The open-source app everyone uses to manage agents at work
This report presents the forensic synthetic code analysis of paperclipai/paperclip, a TypeScript project with 73,591 GitHub stars. SynthScan v2.0 examined 975,923 lines of code across 3072 source files, recording 3662 pattern matches distributed across 10 syntactic categories. The overall adjusted score of 4.0 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 3662 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/storybook/.storybook/preview.tsx | 41 | function withStorybookTimelineDetails(data: WorkTimelineResult): WorkTimelineResult { | CODE |
| LOW | ui/storybook/.storybook/preview.tsx | 72 | function installStorybookApiFixtures() { | CODE |
| LOW | …torybook/stories/projects-goals-workspaces.stories.tsx | 446 | function ProjectsGoalsWorkspacesStories() { | CODE |
| LOW | …rybook/stories/assigned-backlog-safeguards.stories.tsx | 95 | function AssignedBacklogNoticePanel() { | CODE |
| LOW | ui/storybook/stories/scheduled-retry.stories.tsx | 59 | function ScheduledRetrySurfaceStories() { | CODE |
| LOW | ui/storybook/stories/successful-run-handoff.stories.tsx | 33 | function SuccessfulRunHandoffStates() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 164 | function SuccessfulRunHandoffPinnedNotice() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 168 | function SuccessfulRunHandoffActivityEvents() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 172 | function SuccessfulRunHandoffIssueCard() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 176 | function SuccessfulRunHandoffEscalationComment() { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 238 | function seedIssueListLocalStorage() { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 285 | function IssuePropertiesLongValuePane({ inline = false }: { inline?: boolean }) { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 314 | function ColumnConfigurationMatrix() { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 891 | function ModelProfileLedgerStandalone() { | CODE |
| LOW | ui/storybook/stories/blocked-inbox.stories.tsx | 211 | function BlockedReasonChipsCatalog() { | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 109 | function InteractiveSuggestedTasksCard() { | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 169 | function InteractiveAskUserQuestionsCard() { | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 186 | function InteractiveRequestConfirmationCard() { | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 211 | function InteractiveRequestCheckboxConfirmationCard({ | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 252 | function InteractiveRequestItemVerdictsCard({ | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 299 | function AutoOpenDeclineRequestConfirmationCard({ | CODE |
| LOW | ui/storybook/stories/external-objects.stories.tsx | 625 | function FilterPopoverWithExternalChecked() { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 644 | function ExecutionWorkspaceDialogStory({ blocked }: { blocked?: boolean }) { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 708 | function findAssigneeOptionsButton() { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 715 | function useCheapLaneAdapterOverrides(variant: CheapLaneVariant) { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 764 | function CheapLaneIssueDialogOpener({ variant }: { variant: CheapLaneVariant }) { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 820 | function PathInstructionsModalStory() { | CODE |
| LOW | ui/storybook/stories/search.stories.tsx | 414 | function SearchOperatorInputPreview() { | CODE |
| LOW | ui/storybook/stories/search.stories.tsx | 447 | function CommandPaletteWithSearchAll({ | CODE |
| LOW | ui/storybook/stories/navigation-layout.stories.tsx | 127 | function MobileBottomNavActiveStateMatrix() { | CODE |
| LOW | ui/storybook/stories/navigation-layout.stories.tsx | 370 | function SidebarIconAlignmentHarness() { | CODE |
| LOW | ui/storybook/stories/document-annotations.stories.tsx | 369 | function DirtyDraftWithIntegratedHeader() { | CODE |
| LOW | ui/storybook/stories/forms-editors.stories.tsx | 467 | function EnvironmentVariablesEditorGallery() { | CODE |
| LOW | ui/storybook/stories/work-timeline.stories.tsx | 22 | function withStorybookTimelineDetails(data: WorkTimelineResult): WorkTimelineResult { | CODE |
| LOW | ui/src/App.tsx | 242 | function LegacySkillStudioRedirect() { | CODE |
| LOW | ui/src/main.tsx | 40 | function CompanyAwareBreadcrumbProvider({ children }: { children: React.ReactNode }) { | CODE |
| LOW | ui/src/context/EditorAutocompleteContext.tsx | 41 | export function EditorAutocompleteProvider({ children }: { children: ReactNode }) { | CODE |
| LOW⚡ | ui/src/context/FileViewerContext.tsx | 56 | export function getCurrentFileViewerSearch(fallbackSearch: string): string { | CODE |
| LOW⚡ | ui/src/context/FileViewerContext.tsx | 61 | export function shouldNavigateFileViewerSearch(nextSearch: string, fallbackSearch: string): boolean { | CODE |
| LOW⚡ | ui/src/context/FileViewerContext.tsx | 65 | export function readFileViewerStateFromSearch(search: string): FileViewerUrlState | null { | CODE |
| LOW | ui/src/context/FileViewerContext.tsx | 90 | export function writeFileViewerStateToSearch(current: string, next: FileViewerUrlState | null): string { | CODE |
| LOW | ui/src/context/FileViewerContext.tsx | 127 | export function readBrowseStateFromSearch(search: string): FileViewerBrowseState | null { | CODE |
| LOW | ui/src/context/FileViewerContext.tsx | 142 | export function writeFolderViewerStateToSearch( | CODE |
| LOW | ui/src/context/FileViewerContext.tsx | 202 | function EnabledFileViewerProvider({ issueId, children }: Omit<FileViewerProviderProps, "enabled">) { | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 180 | function resolveVisibleIssueRouteContext( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 233 | function shouldSuppressActivityToastForVisibleIssue( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 249 | function shouldSuppressRunStatusToastForVisibleIssue( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 265 | function invalidateVisibleIssueRunQueries( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 366 | function readRunLiveStatusPatchFromPayload( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 409 | function applyRunLiveStatusPatchToCaches( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 467 | function shouldSuppressAgentStatusToastForVisibleIssue( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 480 | function shouldDeferIssueRefetchForVisibleAgentActivity( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 503 | function shouldDeferVisibleIssueCommentActivity( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 523 | async function hydrateVisibleIssueComment( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 799 | function invalidateHeartbeatQueries( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 818 | function invalidateHeartbeatProgressQueries( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 829 | function invalidateActivityQueries( | CODE |
| LOW | ui/src/context/CompanyContext.tsx | 38 | export function resolveBootstrapCompanySelection(input: { | CODE |
| LOW | ui/src/context/CompanyContext.tsx | 58 | export function shouldClearStoredCompanySelection(input: { | CODE |
| LOW | ui/src/plugins/launchers.tsx | 161 | function resolveLauncherNavigationTarget(target: string, hostContext: PluginLauncherContext): string { | CODE |
| 3144 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ui/src/adapters/registry.ts | 166 | // ── Builtin override lifecycle ────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/registry.ts | 222 | // ── Non-builtin externals ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/schema-config-fields.tsx | 16 | // ── Select field (extracted to keep hooks at component top level) ────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 14 | // ── Message protocol ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 27 | // ── Worker bootstrap source ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 41 | // ── 1. Lock down dangerous globals ────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 82 | // ── 2. Parser state ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 88 | // ── 3. Message handler ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 158 | // ── Public API ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/dynamic-loader.ts | 35 | // ── Types ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/dynamic-loader.ts | 49 | // ── State ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/dynamic-loader.ts | 69 | // ── Internal helpers ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/dynamic-loader.ts | 210 | // ── Public API ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/components/PipelineItemBodyDocument.tsx | 281 | // ── Body content (edit / preview / read) ────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/components/transcript/RunTranscriptView.tsx | 625 | // ── Diff entries — accumulate into diff_group blocks ────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 52 | // ── Import-specific helpers ─────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 148 | // ── Import file tree customization ─────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 180 | // ── Preview pane ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 267 | // ── Conflict item type ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 389 | // ── Conflict resolution UI ─────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 515 | // ── Adapter type options for import ─────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 522 | // ── Adapter picker for imported agents ─────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 625 | // ── Helpers ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 646 | // ── Main page ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/OrgChart.tsx | 27 | // ── Tree layout types ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/OrgChart.tsx | 54 | // ── Layout algorithm ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/OrgChart.tsx | 158 | // ── Status dot colors (raw hex for SVG) ───────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/OrgChart.tsx | 172 | // ── Main component ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyExport.tsx | 345 | // ── Frontmatter card (export-specific: skill click support) ────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyExport.tsx | 390 | // ── Client-side README generation ──────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyExport.tsx | 488 | // ── Preview pane ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyExport.tsx | 557 | // ── Main page ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/nux-phase4-screenshots.spec.ts | 60 | // ── Section A: create-company path (name → mission → hire) ──────────── | COMMENT |
| MEDIUM | tests/e2e/nux-phase4-screenshots.spec.ts | 101 | // ── Section B: front door + growth intake ───────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/nux-phase4-screenshots.spec.ts | 132 | // ── Section C: Conference Room (BoardChat) ──────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/nux-phase4-screenshots.spec.ts | 148 | // ── Section D: Artifacts ────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/plugin-routes-authz.test.ts | 917 | // ─── Agent JWT tool execution (cherry-picked from #5549) ───────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/plugin-routes-authz.test.ts | 917 | // ─── Agent JWT tool execution (cherry-picked from #5549) ───────────────────── | COMMENT |
| MEDIUM | server/src/routes/adapters.ts | 564 | // ── POST /api/adapters/:type/reinstall ────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/adapters.ts | 632 | // ── GET /api/adapters/:type/config-schema ──────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/adapters.ts | 676 | // ── GET /api/adapters/:type/ui-parser.js ───────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/org-chart-svg.ts | 30 | // ── Style theme definitions ────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/org-chart-svg.ts | 54 | // ── Role config with Twemoji SVG inlines (viewBox 0 0 36 36) ───── | COMMENT |
| MEDIUM | server/src/routes/org-chart-svg.ts | 159 | // ── Style themes ───────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/src/routes/org-chart-svg.ts | 318 | // ── Layout constants ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | server/src/routes/org-chart-svg.ts | 327 | // ── Collapsed avatar grid constants ───────────────────────────── | COMMENT |
| MEDIUM⚡ | server/src/routes/org-chart-svg.ts | 335 | // ── Text measurement ───────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/org-chart-svg.ts | 379 | // ── Tree layout (top-down, centered) ───────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/org-chart-svg.ts | 420 | // ── SVG rendering ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/org-chart-svg.ts | 566 | // ── Public API ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 420 | // ─── Common schemas ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 881 | // ─── Health ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 969 | // ─── Companies ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 1131 | // ─── Teams Catalog ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 1149 | // ─── Agents ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 1603 | // ─── Adapters ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 1635 | // ─── Issues ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 2091 | // ─── Projects ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 2186 | // ─── Routines ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/openapi.ts | 2305 | // ─── Goals ─────────────────────────────────────────────────────────────────── | COMMENT |
| 127 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/signoff-policy.spec.ts | 301 | // Step 1: Executor marks done → should route to reviewer | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 319 | // Step 2: Navigate to issue in UI and verify execution label | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 323 | // Step 3: Reviewer approves → should route to approver | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 337 | // Step 4: Verify UI shows approval pending | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 341 | // Step 5: Approver approves → should complete | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 62 | // Step 0: front door (skipped when the wizard opens on the create path). | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 66 | // Step 1: company name. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 70 | // Step 2: mission (direct path default). | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 76 | // Step 3: lead name (prefilled) → Next. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 82 | // Step 4: adapter (claude_local default); heartbeat is intercepted. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 85 | // Step 5: review → Get started creates the first task and opens dashboard. | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 33 | ### Step 1: Gather Context | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 40 | ### Step 2: Interview (Use AskUserQuestion) | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 88 | ### Step 3: Read the Spec | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 100 | ### Step 4: Generate the Package | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 159 | ### Step 5: Confirm Output Location | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 167 | ### Step 6: Write README.md and LICENSE | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 180 | ### Step 7: Write Files and Summarize | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 26 | ## Step 0: Fetch the Advisory Details | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 37 | ## Step 1: Acknowledge the Report | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 47 | ## Step 2: Create the Temporary Private Fork | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 78 | ## Step 3: Develop and Validate the Fix | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 103 | ## Step 4: Coordinate with the Reporter | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 111 | ## Step 5: Request a CVE | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 123 | ## Step 6: Publish Everything Simultaneously | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 208 | ## Step 7: Post-Publication Verification | COMMENT |
| LOW⚡ | server/src/routes/access.ts | 1931 | ## Step 2: Wait for board approval | COMMENT |
| LOW⚡ | server/src/routes/access.ts | 1934 | ## Step 3: Claim API key (one-time) | COMMENT |
| LOW | server/src/routes/access.ts | 1857 | ## Step 1: Submit agent join request | COMMENT |
| LOW | server/src/routes/access.ts | 1951 | ## Step 4: Install Paperclip skill | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2530 | // Step 1: Resolve the plugin | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2537 | // Step 2: Validate the plugin is in 'ready' state | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2545 | // Step 3: Validate the plugin has webhooks.receive capability | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2605 | // Step 7: Dispatch to the worker via handleWebhook RPC | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2615 | // Step 8: Update delivery record to success | COMMENT |
| LOW | server/src/routes/plugins.ts | 2560 | // Step 4: Validate the endpointKey exists in the manifest's webhook declarations | COMMENT |
| LOW | server/src/routes/plugins.ts | 2572 | // Step 5: Extract request data | COMMENT |
| LOW | server/src/routes/plugins.ts | 2591 | // Step 6: Record the delivery in the database | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 244 | // Step 1: Look up the plugin | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 266 | // Step 2: Verify the plugin is ready and has UI declared | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 393 | // Step 3: Resolve the plugin's UI directory | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 410 | // Step 4: Resolve the requested file path and prevent traversal (including symlinks) | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 413 | // Step 5: Check that the file exists and is a regular file | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 445 | // Step 6: Determine cache strategy based on filename | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 449 | // Step 7: Set cache headers | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 467 | // Step 8: Set Content-Type | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 474 | // Step 9: Set CORS headers (plugin UI may be loaded from different origin in dev) | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 477 | // Step 10: Send the file | COMMENT |
| LOW | server/src/services/plugin-worker-manager.ts | 992 | // Step 1: Send shutdown RPC and wait for the worker to exit gracefully. | COMMENT |
| LOW⚡ | server/src/services/plugin-worker-manager.ts | 1016 | // Step 2: Send SIGTERM and wait | COMMENT |
| LOW⚡ | server/src/services/plugin-worker-manager.ts | 1025 | // Step 3: Forcefully kill with SIGKILL | COMMENT |
| LOW⚡ | server/src/services/environment-run-orchestrator.ts | 266 | // Step 1: Resolve environment | COMMENT |
| LOW⚡ | server/src/services/environment-run-orchestrator.ts | 273 | // Step 2: Acquire lease | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 284 | // Step 3: Log lease acquisition activity | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 304 | // Step 4: Resolve execution transport | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 354 | // Step 1: Build workspace realization request | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 367 | // Step 2: Realize workspace in the environment via the runtime driver | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 445 | // Step 3: Persist realization metadata on lease and execution workspace | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 469 | // Step 4: Resolve execution target for the adapter | COMMENT |
| LOW | server/src/services/plugin-tool-dispatcher.ts | 330 | // Step 1: Load tools from all currently-ready plugins | COMMENT |
| 49 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/signoff-policy.spec.ts | 301 | // Step 1: Executor marks done → should route to reviewer | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 319 | // Step 2: Navigate to issue in UI and verify execution label | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 323 | // Step 3: Reviewer approves → should route to approver | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 337 | // Step 4: Verify UI shows approval pending | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 341 | // Step 5: Approver approves → should complete | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 62 | // Step 0: front door (skipped when the wizard opens on the create path). | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 66 | // Step 1: company name. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 70 | // Step 2: mission (direct path default). | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 76 | // Step 3: lead name (prefilled) → Next. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 82 | // Step 4: adapter (claude_local default); heartbeat is intercepted. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 85 | // Step 5: review → Get started creates the first task and opens dashboard. | COMMENT |
| LOW⚡ | server/src/routes/access.ts | 1931 | ## Step 2: Wait for board approval | COMMENT |
| LOW⚡ | server/src/routes/access.ts | 1934 | ## Step 3: Claim API key (one-time) | COMMENT |
| LOW | server/src/routes/access.ts | 1857 | ## Step 1: Submit agent join request | COMMENT |
| LOW | server/src/routes/access.ts | 1951 | ## Step 4: Install Paperclip skill | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2530 | // Step 1: Resolve the plugin | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2537 | // Step 2: Validate the plugin is in 'ready' state | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2545 | // Step 3: Validate the plugin has webhooks.receive capability | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2605 | // Step 7: Dispatch to the worker via handleWebhook RPC | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2615 | // Step 8: Update delivery record to success | COMMENT |
| LOW | server/src/routes/plugins.ts | 2560 | // Step 4: Validate the endpointKey exists in the manifest's webhook declarations | COMMENT |
| LOW | server/src/routes/plugins.ts | 2572 | // Step 5: Extract request data | COMMENT |
| LOW | server/src/routes/plugins.ts | 2591 | // Step 6: Record the delivery in the database | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 244 | // Step 1: Look up the plugin | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 266 | // Step 2: Verify the plugin is ready and has UI declared | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 393 | // Step 3: Resolve the plugin's UI directory | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 410 | // Step 4: Resolve the requested file path and prevent traversal (including symlinks) | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 413 | // Step 5: Check that the file exists and is a regular file | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 445 | // Step 6: Determine cache strategy based on filename | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 449 | // Step 7: Set cache headers | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 467 | // Step 8: Set Content-Type | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 474 | // Step 9: Set CORS headers (plugin UI may be loaded from different origin in dev) | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 477 | // Step 10: Send the file | COMMENT |
| LOW | server/src/services/plugin-worker-manager.ts | 992 | // Step 1: Send shutdown RPC and wait for the worker to exit gracefully. | COMMENT |
| LOW⚡ | server/src/services/plugin-worker-manager.ts | 1016 | // Step 2: Send SIGTERM and wait | COMMENT |
| LOW⚡ | server/src/services/plugin-worker-manager.ts | 1025 | // Step 3: Forcefully kill with SIGKILL | COMMENT |
| LOW⚡ | server/src/services/environment-run-orchestrator.ts | 266 | // Step 1: Resolve environment | COMMENT |
| LOW⚡ | server/src/services/environment-run-orchestrator.ts | 273 | // Step 2: Acquire lease | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 284 | // Step 3: Log lease acquisition activity | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 304 | // Step 4: Resolve execution transport | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 354 | // Step 1: Build workspace realization request | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 367 | // Step 2: Realize workspace in the environment via the runtime driver | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 445 | // Step 3: Persist realization metadata on lease and execution workspace | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 469 | // Step 4: Resolve execution target for the adapter | COMMENT |
| LOW | server/src/services/plugin-tool-dispatcher.ts | 330 | // Step 1: Load tools from all currently-ready plugins | COMMENT |
| LOW | server/src/services/plugin-tool-dispatcher.ts | 350 | // Step 2: Subscribe to lifecycle events for dynamic updates | COMMENT |
| LOW⚡ | server/src/services/plugin-loader.ts | 1222 | // Step 4: Reject incompatible plugin API versions | COMMENT |
| LOW⚡ | server/src/services/plugin-loader.ts | 1230 | // Step 5: Validate manifest capabilities are consistent | COMMENT |
| LOW | server/src/services/plugin-loader.ts | 1201 | // Step 3: Read and validate plugin manifest | COMMENT |
| LOW | server/src/services/plugin-loader.ts | 1241 | // Step 6: Reject plugins that require a newer host than the running server | COMMENT |
| LOW | server/src/services/plugin-loader.ts | 1649 | // Step 6: Persist install record and apply plugin-owned schema migrations | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/src/App.test.tsx | 105 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 108 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 128 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 131 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 179 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 216 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.cases-routing.test.tsx | 141 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.cases-routing.test.tsx | 144 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/plugins/slots.tsx | 765 | missingBehavior?: "hidden" | "placeholder"; | CODE |
| LOW | ui/src/plugins/slots.tsx | 886 | missingBehavior?: "hidden" | "placeholder"; | CODE |
| LOW | ui/src/plugins/slots.test.ts | 74 | missingBehavior: "placeholder", | CODE |
| LOW | ui/src/components/CommentThread.tsx | 399 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/CommentThread.tsx | 434 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/SidebarProjects.tsx | 219 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/OnboardingWizard.tsx | 993 | placeholder="Acme Corp" | CODE |
| LOW | ui/src/components/IssueProperties.test.tsx | 2003 | const textInput = inputs.find((input) => input.getAttribute("placeholder") === "What should the agent re-check?"); | CODE |
| LOW | ui/src/components/IssueProperties.test.tsx | 2098 | .find((node) => node.getAttribute("placeholder")?.includes("watchdog")); | CODE |
| LOW | ui/src/components/Layout.tsx | 146 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/Sidebar.tsx | 255 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/Sidebar.tsx | 283 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/IssueDetail.tsx | 4502 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/IssueDetail.tsx | 4529 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/IssueDetail.tsx | 4849 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ExecutionWorkspaceDetail.tsx | 953 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ExecutionWorkspaceDetail.tsx | 1401 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ProjectDetail.tsx | 844 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ProjectDetail.tsx | 957 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/PluginSettings.tsx | 242 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ProjectWorkspaceDetail.tsx | 736 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/CompanySettingsPluginPage.tsx | 85 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/PluginPage.tsx | 182 | missingBehavior="placeholder" | CODE |
| LOW | tests/e2e/nux-phase4-screenshots.spec.ts | 71 | await page.getByPlaceholder("Acme Corp").fill("QA Robotics"); | CODE |
| LOW | tests/e2e/nux-phase4-screenshots.spec.ts | 125 | await page.getByPlaceholder("Acme Corp").fill("QA Robotics Grow"); | CODE |
| LOW | tests/e2e/planning-mode-visual-verification.spec.ts | 52 | await page.locator('input[placeholder="Acme Corp"]').fill(companyName); | CODE |
| LOW | tests/e2e/onboarding.spec.ts | 60 | await page.getByPlaceholder("Acme Corp").fill(COMPANY_NAME); | CODE |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 67 | await page.getByPlaceholder("Acme Corp").fill(COMPANY_NAME); | CODE |
| LOW | tests/release-smoke/docker-auth-onboarding.spec.ts | 47 | await page.locator('input[placeholder="Acme Corp"]').fill(COMPANY_NAME); | CODE |
| LOW | server/src/__tests__/auth-session-route.test.ts | 46 | email: "user@example.com", | CODE |
| LOW | server/src/__tests__/auth-session-route.test.ts | 62 | userEmail: "user@example.com", | CODE |
| LOW | …/src/__tests__/codex-local-adapter-environment.test.ts | 54 | JSON.stringify({ accessToken: "fake-token", accountId: "acct-1" }), | CODE |
| LOW | server/src/__tests__/redact-sensitive.test.ts | 6 | const body = { email: "user@example.com", password: "founding6gomez6croaking" }; | CODE |
| LOW | server/src/__tests__/redact-sensitive.test.ts | 10 | expect(out.email).toBe("user@example.com"); | CODE |
| LOW | server/src/__tests__/redact-sensitive.test.ts | 44 | user: { email: "user@example.com", password: "secret-pass" }, | CODE |
| LOW | server/src/__tests__/redact-sensitive.test.ts | 48 | expect((out.user as Record<string, unknown>).email).toBe("user@example.com"); | CODE |
| LOW | server/src/__tests__/work-timeline-service.test.ts | 92 | email: "user@example.com", | CODE |
| LOW | server/src/__tests__/cli-auth-routes.test.ts | 212 | user: { id: "user-1", name: "User One", email: "user@example.com" }, | CODE |
| LOW | …box-providers/kubernetes/test/unit/kube-client.test.ts | 22 | token: fake-token | CODE |
| LOW | packages/plugins/create-paperclip-plugin/README.md | 17 | --author "Acme Inc" | CODE |
| LOW | packages/db/src/client.test.ts | 229 | VALUES ('user-1', 'User One', 'user@example.com', true, now(), now()) | CODE |
| LOW | doc/plans/2026-02-18-agent-authentication.md | 126 | "name": "Acme Corp" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/src/App.cases-routing.test.tsx | 1 | // @vitest-environment jsdom | COMMENT |
| LOW | ui/src/context/SidebarContext.tsx | 21 | // True while a secondary sidebar forces the rail: the collapse is locked, so | COMMENT |
| LOW | ui/src/components/Layout.tsx | 241 | cancelable: true, | COMMENT |
| LOW | …nvironment-variables-editor/ConvertToSecretPopover.tsx | 1 | // The "Store as secret" (convert) flow shares its form with the create flow; | COMMENT |
| LOW | ui/src/components/environment-variables-editor/Row.tsx | 481 | // anchored here. Those controls close by returning focus to | COMMENT |
| LOW | ui/src/lib/attention.ts | 81 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | evals/promptfoo/promptfooconfig.yaml | 1 | # yaml-language-server: $schema=https://promptfoo.dev/config-schema.json | COMMENT |
| LOW | server/src/agent-auth-jwt.ts | 181 | // tokens issued before per-company derivation existed continue to verify — | COMMENT |
| LOW | server/src/instrumentation.ts | 1 | // Optional OpenTelemetry auto-instrumentation for HTTP / Express / PG / … | COMMENT |
| LOW | server/src/instrumentation.ts | 181 | // unreachable collector must not block process exit. 5s matches the | COMMENT |
| LOW | server/src/middleware/trust-proxy.ts | 41 | // | COMMENT |
| LOW | server/src/middleware/redact-sensitive.ts | 1 | // Redaction for HTTP log payloads. | COMMENT |
| LOW | server/src/__tests__/trust-proxy.test.ts | 41 | expect(() => parseTrustProxyEnv("01")).toThrow(/invalid integer/); | COMMENT |
| LOW | server/src/__tests__/qa-routine-secrets-e2e.test.ts | 1 | // QA validation for [PAP-9522](/PAP/issues/PAP-9522). Drives the routine-secret | COMMENT |
| LOW | …er/src/__tests__/execution-lock-orphan-cleanup.test.ts | 301 | it("clears checkout_run_id on every sibling and preserves an in-flight retry's execution_run_id pointer", async () = | COMMENT |
| LOW | server/src/services/heartbeat.ts | 13561 | recoveryAgent.status !== "paused" && | COMMENT |
| LOW | server/src/services/heartbeat.ts | 13621 | // Clear orphaned execution-lock columns that still point at this finalizing | COMMENT |
| LOW | server/src/services/heartbeat.ts | 14781 | } | COMMENT |
| LOW | server/src/services/plugin-loader.ts | 2201 | // are registered by the host handler layer when the worker calls | COMMENT |
| LOW | server/src/services/recovery/service.ts | 1841 | COMMENT | |
| LOW | scripts/kill-workspaces.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …ckages/plugins/sandbox-providers/daytona/src/plugin.ts | 81 | COMMENT | |
| LOW | …ckages/plugins/sandbox-providers/daytona/src/plugin.ts | 701 | } catch (error) { | COMMENT |
| LOW | …iders/kubernetes/manifests/operator-prerequisites.yaml | 1 | # This plugin uses only stable Kubernetes APIs. No CRD installation is required. | COMMENT |
| LOW | …iders/kubernetes/manifests/operator-prerequisites.yaml | 21 | # - kubernetes-sigs/agent-sandbox (when it reaches v1beta1) as an alternative | COMMENT |
| LOW | …s/plugins/sandbox-providers/kubernetes/src/pod-exec.ts | 101 | COMMENT | |
| LOW | …ges/plugins/sandbox-providers/kubernetes/src/plugin.ts | 201 | // `adapterType` is an optional per-run hint the server may pass once the | COMMENT |
| LOW | …ndbox-providers/kubernetes/src/sandbox-orchestrator.ts | 61 | // Optional warm-pool / Kata-FC extension slots. Job-backed implementation | COMMENT |
| LOW | packages/adapters/opencode-local/src/index.ts | 1 | import type { AdapterModelProfileDefinition } from "@paperclipai/adapter-utils"; | COMMENT |
| LOW | packages/adapters/opencode-local/src/index.ts | 21 | // Security tradeoff: this is `curl | bash` without a SHA-256 verification of | COMMENT |
| LOW | packages/adapters/opencode-local/src/index.ts | 61 | { id: "openai/gpt-5.2", label: "openai/gpt-5.2" }, | COMMENT |
| LOW | packages/adapters/gemini-local/src/server/execute.ts | 421 | // image are invisible -- pre-select the api-key auth whenever an API key | COMMENT |
| LOW | …ckages/adapters/claude-local/src/server/permissions.ts | 1 | // Explicit allowlist of Claude Code tools we permit when running on a remote | COMMENT |
| LOW | packages/adapters/codex-local/src/server/execute.ts | 501 | followSymlinks: true, | COMMENT |
| LOW | …ages/adapters/codex-local/src/server/runtime-config.ts | 61 | // "base_url": "http://...", // OpenAI-compatible endpoint | COMMENT |
| LOW | …ages/adapters/codex-local/src/server/runtime-config.ts | 321 | // $CODEX_HOME/config.toml, selected by a top-level `model_provider = "<id>"` | COMMENT |
| LOW | packages/adapters/pi-local/src/server/runtime-config.ts | 81 | }; | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .agents/skills/paperclip-create-plugin/SKILL.md | 40 | ## 3. CLI-first scaffold workflow | COMMENT |
| MEDIUM | .agents/skills/paperclip-create-plugin/SKILL.md | 92 | ## 5. After scaffolding, sanity-check the package | COMMENT |
| MEDIUM | packages/plugins/create-paperclip-plugin/README.md | 44 | ## Workflow after scaffolding | COMMENT |
| MEDIUM | …bundled/paperclip-operations/reflection-coach/SKILL.md | 48 | ## Hard guardrails | COMMENT |
| MEDIUM | …bundled/paperclip-operations/reflection-coach/SKILL.md | 86 | ### 3) Read the target's current guardrails | COMMENT |
| MEDIUM | doc/plans/2026-04-08-agent-os-technical-report.md | 219 | ### 1. Its built-in orchestration primitives overlap the wrong layer | COMMENT |
| MEDIUM | doc/plans/2026-02-21-humans-and-permissions.md | 331 | ## Phase 1: Mode and guardrails | COMMENT |
| MEDIUM | …ans/2026-03-10-workspace-strategy-and-git-worktrees.md | 624 | ### 11. Runtime service orchestration | COMMENT |
| MEDIUM | doc/plugins/ideas-from-opencode.md | 429 | ## 3. Prefer event-driven extensions over core-logic mutation | COMMENT |
| MEDIUM | …perclip-create-agent/references/baseline-role-guide.md | 128 | ## Minimal scaffold | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 732 | const uploadCall = sandbox.fs.uploadFile.mock.calls.find( | CODE |
| CRITICAL | …kages/plugins/sandbox-providers/e2b/src/plugin.test.ts | 306 | const stdinCall = sandbox.commands.run.mock.calls.find(([cmd]: [string]) => cmd.includes("'printf'")); | CODE |
| CRITICAL | …kages/plugins/sandbox-providers/e2b/src/plugin.test.ts | 363 | const fgCall = sandbox.commands.run.mock.calls.find(([cmd]: [string]) => cmd.includes("'printf'")); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | evals/promptfoo/promptfooconfig.yaml | 8 | # Usage: | COMMENT |
| LOW | scripts/build-npm.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/kill-agent-browsers.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/kill-workspaces.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/kill-dev.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/kill-vitest.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/backup-db.sh | 7 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ui/storybook/stories/skills-store-detail.stories.tsx | 22 | markdown: "# deep-research\n\nResearch harness.", | CODE |
| MEDIUM | …er/src/__tests__/execution-lock-orphan-cleanup.test.ts | 269 | // make us robust against it. | COMMENT |
| MEDIUM | server/src/__tests__/helpers/wake-message.ts | 5 | // them robust to serialization formatting/key-order changes. | COMMENT |
| MEDIUM | …es/plugins/plugin-llm-wiki/tests/screenshots/entry.tsx | 5 | if (!container) throw new Error("No #root in harness host"); | CODE |