3.3

Adjusted Signal

3.3

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

109.1K

Stars

TypeScript

Language

3.3M

Lines of Code

11.3K

Files

9.9K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 13.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 9338 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.2/100 · LOW

Are imports declared and package/API names verified? 264 finding(s).

Agent Over-Engineering Ratio 12.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 8924 finding(s).

PR Review Velocity Impact 15.5/100 · LOW

Which changes need focused human review? 9898 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 55HIGH 28MEDIUM 260LOW 9555

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 9898 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers8628 hits · 8358 pts

Severity	File	Line	Snippet	Context
LOW	ui/storybook/.storybook/preview-base.tsx	60	function withStorybookTimelineDetails(	CODE
LOW	ui/storybook/.storybook/preview-base.tsx	97	function installStorybookApiFixtures() {	CODE
LOW	…ories/connection-setup/notion-connect-flow.stories.tsx	314	function VercelConnectProvenanceHost() {	CODE
LOW	…s/connection-setup/connection-instructions.stories.tsx	24	function ConnectionInstructionsPrototype({ initialView = "connection", provider = "Honcho", scenario = "normal", baselin	CODE
LOW	…nection-setup/apps-connection-count-toggle.stories.tsx	51	function ConnectionCountToggleReview({ rows, defaultExpanded = false }: { rows: Row[]; defaultExpanded?: boolean }) {	CODE
LOW	…/stories/tasks/assigned-backlog-safeguards.stories.tsx	95	function AssignedBacklogNoticePanel() {	CODE
LOW	…ybook/stories/tasks/successful-run-handoff.stories.tsx	33	function SuccessfulRunHandoffStates() {	CODE
LOW	…ybook/stories/tasks/successful-run-handoff.stories.tsx	138	function HandoffLivenessComparisonPanel() {	CODE
LOW⚡	…ybook/stories/tasks/successful-run-handoff.stories.tsx	212	function SuccessfulRunHandoffPinnedNotice() {	CODE
LOW⚡	…ybook/stories/tasks/successful-run-handoff.stories.tsx	216	function SuccessfulRunHandoffInFlightNoticeStory() {	CODE
LOW⚡	…ybook/stories/tasks/successful-run-handoff.stories.tsx	220	function SuccessfulRunHandoffLivenessComparison() {	CODE
LOW⚡	…ybook/stories/tasks/successful-run-handoff.stories.tsx	228	function SuccessfulRunHandoffActivityEvents() {	CODE
LOW⚡	…ybook/stories/tasks/successful-run-handoff.stories.tsx	232	function SuccessfulRunHandoffIssueCard() {	CODE
LOW⚡	…ybook/stories/tasks/successful-run-handoff.stories.tsx	236	function SuccessfulRunHandoffEscalationComment() {	CODE
LOW	ui/storybook/stories/tasks/issue-management.stories.tsx	254	function seedIssueListLocalStorage() {	CODE
LOW	ui/storybook/stories/tasks/issue-management.stories.tsx	302	function IssuePropertiesLongValuePane({ inline = false }: { inline?: boolean }) {	CODE
LOW	ui/storybook/stories/tasks/issue-management.stories.tsx	351	function IssuePropertiesRelationshipBadgesPane({ inline = false }: { inline?: boolean }) {	CODE
LOW	ui/storybook/stories/tasks/issue-management.stories.tsx	387	function IssuePropertiesModelOverridePane() {	CODE
LOW	ui/storybook/stories/tasks/issue-management.stories.tsx	408	function IssuePropertiesMobileBlockerActionsPane() {	CODE
LOW	ui/storybook/stories/tasks/issue-management.stories.tsx	442	function ColumnConfigurationMatrix() {	CODE
LOW	ui/storybook/stories/tasks/external-objects.stories.tsx	625	function FilterPopoverWithExternalChecked() {	CODE
LOW	ui/storybook/stories/tasks/dialogs-modals.stories.tsx	611	function ExecutionWorkspaceDialogStory({ blocked }: { blocked?: boolean }) {	CODE
LOW	ui/storybook/stories/tasks/dialogs-modals.stories.tsx	663	function PathInstructionsModalStory() {	CODE
LOW	ui/storybook/stories/tasks/dialogs-modals.stories.tsx	704	function constrainVisualViewportForPickerStory() {	CODE
LOW	ui/storybook/stories/tasks/chat-comments.stories.tsx	946	function CompactRecoveryNoticeReview() {	CODE
LOW	…k/stories/tasks/task-chat-chain-of-thought.stories.tsx	126	function SteeringSenderAvatarReview() {	CODE
LOW	…k/stories/tasks/task-chat-chain-of-thought.stories.tsx	142	function ReconnectingAlignmentReview() {	CODE
LOW	ui/storybook/stories/activity/work-timeline.stories.tsx	22	function withStorybookTimelineDetails(data: WorkTimelineResult): WorkTimelineResult {	CODE
LOW	…storybook/stories/recovery/scheduled-retry.stories.tsx	59	function ScheduledRetrySurfaceStories() {	CODE
LOW	…stories/projects/projects-goals-workspaces.stories.tsx	446	function ProjectsGoalsWorkspacesStories() {	CODE
LOW	…ybook/stories/agents/codex-runner/creation.stories.tsx	9	function installCodexCreationFixture({ setupFailure = false, nativeRunnerEnabled = false, unqualifiedTarget = false }: {	CODE
LOW	…s/navigation-preferences/navigation-layout.stories.tsx	127	function MobileBottomNavActiveStateMatrix() {	CODE
LOW	…s/navigation-preferences/navigation-layout.stories.tsx	377	function SidebarIconAlignmentHarness() {	CODE
LOW	…s/documents-artifacts/document-annotations.stories.tsx	370	function DirtyDraftWithIntegratedHeader() {	CODE
LOW	…torybook/stories/foundations/forms-editors.stories.tsx	467	function EnvironmentVariablesEditorGallery() {	CODE
LOW	…orybook/stories/inbox-search/blocked-inbox.stories.tsx	211	function BlockedReasonChipsCatalog() {	CODE
LOW	ui/storybook/stories/inbox-search/search.stories.tsx	366	function SearchOperatorInputPreview() {	CODE
LOW	ui/storybook/stories/inbox-search/search.stories.tsx	399	function CommandPaletteWithSearchAll({	CODE
LOW	…ok/stories/onboarding/onboarding-agent-arc.stories.tsx	379	function signedOutConnectionFixture() {	CODE
LOW	…ok/stories/onboarding/onboarding-agent-arc.stories.tsx	543	function installCodexPlatformFixture(outcome: CodexPlatformFixtureOutcome) {	CODE
LOW	…ok/stories/onboarding/onboarding-agent-arc.stories.tsx	613	function managedCodexQualificationStory(outcome: CodexPlatformFixtureOutcome): StoryObj {	CODE
LOW	…tions-and-approvals/composer-question-flow.stories.tsx	50	function InteractiveComposerQuestions() {	CODE
LOW	…ovals/task-chat-interaction-above-composer.stories.tsx	235	function RuntimeQuestionAboveComposer() {	CODE
LOW	…ns-and-approvals/issue-thread-interactions.stories.tsx	139	function OpenConnectionIntentDialogStory() {	CODE
LOW	…ns-and-approvals/issue-thread-interactions.stories.tsx	182	function InteractiveSuggestedTasksCard() {	CODE
LOW	…ns-and-approvals/issue-thread-interactions.stories.tsx	252	function InteractiveAskUserQuestionsCard() {	CODE
LOW	…ns-and-approvals/issue-thread-interactions.stories.tsx	270	function InteractiveRequestConfirmationCard() {	CODE
LOW	…ns-and-approvals/issue-thread-interactions.stories.tsx	302	function InteractiveRequestCheckboxConfirmationCard({	CODE
LOW	…ns-and-approvals/issue-thread-interactions.stories.tsx	350	function InteractiveRequestItemVerdictsCard({	CODE
LOW	…ns-and-approvals/issue-thread-interactions.stories.tsx	402	function AutoOpenDeclineRequestConfirmationCard({	CODE
LOW	ui/storybook/prototypes/ConnectionPoolConnectorHost.tsx	22	export function ConnectionPoolConnectorHost({ pluginKey = "example.pool-router", descriptor = { name: "AI connection poo	CODE
LOW	ui/storybook/prototypes/ProviderConnectionPreview.tsx	16	export function ProviderConnectionPreview({ provider, initialMethod = "subscription", initialWaiting = false, onConnecte	CODE
LOW	ui/storybook/prototypes/RemoteMcpConnectionReview.tsx	14	export function RemoteMcpConnectionReview({ provider, scenario = "journey", inline = false, upstreamServiceName }: { ups	CODE
LOW	ui/storybook/prototypes/ConnectorCatalogNavigation.tsx	74	export function ConnectorCatalogNavigation({	CODE
LOW	ui/storybook/prototypes/ManagedAggregatorAccounts.tsx	7	export function ManagedAggregatorAccounts() {	CODE
LOW	…prototypes/slack-avatar/SlackAvatarSettingsPreview.tsx	11	export function SlackAvatarSettingsPreview({ initialInstructions = "", failFirstSave = false }: { initialInstructions?:	CODE
LOW	…s/composer-model-picker/ComposerModelPickerPreview.tsx	66	export function ComposerModelPickerPreview({	CODE
LOW	…composer-model-picker/ComposerRunSettingsLiveStory.tsx	41	export function ComposerRunSettingsLiveStory({	CODE
LOW	…ototypes/agent-chat-sidebar/AgentChatSidebarReview.tsx	6	export function AgentChatSidebarReviewLayout(_props: { scenario: SidebarScenario }) {	CODE
LOW	…ook/prototypes/project-repos/ProjectReposPrototype.tsx	130	export function RepositoryConfigurationSection(props: PrototypeProps) {	CODE
8568 more matches not shown…

Decorative Section Separators215 hits · 576 pts

Severity	File	Line	Snippet	Context
MEDIUM	ui/src/adapters/registry.ts	170	// ── Builtin override lifecycle ──────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/registry.ts	226	// ── Non-builtin externals ───────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/schema-config-fields.tsx	17	// ── Select field (extracted to keep hooks at component top level) ──────	COMMENT
MEDIUM	ui/src/adapters/sandboxed-parser-worker.ts	14	// ── Message protocol ────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/sandboxed-parser-worker.ts	27	// ── Worker bootstrap source ─────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/sandboxed-parser-worker.ts	41	// ── 1. Lock down dangerous globals ──────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/sandboxed-parser-worker.ts	82	// ── 2. Parser state ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/sandboxed-parser-worker.ts	88	// ── 3. Message handler ──────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/sandboxed-parser-worker.ts	158	// ── Public API ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/dynamic-loader.ts	35	// ── Types ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/dynamic-loader.ts	49	// ── State ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/dynamic-loader.ts	69	// ── Internal helpers ────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/adapters/dynamic-loader.ts	210	// ── Public API ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/components/transcript/RunTranscriptView.tsx	790	// ── Diff entries — accumulate into diff_group blocks ──────────	COMMENT
MEDIUM	ui/src/pages/OrgChart.production.tsx	29	// ── Tree layout types ───────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/OrgChart.production.tsx	56	// ── Layout algorithm ────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/OrgChart.production.tsx	160	// ── Status dot colors (raw hex for SVG) ─────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/OrgChart.production.tsx	174	// ── Main component ──────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	75	// ── Import-specific helpers ───────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	171	// ── Import file tree customization ───────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	203	// ── Preview pane ──────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	290	// ── Conflict item type ───────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	412	// ── Post-import activation ───────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	435	// ── Conflict resolution UI ───────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	561	// ── Adapter type options for import ───────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	624	// ── Adapter picker for imported agents ───────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	761	// ── Helpers ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	792	// ── Chunked transfer flow for large local zips ───────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	819	// ── Async import job flow ─────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyImport.tsx	919	// ── Main page ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/OrgChart.tsx	30	// ── Tree layout types ───────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/OrgChart.tsx	57	// ── Layout algorithm ────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/OrgChart.tsx	183	// ── Status dot colors (raw hex for SVG) ─────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/OrgChart.tsx	197	// ── Main component ──────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyExport.tsx	359	// ── Frontmatter card (export-specific: skill click support) ──────────	COMMENT
MEDIUM	ui/src/pages/CompanyExport.tsx	404	// ── Client-side README generation ────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyExport.tsx	502	// ── Preview pane ──────────────────────────────────────────────────────	COMMENT
MEDIUM	ui/src/pages/CompanyExport.tsx	587	// ── Main page ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/e2e/nux-phase4-screenshots.spec.ts	62	// ── Section A: create-company path (name → hire) ──────────────────────	COMMENT
MEDIUM	tests/e2e/nux-phase4-screenshots.spec.ts	88	// ── Section B: Conference Room (BoardChat) ────────────────────────────	COMMENT
MEDIUM	tests/e2e/nux-phase4-screenshots.spec.ts	104	// ── Section C: Artifacts ──────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/plugin-routes-authz.test.ts	966	// ─── Agent JWT tool execution (cherry-picked from #5549) ─────────────────────	COMMENT
MEDIUM	server/src/__tests__/plugin-routes-authz.test.ts	966	// ─── Agent JWT tool execution (cherry-picked from #5549) ─────────────────────	COMMENT
MEDIUM	…rc/__tests__/agents-adapter-config-user-secret.test.ts	249	// ── test-environment ──────────────────────────────────────────────	COMMENT
MEDIUM	…rc/__tests__/agents-adapter-config-user-secret.test.ts	372	// ── claude-login ──────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	52	// ── The exact allowlist ───────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	95	// ── Documentation phrases ─────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	110	// ── Command extraction ────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	320	// ── Repository walk ───────────────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	401	// ── Backslash line continuation ───────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	578	// ── The extraction and allowlist logic, in isolation ─────────────────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	633	// ── Fail closed on an ambiguous quote context before the marker ──────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	795	// ── Direct assertions on the runtime-generated instruction surfaces ──────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	845	// ── Runtime surfaces and their fixed literal lifecycle hints ─────────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	905	// ── The safe-invocation note ─────────────────────────────────────────────	COMMENT
MEDIUM	server/src/__tests__/cli-invocation-safety.test.ts	940	// ── Backslash line continuation ──────────────────────────────────────────	COMMENT
MEDIUM	server/src/routes/adapters.ts	693	// ── POST /api/adapters/:type/reinstall ──────────────────────────────────	COMMENT
MEDIUM	server/src/routes/adapters.ts	763	// ── GET /api/adapters/:type/config-schema ────────────────────────────────	COMMENT
MEDIUM	server/src/routes/adapters.ts	807	// ── GET /api/adapters/:type/ui-parser.js ─────────────────────────────────	COMMENT
MEDIUM	server/src/routes/org-chart-svg.ts	30	// ── Style theme definitions ──────────────────────────────────────	COMMENT
155 more matches not shown…

Hallucination Indicators55 hits · 565 pts

Severity	File	Line	Snippet	Context
CRITICAL	ui/src/components/MuseRunnerConnection.tsx	39	const detectorObservedAtValid = museDetectorCleanupAttestationSchema.shape.observation.shape.observedAt.safeParse(dete	CODE
CRITICAL	tests/runner-e2e/copilot-protection-flow.test.ts	72	(r: any) => { r.payload.prpEvent.payload.details.push({ name: "stage", value: "tool" }); },	CODE
CRITICAL	tests/runner-e2e/first-task.test.ts	1613	if (phase === "default") expect(h.api.patch.mock.calls.some(([path]) => path === "/api/instance/settings/experimenta	CODE
CRITICAL	tests/runner-e2e/pi-controls-evidence.test.ts	83	["extra cancellation effect", s => { s.f.run.resultJson.nativeCancellation.effects.push("pause_agent"); }],	CODE
CRITICAL	…/src/__tests__/voice-session-store.integration.test.ts	1173	expect(f.transport.sendCallMessage.mock.calls.at(-1)?.[1]).toBe("Committed answer");	CODE
CRITICAL	…/src/__tests__/voice-session-store.integration.test.ts	1196	expect(f.transport.sendCallMessage.mock.calls.at(-1)?.[1]).toBe("Later answer");	CODE
CRITICAL	…/src/__tests__/voice-session-store.integration.test.ts	1214	expect(f.transport.sendCallMessage).toHaveBeenCalledTimes(2); expect(f.transport.sendCallMessage.mock.calls.at(-1)	CODE
CRITICAL	…/src/__tests__/voice-session-store.integration.test.ts	2029	expect(f.transport.configureTool.mock.calls.slice(-3).every((call) => Boolean(call[3]))).toBe(true);	CODE
CRITICAL⚡	…/src/__tests__/voice-session-store.integration.test.ts	2052	expect(f.transport.configureTool.mock.calls.slice(-3).every(call => call[2] === "whsec_rotated")).toBe(true);	CODE
CRITICAL⚡	…/src/__tests__/voice-session-store.integration.test.ts	2055	expect(f.transport.configureWebhook.mock.calls.at(-1)?.[3]).toBe("hook_test");	CODE
CRITICAL⚡	…/src/__tests__/voice-session-store.integration.test.ts	2056	expect(f.transport.configureWebhook.mock.calls.at(-1)?.[2]).toBe("whsec_rotated");	CODE
CRITICAL	server/src/__tests__/photon/channel.integration.test.ts	531	t.f.client.messages.sendText.mock.calls.find((call) =>	CODE
CRITICAL	server/src/__tests__/photon/channel.integration.test.ts	775	expect(t.f.client.messages.sendText.mock.calls.some((call) =>	CODE
CRITICAL	server/src/__tests__/photon/channel.integration.test.ts	887	t.f.client.attachments.downloadStream.mockImplementationOnce(() =>	CODE
CRITICAL	server/src/__tests__/photon/channel.integration.test.ts	913	t.f.client.attachments.downloadStream.mockImplementation(() =>	CODE
CRITICAL	server/src/__tests__/photon/channel.integration.test.ts	1001	expect(t.f.client.messages.sendText.mock.calls.some((call) => call[1].includes(original.issueIdentifier!))).toBe(tru	CODE
CRITICAL	server/src/__tests__/photon/channel.integration.test.ts	1053	t.f.client.messages.sendText.mock.calls.some((call) =>	CODE
CRITICAL	server/src/__tests__/photon/channel.integration.test.ts	1388	expect(t.f.client.messages.sendText.mock.calls.at(-1)?.[1]).toContain(	CODE
CRITICAL	server/src/services/workspace-recovery.test.ts	536	expect(f.runtime.resumeRunLease.mock.calls.filter(([input]) => input.lease.id === f.lease.id)).toHaveLength(1);	CODE
CRITICAL	server/src/services/workspace-recovery.test.ts	560	expect(f.runtime.resumeRunLease.mock.calls.filter(([input]) => input.lease.id === f.lease.id)).toHaveLength(1);	CODE
CRITICAL	server/src/services/workspace-recovery.test.ts	674	expect(f.runtime.resumeRunLease.mock.calls.filter(([input]) => input.lease.id === f.lease.id)).toHaveLength(1);	CODE
CRITICAL	server/src/services/workspace-recovery.test.ts	890	expect(f.runtime.resumeRunLease.mock.calls.filter(([input]) => input.lease.id === f.lease.id)).toHaveLength(1);	CODE
CRITICAL	server/src/services/workspace-recovery.test.ts	909	expect(f.runtime.resumeRunLease.mock.calls.filter(([input]) => input.lease.id === f.lease.id)).toHaveLength(1);	CODE
CRITICAL	server/src/services/workspace-recovery.test.ts	911	expect(f.runtime.resumeRunLease.mock.calls.filter(([input]) => input.lease.id === f.lease.id)).toHaveLength(1);	CODE
CRITICAL	server/src/services/workspace-recovery.test.ts	1010	try { await recoverRetainedWorkspace(f.input); expect(f.runtime.resumeRunLease.mock.calls.filter(([input]) => input.	CODE
CRITICAL	server/src/services/workspace-recovery.test.ts	1431	expect(f.runtime.resumeRunLease.mock.calls.filter(([input]) => input.lease.id === f.lease.id)).toHaveLength(1);	CODE
CRITICAL	server/src/services/workspace-recovery.test.ts	1570	expect(queueDeps.wakeQueue.admitWakeBehindIssueExecution.mock.calls.every(([, input]) => input.durableReceipt === un	CODE
CRITICAL	…src/services/native-runtime/native-session-executor.ts	12357	criterionIds: input.execution.completionContract.contract.criteria.map(criterion => criterion.id) },	CODE
CRITICAL	…src/services/native-runtime/native-session-executor.ts	13854	input.execution.completionContract.contract.criteria.map(	CODE
CRITICAL	…rc/services/heartbeat/instruction-working-copy.test.ts	133	expect(f.copies.prepare.mock.calls.map(([input]) => input.reuseRunId)).toEqual(["previous-run", undefined]);	CODE
CRITICAL	…runner/src/drivers/external/runnerd-external-driver.ts	284	criterionIds: o.execution.completionContract.contract.criteria.map(c => c.id) },	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	1991	const uploadCall = sandbox.fs.uploadFile.mock.calls.find(	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	3238	expect(sandbox.process.getSessionCommandLogs.mock.calls.filter((call) => call[2])).toHaveLength(1);	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	3416	expect(sandbox.process.getSessionCommandLogs.mock.calls.filter((call) => call[2]).length).toBe(2);	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	3759	const snapshotCalls = sandbox.process.getSessionCommandLogs.mock.calls.filter(	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	3798	expect(sandbox.process.getSessionCommandLogs.mock.calls.filter((call) => call[2])).toHaveLength(2);	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	5456	const mvCall = sandbox.process.executeCommand.mock.calls.find(([cmd]) => String(cmd).includes("mv -f"));	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	5822	const mkdirCall = sandbox.process.executeCommand.mock.calls.find(	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	5830	const extractCall = sandbox.process.executeCommand.mock.calls.find(([cmd]) => String(cmd).includes("tar -xf"));	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	5991	const guardCall = sandbox.process.executeCommand.mock.calls.find(	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	6148	const cleanupCall = sandbox.process.executeCommand.mock.calls.find(	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	6390	sandbox.process.executeCommand.mock.calls.find(([c]) => c === cmd);	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	6396	const idx = sandbox.process.executeCommand.mock.calls.findIndex(([c]) => c === cmd);	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	6445	sandbox.process.executeCommand.mock.calls.some(([c]) => c === "should-not-run"),	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	6492	const mvCalls = sandbox.process.executeCommand.mock.calls.filter(([cmd]) =>	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	6500	const idx = sandbox.process.executeCommand.mock.calls.findIndex(([c]) => c === cmd);	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	6560	sandbox.process.executeCommand.mock.calls.some(([c]) => c === cmd);	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	6641	const destinations = sandbox.fs.uploadFiles.mock.calls.flatMap(	CODE
CRITICAL	…s/plugins/sandbox-providers/daytona/src/plugin.test.ts	6681	const sources = sandbox.fs.downloadFiles.mock.calls.flatMap(	CODE
CRITICAL	…kages/plugins/sandbox-providers/e2b/src/plugin.test.ts	306	const stdinCall = sandbox.commands.run.mock.calls.find(([cmd]: [string]) => cmd.includes("'printf'"));	CODE
CRITICAL	…kages/plugins/sandbox-providers/e2b/src/plugin.test.ts	363	const fgCall = sandbox.commands.run.mock.calls.find(([cmd]: [string]) => cmd.includes("'printf'"));	CODE
CRITICAL	packages/plugins/plugin-llm-wiki/tests/plugin.spec.ts	3578	const originalSendMessage = harness.ctx.agents.sessions.sendMessage.bind(harness.ctx.agents.sessions);	CODE
CRITICAL	…/adapter-utils/src/github-launcher-environment.test.ts	157	expect(fixture.runner.execute.mock.calls.some(([input]) => input.args?.join(" ").startsWith("chmod 700"))).toBe(fals	CODE
CRITICAL	…/adapter-utils/src/github-launcher-environment.test.ts	470	expect(fixture.runner.execute.mock.calls.every(([input]) => !input.args?.join(" ").includes("$PATH"))).toBe(true);	CODE
CRITICAL	…/adapter-utils/src/github-launcher-environment.test.ts	488	expect(fixture.runner.execute.mock.calls.every(([input]) => !input.args?.join(" ").includes("$PATH"))).toBe(true);	CODE

Over-Commented Block448 hits · 370 pts

Severity	File	Line	Snippet	Context
LOW	pnpm-workspace.yaml	41	# these two packages may resolve. Different CodeMirror packages pin	COMMENT
LOW	ui/src/App.cases-routing.test.tsx	1	// @vitest-environment jsdom	COMMENT
LOW	ui/src/connect-flow-preview-main.tsx	161	// The row finishes answering before the card starts arriving.	COMMENT
LOW	ui/src/context/CompanyContext.tsx	121	// measurement was taken against an implementation that removed the cache	COMMENT
LOW	ui/src/components/AttentionQueueRow.tsx	161	const compactActions = !isHidden ? collectCompactActions(item) : [];	COMMENT
LOW	ui/src/components/Layout.production.tsx	361	bubbles: true,	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	361	rawBlob === undefined \|\| rawBlob === null,	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	381	// nothing to authorize, and this must not add a request to every wizard	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	401	// can be thirty seconds old, and a company created moments ago in another tab	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	441	// `isFetching`, not `isLoading`. `isLoading` is false whenever the cache	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	581	// The name is not defaulted: a pre-filled "Chief of staff" is a choice made	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	741	(saved?.createdIssueRef as string) ?? null	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	881	\|\| (initialRequest && typeof saved?.createdCompanyId === "string"	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	901	// `/onboarding` is a request to start a company, so honouring it beats	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	1501	);	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	1941	});	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	2061	: {};	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	2381	// that binding together with a configured ANTHROPIC_API_KEY, so this	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	2621	// handles Enter itself and does not check for a modifier, so Cmd+Enter in	COMMENT
LOW	ui/src/components/OnboardingWizard.tsx	2741	// now differ only in measure. One element styled two ways, not	COMMENT
LOW	ui/src/components/OnboardingWizard.test.tsx	1821	});	COMMENT
LOW	ui/src/components/OnboardingWizard.test.tsx	1861	// its company. The account then changes without this component's company	COMMENT
LOW	ui/src/components/OnboardingWizard.test.tsx	1901	});	COMMENT
LOW	ui/src/components/OnboardingWizard.test.tsx	2481		COMMENT
LOW	ui/src/components/Layout.tsx	361	cancelable: true,	COMMENT
LOW	ui/src/components/IssueChatThread.tsx	6381		COMMENT
LOW	ui/src/components/IssueLinkQuicklook.tsx	301	closeQuicklookId(instanceId);	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	721	claudeStoredSessionId: storedSessionId,	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	1141	// environment, else the instance default. Testing the host for an	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	1241		COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	2461	// The login panel for one adapter in one sandbox environment. It starts a login	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	2481	// `onApplyStored` binds the fixed reference to an existing stored login with no	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	2501	// DIFFERENT account — the one case where the login cannot take effect	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	2801	// the status is the whole of the news.	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	3041	// The public session states that fail a Claude login. The panel returns to its	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	3061	// timer from it. This failsafe only bounds a stuck poll while the status route	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	3101	const [browserCode, setBrowserCode] = useState("");	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	3221	setStartError(error instanceof Error ? error.message : "Could not cancel the login.");	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	3261	},	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	3301	});	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	3421	completionFailed \|\|	COMMENT
LOW	ui/src/components/AgentConfigForm.tsx	3481	setCodeSubmitted(true);	COMMENT
LOW	ui/src/components/transcript/useLiveRunTranscripts.ts	21	const LOG_READ_LIMIT_BYTES = 256_000;	COMMENT
LOW	ui/src/components/issue-properties/IssueProperties.tsx	261	queryFn: () => instanceSettingsApi.getExperimental(),	COMMENT
LOW	…t-variables-editor/EnvironmentVariablesEditor.test.tsx	661	const secretValueField = document.querySelector<HTMLInputElement>('input[aria-label="Secret value"]');	COMMENT
LOW	…nvironment-variables-editor/ConvertToSecretPopover.tsx	1	// The "Store as secret" (convert) flow shares its form with the create flow;	COMMENT
LOW	ui/src/components/environment-variables-editor/Row.tsx	481	// anchored here. Those controls close by returning focus to	COMMENT
LOW	ui/src/components/task-chat/TaskChatStatusPill.tsx	361	) : null}	COMMENT
LOW	ui/src/hooks/useSignOut.ts	61	onSignedOut?.();	COMMENT
LOW	ui/src/hooks/useSignOut.ts	81	// across the whole sign-out/sign-in cycle. Reset notifies them, so the	COMMENT
LOW	ui/src/lib/sentry.ts	1	// Optional Sentry error monitoring for the browser.	COMMENT
LOW	ui/src/lib/sentry.ts	21	// chain (`enqueue`) instead of running at once. One operation runs at a	COMMENT
LOW	ui/src/lib/sentry.ts	121	// `Sentry.close()` call, which reads the client off the current scope	COMMENT
LOW	ui/src/lib/status-colors.ts	201	// Softer, full-width banner surface derived from the same brand hue anchors as	COMMENT
LOW	ui/src/lib/status-colors.ts	321	//	COMMENT
LOW	ui/src/lib/attention.ts	81	};	COMMENT
LOW	ui/src/api/client.ts	41	});	COMMENT
LOW	ui/src/pages/Dashboard.tsx	121	// A company with no agent cannot do anything — no runs, no tasks, nothing	COMMENT
LOW	ui/src/pages/InviteLanding.test.tsx	741	});	COMMENT
LOW	ui/src/pages/InviteLanding.tsx	241	retry: false,	COMMENT
388 more matches not shown…

Structural Annotation Overuse141 hits · 246 pts

Severity	File	Line	Snippet	Context
LOW	tests/e2e/signoff-policy.spec.ts	630	// Step 1: Executor marks done → should route to reviewer	COMMENT
LOW⚡	tests/e2e/signoff-policy.spec.ts	648	// Step 2: Navigate to issue in UI and verify execution label	COMMENT
LOW⚡	tests/e2e/signoff-policy.spec.ts	652	// Step 3: Reviewer approves → should route to approver	COMMENT
LOW⚡	tests/e2e/signoff-policy.spec.ts	666	// Step 4: Verify UI shows approval pending	COMMENT
LOW⚡	tests/e2e/signoff-policy.spec.ts	670	// Step 5: Approver approves → should complete	COMMENT
LOW⚡	tests/e2e/conference-room-typing-intro.spec.ts	73	// Step 0: front door (skipped when the wizard opens on the create path).	COMMENT
LOW⚡	tests/e2e/conference-room-typing-intro.spec.ts	77	// Step 1: company name.	COMMENT
LOW⚡	tests/e2e/conference-room-typing-intro.spec.ts	83	// Step 3: name the agent. The role picker is gone — the arc asks for a	COMMENT
LOW⚡	tests/e2e/conference-room-typing-intro.spec.ts	89	// Step 4: pick a model source, then advance. Nothing is selected on arrival	COMMENT
LOW	tests/e2e/conference-room-typing-intro.spec.ts	107	// Step 5: review → Get started creates the first task and opens its	COMMENT
LOW⚡	tests/release-smoke/docker-auth-onboarding.spec.ts	125	// Step 1: name the organization. "Continue" creates the company itself and	COMMENT
LOW⚡	tests/release-smoke/docker-auth-onboarding.spec.ts	132	// Step 3: name the team lead. The name is the step's only question and it	COMMENT
LOW⚡	tests/release-smoke/docker-auth-onboarding.spec.ts	142	// Step 4: answer the model-source question, then connect (hire) the lead.	COMMENT
LOW	tests/release-smoke/docker-auth-onboarding.spec.ts	222	// Step 5: review, then launch. "Get started" provisions the onboarding	COMMENT
LOW	.agents/skills/company-creator/SKILL.md	33	### Step 1: Gather Context	COMMENT
LOW	.agents/skills/company-creator/SKILL.md	40	### Step 2: Interview (Use AskUserQuestion)	COMMENT
LOW	.agents/skills/company-creator/SKILL.md	88	### Step 3: Read the Spec	COMMENT
LOW	.agents/skills/company-creator/SKILL.md	100	### Step 4: Generate the Package	COMMENT
LOW	.agents/skills/company-creator/SKILL.md	159	### Step 5: Confirm Output Location	COMMENT
LOW	.agents/skills/company-creator/SKILL.md	167	### Step 6: Write README.md and LICENSE	COMMENT
LOW	.agents/skills/company-creator/SKILL.md	180	### Step 7: Write Files and Summarize	COMMENT
LOW	.agents/skills/deal-with-security-advisory/SKILL.md	26	## Step 0: Fetch the Advisory Details	COMMENT
LOW	.agents/skills/deal-with-security-advisory/SKILL.md	37	## Step 1: Acknowledge the Report	COMMENT
LOW	.agents/skills/deal-with-security-advisory/SKILL.md	47	## Step 2: Create the Temporary Private Fork	COMMENT
LOW	.agents/skills/deal-with-security-advisory/SKILL.md	78	## Step 3: Develop and Validate the Fix	COMMENT
LOW	.agents/skills/deal-with-security-advisory/SKILL.md	103	## Step 4: Coordinate with the Reporter	COMMENT
LOW	.agents/skills/deal-with-security-advisory/SKILL.md	111	## Step 5: Request a CVE	COMMENT
LOW	.agents/skills/deal-with-security-advisory/SKILL.md	123	## Step 6: Publish Everything Simultaneously	COMMENT
LOW	.agents/skills/deal-with-security-advisory/SKILL.md	208	## Step 7: Post-Publication Verification	COMMENT
LOW⚡	server/src/routes/access.ts	1977	## Step 2: Wait for board approval	COMMENT
LOW⚡	server/src/routes/access.ts	1980	## Step 3: Claim API key (one-time)	COMMENT
LOW	server/src/routes/access.ts	1903	## Step 1: Submit agent join request	COMMENT
LOW	server/src/routes/access.ts	1997	## Step 4: Install Paperclip skill	COMMENT
LOW⚡	server/src/routes/plugins.ts	2772	// Step 1: Resolve the plugin	COMMENT
LOW⚡	server/src/routes/plugins.ts	2779	// Step 2: Validate the plugin is in 'ready' state	COMMENT
LOW⚡	server/src/routes/plugins.ts	2787	// Step 3: Validate the plugin has webhooks.receive capability	COMMENT
LOW⚡	server/src/routes/plugins.ts	2847	// Step 7: Dispatch to the worker via handleWebhook RPC	COMMENT
LOW⚡	server/src/routes/plugins.ts	2857	// Step 8: Update delivery record to success	COMMENT
LOW	server/src/routes/plugins.ts	2802	// Step 4: Validate the endpointKey exists in the manifest's webhook declarations	COMMENT
LOW	server/src/routes/plugins.ts	2814	// Step 5: Extract request data	COMMENT
LOW	server/src/routes/plugins.ts	2833	// Step 6: Record the delivery in the database	COMMENT
LOW	server/src/routes/plugin-ui-static.ts	248	// Step 1: Look up the plugin	COMMENT
LOW	server/src/routes/plugin-ui-static.ts	270	// Step 2: Verify the plugin is ready and has UI declared	COMMENT
LOW	server/src/routes/plugin-ui-static.ts	409	// Step 3: Resolve the plugin's UI directory	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	429	// Step 4: Resolve the requested file path and prevent traversal (including symlinks)	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	432	// Step 5: Check that the file exists and is a regular file	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	464	// Step 6: Determine cache strategy based on filename	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	468	// Step 7: Set cache headers	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	486	// Step 8: Set Content-Type	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	493	// Step 9: Set CORS headers (plugin UI may be loaded from different origin in dev)	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	496	// Step 10: Send the file	COMMENT
LOW⚡	server/src/services/plugin-worker-manager.ts	3272	// Step 2: Send SIGTERM and wait	COMMENT
LOW⚡	server/src/services/plugin-worker-manager.ts	3281	// Step 3: Forcefully kill with SIGKILL	COMMENT
LOW	server/src/services/plugin-worker-manager.ts	3248	// Step 1: Send shutdown RPC and wait for the worker to exit gracefully.	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	289	// Step 1: Resolve environment	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	314	// Step 2: Acquire lease	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	354	// Step 3: Log lease acquisition activity	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	376	// Step 4: Resolve execution transport	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	449	// Step 1: Build workspace realization request	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	462	// Step 2: Realize workspace in the environment via the runtime driver	COMMENT
81 more matches not shown…

Fake / Example Data196 hits · 200 pts

Severity	File	Line	Snippet	Context
LOW	…stories/connection-setup/apps-connect-name.stories.tsx	57	(i) => i.getAttribute("placeholder") === "My app",	CODE
LOW	…storybook/support/design-proposals/AppShellPreview.tsx	21	id: `app-shell-${label.toLowerCase()}`, type: "placeholder", label, closable: true, payload: null,	CODE
LOW	ui/src/App.test.tsx	149	user: { id: "user-1", email: "user@example.com", name: "User", image: null },	CODE
LOW	ui/src/App.test.tsx	152	user: { id: "user-1", email: "user@example.com", name: "User", image: null },	CODE
LOW	ui/src/App.test.tsx	207	user: { id: "user-1", email: "user@example.com", name: "User", image: null },	CODE
LOW	ui/src/App.test.tsx	210	user: { id: "user-1", email: "user@example.com", name: "User", image: null },	CODE
LOW	ui/src/App.test.tsx	258	user: { id: "user-1", email: "user@example.com", name: "User", image: null },	CODE
LOW	ui/src/App.test.tsx	295	user: { id: "user-1", email: "user@example.com", name: "User", image: null },	CODE
LOW	ui/src/plugins/slots.tsx	800	missingBehavior?: "hidden" \| "placeholder";	CODE
LOW	ui/src/plugins/slots.tsx	929	missingBehavior?: "hidden" \| "placeholder";	CODE
LOW	ui/src/plugins/slots.test.ts	74	missingBehavior: "placeholder",	CODE
LOW	ui/src/components/CommentThread.tsx	380	missingBehavior="placeholder"	CODE
LOW	ui/src/components/CommentThread.tsx	415	missingBehavior="placeholder"	CODE
LOW⚡	ui/src/components/QueryView.tsx	207	<div role="status" aria-busy="true" aria-label={label} data-query-view="placeholder" className={className}>	CODE
LOW⚡	ui/src/components/QueryView.tsx	214	<span role="status" aria-busy="true" aria-label={label} data-query-view="placeholder" className={cn("inline-flex",	CODE
LOW⚡	ui/src/components/QueryView.tsx	220	<div role="status" aria-busy="true" aria-label={label} data-query-view="placeholder" className={cn("space-y-2 py-1",	CODE
LOW	ui/src/components/Layout.production.tsx	242	missingBehavior="placeholder"	CODE
LOW	ui/src/components/QueryView.test.tsx	162	expect(container.querySelector('[data-query-view="placeholder"]')).not.toBeNull();	CODE
LOW	ui/src/components/QueryView.test.tsx	196	expect(container.querySelector('[data-query-view="placeholder"]')).not.toBeNull();	CODE
LOW	ui/src/components/QueryView.test.tsx	215	expect(container.querySelector('[data-query-view="placeholder"]')).toBeNull();	CODE
LOW	ui/src/components/SidebarProjects.tsx	220	missingBehavior="placeholder"	CODE
LOW	ui/src/components/Sidebar.production.tsx	212	missingBehavior="placeholder"	CODE
LOW	ui/src/components/Sidebar.production.tsx	243	missingBehavior="placeholder"	CODE
LOW	ui/src/components/IssueProperties.test.tsx	2921	const textInput = inputs.find((input) => input.getAttribute("placeholder") === "What should the agent re-check?");	CODE
LOW	ui/src/components/IssueProperties.test.tsx	3194	.find((node) => node.getAttribute("placeholder")?.includes("watchdog"));	CODE
LOW	ui/src/components/Layout.tsx	210	missingBehavior="placeholder"	CODE
LOW	ui/src/components/Layout.tsx	218	missingBehavior="placeholder"	CODE
LOW	ui/src/components/Sidebar.tsx	266	missingBehavior="placeholder"	CODE
LOW	ui/src/components/Sidebar.tsx	316	missingBehavior="placeholder"	CODE
LOW	ui/src/components/side-panel/SidePanelLauncher.tsx	37	}: Pick<SidePanelLauncherProps, "sections" \| "onSelect" \| "placeholder" \| "emptyMessage"> & { panel: boolean }) {	CODE
LOW	ui/src/pages/AgentDetailPage.tsx	39	{slot ? <PluginSlotMount slot={slot} context={{ companyId: agent.companyId, companyPrefix: companyPrefix ?? null, en	CODE
LOW	ui/src/pages/IssueDetail.tsx	8075	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/IssueDetail.tsx	8102	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/IssueDetail.tsx	8808	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/ExecutionWorkspaceDetail.tsx	1093	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/ExecutionWorkspaceDetail.tsx	1590	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/ProjectDetail.tsx	840	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/ProjectDetail.tsx	949	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/PluginSettings.tsx	252	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/InstanceAccess.test.tsx	24	const user = { id: "admin", name: "Admin", email: "admin@example.com", isInstanceAdmin: true };	CODE
LOW	ui/src/pages/ProjectWorkspaceDetail.tsx	756	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/CompanySettingsPluginPage.tsx	84	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/NewAgent.test.tsx	1082	expect(container.querySelector('[aria-label="KIMI_API_KEY"]')?.getAttribute("placeholder")).toBe("Using saved key"	CODE
LOW	ui/src/pages/PluginPage.tsx	182	missingBehavior="placeholder"	CODE
LOW	ui/src/pages/apps/AppsConnect.test.tsx	279	).find((i) => i.getAttribute("placeholder")?.startsWith("https://"));	CODE
LOW	ui/src/pages/apps/AppsConnect.test.tsx	994	).find((input) => input.getAttribute("placeholder")?.startsWith("https://"));	CODE
LOW	ui/src/pages/apps/AppsConnect.test.tsx	3724	).find((i) => i.getAttribute("placeholder")?.startsWith("https://"));	CODE
LOW	ui/src/pages/apps/AppsConnect.test.tsx	3874	i.getAttribute("placeholder")?.startsWith("https://example.com/actions"),	CODE
LOW	ui/src/pages/apps/AppsConnect.test.tsx	3877	expect(linkInput?.getAttribute("placeholder")).toBe("https://example.com/actions");	CODE
LOW	tests/runner-e2e/evidence.ts	88	if (privateStandardOnly && !relative && !isStandardEvidencePath(entry.isDirectory() ? path.join(next, "placeholder")	CODE
LOW	tests/runner-e2e/first-task-flow.ts	69	...(q.customAnswer ? { customAnswer: pick(q.customAnswer, ["enabled", "label", "placeholder"]) } : {}),	CODE
LOW	…r/src/__tests__/workspace-login-handoff-issuer.test.ts	276	stubDb({ adminRows: [{ id: "admin-1", email: "admin@example.com", createdAt: new Date(0) }] }),	CODE
LOW	…r/src/__tests__/workspace-login-handoff-issuer.test.ts	279	).resolves.toEqual({ userId: "admin-1", email: "admin@example.com" });	CODE
LOW	server/src/__tests__/auth-session-route.test.ts	56	email: "user@example.com",	CODE
LOW	server/src/__tests__/auth-session-route.test.ts	72	userEmail: "user@example.com",	CODE
LOW	…/src/__tests__/codex-local-adapter-environment.test.ts	129	JSON.stringify({ accessToken: "fake-token", accountId: "acct-1" }),	CODE
LOW	server/src/__tests__/redact-sensitive.test.ts	17	email: "user@example.com",	CODE
LOW	server/src/__tests__/redact-sensitive.test.ts	23	expect(out.email).toBe("user@example.com");	CODE
LOW	server/src/__tests__/redact-sensitive.test.ts	173	user: { email: "user@example.com", password: "secret-pass" },	CODE
LOW	server/src/__tests__/redact-sensitive.test.ts	178	"user@example.com",	CODE
136 more matches not shown…

Verbosity Indicators56 hits · 106 pts

Severity	File	Line	Snippet	Context
LOW	tests/e2e/signoff-policy.spec.ts	630	// Step 1: Executor marks done → should route to reviewer	COMMENT
LOW⚡	tests/e2e/signoff-policy.spec.ts	648	// Step 2: Navigate to issue in UI and verify execution label	COMMENT
LOW⚡	tests/e2e/signoff-policy.spec.ts	652	// Step 3: Reviewer approves → should route to approver	COMMENT
LOW⚡	tests/e2e/signoff-policy.spec.ts	666	// Step 4: Verify UI shows approval pending	COMMENT
LOW⚡	tests/e2e/signoff-policy.spec.ts	670	// Step 5: Approver approves → should complete	COMMENT
LOW⚡	tests/e2e/conference-room-typing-intro.spec.ts	73	// Step 0: front door (skipped when the wizard opens on the create path).	COMMENT
LOW⚡	tests/e2e/conference-room-typing-intro.spec.ts	77	// Step 1: company name.	COMMENT
LOW⚡	tests/e2e/conference-room-typing-intro.spec.ts	83	// Step 3: name the agent. The role picker is gone — the arc asks for a	COMMENT
LOW⚡	tests/e2e/conference-room-typing-intro.spec.ts	89	// Step 4: pick a model source, then advance. Nothing is selected on arrival	COMMENT
LOW	tests/e2e/conference-room-typing-intro.spec.ts	107	// Step 5: review → Get started creates the first task and opens its	COMMENT
LOW⚡	tests/release-smoke/docker-auth-onboarding.spec.ts	125	// Step 1: name the organization. "Continue" creates the company itself and	COMMENT
LOW⚡	tests/release-smoke/docker-auth-onboarding.spec.ts	132	// Step 3: name the team lead. The name is the step's only question and it	COMMENT
LOW⚡	tests/release-smoke/docker-auth-onboarding.spec.ts	142	// Step 4: answer the model-source question, then connect (hire) the lead.	COMMENT
LOW	tests/release-smoke/docker-auth-onboarding.spec.ts	222	// Step 5: review, then launch. "Get started" provisions the onboarding	COMMENT
LOW⚡	server/src/routes/access.ts	1977	## Step 2: Wait for board approval	COMMENT
LOW⚡	server/src/routes/access.ts	1980	## Step 3: Claim API key (one-time)	COMMENT
LOW	server/src/routes/access.ts	1903	## Step 1: Submit agent join request	COMMENT
LOW	server/src/routes/access.ts	1997	## Step 4: Install Paperclip skill	COMMENT
LOW⚡	server/src/routes/plugins.ts	2772	// Step 1: Resolve the plugin	COMMENT
LOW⚡	server/src/routes/plugins.ts	2779	// Step 2: Validate the plugin is in 'ready' state	COMMENT
LOW⚡	server/src/routes/plugins.ts	2787	// Step 3: Validate the plugin has webhooks.receive capability	COMMENT
LOW⚡	server/src/routes/plugins.ts	2847	// Step 7: Dispatch to the worker via handleWebhook RPC	COMMENT
LOW⚡	server/src/routes/plugins.ts	2857	// Step 8: Update delivery record to success	COMMENT
LOW	server/src/routes/plugins.ts	2802	// Step 4: Validate the endpointKey exists in the manifest's webhook declarations	COMMENT
LOW	server/src/routes/plugins.ts	2814	// Step 5: Extract request data	COMMENT
LOW	server/src/routes/plugins.ts	2833	// Step 6: Record the delivery in the database	COMMENT
LOW	server/src/routes/plugin-ui-static.ts	248	// Step 1: Look up the plugin	COMMENT
LOW	server/src/routes/plugin-ui-static.ts	270	// Step 2: Verify the plugin is ready and has UI declared	COMMENT
LOW	server/src/routes/plugin-ui-static.ts	409	// Step 3: Resolve the plugin's UI directory	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	429	// Step 4: Resolve the requested file path and prevent traversal (including symlinks)	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	432	// Step 5: Check that the file exists and is a regular file	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	464	// Step 6: Determine cache strategy based on filename	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	468	// Step 7: Set cache headers	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	486	// Step 8: Set Content-Type	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	493	// Step 9: Set CORS headers (plugin UI may be loaded from different origin in dev)	COMMENT
LOW⚡	server/src/routes/plugin-ui-static.ts	496	// Step 10: Send the file	COMMENT
LOW⚡	server/src/services/plugin-worker-manager.ts	3272	// Step 2: Send SIGTERM and wait	COMMENT
LOW⚡	server/src/services/plugin-worker-manager.ts	3281	// Step 3: Forcefully kill with SIGKILL	COMMENT
LOW	server/src/services/plugin-worker-manager.ts	3248	// Step 1: Send shutdown RPC and wait for the worker to exit gracefully.	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	289	// Step 1: Resolve environment	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	314	// Step 2: Acquire lease	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	354	// Step 3: Log lease acquisition activity	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	376	// Step 4: Resolve execution transport	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	449	// Step 1: Build workspace realization request	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	462	// Step 2: Realize workspace in the environment via the runtime driver	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	569	// Step 3: Persist realization metadata on lease and execution workspace	COMMENT
LOW	server/src/services/environment-run-orchestrator.ts	593	// Step 4: Resolve execution target for the adapter	COMMENT
LOW	server/src/services/plugin-tool-dispatcher.ts	330	// Step 1: Load tools from all currently-ready plugins	COMMENT
LOW	server/src/services/plugin-tool-dispatcher.ts	350	// Step 2: Subscribe to lifecycle events for dynamic updates	COMMENT
LOW⚡	server/src/services/plugin-loader.ts	1312	// Step 4: Reject incompatible plugin API versions	COMMENT
LOW⚡	server/src/services/plugin-loader.ts	1320	// Step 5: Validate manifest capabilities are consistent	COMMENT
LOW	server/src/services/plugin-loader.ts	1289	// Step 3: Read and validate plugin manifest	COMMENT
LOW	server/src/services/plugin-loader.ts	1331	// Step 6: Reject plugins that require a newer host than the running server	COMMENT
LOW	server/src/services/plugin-loader.ts	1745	// Step 6: Persist install record and apply plugin-owned schema migrations	COMMENT
LOW	server/src/services/setup-token-transport-binding.ts	202	// Step 1: lock and conditionally transition the exact durable row to	COMMENT
LOW	server/src/services/setup-token-transport-binding.ts	217	// Step 2: write or rotate the secret on the same transaction handle. A	COMMENT

Excessive Try-Catch Wrapping63 hits · 71 pts

Severity	File	Line	Snippet	Context
LOW	tests/runner-e2e/kimi-provider-fault-diagnostic.py	34	except Exception:pass	CODE
LOW	tests/runner-e2e/kimi-provider-fault-diagnostic.py	52	except Exception:pass	CODE
LOW	tests/runner-e2e/kimi-provider-fault.py	268	except Exception:	CODE
LOW	tests/runner-e2e/pi-provider-fault.py	226	except Exception:	CODE
LOW⚡	tests/runner-e2e/kimi-local-provider-fault.ts	80	except Exception:	CODE
LOW	tests/runner-e2e/pi-provider-fault.test.py	275	except Exception:	CODE
LOW	tests/runner-e2e/everyday-artifact.py	132	except Exception as error:checks=[dict(id='artifact-readable',passed=False,detail=str(error))]	CODE
LOW	.agents/skills/verify-paperclip/scripts/doctor.py	58	except Exception as error:	CODE
LOW	server/src/services/scripts/v6/client.py	74	except Exception:	CODE
LOW	server/src/services/scripts/v6/client.py	101	except Exception:	CODE
LOW	server/src/services/scripts/v6/client.py	112	except Exception: raise RuntimeError("Paperclip response is invalid or exceeds the transport limit") from No	CODE
LOW	server/src/services/scripts/v6/client.py	347	except Exception as error:	CODE
MEDIUM	server/src/services/scripts/v6/client.py	106	def request_json(request, decode):	CODE
LOW	server/src/services/scripts/v6/detector.sh	36	except Exception: print('ERROR')	CODE
LOW	server/src/services/scripts/v1/client.py	104	except Exception:	CODE
LOW	server/src/services/scripts/v1/client.py	245	except Exception as error:	CODE
LOW	server/src/services/scripts/v1/detector.sh	42	except Exception: print('ERROR')	CODE
LOW	server/src/services/scripts/v1/detector.sh	62	except Exception:pass	CODE
LOW	server/src/services/scripts/v8/client.py	74	except Exception:	CODE
LOW	server/src/services/scripts/v8/client.py	101	except Exception:	CODE
LOW	server/src/services/scripts/v8/client.py	112	except Exception: raise RuntimeError("Paperclip response is invalid or exceeds the transport limit") from No	CODE
LOW	server/src/services/scripts/v8/client.py	508	except Exception as error:	CODE
MEDIUM	server/src/services/scripts/v8/client.py	106	def request_json(request, decode):	CODE
LOW	server/src/services/scripts/v8/detector.sh	36	except Exception: print('ERROR')	CODE
LOW	server/src/services/scripts/v9/client.py	74	except Exception:	CODE
LOW	server/src/services/scripts/v9/client.py	101	except Exception:	CODE
LOW	server/src/services/scripts/v9/client.py	112	except Exception: raise RuntimeError("Paperclip response is invalid or exceeds the transport limit") from No	CODE
LOW	server/src/services/scripts/v9/client.py	609	except Exception as error:	CODE
MEDIUM	server/src/services/scripts/v9/client.py	106	def request_json(request, decode):	CODE
LOW	server/src/services/scripts/v9/detector.sh	36	except Exception: print('ERROR')	CODE
LOW	server/src/services/scripts/v7/client.py	74	except Exception:	CODE
LOW	server/src/services/scripts/v7/client.py	101	except Exception:	CODE
LOW	server/src/services/scripts/v7/client.py	112	except Exception: raise RuntimeError("Paperclip response is invalid or exceeds the transport limit") from No	CODE
LOW	server/src/services/scripts/v7/client.py	508	except Exception as error:	CODE
MEDIUM	server/src/services/scripts/v7/client.py	106	def request_json(request, decode):	CODE
LOW	server/src/services/scripts/v7/detector.sh	36	except Exception: print('ERROR')	CODE
LOW	server/src/services/scripts/v2/client.py	49	except Exception:	CODE
LOW	server/src/services/scripts/v2/client.py	76	except Exception:	CODE
LOW	server/src/services/scripts/v2/client.py	83	except Exception: raise RuntimeError("Paperclip response is unavailable") from None	CODE
LOW	server/src/services/scripts/v2/client.py	284	except Exception as error:	CODE
LOW	server/src/services/scripts/v2/detector.sh	36	except Exception: print('ERROR')	CODE
LOW	server/src/services/scripts/v5/client.py	74	except Exception:	CODE
LOW	server/src/services/scripts/v5/client.py	101	except Exception:	CODE
LOW	server/src/services/scripts/v5/client.py	112	except Exception: raise RuntimeError("Paperclip response is invalid or exceeds the transport limit") from No	CODE
LOW	server/src/services/scripts/v5/client.py	345	except Exception as error:	CODE
MEDIUM	server/src/services/scripts/v5/client.py	106	def request_json(request, decode):	CODE
LOW	server/src/services/scripts/v5/detector.sh	36	except Exception: print('ERROR')	CODE
LOW	server/src/services/scripts/v4/client.py	74	except Exception:	CODE
LOW	server/src/services/scripts/v4/client.py	101	except Exception:	CODE
LOW	server/src/services/scripts/v4/client.py	112	except Exception: raise RuntimeError("Paperclip response is invalid or exceeds the transport limit") from No	CODE
LOW	server/src/services/scripts/v4/client.py	345	except Exception as error:	CODE
MEDIUM	server/src/services/scripts/v4/client.py	106	def request_json(request, decode):	CODE
LOW	server/src/services/scripts/v4/detector.sh	36	except Exception: print('ERROR')	CODE
LOW	server/src/services/scripts/v3/client.py	50	except Exception:	CODE
LOW	server/src/services/scripts/v3/client.py	77	except Exception:	CODE
LOW	server/src/services/scripts/v3/client.py	88	except Exception: raise RuntimeError("Paperclip response is invalid or exceeds the transport limit") from No	CODE
LOW	server/src/services/scripts/v3/client.py	304	except Exception as error:	CODE
MEDIUM	server/src/services/scripts/v3/client.py	82	def request_json(request, decode):	CODE
LOW	server/src/services/scripts/v3/detector.sh	36	except Exception: print('ERROR')	CODE
LOW	packages/paperclip-runner/scripts/probe-copilot-acp.py	174	except Exception:	CODE
3 more matches not shown…

Empty Error Handlers10 hits · 50 pts

Severity	File	Line	Snippet	Context
HIGH	tests/runner-e2e/kimi-provider-fault-diagnostic.py	34	except Exception:pass	CODE
HIGH	tests/runner-e2e/kimi-provider-fault-diagnostic.py	52	except Exception:pass	CODE
HIGH	tests/runner-e2e/kimi-provider-fault-diagnostic.test.py	96	except RuntimeError:	CODE
HIGH	tests/runner-e2e/kimi-provider-fault-diagnostic.test.py	110	except RuntimeError:	CODE
HIGH	tests/runner-e2e/kimi-provider-fault.test.py	382	except ProcessLookupError:	CODE
HIGH	tests/runner-e2e/kimi-provider-fault.test.py	396	except ProcessLookupError:	CODE
HIGH	tests/runner-e2e/pi-provider-fault.test.py	315	except ProcessLookupError: pass	CODE
HIGH	tests/runner-e2e/pi-provider-fault.test.py	327	except ProcessLookupError: pass	CODE
HIGH	tests/runner-e2e/pi-provider-fault.test.py	320	except ProcessLookupError: pass	CODE
HIGH	packages/paperclip-runner/scripts/probe-copilot-acp.py	34	except OSError:pass	CODE

Modern AI Meta-Vocabulary17 hits · 48 pts

Severity	File	Line	Snippet	Context
MEDIUM	.agents/skills/paperclip-create-plugin/SKILL.md	40	## 3. CLI-first scaffold workflow	COMMENT
MEDIUM	.agents/skills/paperclip-create-plugin/SKILL.md	92	## 5. After scaffolding, sanity-check the package	COMMENT
MEDIUM	.agents/skills/directions-lab/SKILL.md	106	## State what you derived, then scaffold	COMMENT
MEDIUM	.agents/skills/directions-lab/SKILL.md	157	## Commit the scaffold, then draw	COMMENT
MEDIUM	.agents/skills/directions-lab/references/generator.md	1	# Generator: how `scaffold.mjs` renders a lab	COMMENT
MEDIUM	.agents/skills/directions-lab/references/generator.md	248	## 9. Tests: `scaffold.test.mjs`	COMMENT
MEDIUM	…ls/directions-lab/references/questions-and-defaults.md	1	# Questions and defaults - the intake before `scaffold.mjs new`	COMMENT
MEDIUM	…/directions-lab/references/today-fixtures-and-build.md	284	Six files: `lab-state.test.ts`, `api-stub.test.ts`, and `directions/d5-v1-mvp/Thread.test.tsx`, `MediaPrint.test.ts`, `k	CODE
MEDIUM	…nts/skills/directions-lab/references/drawing-phases.md	112	`--strict` fails on any remaining `data-lab-stub` (the placeholder-tagline warning comes from `check` itself); `--run` e	CODE
MEDIUM	…erclip-runner/spec/paperclip-agent-operation-groups.md	210	\| [`mh` — Multi-hop](#behavior-group-mh-multi-hop) \| composed semantic operations + control-plane continuation \| `create	CODE
MEDIUM	packages/plugins/create-paperclip-plugin/README.md	44	## Workflow after scaffolding	COMMENT
MEDIUM	…bundled/paperclip-operations/reflection-coach/SKILL.md	48	## Hard guardrails	COMMENT
MEDIUM	…bundled/paperclip-operations/reflection-coach/SKILL.md	86	### 3) Read the target's current guardrails	COMMENT
MEDIUM	doc/plans/2026-04-08-agent-os-technical-report.md	219	### 1. Its built-in orchestration primitives overlap the wrong layer	COMMENT
MEDIUM	doc/plans/2026-02-21-humans-and-permissions.md	331	## Phase 1: Mode and guardrails	COMMENT
MEDIUM	…ans/2026-03-10-workspace-strategy-and-git-worktrees.md	624	### 11. Runtime service orchestration	COMMENT
MEDIUM	doc/plugins/ideas-from-opencode.md	429	## 3. Prefer event-driven extensions over core-logic mutation	COMMENT

AI Slop Vocabulary18 hits · 41 pts

Severity	File	Line	Snippet	Context
MEDIUM	…orybook/stories/skills/skills-store-detail.stories.tsx	22	markdown: "# deep-research\n\nResearch harness.",	CODE
MEDIUM	…er/src/__tests__/execution-lock-orphan-cleanup.test.ts	271	// make us robust against it.	COMMENT
MEDIUM	server/src/__tests__/helpers/wake-message.ts	5	// them robust to serialization formatting/key-order changes.	COMMENT
MEDIUM	scripts/docker-onboard-smoke.sh	14	# Serve api.anthropic.com from a mock inside the harness. Connecting a model	COMMENT
MEDIUM	…-runner/src/drivers/opencode/opencode-server-driver.ts	664	this.#emit("harness.diagnostic", {	CODE
MEDIUM	…-runner/src/drivers/opencode/opencode-server-driver.ts	1403	this.#emit("harness.diagnostic", {	CODE
MEDIUM	…-runner/src/drivers/opencode/opencode-server-driver.ts	1413	this.#emit("harness.diagnostic", {	CODE
MEDIUM	…-runner/src/drivers/opencode/opencode-server-driver.ts	1490	this.#emit("harness.diagnostic", {	CODE
MEDIUM	…-runner/src/drivers/opencode/opencode-server-driver.ts	2142	this.#emit("harness.diagnostic", {	CODE
MEDIUM	…-runner/src/drivers/opencode/opencode-server-driver.ts	2153	if (performance) this.#emit("harness.diagnostic", performance, refs);	CODE
MEDIUM	packages/paperclip-runner/src/mock-core/local-runner.ts	446	const harnessExitEvent = this.#events.find((event) => event.eventType === "harness.exited");	CODE
MEDIUM	…p-runner/src/mock-core/live-console-scripted-driver.ts	205	this.#emit("harness.diagnostic", { message: `demo turn failed: ${String(error)}` });	CODE
MEDIUM	…p-runner/src/mock-core/live-console-scripted-driver.ts	221	this.#emit("harness.diagnostic", {	CODE
MEDIUM	…p-runner/src/mock-core/live-console-scripted-driver.ts	644	this.#emit("harness.diagnostic", { message: beat.message });	CODE
MEDIUM	…p-runner/src/mock-core/live-console-scripted-driver.ts	648	this.#emit("harness.diagnostic", { message: beat.note });	CODE
MEDIUM	…es/plugins/plugin-llm-wiki/tests/screenshots/entry.tsx	5	if (!container) throw new Error("No #root in harness host");	CODE
MEDIUM	.github/workflows/release-smoke.yml	118	# Fixed here rather than read back out of the harness, so the `always()`	COMMENT
MEDIUM	.github/workflows/release-smoke.yml	183	# harness already tore the container down it wrote this file on its	COMMENT

Cross-File Repetition8 hits · 40 pts

Severity	File	Snippet	Context
HIGH	server/src/services/scripts/v6/client.py	muse secure vault transport; profile is nonsecret and operation identities are durable.	STRING
HIGH	server/src/services/scripts/v8/client.py	muse secure vault transport; profile is nonsecret and operation identities are durable.	STRING
HIGH	server/src/services/scripts/v9/client.py	muse secure vault transport; profile is nonsecret and operation identities are durable.	STRING
HIGH	server/src/services/scripts/v7/client.py	muse secure vault transport; profile is nonsecret and operation identities are durable.	STRING
HIGH	server/src/services/scripts/v2/client.py	muse secure vault transport; profile is nonsecret and operation identities are durable.	STRING
HIGH	server/src/services/scripts/v5/client.py	muse secure vault transport; profile is nonsecret and operation identities are durable.	STRING
HIGH	server/src/services/scripts/v4/client.py	muse secure vault transport; profile is nonsecret and operation identities are durable.	STRING
HIGH	server/src/services/scripts/v3/client.py	muse secure vault transport; profile is nonsecret and operation identities are durable.	STRING

Magic Placeholder Names5 hits · 32 pts

Severity	File	Line	Snippet	Context
HIGH	ui/src/pages/tools/McpConfigHelpDialog.test.tsx	198	expect(MCP_CONFIG_HELP_PROMPT).toContain("<YOUR_API_KEY>");	CODE
HIGH	ui/src/pages/tools/McpConfigHelpDialog.test.tsx	198	expect(MCP_CONFIG_HELP_PROMPT).toContain("<YOUR_API_KEY>");	CODE
HIGH⚡	packages/shared/src/mcp-config-help-prompt.ts	32	"headers": { "Authorization": "Bearer <YOUR_TOKEN>" }	CODE
HIGH⚡	packages/shared/src/mcp-config-help-prompt.ts	37	3. Use an obvious placeholder for every credential, like <YOUR_API_KEY>. Do not ask me to paste a real token into this c	CODE
HIGH⚡	packages/shared/src/mcp-config-help-prompt.ts	37	3. Use an obvious placeholder for every credential, like <YOUR_API_KEY>. Do not ask me to paste a real token into this c	CODE

Deep Nesting19 hits · 18 pts

Severity	File	Line	Context
LOW	tests/runner-e2e/kimi-provider-fault.test.py	314	CODE
LOW	tests/runner-e2e/private-history-archive.py	26	CODE
LOW	tests/runner-e2e/private-history-archive.py	90	CODE
LOW	tests/runner-e2e/pi-provider-fault.test.py	231	CODE
LOW	tests/runner-e2e/everyday-artifact.py	86	CODE
LOW	tests/runner-e2e/everyday-artifact.py	52	CODE
LOW	.agents/skills/verify-paperclip/tests/test_ownership.py	14	CODE
LOW	server/src/services/scripts/v6/client.py	303	CODE
LOW	server/src/services/scripts/v1/client.py	200	CODE
LOW	server/src/services/scripts/v8/client.py	464	CODE
LOW	server/src/services/scripts/v8/client.py	404	CODE
LOW	server/src/services/scripts/v9/client.py	565	CODE
LOW	server/src/services/scripts/v7/client.py	464	CODE
LOW	server/src/services/scripts/v7/client.py	404	CODE
LOW	server/src/services/scripts/v2/client.py	243	CODE
LOW	server/src/services/scripts/v5/client.py	301	CODE
LOW	server/src/services/scripts/v4/client.py	301	CODE
LOW	server/src/services/scripts/v3/client.py	261	CODE
LOW	packages/paperclip-runner/scripts/probe-copilot-acp.py	97	CODE

Cross-Language Confusion3 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	tests/runner-e2e/kimi-provider-fault.test.py	347	script.write_text('const fs=require("node:fs"),cp=require("node:child_process");const directory=fs.openSync(	CODE
HIGH	tests/runner-e2e/pi-provider-fault.test.py	253	(distribution / 'pi-entry.cjs').write_text('const p=require("node:child_process").spawn(process.execPath,["-	CODE
HIGH	tests/runner-e2e/pi-provider-fault.test.py	271	script = base / 'root.cjs'; script.write_text(setup + 'const p=require("node:child_process").spawn(' + launc	CODE

Cross-Language Confusion (JS/TS)2 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH⚡	tests/runner-e2e/kimi-local-provider-fault.ts	79	print(json.dumps(out,separators=(',',':')))	CODE
HIGH⚡	tests/runner-e2e/kimi-local-provider-fault.ts	81	print(json.dumps({'error':'local_process_inspection_failed'}));sys.exit(1)	CODE

Example Usage Blocks7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	evals/promptfoo/promptfooconfig.yaml	8	# Usage:	COMMENT
LOW	scripts/build-npm.sh	9	# Usage:	COMMENT
LOW	scripts/kill-agent-browsers.sh	5	# Usage:	COMMENT
LOW	scripts/kill-workspaces.sh	9	# Usage:	COMMENT
LOW	scripts/kill-dev.sh	5	# Usage:	COMMENT
LOW	scripts/kill-vitest.sh	5	# Usage:	COMMENT
LOW	scripts/backup-db.sh	7	# Usage:	COMMENT

Unused Imports3 hits · 3 pts

Severity	File	Line	Context
LOW	tests/runner-e2e/kimi-provider-fault-diagnostic.py	1	CODE
LOW	tests/runner-e2e/kimi-provider-fault-diagnostic.py	1	CODE
LOW	tests/runner-e2e/kimi-provider-fault-diagnostic.py	2	CODE

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	packages/paperclip-runner/scripts/aws-agentcore.sh	211	# This file is generated locally, mode 0600, and contains nonsecret metadata only.	COMMENT

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/runner-e2e/first-task.test.ts	547	"A new task was mentioned earlier. Continue?",	CODE

Overly Generic Function Names2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	…ges/paperclip-runner/src/drivers/runner-tool-bridge.ts	206	async function handleRequest(	CODE
LOW	…es/paperclip-runner/src/drivers/opencode/mcp-bridge.ts	138	async function handleRequest(	CODE

paperclipai/paperclip

Open-Source Code Quality, Security and Technical Debt Review