Home / paperclipai / paperclip
Repository Analysis

paperclipai/paperclip

The open-source app everyone uses to manage agents at work

3.6 Likely human-written View on GitHub
3.6
Adjusted Score
3.6
Raw Score
100%
Time Factor
2026-05-30
Last Push
68,293
Stars
TypeScript
Language
630,271
Lines of Code
2231
Files
2169
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 2HIGH 0MEDIUM 67LOW 2100

Pattern Findings

2169 matches across 8 categories. Click a row to expand file-level details.

Hyper-Verbose Identifiers2024 hits · 1918 pts
SeverityFileLineSnippet
LOWui/storybook/.storybook/preview.tsx42function installStorybookApiFixtures() {
LOW…torybook/stories/projects-goals-workspaces.stories.tsx446function ProjectsGoalsWorkspacesStories() {
LOW…rybook/stories/assigned-backlog-safeguards.stories.tsx95function AssignedBacklogNoticePanel() {
LOWui/storybook/stories/acpx-local.stories.tsx813function AcpxClaudeSkillsLoadingStory() {
LOWui/storybook/stories/acpx-local.stories.tsx829function AcpxClaudeSkillsEmptyLibraryStory() {
LOWui/storybook/stories/scheduled-retry.stories.tsx59function ScheduledRetrySurfaceStories() {
LOWui/storybook/stories/successful-run-handoff.stories.tsx33function SuccessfulRunHandoffStates() {
LOWui/storybook/stories/successful-run-handoff.stories.tsx164function SuccessfulRunHandoffPinnedNotice() {
LOWui/storybook/stories/successful-run-handoff.stories.tsx168function SuccessfulRunHandoffActivityEvents() {
LOWui/storybook/stories/successful-run-handoff.stories.tsx172function SuccessfulRunHandoffIssueCard() {
LOWui/storybook/stories/successful-run-handoff.stories.tsx176function SuccessfulRunHandoffEscalationComment() {
LOWui/storybook/stories/issue-management.stories.tsx138function seedIssueListLocalStorage() {
LOWui/storybook/stories/issue-management.stories.tsx167function ColumnConfigurationMatrix() {
LOWui/storybook/stories/issue-management.stories.tsx718function ModelProfileLedgerStandalone() {
LOWui/storybook/stories/blocked-inbox.stories.tsx210function BlockedReasonChipsCatalog() {
LOW…torybook/stories/issue-thread-interactions.stories.tsx92function InteractiveSuggestedTasksCard() {
LOW…torybook/stories/issue-thread-interactions.stories.tsx152function InteractiveAskUserQuestionsCard() {
LOW…torybook/stories/issue-thread-interactions.stories.tsx169function InteractiveRequestConfirmationCard() {
LOW…torybook/stories/issue-thread-interactions.stories.tsx194function AutoOpenDeclineRequestConfirmationCard({
LOWui/storybook/stories/dialogs-modals.stories.tsx642function ExecutionWorkspaceDialogStory({ blocked }: { blocked?: boolean }) {
LOWui/storybook/stories/dialogs-modals.stories.tsx706function findAssigneeOptionsButton() {
LOWui/storybook/stories/dialogs-modals.stories.tsx713function useCheapLaneAdapterOverrides(variant: CheapLaneVariant) {
LOWui/storybook/stories/dialogs-modals.stories.tsx760function CheapLaneIssueDialogOpener({ variant }: { variant: CheapLaneVariant }) {
LOWui/storybook/stories/dialogs-modals.stories.tsx816function PathInstructionsModalStory() {
LOWui/storybook/stories/search.stories.tsx388function CommandPaletteWithSearchAll({
LOWui/storybook/stories/navigation-layout.stories.tsx126function MobileBottomNavActiveStateMatrix() {
LOWui/storybook/stories/document-annotations.stories.tsx368function DirtyDraftWithIntegratedHeader() {
LOWui/src/main.tsx40function CompanyAwareBreadcrumbProvider({ children }: { children: React.ReactNode }) {
LOWui/src/context/EditorAutocompleteContext.tsx41export function EditorAutocompleteProvider({ children }: { children: ReactNode }) {
LOWui/src/context/LiveUpdatesProvider.tsx180function resolveVisibleIssueRouteContext(
LOWui/src/context/LiveUpdatesProvider.tsx233function shouldSuppressActivityToastForVisibleIssue(
LOWui/src/context/LiveUpdatesProvider.tsx249function shouldSuppressRunStatusToastForVisibleIssue(
LOWui/src/context/LiveUpdatesProvider.tsx265function invalidateVisibleIssueRunQueries(
LOWui/src/context/LiveUpdatesProvider.tsx309function shouldSuppressAgentStatusToastForVisibleIssue(
LOWui/src/context/LiveUpdatesProvider.tsx322function shouldDeferIssueRefetchForVisibleAgentActivity(
LOWui/src/context/LiveUpdatesProvider.tsx345function shouldDeferVisibleIssueCommentActivity(
LOWui/src/context/LiveUpdatesProvider.tsx365async function hydrateVisibleIssueComment(
LOWui/src/context/LiveUpdatesProvider.tsx620function invalidateHeartbeatQueries(
LOWui/src/context/LiveUpdatesProvider.tsx639function invalidateActivityQueries(
LOWui/src/context/CompanyContext.tsx38export function resolveBootstrapCompanySelection(input: {
LOWui/src/context/CompanyContext.tsx58export function shouldClearStoredCompanySelection(input: {
LOWui/src/plugins/launchers.tsx161function resolveLauncherNavigationTarget(target: string, hostContext: PluginLauncherContext): string {
LOWui/src/plugins/launchers.tsx373function PluginLauncherBridgeScope({
LOWui/src/plugins/slots.tsx139function usePluginRegistrySubscription(): void {
LOWui/src/plugins/slots.tsx163export function registerPluginReactComponent(
LOWui/src/plugins/slots.tsx178export function registerPluginWebComponent(
LOWui/src/plugins/slots.tsx190function resolveRegisteredComponent(slot: ResolvedPluginSlot): RegisteredPluginComponent | null {
LOWui/src/plugins/slots.tsx194export function resolveRegisteredPluginComponent(
LOWui/src/plugins/slots.tsx201function isRegisterablePluginExport(exported: unknown): boolean {
LOWui/src/plugins/slots.tsx205function collectRegisterableExportNames(
LOWui/src/plugins/slots.tsx335 return function MissingPaperclipSdkUiComponent() {
LOWui/src/plugins/slots.tsx553function isLauncherComponentTarget(launcher: PluginLauncherDeclaration): boolean {
LOWui/src/plugins/slots.tsx565async function ensurePluginModulesLoaded(contributions: PluginUiContribution[]): Promise<void> {
LOWui/src/plugins/slots.tsx571export async function ensurePluginContributionLoaded(
LOWui/src/plugins/bridge.ts239function serializeRenderEnvironment(
LOWui/src/plugins/bridge.ts250function serializeRenderEnvironmentSnapshot(
LOWui/src/plugins/bridge.ts290export function resolveHostNavigationHref(
LOWui/src/plugins/bridge.ts320export function shouldHandleHostNavigationClick(
LOWui/src/adapters/local-workspace-runtime-fields.tsx3export function LocalWorkspaceRuntimeFields(_props: AdapterConfigFieldsProps) {
LOWui/src/adapters/registry.ts53function registerBuiltInUIAdapters() {
1964 more matches not shown…
Decorative Section Separators66 hits · 212 pts
SeverityFileLineSnippet
MEDIUMui/src/adapters/registry.ts166 // ── Builtin override lifecycle ──────────────────────────────────────────
MEDIUMui/src/adapters/registry.ts222 // ── Non-builtin externals ───────────────────────────────────────────────
MEDIUMui/src/adapters/schema-config-fields.tsx16// ── Select field (extracted to keep hooks at component top level) ──────
MEDIUMui/src/adapters/sandboxed-parser-worker.ts14// ── Message protocol ────────────────────────────────────────────────────────
MEDIUMui/src/adapters/sandboxed-parser-worker.ts27// ── Worker bootstrap source ─────────────────────────────────────────────────
MEDIUMui/src/adapters/sandboxed-parser-worker.ts41// ── 1. Lock down dangerous globals ──────────────────────────────────────────
MEDIUMui/src/adapters/sandboxed-parser-worker.ts82// ── 2. Parser state ─────────────────────────────────────────────────────────
MEDIUMui/src/adapters/sandboxed-parser-worker.ts88// ── 3. Message handler ──────────────────────────────────────────────────────
MEDIUMui/src/adapters/sandboxed-parser-worker.ts158// ── Public API ───────────────────────────────────────────────────────────────
MEDIUMui/src/adapters/dynamic-loader.ts35// ── Types ───────────────────────────────────────────────────────────────────
MEDIUMui/src/adapters/dynamic-loader.ts49// ── State ───────────────────────────────────────────────────────────────────
MEDIUMui/src/adapters/dynamic-loader.ts69// ── Internal helpers ────────────────────────────────────────────────────────
MEDIUMui/src/adapters/dynamic-loader.ts210// ── Public API ──────────────────────────────────────────────────────────────
MEDIUMui/src/components/transcript/RunTranscriptView.tsx599 // ── Diff entries — accumulate into diff_group blocks ──────────
MEDIUMui/src/pages/CompanyImport.tsx51// ── Import-specific helpers ───────────────────────────────────────────
MEDIUMui/src/pages/CompanyImport.tsx147// ── Import file tree customization ───────────────────────────────────
MEDIUMui/src/pages/CompanyImport.tsx179// ── Preview pane ──────────────────────────────────────────────────────
MEDIUMui/src/pages/CompanyImport.tsx266// ── Conflict item type ───────────────────────────────────────────────
MEDIUMui/src/pages/CompanyImport.tsx388// ── Conflict resolution UI ───────────────────────────────────────────
MEDIUMui/src/pages/CompanyImport.tsx514// ── Adapter type options for import ───────────────────────────────────
MEDIUMui/src/pages/CompanyImport.tsx521// ── Adapter picker for imported agents ───────────────────────────────
MEDIUMui/src/pages/CompanyImport.tsx624// ── Helpers ───────────────────────────────────────────────────────────
MEDIUMui/src/pages/CompanyImport.tsx645// ── Main page ─────────────────────────────────────────────────────────
MEDIUMui/src/pages/OrgChart.tsx26// ── Tree layout types ───────────────────────────────────────────────────
MEDIUMui/src/pages/OrgChart.tsx53// ── Layout algorithm ────────────────────────────────────────────────────
MEDIUMui/src/pages/OrgChart.tsx157// ── Status dot colors (raw hex for SVG) ─────────────────────────────────
MEDIUMui/src/pages/OrgChart.tsx171// ── Main component ──────────────────────────────────────────────────────
MEDIUMui/src/pages/CompanyExport.tsx345// ── Frontmatter card (export-specific: skill click support) ──────────
MEDIUMui/src/pages/CompanyExport.tsx390// ── Client-side README generation ────────────────────────────────────
MEDIUMui/src/pages/CompanyExport.tsx488// ── Preview pane ──────────────────────────────────────────────────────
MEDIUMui/src/pages/CompanyExport.tsx557// ── Main page ─────────────────────────────────────────────────────────
MEDIUMserver/src/routes/adapters.ts545 // ── POST /api/adapters/:type/reinstall ──────────────────────────────────
MEDIUMserver/src/routes/adapters.ts613 // ── GET /api/adapters/:type/config-schema ────────────────────────────────
MEDIUMserver/src/routes/adapters.ts657 // ── GET /api/adapters/:type/ui-parser.js ─────────────────────────────────
MEDIUMserver/src/routes/org-chart-svg.ts30// ── Style theme definitions ──────────────────────────────────────
MEDIUMserver/src/routes/org-chart-svg.ts54// ── Role config with Twemoji SVG inlines (viewBox 0 0 36 36) ─────
MEDIUMserver/src/routes/org-chart-svg.ts159// ── Style themes ─────────────────────────────────────────────────
MEDIUMserver/src/routes/org-chart-svg.ts318// ── Layout constants ─────────────────────────────────────────────
MEDIUMserver/src/routes/org-chart-svg.ts327// ── Collapsed avatar grid constants ─────────────────────────────
MEDIUMserver/src/routes/org-chart-svg.ts335// ── Text measurement ─────────────────────────────────────────────
MEDIUMserver/src/routes/org-chart-svg.ts379// ── Tree layout (top-down, centered) ─────────────────────────────
MEDIUMserver/src/routes/org-chart-svg.ts420// ── SVG rendering ────────────────────────────────────────────────
MEDIUMserver/src/routes/org-chart-svg.ts566// ── Public API ───────────────────────────────────────────────────
MEDIUMcli/src/commands/worktree.ts1730 // ── 1. Assess current state ──────────────────────────────────────────
MEDIUMcli/src/commands/worktree.ts1747 // ── 2. Safety checks ────────────────────────────────────────────────
MEDIUMcli/src/commands/worktree.ts1783 // ── 3. Clean up (idempotent steps) ──────────────────────────────────
MEDIUMscripts/generate-org-chart-satori-comparison.ts23// ── Sample org data ──────────────────────────────────────────────
MEDIUMscripts/generate-org-chart-satori-comparison.ts126// ── Main ─────────────────────────────────────────────────────────
MEDIUMscripts/generate-org-chart-images.ts17// ── Org data (same as index.html) ──────────────────────────────
MEDIUMscripts/generate-org-chart-images.ts127// ── Style definitions ──────────────────────────────────────────
MEDIUMscripts/generate-org-chart-images.ts516// ── HTML rendering ─────────────────────────────────────────────
MEDIUMscripts/generate-org-chart-images.ts567// ── Main ───────────────────────────────────────────────────────
MEDIUMscripts/build-npm.sh28# ── Step 1: Forbidden token check ──────────────────────────────────────────────
MEDIUMscripts/build-npm.sh36# ── Step 2: TypeScript type-check ──────────────────────────────────────────────
MEDIUMscripts/build-npm.sh45# ── Step 3: Bundle CLI with esbuild ────────────────────────────────────────────
MEDIUMscripts/build-npm.sh58# ── Step 4: Validate bundled entrypoint syntax ─────────────────────────────────
MEDIUMscripts/build-npm.sh62# ── Step 5: Back up dev package.json, generate publishable one ─────────────────
MEDIUMscripts/build-npm.sh70# ── Step 6: Summary ───────────────────────────────────────────────────────────
MEDIUMscripts/generate-company-assets.ts20// ── YAML frontmatter parser (minimal, no deps) ──────────────────
MEDIUMscripts/generate-company-assets.ts96// ── Slug to role mapping ─────────────────────────────────────────
6 more matches not shown…
Verbosity Indicators45 hits · 74 pts
SeverityFileLineSnippet
LOWtests/e2e/signoff-policy.spec.ts279 // Step 1: Executor marks done → should route to reviewer
LOWtests/e2e/signoff-policy.spec.ts297 // Step 2: Navigate to issue in UI and verify execution label
LOWtests/e2e/signoff-policy.spec.ts301 // Step 3: Reviewer approves → should route to approver
LOWtests/e2e/signoff-policy.spec.ts315 // Step 4: Verify UI shows approval pending
LOWtests/e2e/signoff-policy.spec.ts319 // Step 5: Approver approves → should complete
LOWserver/src/routes/access.ts1684 ## Step 1: Submit agent join request
LOWserver/src/routes/access.ts1722 ## Step 2: Wait for board approval
LOWserver/src/routes/access.ts1725 ## Step 3: Claim API key (one-time)
LOWserver/src/routes/access.ts1742 ## Step 4: Install Paperclip skill
LOWserver/src/routes/plugins.ts2501 // Step 1: Resolve the plugin
LOWserver/src/routes/plugins.ts2508 // Step 2: Validate the plugin is in 'ready' state
LOWserver/src/routes/plugins.ts2516 // Step 3: Validate the plugin has webhooks.receive capability
LOWserver/src/routes/plugins.ts2531 // Step 4: Validate the endpointKey exists in the manifest's webhook declarations
LOWserver/src/routes/plugins.ts2543 // Step 5: Extract request data
LOWserver/src/routes/plugins.ts2562 // Step 6: Record the delivery in the database
LOWserver/src/routes/plugins.ts2576 // Step 7: Dispatch to the worker via handleWebhook RPC
LOWserver/src/routes/plugins.ts2586 // Step 8: Update delivery record to success
LOWserver/src/routes/plugin-ui-static.ts244 // Step 1: Look up the plugin
LOWserver/src/routes/plugin-ui-static.ts266 // Step 2: Verify the plugin is ready and has UI declared
LOWserver/src/routes/plugin-ui-static.ts393 // Step 3: Resolve the plugin's UI directory
LOWserver/src/routes/plugin-ui-static.ts410 // Step 4: Resolve the requested file path and prevent traversal (including symlinks)
LOWserver/src/routes/plugin-ui-static.ts413 // Step 5: Check that the file exists and is a regular file
LOWserver/src/routes/plugin-ui-static.ts445 // Step 6: Determine cache strategy based on filename
LOWserver/src/routes/plugin-ui-static.ts449 // Step 7: Set cache headers
LOWserver/src/routes/plugin-ui-static.ts467 // Step 8: Set Content-Type
LOWserver/src/routes/plugin-ui-static.ts474 // Step 9: Set CORS headers (plugin UI may be loaded from different origin in dev)
LOWserver/src/routes/plugin-ui-static.ts477 // Step 10: Send the file
LOWserver/src/services/plugin-worker-manager.ts992 // Step 1: Send shutdown RPC and wait for the worker to exit gracefully.
LOWserver/src/services/plugin-worker-manager.ts1016 // Step 2: Send SIGTERM and wait
LOWserver/src/services/plugin-worker-manager.ts1025 // Step 3: Forcefully kill with SIGKILL
LOWserver/src/services/environment-run-orchestrator.ts271 // Step 1: Resolve environment
LOWserver/src/services/environment-run-orchestrator.ts278 // Step 2: Acquire lease
LOWserver/src/services/environment-run-orchestrator.ts287 // Step 3: Log lease acquisition activity
LOWserver/src/services/environment-run-orchestrator.ts307 // Step 4: Resolve execution transport
LOWserver/src/services/environment-run-orchestrator.ts357 // Step 1: Build workspace realization request
LOWserver/src/services/environment-run-orchestrator.ts370 // Step 2: Realize workspace in the environment via the runtime driver
LOWserver/src/services/environment-run-orchestrator.ts448 // Step 3: Persist realization metadata on lease and execution workspace
LOWserver/src/services/environment-run-orchestrator.ts472 // Step 4: Resolve execution target for the adapter
LOWserver/src/services/plugin-tool-dispatcher.ts324 // Step 1: Load tools from all currently-ready plugins
LOWserver/src/services/plugin-tool-dispatcher.ts344 // Step 2: Subscribe to lifecycle events for dynamic updates
LOWserver/src/services/plugin-loader.ts901 // Step 3: Read and validate plugin manifest
LOWserver/src/services/plugin-loader.ts915 // Step 4: Reject incompatible plugin API versions
LOWserver/src/services/plugin-loader.ts923 // Step 5: Validate manifest capabilities are consistent
LOWserver/src/services/plugin-loader.ts934 // Step 6: Reject plugins that require a newer host than the running server
LOWserver/src/services/plugin-loader.ts1342 // Step 6: Persist install record and apply plugin-owned schema migrations
Hallucination Indicators2 hits · 20 pts
SeverityFileLineSnippet
CRITICAL…kages/plugins/sandbox-providers/e2b/src/plugin.test.ts306 const stdinCall = sandbox.commands.run.mock.calls.find(([cmd]: [string]) => cmd.includes("'printf'"));
CRITICAL…kages/plugins/sandbox-providers/e2b/src/plugin.test.ts363 const fgCall = sandbox.commands.run.mock.calls.find(([cmd]: [string]) => cmd.includes("'printf'"));
Fake / Example Data16 hits · 16 pts
SeverityFileLineSnippet
LOWui/src/App.test.tsx104 user: { id: "user-1", email: "user@example.com", name: "User", image: null },
LOWui/src/App.test.tsx107 user: { id: "user-1", email: "user@example.com", name: "User", image: null },
LOWui/src/App.test.tsx127 user: { id: "user-1", email: "user@example.com", name: "User", image: null },
LOWui/src/App.test.tsx130 user: { id: "user-1", email: "user@example.com", name: "User", image: null },
LOWui/src/App.test.tsx178 user: { id: "user-1", email: "user@example.com", name: "User", image: null },
LOWui/src/App.test.tsx215 user: { id: "user-1", email: "user@example.com", name: "User", image: null },
LOWui/src/components/OnboardingWizard.tsx685 placeholder="Acme Corp"
LOWtests/e2e/planning-mode-visual-verification.spec.ts16 await page.locator('input[placeholder="Acme Corp"]').fill(companyName);
LOWtests/e2e/onboarding.spec.ts31 const companyNameInput = page.locator('input[placeholder="Acme Corp"]');
LOWtests/release-smoke/docker-auth-onboarding.spec.ts47 await page.locator('input[placeholder="Acme Corp"]').fill(COMPANY_NAME);
LOWserver/src/__tests__/auth-session-route.test.ts45 email: "user@example.com",
LOWserver/src/__tests__/auth-session-route.test.ts61 userEmail: "user@example.com",
LOWserver/src/__tests__/cli-auth-routes.test.ts209 user: { id: "user-1", name: "User One", email: "user@example.com" },
LOWpackages/plugins/create-paperclip-plugin/README.md17 --author "Acme Inc"
LOWpackages/db/src/client.test.ts154 VALUES ('user-1', 'User One', 'user@example.com', true, now(), now())
LOWdoc/plans/2026-02-18-agent-authentication.md126 "name": "Acme Corp"
Example Usage Blocks6 hits · 9 pts
SeverityFileLineSnippet
LOWevals/promptfoo/promptfooconfig.yaml7# Usage:
LOWscripts/build-npm.sh9# Usage:
LOWscripts/kill-agent-browsers.sh5# Usage:
LOWscripts/kill-dev.sh5# Usage:
LOWscripts/kill-vitest.sh5# Usage:
LOWscripts/backup-db.sh7# Usage:
Over-Commented Block9 hits · 8 pts
SeverityFileLineSnippet
LOWui/src/components/IssueChatThread.tsx3961 if (useVirtualizedThread) {
LOWevals/promptfoo/promptfooconfig.yaml1# Paperclip Agent Evals - Phase 0: Promptfoo Bootstrap
LOWserver/src/__tests__/qa-routine-secrets-e2e.test.ts1// QA validation for [PAP-9522](/PAP/issues/PAP-9522). Drives the routine-secret
LOWserver/src/services/plugin-loader.ts1881 log.info(
LOWserver/src/services/plugin-loader.ts1901 const _scopedBus = eventBus.forPlugin(pluginKey);
LOW…ckages/plugins/sandbox-providers/daytona/src/plugin.ts321 throw error;
LOWpackages/adapters/opencode-local/src/index.ts1import type { AdapterModelProfileDefinition } from "@paperclipai/adapter-utils";
LOWpackages/adapters/opencode-local/src/index.ts21// Security tradeoff: this is `curl | bash` without a SHA-256 verification of
LOW…ckages/adapters/claude-local/src/server/permissions.ts1// Explicit allowlist of Claude Code tools we permit when running inside a
AI Slop Vocabulary1 hit · 2 pts
SeverityFileLineSnippet
MEDIUM…es/plugins/plugin-llm-wiki/tests/screenshots/entry.tsx5if (!container) throw new Error("No #root in harness host");