bundled Mattermost entry. | COMMENT |
| LOW | extensions/imessage/src/actions.ts | 481 | // an inline probe so the first react/send-rich attempt after `imsg | COMMENT |
| 211 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | appcast.xml | 265 | <li><strong>PR #97928</strong> fix(agents): estimate harness role sizes in context guard char estimator (fixes #97927). | CODE |
| MEDIUM | appcast.xml | 412 | <li><strong>PR #96454</strong> feat(cli): openclaw attach — launch an external harness bound to a gateway session. Thank | CODE |
| MEDIUM | appcast.xml | 822 | <li><strong>PR #100200</strong> chore(android): add deterministic chat streaming replay test harness.</li> | CODE |
| MEDIUM | appcast.xml | 890 | <li><strong>PR #100201</strong> chore(ios): add deterministic streaming replay test harness for the shared chat pipeline | CODE |
| MEDIUM | appcast.xml | 1404 | <li><strong>PR #101244</strong> fix(diagnostics-otel): surface error message on run/harness error spans. Thanks @amknigh | CODE |
| MEDIUM | appcast.xml | 1460 | <li><strong>PR #101370</strong> fix(agent-core): handle stdout/stderr stream errors in harness exec. Thanks @wings1029.< | CODE |
| MEDIUM | appcast.xml | 1679 | <li><strong>PR #103467</strong> fix(ci): read Codex bindings from SQLite in live harness. Related #103451. Thanks @vince | CODE |
| MEDIUM | appcast.xml | 1839 | <li><strong>PR #95652</strong> fix(agents): activate selected harness plugins. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | appcast.xml | 1954 | <li><strong>PR #90223</strong> test: make qqbot symlinked media helper test robust on Windows. Thanks @aniruddhaadak80.< | CODE |
| MEDIUM | appcast.xml | 1989 | <li><strong>PR #95930</strong> docs(copilot): refresh harness parity notes. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | appcast.xml | 2018 | <li><strong>PR #96005</strong> feat(copilot): wire harness parity helpers. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | appcast.xml | 2091 | <li><strong>PR #96233</strong> fix(agents): run heartbeat_prompt_contribution on harness prompt builds. Thanks @azogheb | CODE |
| MEDIUM | appcast.xml | 2136 | <li><strong>PR #94838</strong> refactor(copilot): complete harness lifecycle parity. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | ui/src/pages/config/view-appearance.ts | 178 | // Both slots say "Theme default": Dash and Absolutely default | COMMENT |
| MEDIUM | test/scripts/npm-telegram-live.test.ts | 55 | const installRunEnd = script.indexOf("# Mount the trusted current-source QA harness"); | CODE |
| MEDIUM | test/scripts/npm-telegram-live.test.ts | 99 | const runtimeRunStart = script.indexOf("# Mount the trusted current-source QA harness"); | CODE |
| MEDIUM | qa/scenarios/memory/memory-recall.yaml | 19 | # the harness, not the models. So we keep it prose-only, covered by the | COMMENT |
| MEDIUM | qa/scenarios/media/image-understanding-attachment.yaml | 82 | # is the only thing an external harness can verify in mock mode. | COMMENT |
| MEDIUM | extensions/qa-lab/src/docker-harness.ts | 173 | return `# QA Docker harness example env | CODE |
| MEDIUM | …s/memory-core/src/memory-forget-curated-writes.test.ts | 111 | const memoryContent = "# Long-Term Memory\nA harness-authored private fact.\n"; | CODE |
| MEDIUM | scripts/test-live-codex-harness-docker.sh | 160 | # Force the Codex harness to use the staged `~/.codex` auth files. This lane | COMMENT |
| MEDIUM | scripts/test-live-codex-harness-docker.sh | 257 | # Codex. This lane must rebuild the live image so the plugin-owned harness is | COMMENT |
| MEDIUM | scripts/docker/install-sh-e2e/run.sh | 2 | # Official installer E2E harness for Docker. | COMMENT |
| MEDIUM | scripts/docker/install-sh-nonroot/run.sh | 65 | # This non-root harness downloads first; public smoke and CLI lanes intentionally | COMMENT |
| MEDIUM | scripts/e2e/cron-mcp-cleanup-docker.sh | 3 | # child-process cleanup through a mounted test harness. | COMMENT |
| MEDIUM | scripts/e2e/system-agent-first-run-docker.sh | 3 | # functional E2E image, with only the test harness mounted from the checkout. | COMMENT |
| MEDIUM | scripts/e2e/system-agent-rescue-docker.sh | 3 | # functional E2E image, with only the test harness mounted from the checkout. | COMMENT |
| MEDIUM | scripts/e2e/gateway-concurrency-docker.sh | 37 | # Only test-owned harness files cross into the container; the Gateway itself | COMMENT |
| MEDIUM | scripts/e2e/npm-telegram-live-docker.sh | 3 | # onboarding/doctor recovery, then runs the Telegram QA live harness. | COMMENT |
| MEDIUM | scripts/e2e/npm-telegram-live-docker.sh | 447 | # Mount the trusted current-source QA harness separately from the installed | COMMENT |
| MEDIUM | scripts/e2e/lib/upgrade-survivor/run.sh | 3 | # Signal traps inherit the foreground command's redirections. Keep harness stdout separate so the | COMMENT |
| MEDIUM | .github/workflows/qa-profile-evidence.yml | 167 | # workflow SHA from job context so trusted harness checkouts cannot drift to candidate code. | COMMENT |
| MEDIUM | .github/workflows/openclaw-performance.yml | 858 | # target schema so the trusted harness never writes invalid config. | COMMENT |
| MEDIUM | .github/workflows/openclaw-release-publish.yml | 999 | # the trusted harness install instead of the frozen target checkout. | COMMENT |
| MEDIUM | .github/workflows/install-smoke-reusable.yml | 52 | # this reusable workflow, so trusted harness checkouts cannot drift to candidate code. | COMMENT |
| MEDIUM | …ub/workflows/openclaw-live-and-e2e-checks-reusable.yml | 575 | # workflow SHA from job context so trusted harness checkouts cannot drift to candidate code. | COMMENT |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 1606 | #expect(await (harness.recorder.snapshot()).methods == ["openclaw.setup.verify"]) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 1610 | #expect(await (harness.recorder.snapshot()).methods == ["openclaw.setup.verify"]) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 1657 | #expect(await (harness.recorder.snapshot()).methods == ["openclaw.setup.detect"]) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 1693 | #expect(await (harness.recorder.snapshot()).methods == ["openclaw.setup.verify", "openclaw.setup.verify"]) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 1992 | #expect(await (harness.recorder.snapshot()).methods == ["agents.list"]) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 2089 | #expect(await (harness.recorder.snapshot()).methods == ["agents.list"]) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 2129 | #expect(await (harness.recorder.snapshot()).methods == ["agents.list"]) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 2198 | #expect(harness.session.latestTask()?.snapshotSendCount() == 1) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 2246 | #expect(harness.session.latestTask()?.snapshotSendCount() == 1) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 2281 | #expect(harness.session.snapshotMakeCount() == 0) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 2290 | #expect(harness.session.snapshotMakeCount() == 0) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 2356 | #expect(await (harness.recorder.snapshot()).methods == ["agents.list"]) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 2452 | #expect(await (harness.recorder.snapshot()).methods == ["agents.list", "agents.list"]) | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 3056 | #expect(await (harness.recorder.snapshot()).methods == [ | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 3093 | #expect(await (harness.recorder.snapshot()).methods == [ | STRING |
| MEDIUM | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 3161 | #expect(await (harness.recorder.snapshot()).methods == [ | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 418 | #expect(harness.vm.messages.count == 2) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 419 | #expect(harness.vm.messages.map(\.role) == ["user", "assistant"]) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 420 | #expect(harness.vm.pendingRunCount == 0) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 421 | #expect(harness.vm.pendingToolCalls.isEmpty) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 422 | #expect(harness.vm.streamingAssistantText == nil) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 460 | #expect(harness.vm.replayAssistantRows(text: "keyed reply").count == 1) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 461 | #expect(harness.vm.replayAssistantRows(text: "unkeyed reply").count == 1) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 462 | #expect(harness.vm.messages.count == 3) | STRING |
| 33 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | appcast.xml | 737 | <li><strong>PR #100077</strong> fix(agents): scale aggregate tool-result budget with context window and compact on press | CODE |
| MEDIUM | appcast.xml | 1157 | <li><strong>PR #99091</strong> fix: unblock replies after multi-agent room reset. Related #99082. Thanks @ZengWen-DT and | CODE |
| MEDIUM | appcast.xml | 1636 | <li><strong>PR #102005</strong> refactor(qa-lab): localize orchestration declarations. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | appcast.xml | 1747 | <li><strong>PR #105500</strong> fix(qa): repair agentic runtime parity mocks.</li> | CODE |
| MEDIUM | test/vitest/vitest.full-agentic.config.ts | 1 | // Vitest full agentic config wires the full agentic test shard. | COMMENT |
| MEDIUM | test/scripts/ios-release-prepare.test.ts | 1 | // iOS release prepare tests cover release-signing guardrails. | COMMENT |
| MEDIUM | .agents/skills/technical-documentation/SKILL.md | 45 | ## Sub-agent orchestration guidance | COMMENT |
| MEDIUM | .agents/skills/openclaw-ghsa-maintainer/SKILL.md | 10 | ## Respect advisory guardrails | COMMENT |
| MEDIUM | .agents/skills/release-openclaw-maintainer/SKILL.md | 36 | ## Respect release guardrails | COMMENT |
| MEDIUM | qa/scenarios/index.yaml | 48 | # - `core`: default Codex-vs-OpenClaw gate coverage for agentic behavior, | COMMENT |
| MEDIUM | qa/scenarios/memory/memory-recall.yaml | 28 | # in `extensions/qa-lab/src/agentic-parity-report.ts`. Positive-tone | COMMENT |
| MEDIUM | docs/plugins/memory-lancedb.md | 385 | ### Unsupported embedding model | COMMENT |
| MEDIUM | docs/providers/bedrock.md | 395 | You can apply [Amazon Bedrock Guardrails](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html) | CODE |
| MEDIUM | docs/providers/cerebras.md | 84 | Fresh onboarding follows Cerebras's current [Gemma 4 recommendation](https://www.cerebras.ai/blog/gemma-4-on-cerebras-th | CODE |
| MEDIUM | docs/start/why-openclaw.md | 159 | Related research provides context, not validation of OpenClaw's implementation. [Generative Agents](https://arxiv.org/ab | CODE |
| MEDIUM | docs/cli/plugins.md | 98 | ### Provider scaffold | COMMENT |
| MEDIUM | docs/concepts/context.md | 90 | ## What counts toward the context window | COMMENT |
| MEDIUM | docs/concepts/session-tool.md | 115 | ## Status and orchestration helpers | COMMENT |
| MEDIUM | docs/concepts/delegate-architecture.md | 248 | The login writes the delegate's SQLite auth store at `~/.openclaw/agents/delegate/agent/openclaw-agent.sqlite`; its loca | CODE |
| MEDIUM | docs/automation/cron-jobs.md | 587 | # Agent selection (multi-agent setups) | COMMENT |
| MEDIUM | docs/automation/cron-jobs.md | 904 | For untrusted inboxes, route the hook to a dedicated reader agent, give that agent read-only or no workspace access, and | CODE |
| MEDIUM | docs/reference/token-use.md | 56 | ## What counts in the context window | COMMENT |
| MEDIUM | docs/gateway/configuration-reference.md | 38 | ## Agent defaults, multi-agent, sessions, and messages | COMMENT |
| MEDIUM | docs/gateway/configuration.md | 481 | See [Multi-Agent](/concepts/multi-agent) and [full reference](/gateway/config-agents#multi-agent-routing) for bindin | CODE |
| MEDIUM | docs/gateway/security/index.md | 392 | ## Per-agent access profiles (multi-agent) | COMMENT |
| MEDIUM | extensions/qa-lab/src/agentic-parity.ts | 1 | // Qa Lab plugin module implements agentic parity behavior. | COMMENT |
| MEDIUM | extensions/qa-lab/src/agentic-parity-report.test.ts | 1 | // Qa Lab tests cover agentic parity report plugin behavior. | COMMENT |
| MEDIUM | extensions/qa-lab/src/docker-harness.ts | 205 | - \`${params.includeQaLabUi ? `http://127.0.0.1:${params.qaLabPort}` : "not published in this scaffold"}\` | CODE |
| MEDIUM | extensions/qa-lab/src/agentic-parity-report.ts | 9 | // Qa Lab plugin module implements agentic parity report behavior. | COMMENT |
| MEDIUM | extensions/qa-lab/src/agentic-parity-report.ts | 429 | // qa-suite-summary.json rather than a --parity-pack agentic run) cannot influence | COMMENT |
| MEDIUM | extensions/memory-wiki/src/vault.ts | 126 | // Missing scaffold means a new/recreated vault, even when its parent directory survived. | COMMENT |
| MEDIUM | extensions/anthropic/cli-shared.test.ts | 413 | // agentic autofill); restricted runs above must keep forcing --no-chrome. | COMMENT |
| MEDIUM | scripts/e2e/lib/onboard/scenario.sh | 331 | # Assert config + workspace scaffolding. | COMMENT |
| MEDIUM | .github/workflows/docker-release.yml | 167 | # Docker publication remains protected even though only release orchestration can call it. | COMMENT |
| MEDIUM | custodian-skills/add-model-provider/SKILL.md | 16 | openclaw models list --agent <agentId> # --agent is required in multi-agent rosters | CODE |
| MEDIUM | apps/macos/Sources/OpenClawIPC/IPC.swift | 71 | /// Local scaffold fallback (e.g., no index.html present). | COMMENT |
| MEDIUM | …/infra/heartbeat-runner.subagent-session-guard.test.ts | 1 | // Tests heartbeat runner guardrails for subagent sessions. | COMMENT |
| MEDIUM | src/plugins/runtime-live-state-guardrails.test.ts | 1 | // Verifies runtime live-state guardrails stay documented and enforced. | COMMENT |
| MEDIUM | src/plugins/loader-sdk-import-guardrails.test.ts | 1 | // Verifies loader guardrails for plugin SDK import boundaries. | COMMENT |
| MEDIUM | src/plugins/contracts/plugin-sdk-index.bundle.test.ts | 76 | // guardrails, and `plugin-sdk-subpaths.test.ts`. This file only keeps the expensive | COMMENT |
| MEDIUM | src/plugins/contracts/plugin-sdk-index.bundle.test.ts | 111 | // plugin-sdk-package-contract-guardrails.test.ts and plugin-sdk-subpaths.test.ts. Keep this file | COMMENT |
| MEDIUM | src/agents/acp-workspace-provisioning.test.ts | 104 | // Turn scoped to the binding whose cwd points elsewhere: skip scaffold. | COMMENT |
| MEDIUM | …models-config.providers.secrets.bedrock-apikey.test.ts | 1 | // Covers Bedrock AWS SDK auth markers and marker-backed discovery secret guardrails. | COMMENT |
| MEDIUM | src/agents/mcp-transport.test.ts | 1 | // Covers MCP HTTP transport redirects, SSRF guardrails, and auth/TLS handoff. | COMMENT |
| MEDIUM | src/agents/execution-contract.test.ts | 1 | // Covers provider/model gates for strict agentic execution-contract activation. | COMMENT |
| MEDIUM | src/agents/execution-contract.test.ts | 126 | // inherit OpenAI-specific strict-agentic handling by accident. | COMMENT |
| MEDIUM | src/agents/execution-contract.ts | 98 | // strict-agentic is a GPT-5-family OpenAI runtime contract | COMMENT |
| MEDIUM | src/agents/execution-contract.ts | 112 | // Explicit strict-agentic OR unspecified-but-supported → strict-agentic. | COMMENT |
| MEDIUM | src/agents/tools/nodes-tool.test.ts | 2 | // numeric schema guardrails, and pairing approval scopes. | COMMENT |
| MEDIUM | src/agents/embedded-agent-runner/run-loop.ts | 241 | // Silent-error retry: non-strict-agentic models (e.g. ollama/glm-5.1) can | COMMENT |
| MEDIUM | src/plugin-sdk/plugin-entry.ts | 102 | // The plugin-authoring scaffold imports ProviderPlugin from this entrypoint. | COMMENT |
| MEDIUM⚡ | src/sessions/user-turn-transcript.ts | 199 | // Like #111204, mark late-media scaffolding as wire-only so UIs never render it. | COMMENT |
| MEDIUM⚡ | src/commands/status.scan.fast-json.ts | 59 | // `enabled` alone can be a default scaffold; require another configured field. | COMMENT |
| MEDIUM | …ay/server.auth.control-ui.bootstrap-lifecycle.suite.ts | 281 | // The full agentic shard can saturate the event loop enough that the | COMMENT |
| MEDIUM | …ls/plugins/contracts/channel-import-guardrails.test.ts | 191 | // Config schema stays on the public SDK seam and is covered by dedicated config guardrails. | COMMENT |
| MEDIUM | …ls/plugins/contracts/channel-import-guardrails.test.ts | 432 | // plugin-sdk guardrails instead of the generic "core should not touch extensions" rule. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/scripts/install-sh.test.ts | 2579 | /# Step 1: Node\.js[\s\S]*?load_nvm_for_node_detection\s+if ! check_node; then/, | CODE |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 44 | ## Step 1: Identify | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 79 | ## Step 2: Decide (Agent) | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 98 | ## Step 3: Redact | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 112 | ## Step 4: Purge Edit History | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 168 | ## Step 5: Notify | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 189 | ## Step 6: Resolve | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 199 | ## Step 7: Summary | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 180 | ## Step 1: Read The Target | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 207 | ## Step 2: Search Broadly With Gitcrawl | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 244 | ## Step 3: Use Live GitHub Search For Gaps | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 258 | ## Step 4: Decide The Outcome | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 276 | ## Step 5: Reuse Or Create One prtags Group | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 326 | ## Step 6: Ensure The Annotation Fields Exist | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 349 | ## Step 7: Save The Maintainer Judgment In prtags | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 383 | ## Step 8: Let prtags Sync The Group Comment | COMMENT |
| LOW | docs/plugins/sdk-provider-plugins.md | 31 | ### Step 1: Package and manifest | COMMENT |
| LOW | docs/plugins/sdk-provider-plugins.md | 753 | ### Step 5: Add extra capabilities | COMMENT |
| LOW | docs/plugins/sdk-provider-plugins.md | 1136 | ### Step 6: Test | COMMENT |
| LOW | docs/gateway/cloudflare-access.md | 38 | ## Step 1: Route the tunnel to loopback | COMMENT |
| LOW | docs/gateway/cloudflare-access.md | 54 | ## Step 2: Protect the hostname with Access | COMMENT |
| LOW | docs/gateway/cloudflare-access.md | 64 | ## Step 3: Trust those headers in the Gateway | COMMENT |
| LOW | docs/gateway/cloudflare-access.md | 93 | ## Step 4: Decide how nodes and workers get in | COMMENT |
| LOW | docs/gateway/cloudflare-access.md | 125 | ## Step 5: Connect each client | COMMENT |
| LOW | docs/gateway/remote.md | 253 | #### Step 1: add SSH config | COMMENT |
| LOW⚡ | docs/gateway/remote.md | 267 | #### Step 2: copy SSH key (one-time) | COMMENT |
| LOW⚡ | docs/gateway/remote.md | 273 | #### Step 3: configure the gateway token | COMMENT |
| LOW⚡ | docs/gateway/remote.md | 281 | #### Step 4: create the LaunchAgent | COMMENT |
| LOW | docs/gateway/remote.md | 306 | #### Step 5: load the LaunchAgent | COMMENT |
| LOW | docs/channels/msteams.md | 208 | ### Step 1: Create Azure Bot | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 228 | ### Step 2: Get credentials | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 234 | ### Step 3: Configure messaging endpoint | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 241 | ### Step 4: Enable Teams channel | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 247 | ### Step 5: Build Teams app manifest | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 256 | ### Step 6: Configure OpenClaw | COMMENT |
| LOW | docs/channels/msteams.md | 274 | ### Step 7: Run the gateway | COMMENT |
| LOW | extensions/discord/src/voice-message.ts | 413 | // Step 1: Request upload URL from Discord | COMMENT |
| LOW | extensions/discord/src/voice-message.ts | 441 | // Step 3: Send the message with voice message flag and metadata | COMMENT |
| LOW | extensions/feishu/src/bitable.ts | 295 | // Step 1: Clean up default fields | COMMENT |
| LOW | extensions/feishu/src/bitable.ts | 346 | // Step 2: Delete empty placeholder rows (batch when possible) | COMMENT |
| LOW⚡ | extensions/irc/src/protocol.ts | 119 | // Step 1: decode surrogate pairs — first group locked to high surrogate range | COMMENT |
| LOW⚡ | extensions/irc/src/protocol.ts | 128 | // Step 2: decode BMP codepoints; preserve lone surrogates as literals | COMMENT |
| LOW⚡ | …tensions/imessage/src/monitor/self-chat-dedupe.test.ts | 426 | // Step 1: is_from_me=true copy arrives (real user message) → processed, selfChatCache populated | COMMENT |
| LOW⚡ | …tensions/imessage/src/monitor/self-chat-dedupe.test.ts | 433 | // Step 2: is_from_me=false reflection arrives 2s later with same text+createdAt | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 602 | // Step 1: trigger msg A — don't await, let it block in dispatch | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 608 | // Step 2: wait until dispatch is in-flight | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 613 | // Step 3: msg B arrives while agent is processing — must not be lost | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 616 | // Step 4: unblock dispatch and complete | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 621 | // Step 5: trigger msg C — should see [msg B] in history (msg A was consumed) | COMMENT |
| LOW | scripts/install.sh | 3760 | # Step 1: Node.js. macOS package-manager branches install Homebrew lazily | COMMENT |
| LOW⚡ | scripts/install.sh | 3790 | # Step 3: Git (required for npm installs that may fetch from git or apply patches) | COMMENT |
| LOW⚡ | scripts/install.sh | 3795 | # Step 4: npm permissions (Linux) | COMMENT |
| LOW⚡ | scripts/install.sh | 3798 | # Step 5: OpenClaw | COMMENT |
| LOW⚡ | scripts/setup-auth-system.sh | 15 | # Step 1: Check current auth status | COMMENT |
| LOW⚡ | scripts/setup-auth-system.sh | 20 | # Step 2: Set up long-lived token | COMMENT |
| LOW | scripts/setup-auth-system.sh | 41 | # Step 3: Set up auth monitoring | COMMENT |
| LOW | scripts/setup-auth-system.sh | 151 | # Step 4: Termux widget setup | COMMENT |
| LOW⚡ | …-definition-adapter.after-tool-call.fires-once.test.ts | 204 | // Step 1: Simulate tool_execution_start event (SDK emits this) | COMMENT |
| LOW⚡ | …-definition-adapter.after-tool-call.fires-once.test.ts | 207 | // Step 2: Execute tool through the adapter wrapper (SDK calls this) | COMMENT |
| LOW⚡ | …-definition-adapter.after-tool-call.fires-once.test.ts | 210 | // Step 3: Simulate tool_execution_end event (SDK emits this after execute returns) | COMMENT |
| 4 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/scripts/install-sh.test.ts | 2579 | /# Step 1: Node\.js[\s\S]*?load_nvm_for_node_detection\s+if ! check_node; then/, | CODE |
| LOW | extensions/discord/src/voice-message.ts | 413 | // Step 1: Request upload URL from Discord | COMMENT |
| LOW | extensions/discord/src/voice-message.ts | 441 | // Step 3: Send the message with voice message flag and metadata | COMMENT |
| LOW | extensions/feishu/src/bitable.ts | 295 | // Step 1: Clean up default fields | COMMENT |
| LOW | extensions/feishu/src/bitable.ts | 346 | // Step 2: Delete empty placeholder rows (batch when possible) | COMMENT |
| LOW⚡ | extensions/irc/src/protocol.ts | 119 | // Step 1: decode surrogate pairs — first group locked to high surrogate range | COMMENT |
| LOW⚡ | extensions/irc/src/protocol.ts | 128 | // Step 2: decode BMP codepoints; preserve lone surrogates as literals | COMMENT |
| LOW⚡ | …tensions/imessage/src/monitor/self-chat-dedupe.test.ts | 426 | // Step 1: is_from_me=true copy arrives (real user message) → processed, selfChatCache populated | COMMENT |
| LOW⚡ | …tensions/imessage/src/monitor/self-chat-dedupe.test.ts | 433 | // Step 2: is_from_me=false reflection arrives 2s later with same text+createdAt | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 602 | // Step 1: trigger msg A — don't await, let it block in dispatch | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 608 | // Step 2: wait until dispatch is in-flight | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 613 | // Step 3: msg B arrives while agent is processing — must not be lost | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 616 | // Step 4: unblock dispatch and complete | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 621 | // Step 5: trigger msg C — should see [msg B] in history (msg A was consumed) | COMMENT |
| LOW | extensions/signal/src/monitor/event-handler.ts | 975 | // We need to check if it's from our own account to prevent self-reply loops | COMMENT |
| LOW | scripts/install.sh | 3760 | # Step 1: Node.js. macOS package-manager branches install Homebrew lazily | COMMENT |
| LOW⚡ | scripts/install.sh | 3790 | # Step 3: Git (required for npm installs that may fetch from git or apply patches) | COMMENT |
| LOW⚡ | scripts/install.sh | 3795 | # Step 4: npm permissions (Linux) | COMMENT |
| LOW⚡ | scripts/install.sh | 3798 | # Step 5: OpenClaw | COMMENT |
| LOW⚡ | scripts/setup-auth-system.sh | 15 | # Step 1: Check current auth status | COMMENT |
| LOW⚡ | scripts/setup-auth-system.sh | 20 | # Step 2: Set up long-lived token | COMMENT |
| LOW | scripts/setup-auth-system.sh | 41 | # Step 3: Set up auth monitoring | COMMENT |
| LOW | scripts/setup-auth-system.sh | 151 | # Step 4: Termux widget setup | COMMENT |
| LOW⚡ | …-definition-adapter.after-tool-call.fires-once.test.ts | 204 | // Step 1: Simulate tool_execution_start event (SDK emits this) | COMMENT |
| LOW⚡ | …-definition-adapter.after-tool-call.fires-once.test.ts | 207 | // Step 2: Execute tool through the adapter wrapper (SDK calls this) | COMMENT |
| LOW⚡ | …-definition-adapter.after-tool-call.fires-once.test.ts | 210 | // Step 3: Simulate tool_execution_end event (SDK emits this after execute returns) | COMMENT |
| LOW⚡ | src/agents/sessions/package-manager.ts | 637 | // Step 1: Apply includes (or all if no includes) | COMMENT |
| LOW⚡ | src/agents/sessions/package-manager.ts | 645 | // Step 2: Apply excludes | COMMENT |
| LOW⚡ | src/agents/sessions/package-manager.ts | 650 | // Step 3: Force-include (add back from allPaths, overriding exclusions) | COMMENT |
| LOW⚡ | src/agents/sessions/package-manager.ts | 659 | // Step 4: Force-exclude (remove even if included or force-included) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | extensions/msteams/src/messenger.ts | 285 | // Mark as AI-generated so Teams renders the "AI generated" badge. | COMMENT |
| HIGH | extensions/msteams/src/messenger.ts | 295 | // Start with mention entities (if any) + AI-generated entity | COMMENT |
| HIGH | extensions/msteams/src/sdk.ts | 89 | // Feedback (thumbs up/down) on AI-generated messages — Teams delivers | COMMENT |
| HIGH | extensions/msteams/src/monitor.ts | 539 | // Feedback (thumbs up/down) on AI-generated messages. Teams delivers this as | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/install/daytona.md | 50 | daytona login --api-key=YOUR_API_KEY | CODE |
| HIGH | docs/concepts/memory-honcho.md | 74 | apiKey: "your-api-key", // omit for self-hosted | CODE |
| HIGH | skills/trello/SKILL.md | 35 | export TRELLO_API_KEY="your-api-key" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/Tests/OpenClawIPCTests/WebChatSwiftUISmokeTests.swift | 0 | {"sessionkey":"\(sessionkey)","sessionid":null,"messages":[],"thinkinglevel":"off"} | STRING |
| HIGH | …/Tests/OpenClawIPCTests/QuickChatControllerTests.swift | 0 | {"sessionkey":"\(sessionkey)","sessionid":null,"messages":[],"thinkinglevel":"off"} | STRING |
| HIGH | …enClawKitTests/ChatViewModelSessionDeletionTests.swift | 0 | {"sessionkey":"\(sessionkey)","sessionid":null,"messages":[],"thinkinglevel":"off"} | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/skills/autoreview/tests/test_autoreview_hardening.py | 3143 | CODE | |
| LOW | …s/skills/autoreview/tests/test_autoreview_hardening.py | 3393 | CODE | |
| LOW | scripts/compare-release-evidence-zip.py | 13 | CODE | |
| LOW | scripts/release-telegram-candidate-archive.py | 207 | CODE | |
| LOW | scripts/release-telegram-candidate-archive.py | 436 | CODE | |
| LOW | scripts/e2e/telegram-user-driver.py | 563 | CODE | |
| LOW | scripts/e2e/telegram-user-driver.py | 907 | CODE | |
| LOW | scripts/e2e/telegram-user-driver.py | 291 | CODE | |
| LOW | scripts/e2e/telegram-user-driver.py | 568 | CODE | |
| LOW | scripts/e2e/telegram-user-driver.py | 697 | CODE | |
| LOW | scripts/e2e/telegram-user-driver.py | 781 | CODE | |
| LOW | skills/model-usage/scripts/model_usage.py | 156 | CODE | |
| LOW | skills/skill-creator/scripts/package_skill.py | 28 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/create-dmg.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/run-opengrep.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/notarize-mac-artifact.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/k8s/deploy.sh | 7 | # Usage: | COMMENT |
| LOW⚡ | scripts/k8s/create-kind.sh | 6 | # Usage: | COMMENT |
| LOW⚡ | scripts/clawdock/clawdock-helpers.sh | 10 | # Usage: | COMMENT |
| LOW | scripts/e2e/multi-node-update-docker.sh | 11 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/ios-team-id.sh | 117 | except Exception: | CODE |
| LOW | scripts/ios-team-id.sh | 175 | except Exception: | CODE |
| LOW | scripts/docker/setup.sh | 91 | except Exception: | CODE |
| LOW | scripts/e2e/telegram-user-driver.py | 804 | except Exception: | CODE |
| LOW | scripts/e2e/parallels/npm-update-scripts.ts | 278 | except Exception: | CODE |
| LOW⚡ | scripts/e2e/parallels/windows-git.ts | 52 | except Exception: | CODE |
| LOW | skills/model-usage/scripts/model_usage.py | 92 | except Exception: | CODE |
| LOW | skills/model-usage/scripts/model_usage.py | 284 | except Exception as exc: | CODE |
| LOW | skills/skill-creator/scripts/package_skill.py | 114 | except Exception as e: | CODE |
| LOW | skills/python-debugpy/SKILL.md | 48 | except Exception: | CODE |
| MEDIUM | apps/macos/Sources/OpenClawMacCLI/ConnectCommand.swift | 265 | print("Error: \(error)") | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/skills/autoreview/tests/test_autoreview_hardening.py | 2 | CODE | |
| LOW | …s/skills/autoreview/tests/test_autoreview_hardening.py | 9 | CODE | |
| LOW | …s/skills/autoreview/tests/test_autoreview_hardening.py | 17 | CODE | |
| LOW | …gents/skills/autoreview/scripts/test-review-harness.py | 2 | CODE | |
| LOW | .agents/skills/autoreview/scripts/autoreview_test.py | 2 | CODE | |
| LOW | .agents/skills/autoreview/scripts/autoreview_test.py | 10 | CODE | |
| LOW | scripts/check-composite-action-input-interpolation.py | 2 | CODE | |
| LOW | scripts/release-telegram-candidate-archive.py | 4 | CODE | |
| LOW | skills/model-usage/scripts/model_usage.py | 8 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.yml | 52 | ## Set DOCKER_GID to the host's docker group GID (run: stat -c '%g' /var/run/docker.sock). | COMMENT |
| LOW | scripts/clawlog.sh | 353 | # Check if file was created and has content | COMMENT |
| LOW | scripts/auth-monitor.sh | 39 | # Check if we notified recently | COMMENT |
| LOW | scripts/auth-monitor.sh | 47 | # Check if we can still use openclaw | COMMENT |
| LOW⚡ | scripts/k8s/create-kind.sh | 154 | # Check if cluster already exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | extensions/active-memory/prompt.test.ts | 9 | "Please let me know if you need help.", | CODE |
| LOW | …ess/agent-end-side-effects.no-verbatim-capture.test.ts | 70 | "#4242 Vendor Blue 7: Also when reading comments make sure to read the comments they responded to also.", | CODE |
| MEDIUM | src/agents/failover/classify.predicates.test.ts | 170 | "Let me know if you need more details on any of these topics!"; | CODE |
| MEDIUM | …over/failover-classification.legacy-billing-b.cases.ts | 191 | "Sure! Here's how to set up billing for your SaaS application.\n\n## Payment Integration\n\nFirst, you'll need to co | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/gateway-openai-compaction-replay.e2e.test.ts | 233 | async function handleRequest( | CODE |
| LOW | …/clickclack/src/discussions/durable-room-proof.test.ts | 80 | async function handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void> { | CODE |
| LOW | src/cli/skills-cli.clawhub-install.e2e.test.ts | 57 | async function handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void> { | CODE |
| LOW | src/cli/plugins-cli.clawhub-install.e2e.test.ts | 89 | async function handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void> { | CODE |
| LOW | src/auto-reply/chunk.test.ts | 144 | const fence = "```python\ndef my_function():\n x = 1\n\n y = 2\n return x + y\n```"; | CODE |
| LOW | src/gateway/server-http.ts | 243 | async function handleRequest( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/create-dmg.sh | 4 | # Create a styled DMG containing the app bundle + /Applications symlink. | COMMENT |
| MEDIUM | scripts/e2e/multi-node-update-docker.sh | 125 | # Create a systemctl shim since we are in Docker (no real systemd). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/autoreview/scripts/autoreview_test.py | 121 | CODE |