Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞
This report presents the forensic synthetic code analysis of openclaw/openclaw, a TypeScript project with 382,861 GitHub stars. SynthScan v2.0 examined 7,232,129 lines of code across 23061 source files, recording 38758 pattern matches distributed across 22 syntactic categories. The overall adjusted score of 5.7 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 38758 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tsdown.config.ts | 149 | function nodeWorkspacePackageBuildConfig(packageDir: string, config: UserConfig = {}): UserConfig { | CODE |
| LOW | tsdown.config.ts | 215 | function shouldNeverBundleDependency(id: string): boolean { | CODE |
| LOW | tsdown.config.ts | 221 | function shouldAlwaysBundleDependency(id: string): boolean { | CODE |
| LOW | tsdown.config.ts | 238 | function listBundledPluginEntrySources( | CODE |
| LOW | tsdown.config.ts | 340 | function buildAgentCoreDistEntries(): Record<string, string> { | CODE |
| LOW | tsdown.config.ts | 368 | function buildPackageDistEntriesFromExports(packageDir: string): Record<string, string> { | CODE |
| LOW | tsdown.config.ts | 395 | function buildSpeechCoreDistEntries(): Record<string, string> { | CODE |
| LOW | tsdown.config.ts | 414 | function shouldExternalizeAgentCoreDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 430 | function shouldExternalizeGatewayProtocolDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 434 | function shouldExternalizeGatewayClientDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 440 | function shouldExternalizeNetPolicyDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 444 | function shouldExternalizeSpeechCoreDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 448 | function shouldExternalizeLlmCoreDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 452 | function shouldExternalizeMarkdownCoreDependency(id: string): boolean { | CODE |
| LOW⚡ | tsdown.config.ts | 458 | function shouldExternalizeTerminalCoreDependency(id: string): boolean { | CODE |
| LOW | ui/vite.config.ts | 51 | export function createControlUiPrecompressedAssetVariants( | CODE |
| LOW | ui/vite.config.ts | 162 | export function resolveControlUiBuildInfo( | CODE |
| LOW | ui/vite.config.ts | 230 | function resolveTsconfigTargetPath(target: string): string { | CODE |
| LOW | ui/vite.config.ts | 277 | export function resolveSourcePackageAliasesForVite(): ControlUiViteAlias[] { | CODE |
| LOW | ui/vite.config.ts | 288 | export function resolveExternalPackageAliasesForVite(): ControlUiViteAlias[] { | CODE |
| LOW | ui/vite.config.ts | 308 | export function resolveTsconfigPathAliasesForVite(): ControlUiViteAlias[] { | CODE |
| LOW | ui/vite.config.ts | 327 | function normalizeViteImporterPath(importer: string): string { | CODE |
| LOW | ui/vite.config.ts | 331 | export function controlUiBrowserOnlySharedModuleAliases(): Plugin { | CODE |
| LOW | ui/vite.config.ts | 354 | function controlUiServiceWorkerBuildIdPlugin(buildId: string): Plugin { | CODE |
| LOW | ui/vite.config.ts | 373 | function controlUiPrecompressedAssetsPlugin(): Plugin { | CODE |
| LOW | ui/vitest.config.ts | 98 | function resolveChromiumLaunchOptions(): { executablePath: string } | undefined { | CODE |
| LOW | ui/src/main.ts | 38 | function syncDocumentPublicAssetLinks() { | CODE |
| LOW | ui/src/build-info-normalizers.ts | 24 | function normalizeControlUiBuildTimestamp(value: unknown): string | null { | CODE |
| LOW | ui/src/build-info-normalizers.ts | 39 | function normalizeControlUiBuildId(value: unknown): string { | CODE |
| LOW | ui/src/build-info-normalizers.ts | 51 | export function normalizeControlUiBuildInfo(value: unknown): ControlUiBuildInfo { | CODE |
| LOW | ui/src/app-route-paths.ts | 82 | export function inferBasePathFromPathname(pathname: string): string { | CODE |
| LOW | ui/src/app-navigation.ts | 53 | export function normalizeSidebarPinnedRoutes(value: unknown): SidebarNavRoute[] | null { | CODE |
| LOW | ui/src/app-navigation.ts | 90 | function settingsSearchHasWordPrefix(value: string, query: string): boolean { | CODE |
| LOW | ui/src/app-navigation.ts | 110 | export function settingsSearchTextMatches(value: string, query: string): boolean { | CODE |
| LOW | ui/src/app-navigation.ts | 184 | export function isSettingsNavigationRoute(routeId: NavigationRouteId): boolean { | CODE |
| LOW | ui/src/app-navigation.ts | 291 | export function settingsNavigationLabelForRoute(routeId: NavigationRouteId): string { | CODE |
| LOW | ui/src/app/agent-selection.ts | 25 | export function createAgentSelectionCapability( | CODE |
| LOW | ui/src/app/approval-deep-link.ts | 13 | export function resolveApprovalDocumentMode( | CODE |
| LOW⚡ | ui/src/app/control-ui-auth.ts | 24 | export function resolveControlUiAuthToken(source: ControlUiAuthSource): string | null { | CODE |
| LOW⚡ | ui/src/app/control-ui-auth.ts | 33 | export function resolveControlUiAuthHeader(source: ControlUiAuthSource): string | null { | CODE |
| LOW⚡ | ui/src/app/control-ui-auth.ts | 42 | export function resolveControlUiAuthCandidates(source: ControlUiAuthSource): string[] { | CODE |
| LOW | ui/src/app/public-assets.ts | 23 | export function inferControlUiPublicAssetPath( | CODE |
| LOW | ui/src/app/navigation-surface.ts | 4 | export function navigationSurfaceIsHidden(params: { | CODE |
| LOW | ui/src/app/user-identity.ts | 29 | export function normalizeLocalUserIdentity( | CODE |
| LOW | ui/src/app/user-identity.ts | 46 | export function resolveLocalUserAvatarUrl( | CODE |
| LOW | ui/src/app/user-identity.ts | 57 | export function resolveLocalUserAvatarText( | CODE |
| LOW | ui/src/app/settings.ts | 17 | function currentGatewaySelectionKeyForPage(pageUrl: string): string { | CODE |
| LOW | ui/src/app/settings.ts | 54 | export function normalizeChatSendShortcut(value: unknown): ChatSendShortcut { | CODE |
| LOW | ui/src/app/settings.ts | 63 | export function normalizeChatWorkspaceDock(value: unknown): ChatWorkspaceDock { | CODE |
| LOW | ui/src/app/settings.ts | 171 | export function resolvePageGatewaySettings(settings: UiSettings): UiSettings { | CODE |
| LOW | ui/src/app/settings.ts | 208 | function settingsMatchGatewayTarget(parsed: PersistedUiSettings, targetUrl: string): boolean { | CODE |
| LOW | ui/src/app/settings.ts | 233 | function tokenSessionKeyForGateway(gatewayUrl: string): string { | CODE |
| LOW | ui/src/app/settings.ts | 237 | function resolveScopedSessionSelection( | CODE |
| LOW | ui/src/app/settings.ts | 265 | export function loadGatewaySessionSelection(gatewayUrl: string): ScopedSessionSelection { | CODE |
| LOW | ui/src/app/settings.ts | 290 | export function resolveGatewayTokenForUrlEdit( | CODE |
| LOW | ui/src/app/overlays.ts | 108 | function resolveUpdateStatusBanner(params: { | CODE |
| LOW | ui/src/app/overlays.ts | 141 | function resolveUpdateVerificationBanner(params: { | CODE |
| LOW | ui/src/app/overlays.ts | 154 | function resolvePostRestartUpdateBanner( | CODE |
| LOW | ui/src/app/overlays.ts | 168 | function resolvePendingUpdateHandoffTimeoutBanner(): ApplicationStatusBanner { | CODE |
| LOW | ui/src/app/overlays.ts | 175 | function isPendingUpdateHandoffSentinel( | CODE |
| 37650 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | ui/src/pages/memory-import/memory-import-page.test.ts | 450 | mutableContext.agents.state.agentsList.agents.push({ id: "writer", name: "Writer" }); | CODE |
| CRITICAL | extensions/memory-lancedb/index.test.ts | 2376 | expect(harness.logger.warn.mock.calls.map(([message]) => String(message))).toEqual([ | CODE |
| CRITICAL | extensions/discord/src/voice/manager.e2e.test.ts | 2081 | expect(client.rest.get.mock.calls.slice(0, 31)).toEqual( | CODE |
| CRITICAL | extensions/discord/src/voice/manager.e2e.test.ts | 2084 | expect(client.rest.get.mock.calls.slice(31)).toEqual( | CODE |
| CRITICAL | extensions/device-pair/notify.ts | 259 | const adapter = await params.api.runtime.channel.outbound.loadAdapter("telegram"); | CODE |
| CRITICAL | extensions/device-pair/index.ts | 692 | const adapter = await params.api.runtime.channel.outbound.loadAdapter(params.ctx.channel); | CODE |
| CRITICAL | extensions/codex/src/session-catalog.ts | 890 | const created = await params.api.runtime.agent.session.createSessionEntry({ | CODE |
| CRITICAL | extensions/codex/src/session-catalog.ts | 1013 | const restored = await params.api.runtime.agent.session.patchSessionEntry({ | CODE |
| CRITICAL | extensions/codex/src/session-catalog-node-adoption.ts | 211 | finalized = await params.api.runtime.agent.session.patchSessionEntry({ | CODE |
| CRITICAL | extensions/codex/src/session-catalog-node-adoption.ts | 243 | const currentEntry = params.api.runtime.agent.session.getSessionEntry({ | CODE |
| CRITICAL | extensions/codex/src/session-catalog-node-adoption.ts | 289 | const created = await params.api.runtime.agent.session.createSessionEntry({ | CODE |
| CRITICAL | extensions/openshell/src/backend.ts | 731 | ...this.params.execContext.config.providers.flatMap((provider) => ["--provider", provider]), | CODE |
| CRITICAL⚡ | extensions/diagnostics-otel/src/service.test.ts | 4531 | telemetryState.tracer.startSpan.mock.calls.filter((call) => call[0] === "openclaw.run"), | CODE |
| CRITICAL⚡ | extensions/diagnostics-otel/src/service.test.ts | 4534 | telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL⚡ | extensions/diagnostics-otel/src/service.test.ts | 4539 | telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL⚡ | extensions/diagnostics-otel/src/service.test.ts | 4544 | telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 900 | const spanNames = telemetryState.tracer.startSpan.mock.calls.map((call) => call[0]); | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 1631 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 2285 | const modelUsageCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 2639 | const skillSpanCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 2744 | const spanNames = telemetryState.tracer.startSpan.mock.calls.map((call) => call[0]); | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 3422 | const linkedSpanContexts = telemetryState.tracer.setSpanContext.mock.calls.map( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 3431 | telemetryState.tracer.startSpan.mock.calls.map((call) => [ | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 3583 | telemetryState.tracer.startSpan.mock.calls.map((call) => [ | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 3665 | telemetryState.tracer.startSpan.mock.calls.map((call) => [ | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 3967 | const modelUsageCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4358 | telemetryState.tracer.startSpan.mock.calls.map((call) => [call[0], call[2]]), | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4400 | telemetryState.tracer.startSpan.mock.calls.map((call) => [call[0], call[2]]), | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4456 | telemetryState.tracer.startSpan.mock.calls.map((call) => [call[0], call[2]]), | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4647 | const deliverySpanCalls = telemetryState.tracer.startSpan.mock.calls.filter( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4915 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4918 | const toolCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 4974 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5037 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5131 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5191 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5246 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5292 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5363 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5423 | const modelCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/diagnostics-otel/src/service.test.ts | 5467 | const modelUsageCall = telemetryState.tracer.startSpan.mock.calls.find( | CODE |
| CRITICAL | extensions/telegram/src/draft-stream.test.ts | 1375 | const pages = api.raw.sendRichMessage.mock.calls.map((call) => { | CODE |
| CRITICAL | extensions/telegram/src/draft-stream.test.ts | 1401 | const pages = api.raw.sendRichMessage.mock.calls.map((call) => { | CODE |
| CRITICAL | extensions/slack/src/outbound-payload.test.ts | 516 | const fallbackCalls = client.chat.postMessage.mock.calls.slice(1, -1); | CODE |
| CRITICAL | extensions/slack/src/outbound-payload.test.ts | 529 | expect(client.chat.postMessage.mock.calls.at(-1)?.[0]).toMatchObject({ | CODE |
| CRITICAL | extensions/slack/src/send.blocks.test.ts | 259 | const postedTexts = client.chat.postMessage.mock.calls.map((call) => call[0].text); | CODE |
| CRITICAL | extensions/slack/src/send.blocks.test.ts | 281 | const postedTexts = client.chat.postMessage.mock.calls.map((call) => call[0].text); | CODE |
| CRITICAL | extensions/slack/src/send.reconcile.test.ts | 215 | const requests = client.chat.postMessage.mock.calls.map( | CODE |
| CRITICAL | extensions/slack/src/send.reconcile.test.ts | 537 | const postedMetadata = client.chat.postMessage.mock.calls.map( | CODE |
| CRITICAL | extensions/slack/src/send.enterprise.test.ts | 267 | expect(client.chat.postMessage.mock.calls.map((call) => call[0]?.text)).toEqual([ | CODE |
| CRITICAL | extensions/slack/src/send.enterprise.test.ts | 339 | expect(listenerClient.chat.postMessage.mock.calls.map((call) => call[0]?.text)).toEqual([ | CODE |
| CRITICAL | extensions/slack/src/monitor/context.ts | 608 | await params.app.client.assistant.threads.setSuggestedPrompts({ | CODE |
| CRITICAL | …slack/src/monitor/events/interactions.block-actions.ts | 484 | await params.ctx.app.client.chat.update({ | CODE |
| CRITICAL | …st/src/mattermost/monitor.inbound-system-event.test.ts | 1135 | const [recordCall] = runtimeCore.channel.session.recordInboundSession.mock.calls.at(0) ?? []; | CODE |
| CRITICAL | …st/src/mattermost/monitor.inbound-system-event.test.ts | 1219 | const [recordCall] = runtimeCore.channel.session.recordInboundSession.mock.calls.at(0) ?? []; | CODE |
| CRITICAL | …st/src/mattermost/monitor.inbound-system-event.test.ts | 1430 | runtimeCore.channel.reply.createReplyDispatcherWithTyping.mock.results.at(-1)?.value | CODE |
| CRITICAL | …st/src/mattermost/monitor.inbound-system-event.test.ts | 1549 | runtimeCore.channel.reply.createReplyDispatcherWithTyping.mock.results.at(-1)?.value | CODE |
| CRITICAL | …st/src/mattermost/monitor.inbound-system-event.test.ts | 1629 | runtimeCore.channel.reply.createReplyDispatcherWithTyping.mock.results.at(-1)?.value | CODE |
| CRITICAL | extensions/active-memory/session-policy.ts | 182 | const entry = params.api.runtime.agent.session.getSessionEntry({ | CODE |
| CRITICAL | extensions/active-memory/recall-run.ts | 204 | const storePath = params.api.runtime.agent.session.resolveStorePath( | CODE |
| 28 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ui/src/pages/agents/memory/view.ts | 16 | // ── Diary entry parser ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/agents/memory/view.ts | 184 | // ── Sub-tab state ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/agents/memory/view.ts | 323 | // ── Scene renderer ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/agents/memory/view.ts | 1422 | // ── Diary section renderer ──────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/logbook/src/service.ts | 166 | // ── Capture ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/logbook/src/service.ts | 306 | // ── Analysis ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/logbook/src/service.ts | 571 | // ── Q&A / standup ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/logbook/src/service.ts | 628 | // ── Introspection ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/file-consent.test.ts | 30 | // ─── isPrivateOrReservedIP ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/file-consent.test.ts | 85 | // ─── validateConsentUploadUrl ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/file-consent.test.ts | 241 | // ─── CONSENT_UPLOAD_HOST_ALLOWLIST ─────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/file-consent.test.ts | 270 | // ─── uploadToConsentUrl (integration with validation) ──────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/token.ts | 16 | // ── Credential types ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/token.ts | 37 | // ── Helpers ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/token.ts | 53 | // ── hasConfiguredMSTeamsCredentials ──────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/token.ts | 83 | // ── resolveMSTeamsCredentials ───────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/attachments/shared.test.ts | 128 | // ─── resolveAndValidateIP ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/msteams/src/attachments/shared.test.ts | 167 | // ─── safeFetch ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/qqbot/src/engine/group/history.ts | 11 | // ───────────────────────────── Constants ───────────────────────────── | COMMENT |
| MEDIUM | extensions/qqbot/src/engine/group/history.ts | 17 | // ───────────────────────────── Types ───────────────────────────── | COMMENT |
| MEDIUM | extensions/qqbot/src/engine/group/history.ts | 58 | // ───────────────────────────── Content formatting ───────────────────────────── | COMMENT |
| MEDIUM⚡ | extensions/qqbot/src/engine/group/history.ts | 131 | // ───────────────────────────── Attachment tags ───────────────────────────── | COMMENT |
| MEDIUM⚡ | extensions/qqbot/src/engine/group/history.ts | 138 | // ───────────────────────────── Public API ───────────────────────────── | COMMENT |
| MEDIUM | …ensions/qqbot/src/engine/utils/attachment-tags.test.ts | 7 | // ────────────────────────── shared body (mode-agnostic) ────────────────────────── | COMMENT |
| MEDIUM | …ensions/qqbot/src/engine/utils/attachment-tags.test.ts | 59 | // ────────────────────────── ref mode = body + source suffix ────────────────────────── | COMMENT |
| MEDIUM | …ensions/qqbot/src/engine/utils/attachment-tags.test.ts | 126 | // ────────────────────────── Prompt-contract regression guards ────────────────────────── | COMMENT |
| MEDIUM | …ensions/qqbot/src/engine/utils/attachment-tags.test.ts | 177 | // ────────────────────────── Options ────────────────────────── | COMMENT |
| MEDIUM | …nsions/qqbot/src/engine/gateway/stages/access-stage.ts | 78 | // ─────────────────────────── Internal helpers ─────────────────────────── | COMMENT |
| MEDIUM | …sions/qqbot/src/engine/gateway/stages/content-stage.ts | 18 | // ─────────────────────────── Types ─────────────────────────── | COMMENT |
| MEDIUM | …sions/qqbot/src/engine/gateway/stages/content-stage.ts | 37 | // ─────────────────────────── Stage ─────────────────────────── | COMMENT |
| MEDIUM | …sions/qqbot/src/engine/gateway/stages/content-stage.ts | 63 | // ─────────────────────────── Internal ─────────────────────────── | COMMENT |
| MEDIUM | …ions/qqbot/src/engine/gateway/stages/assembly-stage.ts | 28 | // ─────────────────────────── buildUserMessage ─────────────────────────── | COMMENT |
| MEDIUM | …ions/qqbot/src/engine/gateway/stages/assembly-stage.ts | 71 | // ─────────────────────────── buildAgentBody ─────────────────────────── | COMMENT |
| MEDIUM | …ions/qqbot/src/engine/gateway/stages/assembly-stage.ts | 116 | // ─────────────────────────── Internal ─────────────────────────── | COMMENT |
| MEDIUM | …ions/qqbot/src/engine/gateway/stages/envelope-stage.ts | 15 | // ─────────────────────────── Envelope body ─────────────────────────── | COMMENT |
| MEDIUM | …ions/qqbot/src/engine/gateway/stages/envelope-stage.ts | 41 | // ─────────────────────────── Quote / dynamic ctx ─────────────────────────── | COMMENT |
| MEDIUM | …ions/qqbot/src/engine/gateway/stages/envelope-stage.ts | 75 | // ─────────────────────────── System prompt ─────────────────────────── | COMMENT |
| MEDIUM | …ions/qqbot/src/engine/gateway/stages/envelope-stage.ts | 96 | // ─────────────────────────── Media classification ─────────────────────────── | COMMENT |
| MEDIUM | …ensions/mattermost/src/mattermost/interactions.test.ts | 68 | // ── HMAC token management ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …ensions/mattermost/src/mattermost/interactions.test.ts | 96 | // ── Token generation / verification ────────────────────────────────── | COMMENT |
| MEDIUM | …ensions/mattermost/src/mattermost/interactions.test.ts | 326 | // ── buildButtonAttachments ─────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extensions/mattermost/src/mattermost/interactions.ts | 61 | // ── Callback URL registry ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/interactions.ts | 167 | // ── HMAC token management ────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/interactions.ts | 235 | // ── Button builder helpers ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extensions/mattermost/src/mattermost/interactions.ts | 352 | // ── Request body reader ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | extensions/mattermost/src/mattermost/interactions.ts | 361 | // ── HTTP handler ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 5 | // ─── Types ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 92 | // ─── MM API types ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 135 | // ─── Default commands ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 205 | // ─── Command registration ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 452 | // ─── Callback parsing ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-commands.ts | 545 | // ─── Config resolution ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/slash-state.ts | 50 | // ─── Per-account state ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/monitor.ts | 290 | // ─── Interactive buttons registration ────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 24 | // ── Helper: mock fetch that captures requests ──────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 144 | // ── normalizeMattermostBaseUrl ──────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 168 | // ── readMattermostError ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 200 | // ── createMattermostClient ─────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 422 | // ── createMattermostPost ───────────────────────────────────────────── | COMMENT |
| MEDIUM | extensions/mattermost/src/mattermost/client.test.ts | 528 | // ── updateMattermostPost ───────────────────────────────────────────── | COMMENT |
| 99 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .crabbox.yaml | 1 | profile: openclaw-check | COMMENT |
| LOW | docker-compose.yml | 41 | volumes: | COMMENT |
| LOW | ui/src/app/stale-chunk-reload.ts | 1 | // Stale hashed-chunk recovery for lazy routes. | COMMENT |
| LOW | ui/src/components/markdown.ts | 961 | // Disable fuzzy link detection to prevent bare filenames like "README.md" | COMMENT |
| LOW | ui/src/components/markdown.ts | 1441 | } | COMMENT |
| LOW | ui/src/components/workspace-custom-widget.ts | 1 | // Sandboxed host for approved custom widgets (spec-50 §UI side). Renders the | COMMENT |
| LOW | ui/src/lib/workspace/bridge.ts | 1 | // Parent side of the custom-widget postMessage bridge (00 §6, spec-50 §Bridge). | COMMENT |
| LOW | qa/scenarios/index.yaml | 1 | title: OpenClaw QA Scenario Pack | COMMENT |
| LOW | qa/scenarios/index.yaml | 21 | # as `namespace.behavior`, with dashes allowed inside each segment | COMMENT |
| LOW | qa/scenarios/index.yaml | 41 | # | COMMENT |
| LOW | qa/scenarios/index.yaml | 61 | # - `character/` - persona and style eval scenarios | COMMENT |
| LOW | qa/scenarios/memory/memory-recall.yaml | 1 | title: Memory recall after context switch | COMMENT |
| LOW | extensions/parallel/src/parallel-search-normalize.ts | 181 | // The transport endpoint (REST URL or the free MCP URL) partitions paid-REST | COMMENT |
| LOW | extensions/discord/src/thread-binding-api.ts | 1 | // Discord API module exposes the plugin public contract. | COMMENT |
| LOW | extensions/copilot/harness.ts | 741 | // | COMMENT |
| LOW | extensions/copilot/src/tool-bridge.ts | 621 | // Bridged OpenClaw tools enforce their own permission/policy decisions | COMMENT |
| LOW | extensions/copilot/src/replay-shim.ts | 1 | // Replay-shim for the GitHub Copilot agent runtime. | COMMENT |
| LOW | extensions/copilot/src/workspace-bootstrap.test.ts | 161 | // entries for every known bootstrap file the workspace hasn't | COMMENT |
| LOW | extensions/copilot/src/attempt.ts | 941 | promptError = snap.streamError; | COMMENT |
| LOW | extensions/copilot/src/attempt.ts | 1341 | // built-in kind that future SDK versions might surface outside | COMMENT |
| LOW | extensions/copilot/src/attempt.ts | 1361 | // not model. | COMMENT |
| LOW | extensions/copilot/src/attempt.ts | 1381 | // meaningful per the SDK contract | COMMENT |
| LOW | extensions/copilot/src/attempt.ts | 1401 | // token in `CopilotClientOptions.gitHubToken` (set in | COMMENT |
| LOW | extensions/feishu/doctor-contract-api.ts | 1 | // Feishu API module exposes the plugin doctor contract. | COMMENT |
| LOW | extensions/feishu/src/docx-color-text.ts | 61 | */ | COMMENT |
| LOW | extensions/qa-lab/src/agentic-parity-report.ts | 221 | } | COMMENT |
| LOW | extensions/qa-lab/src/providers/mock-openai/server.ts | 3301 | // "candidate" (openai/gpt-5.6-luna) and one against the "baseline" | COMMENT |
| LOW | extensions/deepinfra/provider-models.ts | 221 | // Per-surface static fallback used only when no API key is configured or | COMMENT |
| LOW | extensions/oc-path/src/cli.test.ts | 321 | // the per-kind emit boundary). The CLI handler must catch that | COMMENT |
| LOW | extensions/oc-path/src/oc-path/jsonl/parse.ts | 21 | // Detect the line-ending convention from the input. Windows-authored | COMMENT |
| LOW | extensions/google/oauth.http.ts | 21 | shouldUseEnvHttpProxyForUrl(url) | COMMENT |
| LOW | extensions/mxc/src/windows-env.ts | 1 | // Windows process environment helpers for the MXC ProcessContainer backend. | COMMENT |
| LOW | extensions/mxc/src/windows-command.ts | 1 | // Windows command-line construction and cmd.exe quoting for the MXC | COMMENT |
| LOW | extensions/msteams/src/delivery-trace.test.ts | 1 | // MSTeams delivery trace goldens: replayable wire-level lifecycle recordings. | COMMENT |
| LOW | extensions/msteams/src/reply-dispatcher.test.ts | 301 | await sendTyping(); | COMMENT |
| LOW | extensions/msteams/src/thread-parent-context.ts | 1 | // Parent-message context injection for Teams channel thread replies. | COMMENT |
| LOW | extensions/github-copilot/index.ts | 421 | // come from PERSISTED CONFIG ONLY (never COPILOT_GITHUB_DOMAIN): a | COMMENT |
| LOW | extensions/workspaces/src/broadcast.ts | 1 | // Single-slot handle for the gateway's broadcast function. | COMMENT |
| LOW | …tensions/workspaces/src/ui-gateway-integration.test.ts | 1 | // Wire-as-you-go integration test for the workspace UI <-> gateway seam. | COMMENT |
| LOW | …tensions/workspaces/src/ui-gateway-integration.test.ts | 161 | const client = createRoutingClient(methods); | COMMENT |
| LOW | extensions/workspaces/src/store.ts | 1 | // Workspaces store: the single writer for the workspace document. | COMMENT |
| LOW | extensions/browser/src/browser/screenshot-annotate.ts | 1 | // extensions/browser/src/browser/screenshot-annotate.ts | COMMENT |
| LOW | extensions/qqbot/src/delivery-trace.test.ts | 1 | // QQBot delivery trace goldens: replayable wire-level lifecycle recordings for | COMMENT |
| LOW | …ensions/qqbot/src/engine/gateway/message-queue.test.ts | 61 | accountId: "a", | COMMENT |
| LOW | extensions/telegram/src/bot-message-dispatch.ts | 1941 | // final answer posts below so the timeline reads thoughts/tools → summary → | COMMENT |
| LOW | extensions/telegram/src/bot-message-dispatch.ts | 2661 | onToolStart: async (payload) => { | COMMENT |
| LOW | extensions/telegram/src/draft-stream.ts | 41 | splitTelegramPlainTextChunks, | COMMENT |
| LOW | extensions/telegram/src/polling-session.ts | 321 | return `${params.spoolDir}\0${params.laneKey}`; | COMMENT |
| LOW | extensions/telegram/src/progress-summary.ts | 1 | // Post-turn collapse summary for the Telegram progress window. | COMMENT |
| LOW | extensions/googlechat/src/auth.proof.test.ts | 1 | // Proof: verifyGoogleChatRequest → fetchChatCerts through the REAL | COMMENT |
| LOW | extensions/slack/http-routes-api.ts | 1 | // Narrow entry point for registerSlackPluginHttpRoutes — avoids pulling in | COMMENT |
| LOW | extensions/slack/src/channel.lazy-seams.test.ts | 1 | // Regression tests for the lazy-loading boundaries introduced for Slack | COMMENT |
| LOW | extensions/slack/src/delivery-trace.test.ts | 1 | // Slack delivery trace goldens: replayable wire-level lifecycle recordings. | COMMENT |
| LOW | extensions/mattermost/channel-plugin-runtime.ts | 1 | // Private runtime-bearing plugin export for the bundled Mattermost entry. | COMMENT |
| LOW | extensions/imessage/src/actions.ts | 501 | account.config.probeTimeoutMs ?? DEFAULT_IMESSAGE_PROBE_TIMEOUT_MS, | COMMENT |
| LOW | extensions/imessage/src/constants.ts | 1 | /** Default timeout for iMessage probe/RPC operations (10 seconds). */ | COMMENT |
| LOW | extensions/imessage/src/monitor/recovery-cursor.ts | 1 | // Per-(account, database) high-water of the last dispatched chat.db rowid. On | COMMENT |
| LOW | extensions/imessage/src/monitor/poll-comment.ts | 1 | // A native iMessage poll's comment/caption is delivered as a separate inbound | COMMENT |
| LOW | extensions/imessage/src/monitor/poll-comment.ts | 81 | // so folding on an unknown sender could drop a real in-window reply from a | COMMENT |
| LOW | extensions/imessage/src/monitor/inbound-dedupe.ts | 1 | // iMessage inbound replay protection: brings the channel in line with the | COMMENT |
| 192 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/src/i18n/.i18n/raw-copy-baseline.json | 84 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 427 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 434 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 441 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 448 | "name": "placeholder", | CODE |
| LOW⚡ | ui/src/i18n/.i18n/raw-copy-baseline.json | 455 | "name": "placeholder", | CODE |
| LOW | ui/src/i18n/.i18n/raw-copy-baseline.json | 476 | "name": "placeholder", | CODE |
| LOW | ui/src/i18n/.i18n/raw-copy-baseline.json | 483 | "name": "placeholder", | CODE |
| LOW | ui/src/e2e/new-session-page.e2e.test.ts | 710 | expect(await baseInput.getAttribute("placeholder")).toBe("Loading…"); | CODE |
| LOW | ui/src/e2e/new-session-page.e2e.test.ts | 1233 | expect(await baseInput.getAttribute("placeholder")).toBe("Loading…"); | CODE |
| LOW | ui/src/e2e/new-session-page.e2e.test.ts | 1263 | await expect.poll(() => baseInput.getAttribute("placeholder")).not.toBe("Loading…"); | CODE |
| LOW | ui/src/pages/chat/chat-view.test.ts | 2435 | expect(container.querySelector("textarea")?.getAttribute("placeholder")).toBe( | CODE |
| LOW⚡ | ui/src/pages/chat/chat-view.test.ts | 3599 | expect(textOnly.querySelector("textarea")?.getAttribute("placeholder")).toBe( | CODE |
| LOW⚡ | ui/src/pages/chat/chat-view.test.ts | 3604 | expect(ordinaryTextFile.querySelector("textarea")?.getAttribute("placeholder")).toBe( | CODE |
| LOW⚡ | ui/src/pages/chat/chat-view.test.ts | 3610 | expect(withImage.querySelector("textarea")?.getAttribute("placeholder")).toBe( | CODE |
| LOW | test/scripts/openclaw-npm-publish.test.ts | 98 | writeFileSync(tarball, "placeholder", "utf8"); | CODE |
| LOW | test/scripts/notarize-mac-artifact.test.ts | 50 | writeFileSync(artifact, "placeholder", "utf8"); | CODE |
| LOW | test/scripts/notarize-mac-artifact.test.ts | 66 | writeFileSync(artifact, "placeholder", "utf8"); | CODE |
| LOW | .agents/skills/crabbox/SKILL.md | 580 | ../crabbox/bin/crabbox desktop paste --provider hetzner --id <cbx_id-or-slug> --text "user@example.com" | CODE |
| LOW⚡ | …s/skills/autoreview/tests/test_autoreview_hardening.py | 1979 | 'url="https://example.com:443?email=user@example.org"', | CODE |
| LOW⚡ | …s/skills/autoreview/tests/test_autoreview_hardening.py | 1980 | 'url="https://example.com:443#owner=user@example.org"', | CODE |
| LOW⚡ | …s/skills/autoreview/tests/test_autoreview_hardening.py | 1981 | 'url="https://example.com:443" + "?email=user@example.org"', | CODE |
| LOW | docs/plugins/message-presentation.md | 273 | "placeholder": "Environment", | CODE |
| LOW | docs/plugins/manifest.md | 118 | "placeholder": "sk-or-v1-...", | CODE |
| LOW | docs/plugins/manifest.md | 541 | "placeholder": "sk-or-v1-...", | CODE |
| LOW | docs/plugins/manifest.md | 754 | "placeholder": "https://matrix.example.com" | CODE |
| LOW | docs/gateway/configuration-examples.md | 351 | imessage: ["user@example.com"], | CODE |
| LOW | docs/gateway/config-channels.md | 647 | allowFrom: ["+15555550123", "user@example.com", "chat_id:123"], | CODE |
| LOW | docs/channels/matrix-presentation.md | 27 | "placeholder": "Choose model", | CODE |
| LOW | docs/channels/line.md | 179 | address: "123 Main St", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 19 | "placeholder": "sk-proj-...", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 24 | "placeholder": "openai", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 29 | "placeholder": "text-embedding-3-small", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 34 | "placeholder": "https://api.openai.com/v1", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 40 | "placeholder": "1536", | CODE |
| LOW⚡ | extensions/memory-lancedb/openclaw.plugin.json | 46 | "placeholder": "~/.openclaw/memory/lancedb", | CODE |
| LOW | extensions/memory-lancedb/openclaw.plugin.json | 65 | "placeholder": "500" | CODE |
| LOW | extensions/memory-lancedb/openclaw.plugin.json | 76 | "placeholder": "1000" | CODE |
| LOW | extensions/parallel/openclaw.plugin.json | 19 | "placeholder": "par-..." | CODE |
| LOW | extensions/discord/src/components.test.ts | 607 | expect(modalPayload?.entry.fields?.[0]).not.toHaveProperty("placeholder"); | CODE |
| LOW | extensions/microsoft-foundry/index.test.ts | 417 | user: { name: "user@example.com" }, | CODE |
| LOW | extensions/google-meet/openclaw.plugin.json | 117 | "placeholder": "+15551234567" | CODE |
| LOW | …ensions/google-meet/src/response-body-boundary.test.ts | 39 | accessToken: "fake-token", | CODE |
| LOW | extensions/logbook/openclaw.plugin.json | 34 | "placeholder": "codex/gpt-5.6-sol", | CODE |
| LOW | extensions/feishu/skills/feishu-perm/SKILL.md | 29 | "member_id": "user@example.com", | CODE |
| LOW | extensions/feishu/skills/feishu-perm/SKILL.md | 42 | "member_id": "user@example.com" | CODE |
| LOW | extensions/firecrawl/openclaw.plugin.json | 19 | "placeholder": "fc-..." | CODE |
| LOW | extensions/firecrawl/openclaw.plugin.json | 29 | "placeholder": "fc-..." | CODE |
| LOW | extensions/google/index.test.ts | 421 | email: "user@example.com", | CODE |
| LOW | extensions/google/index.test.ts | 437 | email: "user@example.com", | CODE |
| LOW | extensions/google/index.test.ts | 444 | email: "user@example.com", | CODE |
| LOW | extensions/google/openclaw.plugin.json | 660 | "placeholder": "AIza..." | CODE |
| LOW | extensions/migrate-hermes/files-and-skills.test.ts | 663 | [hermesRefreshField]: "placeholder", | CODE |
| LOW | extensions/migrate-hermes/secrets.test.ts | 294 | const value = ["custom", "provider", "placeholder"].join("-"); | CODE |
| LOW⚡ | extensions/migrate-hermes/secrets.test.ts | 564 | const globalOpenRouterValue = ["global", "openrouter", "placeholder"].join("-"); | CODE |
| LOW⚡ | extensions/migrate-hermes/secrets.test.ts | 565 | const globalGeminiValue = ["global", "gemini", "placeholder"].join("-"); | CODE |
| LOW⚡ | extensions/migrate-hermes/secrets.test.ts | 566 | const profileOpenRouterValue = ["profile", "openrouter", "placeholder"].join("-"); | CODE |
| LOW⚡ | extensions/migrate-hermes/config.test.ts | 303 | const tlsPaths = ["placeholder", "placeholder"]; | CODE |
| LOW⚡ | extensions/migrate-hermes/config.test.ts | 306 | [["client", "id"].join("_")]: "placeholder", | CODE |
| LOW⚡ | extensions/migrate-hermes/config.test.ts | 307 | [["client", "secret"].join("_")]: "placeholder", | CODE |
| 154 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | appcast.xml | 265 | <li><strong>PR #97928</strong> fix(agents): estimate harness role sizes in context guard char estimator (fixes #97927). | CODE |
| MEDIUM | appcast.xml | 412 | <li><strong>PR #96454</strong> feat(cli): openclaw attach — launch an external harness bound to a gateway session. Thank | CODE |
| MEDIUM | appcast.xml | 822 | <li><strong>PR #100200</strong> chore(android): add deterministic chat streaming replay test harness.</li> | CODE |
| MEDIUM | appcast.xml | 890 | <li><strong>PR #100201</strong> chore(ios): add deterministic streaming replay test harness for the shared chat pipeline | CODE |
| MEDIUM | appcast.xml | 1404 | <li><strong>PR #101244</strong> fix(diagnostics-otel): surface error message on run/harness error spans. Thanks @amknigh | CODE |
| MEDIUM | appcast.xml | 1460 | <li><strong>PR #101370</strong> fix(agent-core): handle stdout/stderr stream errors in harness exec. Thanks @wings1029.< | CODE |
| MEDIUM | appcast.xml | 1679 | <li><strong>PR #103467</strong> fix(ci): read Codex bindings from SQLite in live harness. Related #103451. Thanks @vince | CODE |
| MEDIUM | appcast.xml | 1839 | <li><strong>PR #95652</strong> fix(agents): activate selected harness plugins. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | appcast.xml | 1954 | <li><strong>PR #90223</strong> test: make qqbot symlinked media helper test robust on Windows. Thanks @aniruddhaadak80.< | CODE |
| MEDIUM | appcast.xml | 1989 | <li><strong>PR #95930</strong> docs(copilot): refresh harness parity notes. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | appcast.xml | 2018 | <li><strong>PR #96005</strong> feat(copilot): wire harness parity helpers. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | appcast.xml | 2091 | <li><strong>PR #96233</strong> fix(agents): run heartbeat_prompt_contribution on harness prompt builds. Thanks @azogheb | CODE |
| MEDIUM | appcast.xml | 2136 | <li><strong>PR #94838</strong> refactor(copilot): complete harness lifecycle parity. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | test/scripts/npm-telegram-live.test.ts | 53 | const installRunEnd = script.indexOf("# Mount only QA harness source"); | CODE |
| MEDIUM | test/scripts/npm-telegram-live.test.ts | 94 | const runtimeRunStart = script.indexOf("# Mount only QA harness source"); | CODE |
| MEDIUM | qa/scenarios/memory/memory-recall.yaml | 19 | # the harness, not the models. So we keep it prose-only, covered by the | COMMENT |
| MEDIUM | qa/scenarios/media/image-understanding-attachment.yaml | 81 | # is the only thing an external harness can verify in mock mode. | COMMENT |
| MEDIUM | extensions/qa-lab/src/docker-harness.ts | 165 | return `# QA Docker harness example env | CODE |
| MEDIUM | scripts/test-live-codex-harness-docker.sh | 220 | # Force the Codex harness to use the staged `~/.codex` auth files. This lane | COMMENT |
| MEDIUM | scripts/test-live-codex-harness-docker.sh | 343 | # Codex. This lane must rebuild the live image so the plugin-owned harness is | COMMENT |
| MEDIUM | scripts/docker/install-sh-e2e/run.sh | 2 | # Official installer E2E harness for Docker. | COMMENT |
| MEDIUM | scripts/e2e/cron-mcp-cleanup-docker.sh | 3 | # child-process cleanup through a mounted test harness. | COMMENT |
| MEDIUM | scripts/e2e/crestodian-rescue-docker.sh | 3 | # functional E2E image, with only the test harness mounted from the checkout. | COMMENT |
| MEDIUM | scripts/e2e/npm-telegram-live-docker.sh | 3 | # onboarding/doctor recovery, then runs the Telegram QA live harness. | COMMENT |
| MEDIUM | scripts/e2e/npm-telegram-live-docker.sh | 412 | # Mount only QA harness source; the SUT itself, including bundled plugin runtime, | COMMENT |
| MEDIUM | scripts/e2e/npm-telegram-live-docker.sh | 449 | # The mounted QA harness imports openclaw/plugin-sdk and package dependencies; | COMMENT |
| MEDIUM | scripts/e2e/npm-telegram-live-docker.sh | 498 | # QA Lab is intentionally mounted as harness source, so its package-local | COMMENT |
| MEDIUM | scripts/e2e/crestodian-first-run-docker.sh | 3 | # functional E2E image, with only the test harness mounted from the checkout. | COMMENT |
| MEDIUM | .github/workflows/install-smoke-reusable.yml | 53 | # workflow SHA from job context so trusted harness checkouts cannot drift to candidate code. | COMMENT |
| MEDIUM | …ub/workflows/openclaw-live-and-e2e-checks-reusable.yml | 403 | # workflow SHA from job context so trusted harness checkouts cannot drift to candidate code. | COMMENT |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 386 | #expect(harness.vm.messages.count == 2) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 387 | #expect(harness.vm.messages.map(\.role) == ["user", "assistant"]) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 388 | #expect(harness.vm.pendingRunCount == 0) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 389 | #expect(harness.vm.pendingToolCalls.isEmpty) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 390 | #expect(harness.vm.streamingAssistantText == nil) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 428 | #expect(harness.vm.replayAssistantRows(text: "keyed reply").count == 1) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 429 | #expect(harness.vm.replayAssistantRows(text: "unkeyed reply").count == 1) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 430 | #expect(harness.vm.messages.count == 3) | STRING |
| MEDIUM | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 445 | try #require(harness.vm.replayAssistantRows(text: replyText).first?.id) | STRING |
| MEDIUM | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 498 | #expect(harness.vm.streamingAssistantText == nil) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 534 | #expect(harness.vm.messages.count == 2) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 535 | #expect(harness.vm.replayUserRows.count == 1) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 536 | #expect(harness.vm.replayUserRows.first?.idempotencyKey == "\(runId):user") | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 537 | #expect(harness.vm.pendingToolCalls.isEmpty) | STRING |
| MEDIUM⚡ | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 538 | #expect(harness.vm.errorText == nil) | STRING |
| MEDIUM | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 553 | try #require(harness.vm.streamingAssistantText) | STRING |
| MEDIUM | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 610 | #expect(harness.vm.streamingAssistantText == secondText) | STRING |
| MEDIUM | …Kit/Tests/OpenClawKitTests/ChatStreamReplayTests.swift | 611 | #expect(harness.vm.replayAssistantRows(text: firstText).count == 1) | STRING |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 90 | #expect(harness.controller.phase == .preparing(messageID)) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 91 | #expect(await waitForPhase(harness.controller, .speaking(messageID))) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 92 | #expect(harness.clipPlayer.playedClips == [clip]) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 95 | #expect(await waitForPhase(harness.controller, .idle)) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 96 | #expect(harness.localSpeaker.spokenTexts.isEmpty) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 105 | #expect(await waitForPhase(harness.controller, .idle)) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 106 | #expect(harness.localSpeaker.spokenTexts == ["Read me aloud"]) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 107 | #expect(harness.clipPlayer.playedClips.isEmpty) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 116 | #expect(await waitForPhase(harness.controller, .speaking(messageID))) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 120 | #expect(await waitForPhase(harness.controller, .idle)) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 121 | #expect(harness.localSpeaker.spokenTexts == ["Broken clip"]) | COMMENT |
| MEDIUM⚡ | …Tests/OpenClawKitTests/ChatSpeechControllerTests.swift | 130 | #expect(await waitForPhase(harness.controller, .speaking(messageID))) | COMMENT |
| 12 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | ui/src/components/markdown.test.ts | 461 | print(f"--- {ws.title} ---") | CODE |
| HIGH | ui/src/components/markdown.test.ts | 465 | print(row) | CODE |
| HIGH⚡ | test/scripts/test-helpers.ts | 30 | print(profile?.profileId ?? "none"); | CODE |
| HIGH⚡ | test/scripts/test-helpers.ts | 33 | print(Math.max(0, ...counts)); | CODE |
| HIGH⚡ | test/scripts/test-helpers.ts | 36 | print(Math.max(0, ...profiles.map((item) => item.expiresAt ?? 0))); | CODE |
| HIGH | test/scripts/release-telegram-candidate-archive.test.ts | 390 | print(json.dumps({ | CODE |
| HIGH | …sions/qa-lab/src/mantis/slack-desktop-smoke.runtime.ts | 793 | elif [ "$hydrate_mode" = "prehydrated" ]; then | CODE |
| HIGH | …sions/qa-lab/src/mantis/slack-desktop-smoke.runtime.ts | 1070 | elif kill -0 "$watcher_pid" >/dev/null 2>&1; then | CODE |
| HIGH | …sions/qa-lab/src/mantis/slack-desktop-smoke.runtime.ts | 1125 | elif [ "$approval_checkpoints" = "1" ] && [ -s "$out/approval-checkpoints/slack-approval-exec-native-pending.png" ]; the | CODE |
| HIGH | …/qa-lab/src/mantis/telegram-desktop-builder.runtime.ts | 377 | elif [ "$hydrate_mode" = "prehydrated" ]; then | CODE |
| HIGH | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 294 | print(json.dumps(payload, separators=(",", ":")), flush=True) | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 343 | return False | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 346 | return True | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 348 | return True | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 351 | return True | CODE |
| HIGH⚡ | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 354 | return True | CODE |
| HIGH | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 369 | return None | CODE |
| HIGH | …sions/codex/src/app-server/sandbox-exec-server/http.ts | 386 | return None | CODE |
| HIGH | extensions/line/src/markdown-to-line.test.ts | 125 | print("hello") | CODE |
| HIGH | extensions/line/src/markdown-to-line.test.ts | 369 | print("done") | CODE |
| HIGH | scripts/e2e/telegram-user-crabbox-proof.ts | 2174 | print((payload.get("session") or {}).get("id") or "") | CODE |
| HIGH⚡ | scripts/e2e/parallels/windows-git.ts | 36 | print(preferred_names[0]) | CODE |
| HIGH⚡ | scripts/e2e/parallels/windows-git.ts | 37 | print(fallback_urls[preferred_names[0]]) | CODE |
| HIGH | scripts/e2e/parallels/windows-git.ts | 61 | elif "-arm64." in name: | CODE |
| HIGH | scripts/e2e/parallels/windows-git.ts | 63 | elif "-32-bit." in name: | CODE |
| HIGH | scripts/e2e/parallels/windows-git.ts | 74 | print(best["name"]) | CODE |
| HIGH | scripts/e2e/parallels/windows-git.ts | 75 | print(best["browser_download_url"])`, | CODE |
| HIGH | src/docker-setup.e2e.test.ts | 104 | elif [[ "\${1:-}" == "--kill-after" ]]; then | CODE |
| HIGH⚡ | src/agents/sandbox/fs-bridge-mutation-helper.ts | 101 | " return None", | CODE |
| HIGH⚡ | src/agents/sandbox/fs-bridge-mutation-helper.ts | 104 | " return None", | CODE |
| HIGH | src/cli/update-cli/restart-helper.ts | 100 | elif systemctl is-active --quiet '${escaped}' || systemctl is-enabled --quiet '${escaped}'; then | CODE |
| HIGH | src/gateway/worker-environments/bootstrap.ts | 342 | elif [ -r "$lock/pid" ]; then | CODE |
| HIGH | src/gateway/worker-environments/bootstrap.ts | 421 | elif [ -d "$stale_staging" ]; then | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | appcast.xml | 737 | <li><strong>PR #100077</strong> fix(agents): scale aggregate tool-result budget with context window and compact on press | CODE |
| MEDIUM | appcast.xml | 1157 | <li><strong>PR #99091</strong> fix: unblock replies after multi-agent room reset. Related #99082. Thanks @ZengWen-DT and | CODE |
| MEDIUM | appcast.xml | 1636 | <li><strong>PR #102005</strong> refactor(qa-lab): localize orchestration declarations. Thanks @vincentkoc.</li> | CODE |
| MEDIUM | appcast.xml | 1747 | <li><strong>PR #105500</strong> fix(qa): repair agentic runtime parity mocks.</li> | CODE |
| MEDIUM | ui/src/e2e/workspace-custom-widget.e2e.test.ts | 4 | // list: approve flow, bridge getData round-trip with the L2 scaffold fixture, | COMMENT |
| MEDIUM | ui/src/e2e/workspace-custom-widget.e2e.test.ts | 99 | // A framework-free fixture widget mirroring the L2 scaffold template: v1 | COMMENT |
| MEDIUM | test/vitest/vitest.full-agentic.config.ts | 1 | // Vitest full agentic config wires the full agentic test shard. | COMMENT |
| MEDIUM | test/scripts/ios-release-prepare.test.ts | 1 | // iOS release prepare tests cover release-signing guardrails. | COMMENT |
| MEDIUM | .agents/skills/technical-documentation/SKILL.md | 45 | ## Sub-agent orchestration guidance | COMMENT |
| MEDIUM | .agents/skills/openclaw-ghsa-maintainer/SKILL.md | 10 | ## Respect advisory guardrails | COMMENT |
| MEDIUM | .agents/skills/release-openclaw-maintainer/SKILL.md | 33 | ## Respect release guardrails | COMMENT |
| MEDIUM | qa/scenarios/memory/memory-recall.yaml | 28 | # in `extensions/qa-lab/src/agentic-parity-report.ts`. Positive-tone | COMMENT |
| MEDIUM | docs/docs_map.md | 2690 | ## concepts/multi-agent.md | COMMENT |
| MEDIUM | docs/docs_map.md | 9872 | ## tools/multi-agent-sandbox-tools.md | COMMENT |
| MEDIUM | docs/plugins/memory-lancedb.md | 339 | ### Unsupported embedding model | COMMENT |
| MEDIUM | docs/providers/bedrock.md | 381 | You can apply [Amazon Bedrock Guardrails](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html) | CODE |
| MEDIUM | docs/cli/plugins.md | 97 | ### Provider scaffold | COMMENT |
| MEDIUM | docs/concepts/context.md | 92 | ## What counts toward the context window | COMMENT |
| MEDIUM | docs/concepts/session-tool.md | 76 | ## Status and orchestration helpers | COMMENT |
| MEDIUM | docs/automation/cron-jobs.md | 366 | # Agent selection (multi-agent setups) | COMMENT |
| MEDIUM | docs/automation/cron-jobs.md | 484 | For untrusted inboxes, route the hook to a dedicated reader agent, give that agent read-only or no workspace access, and | CODE |
| MEDIUM | docs/reference/token-use.md | 55 | ## What counts in the context window | COMMENT |
| MEDIUM | docs/gateway/configuration-reference.md | 31 | ## Agent defaults, multi-agent, sessions, and messages | COMMENT |
| MEDIUM | docs/gateway/configuration.md | 490 | See [Multi-Agent](/concepts/multi-agent) and [full reference](/gateway/config-agents#multi-agent-routing) for bindin | CODE |
| MEDIUM | docs/gateway/security/index.md | 381 | ## Per-agent access profiles (multi-agent) | COMMENT |
| MEDIUM | extensions/open-prose/skills/prose/guidance/patterns.md | 245 | # Captain orchestrates, specialists do the hard work | STRING |
| MEDIUM | extensions/qa-lab/src/agentic-parity.ts | 1 | // Qa Lab plugin module implements agentic parity behavior. | COMMENT |
| MEDIUM | extensions/qa-lab/src/agentic-parity-report.test.ts | 1 | // Qa Lab tests cover agentic parity report plugin behavior. | COMMENT |
| MEDIUM | extensions/qa-lab/src/docker-harness.ts | 197 | - \`${params.includeQaLabUi ? `http://127.0.0.1:${params.qaLabPort}` : "not published in this scaffold"}\` | CODE |
| MEDIUM | extensions/qa-lab/src/agentic-parity-report.ts | 1 | // Qa Lab plugin module implements agentic parity report behavior. | COMMENT |
| MEDIUM | extensions/qa-lab/src/agentic-parity-report.ts | 449 | // qa-suite-summary.json rather than a --parity-pack agentic run) cannot influence | COMMENT |
| MEDIUM | extensions/workspaces/src/scaffold.ts | 144 | // schema at mount time, and a scaffold that cannot load is worse than a clear | COMMENT |
| MEDIUM | extensions/workspaces/src/gateway.test.ts | 274 | // create + add + update + move + setLayout + scaffold + approve + replace + undo | COMMENT |
| MEDIUM | scripts/e2e/lib/onboard/scenario.sh | 259 | # Assert config + workspace scaffolding. | COMMENT |
| MEDIUM | apps/macos/Sources/OpenClawIPC/IPC.swift | 71 | /// Local scaffold fallback (e.g., no index.html present). | COMMENT |
| MEDIUM | …ps/macos/Sources/OpenClaw/CanvasWindowController.swift | 121 | // Canvas scaffold is a fully self-contained HTML page; avoid relying on transparency underlays. | STRING |
| MEDIUM | apps/macos/Sources/OpenClaw/CanvasManager.swift | 312 | // Root special-case: built-in scaffold page when no index exists. | COMMENT |
| MEDIUM | apps/macos/Sources/OpenClaw/CanvasManager.swift | 349 | // no bundled A2UI shell; scaffold fallback is purely visual | COMMENT |
| MEDIUM | apps/macos/Sources/OpenClaw/CanvasSchemeHandler.swift | 208 | // Default Canvas UX: when no index exists, show the built-in scaffold page. | STRING |
| MEDIUM | apps/ios/Sources/Screen/ScreenWebView.swift | 99 | // Canvas scaffold is a fully self-contained HTML page; avoid relying on transparency underlays. | COMMENT |
| MEDIUM | …/app/src/main/java/ai/openclaw/app/node/A2UIHandler.kt | 94 | // Android scaffold currently implements A2UI v0.8, not the v0.9 createSurface shape. | COMMENT |
| MEDIUM | …rc/main/java/ai/openclaw/app/node/CanvasActionTrust.kt | 8 | const val scaffoldAssetUrl: String = "file:///android_asset/CanvasScaffold/scaffold.html" | CODE |
| MEDIUM | …c/infra/heartbeat-runner.returns-default-unset.test.ts | 1453 | // docs template started wrapping the scaffold in a fenced ```markdown block. | COMMENT |
| MEDIUM | …/infra/heartbeat-runner.subagent-session-guard.test.ts | 1 | // Tests heartbeat runner guardrails for subagent sessions. | COMMENT |
| MEDIUM | src/plugins/runtime-live-state-guardrails.test.ts | 1 | // Verifies runtime live-state guardrails stay documented and enforced. | COMMENT |
| MEDIUM | src/plugins/loader-sdk-import-guardrails.test.ts | 1 | // Verifies loader guardrails for plugin SDK import boundaries. | COMMENT |
| MEDIUM | src/plugins/contracts/plugin-sdk-index.bundle.test.ts | 73 | // guardrails, and `plugin-sdk-subpaths.test.ts`. This file only keeps the expensive | COMMENT |
| MEDIUM | src/plugins/contracts/plugin-sdk-index.bundle.test.ts | 108 | // plugin-sdk-package-contract-guardrails.test.ts and plugin-sdk-subpaths.test.ts. Keep this file | COMMENT |
| MEDIUM | …models-config.providers.secrets.bedrock-apikey.test.ts | 1 | // Covers Bedrock AWS SDK auth markers and marker-backed discovery secret guardrails. | COMMENT |
| MEDIUM | src/agents/mcp-transport.test.ts | 1 | // Covers MCP HTTP transport redirects, SSRF guardrails, and auth/TLS handoff. | COMMENT |
| MEDIUM | src/agents/execution-contract.test.ts | 1 | // Covers provider/model gates for strict agentic execution-contract activation. | COMMENT |
| MEDIUM | src/agents/execution-contract.test.ts | 124 | // inherit OpenAI-specific strict-agentic handling by accident. | COMMENT |
| MEDIUM | src/agents/execution-contract.ts | 99 | // strict-agentic is a GPT-5-family OpenAI runtime contract | COMMENT |
| MEDIUM | src/agents/execution-contract.ts | 113 | // Explicit strict-agentic OR unspecified-but-supported → strict-agentic. | COMMENT |
| MEDIUM | src/agents/tools/nodes-tool.test.ts | 2 | // numeric schema guardrails, and pairing approval scopes. | COMMENT |
| MEDIUM | src/agents/embedded-agent-runner/run.ts | 1423 | // Silent-error retry: non-strict-agentic models (e.g. ollama/glm-5.1) can | COMMENT |
| MEDIUM⚡ | src/commands/status.scan.fast-json.ts | 55 | // `enabled` alone can be a default scaffold; require another configured field. | COMMENT |
| MEDIUM | src/gateway/server.auth.control-ui.suite.ts | 1769 | // The full agentic shard can saturate the event loop enough that the | COMMENT |
| MEDIUM | …ls/plugins/contracts/channel-import-guardrails.test.ts | 251 | // Config schema stays on the public SDK seam and is covered by dedicated config guardrails. | COMMENT |
| MEDIUM | …ls/plugins/contracts/channel-import-guardrails.test.ts | 492 | // plugin-sdk guardrails instead of the generic "core should not touch extensions" rule. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/scripts/install-sh.test.ts | 1259 | /# Step 1: Node\.js[\s\S]*?load_nvm_for_node_detection\s+if ! check_node; then/, | CODE |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 44 | ## Step 1: Identify | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 79 | ## Step 2: Decide (Agent) | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 98 | ## Step 3: Redact | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 112 | ## Step 4: Purge Edit History | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 168 | ## Step 5: Notify | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 189 | ## Step 6: Resolve | COMMENT |
| LOW | …ts/skills/openclaw-secret-scanning-maintainer/SKILL.md | 199 | ## Step 7: Summary | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 180 | ## Step 1: Read The Target | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 207 | ## Step 2: Search Broadly With Gitcrawl | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 244 | ## Step 3: Use Live GitHub Search For Gaps | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 258 | ## Step 4: Decide The Outcome | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 276 | ## Step 5: Reuse Or Create One prtags Group | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 326 | ## Step 6: Ensure The Annotation Fields Exist | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 349 | ## Step 7: Save The Maintainer Judgment In prtags | COMMENT |
| LOW | .agents/skills/tag-duplicate-prs-issues/SKILL.md | 383 | ## Step 8: Let prtags Sync The Group Comment | COMMENT |
| LOW | docs/plugins/sdk-provider-plugins.md | 31 | ### Step 1: Package and manifest | COMMENT |
| LOW | docs/plugins/sdk-provider-plugins.md | 700 | ### Step 5: Add extra capabilities | COMMENT |
| LOW | docs/plugins/sdk-provider-plugins.md | 1032 | ### Step 6: Test | COMMENT |
| LOW | docs/gateway/remote.md | 140 | #### Step 1: add SSH config | COMMENT |
| LOW⚡ | docs/gateway/remote.md | 154 | #### Step 2: copy SSH key (one-time) | COMMENT |
| LOW⚡ | docs/gateway/remote.md | 160 | #### Step 3: configure the gateway token | COMMENT |
| LOW⚡ | docs/gateway/remote.md | 168 | #### Step 4: create the LaunchAgent | COMMENT |
| LOW | docs/gateway/remote.md | 193 | #### Step 5: load the LaunchAgent | COMMENT |
| LOW | docs/channels/msteams.md | 202 | ### Step 1: Create Azure Bot | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 222 | ### Step 2: Get credentials | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 228 | ### Step 3: Configure messaging endpoint | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 235 | ### Step 4: Enable Teams channel | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 241 | ### Step 5: Build Teams app manifest | COMMENT |
| LOW⚡ | docs/channels/msteams.md | 250 | ### Step 6: Configure OpenClaw | COMMENT |
| LOW | docs/channels/msteams.md | 268 | ### Step 7: Run the gateway | COMMENT |
| LOW | extensions/discord/src/voice-message.ts | 418 | // Step 1: Request upload URL from Discord | COMMENT |
| LOW | extensions/discord/src/voice-message.ts | 446 | // Step 3: Send the message with voice message flag and metadata | COMMENT |
| LOW⚡ | extensions/discord/src/internal/command-deploy.test.ts | 386 | // Step 1: A runs a full deploy (load -> reconcile -> persist) on the | COMMENT |
| LOW⚡ | extensions/discord/src/internal/command-deploy.test.ts | 390 | // Step 2: B runs its full deploy. Without the fix, B's persistHashes | COMMENT |
| LOW⚡ | extensions/open-prose/skills/prose/compiler.md | 2795 | # Step 1: Gather data | STRING |
| LOW⚡ | extensions/open-prose/skills/prose/compiler.md | 2799 | # Step 2: Analysis | STRING |
| LOW⚡ | extensions/open-prose/skills/prose/compiler.md | 2803 | # Step 3: Report generation | STRING |
| LOW | extensions/feishu/src/bitable.ts | 298 | // Step 1: Clean up default fields | COMMENT |
| LOW | extensions/feishu/src/bitable.ts | 349 | // Step 2: Delete empty placeholder rows (batch when possible) | COMMENT |
| LOW | extensions/feishu/src/docx.ts | 714 | // Step 1: Create an empty image block (block_type 27). | COMMENT |
| LOW | extensions/feishu/src/docx.ts | 729 | // Step 2: Resolve and upload the image buffer. | COMMENT |
| LOW | extensions/feishu/src/docx.ts | 746 | // Step 3: Set the image token on the block. | COMMENT |
| LOW⚡ | extensions/irc/src/protocol.ts | 119 | // Step 1: decode surrogate pairs — first group locked to high surrogate range | COMMENT |
| LOW⚡ | extensions/irc/src/protocol.ts | 128 | // Step 2: decode BMP codepoints; preserve lone surrogates as literals | COMMENT |
| LOW⚡ | …ons/qqbot/src/engine/messaging/streaming-media-send.ts | 95 | // Step 1: 将八进制转义转换为字节 | COMMENT |
| LOW⚡ | …ons/qqbot/src/engine/messaging/streaming-media-send.ts | 100 | // Step 2: 提取所有字节（包括 Latin-1 字符） | COMMENT |
| LOW | …ons/qqbot/src/engine/messaging/streaming-media-send.ts | 112 | // Step 3: 尝试按 UTF-8 解码 | COMMENT |
| LOW | …tensions/imessage/src/monitor/self-chat-dedupe.test.ts | 583 | // Step 1: is_from_me=true copy arrives (real user message) → processed, selfChatCache populated | COMMENT |
| LOW | …tensions/imessage/src/monitor/self-chat-dedupe.test.ts | 603 | // Step 2: is_from_me=false reflection arrives 2s later with same text+createdAt | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 581 | // Step 1: trigger msg A — don't await, let it block in dispatch | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 587 | // Step 2: wait until dispatch is in-flight | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 592 | // Step 3: msg B arrives while agent is processing — must not be lost | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 595 | // Step 4: unblock dispatch and complete | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 600 | // Step 5: trigger msg C — should see [msg B] in history (msg A was consumed) | COMMENT |
| LOW | scripts/install.sh | 3293 | # Step 1: Node.js. macOS package-manager branches install Homebrew lazily | COMMENT |
| LOW⚡ | scripts/install.sh | 3330 | # Step 3: Git (required for npm installs that may fetch from git or apply patches) | COMMENT |
| LOW⚡ | scripts/install.sh | 3335 | # Step 4: npm permissions (Linux) | COMMENT |
| LOW⚡ | scripts/install.sh | 3338 | # Step 5: OpenClaw | COMMENT |
| LOW⚡ | scripts/setup-auth-system.sh | 15 | # Step 1: Check current auth status | COMMENT |
| 10 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/scripts/install-sh.test.ts | 1259 | /# Step 1: Node\.js[\s\S]*?load_nvm_for_node_detection\s+if ! check_node; then/, | CODE |
| LOW | extensions/discord/src/voice-message.ts | 418 | // Step 1: Request upload URL from Discord | COMMENT |
| LOW | extensions/discord/src/voice-message.ts | 446 | // Step 3: Send the message with voice message flag and metadata | COMMENT |
| LOW⚡ | extensions/discord/src/internal/command-deploy.test.ts | 386 | // Step 1: A runs a full deploy (load -> reconcile -> persist) on the | COMMENT |
| LOW⚡ | extensions/discord/src/internal/command-deploy.test.ts | 390 | // Step 2: B runs its full deploy. Without the fix, B's persistHashes | COMMENT |
| LOW | extensions/feishu/src/bitable.ts | 298 | // Step 1: Clean up default fields | COMMENT |
| LOW | extensions/feishu/src/bitable.ts | 349 | // Step 2: Delete empty placeholder rows (batch when possible) | COMMENT |
| LOW | extensions/feishu/src/docx.ts | 714 | // Step 1: Create an empty image block (block_type 27). | COMMENT |
| LOW | extensions/feishu/src/docx.ts | 729 | // Step 2: Resolve and upload the image buffer. | COMMENT |
| LOW | extensions/feishu/src/docx.ts | 746 | // Step 3: Set the image token on the block. | COMMENT |
| LOW⚡ | extensions/irc/src/protocol.ts | 119 | // Step 1: decode surrogate pairs — first group locked to high surrogate range | COMMENT |
| LOW⚡ | extensions/irc/src/protocol.ts | 128 | // Step 2: decode BMP codepoints; preserve lone surrogates as literals | COMMENT |
| LOW⚡ | …ons/qqbot/src/engine/messaging/streaming-media-send.ts | 95 | // Step 1: 将八进制转义转换为字节 | COMMENT |
| LOW⚡ | …ons/qqbot/src/engine/messaging/streaming-media-send.ts | 100 | // Step 2: 提取所有字节（包括 Latin-1 字符） | COMMENT |
| LOW | …ons/qqbot/src/engine/messaging/streaming-media-send.ts | 112 | // Step 3: 尝试按 UTF-8 解码 | COMMENT |
| LOW | …tensions/imessage/src/monitor/self-chat-dedupe.test.ts | 583 | // Step 1: is_from_me=true copy arrives (real user message) → processed, selfChatCache populated | COMMENT |
| LOW | …tensions/imessage/src/monitor/self-chat-dedupe.test.ts | 603 | // Step 2: is_from_me=false reflection arrives 2s later with same text+createdAt | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 581 | // Step 1: trigger msg A — don't await, let it block in dispatch | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 587 | // Step 2: wait until dispatch is in-flight | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 592 | // Step 3: msg B arrives while agent is processing — must not be lost | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 595 | // Step 4: unblock dispatch and complete | COMMENT |
| LOW⚡ | …atrix/src/matrix/monitor/handler.group-history.test.ts | 600 | // Step 5: trigger msg C — should see [msg B] in history (msg A was consumed) | COMMENT |
| LOW | extensions/signal/src/monitor/event-handler.ts | 905 | // We need to check if it's from our own account to prevent self-reply loops | COMMENT |
| LOW | scripts/install.sh | 3293 | # Step 1: Node.js. macOS package-manager branches install Homebrew lazily | COMMENT |
| LOW⚡ | scripts/install.sh | 3330 | # Step 3: Git (required for npm installs that may fetch from git or apply patches) | COMMENT |
| LOW⚡ | scripts/install.sh | 3335 | # Step 4: npm permissions (Linux) | COMMENT |
| LOW⚡ | scripts/install.sh | 3338 | # Step 5: OpenClaw | COMMENT |
| LOW⚡ | scripts/setup-auth-system.sh | 15 | # Step 1: Check current auth status | COMMENT |
| LOW⚡ | scripts/setup-auth-system.sh | 20 | # Step 2: Set up long-lived token | COMMENT |
| LOW | scripts/setup-auth-system.sh | 41 | # Step 3: Set up auth monitoring | COMMENT |
| LOW | scripts/setup-auth-system.sh | 151 | # Step 4: Termux widget setup | COMMENT |
| LOW⚡ | …-definition-adapter.after-tool-call.fires-once.test.ts | 201 | // Step 1: Simulate tool_execution_start event (SDK emits this) | COMMENT |
| LOW⚡ | …-definition-adapter.after-tool-call.fires-once.test.ts | 204 | // Step 2: Execute tool through the adapter wrapper (SDK calls this) | COMMENT |
| LOW⚡ | …-definition-adapter.after-tool-call.fires-once.test.ts | 207 | // Step 3: Simulate tool_execution_end event (SDK emits this after execute returns) | COMMENT |
| LOW⚡ | src/agents/sessions/package-manager.ts | 606 | // Step 1: Apply includes (or all if no includes) | COMMENT |
| LOW⚡ | src/agents/sessions/package-manager.ts | 614 | // Step 2: Apply excludes | COMMENT |
| LOW⚡ | src/agents/sessions/package-manager.ts | 619 | // Step 3: Force-include (add back from allPaths, overriding exclusions) | COMMENT |
| LOW⚡ | src/agents/sessions/package-manager.ts | 628 | // Step 4: Force-exclude (remove even if included or force-included) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | extensions/msteams/src/messenger.ts | 288 | // Mark as AI-generated so Teams renders the "AI generated" badge. | COMMENT |
| HIGH | extensions/msteams/src/messenger.ts | 298 | // Start with mention entities (if any) + AI-generated entity | COMMENT |
| HIGH | extensions/msteams/src/reply-stream-controller.ts | 341 | // Emit a final MessageActivity carrying the AI-generated marker and (if | COMMENT |
| HIGH | extensions/msteams/src/reply-stream-controller.ts | 344 | // get the AI-generated label and thumbs up/down. | COMMENT |
| HIGH | extensions/msteams/src/sdk.ts | 88 | // Feedback (thumbs up/down) on AI-generated messages — Teams delivers | COMMENT |
| HIGH | extensions/msteams/src/monitor.ts | 499 | // Feedback (thumbs up/down) on AI-generated messages. Teams delivers this as | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | …s/skills/autoreview/tests/test_autoreview_hardening.py | 987 | + "word=`op read op://vault/item/password || echo real-hardcoded-" | CODE |
| HIGH⚡ | …s/skills/autoreview/tests/test_autoreview_hardening.py | 1100 | + 'ken = process.env.TOKEN || choose(/\\)/, "' | CODE |
| HIGH⚡ | …s/skills/autoreview/tests/test_autoreview_hardening.py | 1654 | + "word = user.credentials.password || getDefault(\n" | CODE |
| HIGH | …s/skills/autoreview/tests/test_autoreview_hardening.py | 1058 | "pass" + "word = user.credentials.password || null", | CODE |
| HIGH | …s/skills/autoreview/tests/test_autoreview_hardening.py | 1334 | + "ken = provider.issue_token(value<int> / total || process.env.TOKEN)", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …s/OpenClawIPCTests/OnboardingCrestodianChatTests.swift | 0 | { "type": "res", "id": "\(id)", "ok": false, "error": { "code": "unavailable", "message": "temporary failure" } } | STRING |
| HIGH | …os/Tests/OpenClawIPCTests/OnboardingAISetupTests.swift | 0 | { "type": "res", "id": "\(id)", "ok": false, "error": { "code": "unavailable", "message": "temporary failure" } } | STRING |
| HIGH | …awIPCTests/OnboardingConfiguredGatewayProbeTests.swift | 0 | { "type": "res", "id": "\(id)", "ok": false, "error": { "code": "unavailable", "message": "temporary failure" } } | STRING |
| HIGH | …ai/openclaw/app/gateway/GatewaySessionReconnectTest.kt | 0 | {"type":"event","event":"connect.challenge","payload":{"nonce":"android-test-nonce"}} | STRING |
| HIGH | …va/ai/openclaw/app/gateway/GatewaySessionInvokeTest.kt | 0 | {"type":"event","event":"connect.challenge","payload":{"nonce":"android-test-nonce"}} | STRING |
| HIGH | …penclaw/app/gateway/GatewaySessionCustomHeadersTest.kt | 0 | {"type":"event","event":"connect.challenge","payload":{"nonce":"android-test-nonce"}} | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/recover-orphaned-processes.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/create-dmg.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/run-opengrep.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/notarize-mac-artifact.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/k8s/deploy.sh | 7 | # Usage: | COMMENT |
| LOW⚡ | scripts/k8s/create-kind.sh | 6 | # Usage: | COMMENT |
| LOW⚡ | scripts/clawdock/clawdock-helpers.sh | 10 | # Usage: | COMMENT |
| LOW | scripts/e2e/multi-node-update-docker.sh | 13 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/ios-team-id.sh | 117 | except Exception: | CODE |
| LOW | scripts/ios-team-id.sh | 175 | except Exception: | CODE |
| LOW | scripts/docker/setup.sh | 91 | except Exception: | CODE |
| LOW | scripts/e2e/parallels/npm-update-scripts.ts | 219 | except Exception: | CODE |
| LOW⚡ | scripts/e2e/parallels/windows-git.ts | 35 | except Exception: | CODE |
| LOW | skills/model-usage/scripts/model_usage.py | 92 | except Exception: | CODE |
| LOW | skills/model-usage/scripts/model_usage.py | 284 | except Exception as exc: | CODE |
| LOW | skills/skill-creator/scripts/package_skill.py | 114 | except Exception as e: | CODE |
| LOW | skills/python-debugpy/SKILL.md | 48 | except Exception: | CODE |
| MEDIUM | apps/macos/Sources/OpenClawMacCLI/ConnectCommand.swift | 265 | print("Error: \(error)") | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/concepts/memory-honcho.md | 74 | apiKey: "your-api-key", // omit for self-hosted | CODE |
| HIGH | skills/trello/SKILL.md | 35 | export TRELLO_API_KEY="your-api-key" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.yml | 49 | ## Set DOCKER_GID to the host's docker group GID (run: stat -c '%g' /var/run/docker.sock). | COMMENT |
| LOW | scripts/clawlog.sh | 314 | # Check if file was created and has content | COMMENT |
| LOW | scripts/auth-monitor.sh | 38 | # Check if we notified recently | COMMENT |
| LOW | scripts/auth-monitor.sh | 46 | # Check if we can still use openclaw | COMMENT |
| LOW⚡ | scripts/k8s/create-kind.sh | 154 | # Check if cluster already exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/skills/autoreview/tests/test_autoreview_hardening.py | 3557 | CODE | |
| LOW | …s/skills/autoreview/tests/test_autoreview_hardening.py | 4122 | CODE | |
| LOW | scripts/release-telegram-candidate-archive.py | 207 | CODE | |
| LOW | scripts/release-telegram-candidate-archive.py | 436 | CODE | |
| LOW | scripts/e2e/telegram-user-driver.py | 274 | CODE | |
| LOW | skills/model-usage/scripts/model_usage.py | 156 | CODE | |
| LOW | skills/skill-creator/scripts/package_skill.py | 28 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/create-dmg.sh | 4 | # Create a styled DMG containing the app bundle + /Applications symlink. | COMMENT |
| MEDIUM | scripts/e2e/multi-node-update-docker.sh | 127 | # Create a systemctl shim since we are in Docker (no real systemd). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/skills/autoreview/tests/test_autoreview_hardening.py | 2 | CODE | |
| LOW | …gents/skills/autoreview/scripts/test-review-harness.py | 2 | CODE | |
| LOW | .agents/skills/autoreview/scripts/autoreview_test.py | 2 | CODE | |
| LOW | scripts/check-composite-action-input-interpolation.py | 2 | CODE | |
| LOW | scripts/release-telegram-candidate-archive.py | 4 | CODE | |
| LOW | skills/model-usage/scripts/model_usage.py | 8 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …es/memory-host-sdk/src/host/embeddings-worker-child.ts | 82 | async function handleRequest(request: LocalEmbeddingWorkerRequest): Promise<void> { | CODE |
| LOW | src/cli/skills-cli.clawhub-install.e2e.test.ts | 57 | async function handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void> { | CODE |
| LOW | src/auto-reply/chunk.test.ts | 143 | const fence = "```python\ndef my_function():\n x = 1\n\n y = 2\n return x + y\n```"; | CODE |
| LOW | src/gateway/server-http.ts | 503 | async function handleRequest(req: IncomingMessage, res: ServerResponse) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …s/embedded-agent-helpers.isbillingerrormessage.test.ts | 218 | "Let me know if you need more details on any of these topics!"; | CODE |