The open-source app everyone uses to manage agents at work
This report presents the forensic synthetic code analysis of paperclipai/paperclip, a TypeScript project with 79,553 GitHub stars. SynthScan v2.0 examined 1,485,032 lines of code across 4405 source files, recording 5279 pattern matches distributed across 10 syntactic categories. The overall adjusted score of 3.7 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 5279 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/storybook/.storybook/preview.tsx | 42 | function withStorybookTimelineDetails(data: WorkTimelineResult): WorkTimelineResult { | CODE |
| LOW | ui/storybook/.storybook/preview.tsx | 73 | function installStorybookApiFixtures() { | CODE |
| LOW | …torybook/stories/projects-goals-workspaces.stories.tsx | 446 | function ProjectsGoalsWorkspacesStories() { | CODE |
| LOW | …rybook/stories/assigned-backlog-safeguards.stories.tsx | 95 | function AssignedBacklogNoticePanel() { | CODE |
| LOW | ui/storybook/stories/scheduled-retry.stories.tsx | 59 | function ScheduledRetrySurfaceStories() { | CODE |
| LOW | ui/storybook/stories/successful-run-handoff.stories.tsx | 33 | function SuccessfulRunHandoffStates() { | CODE |
| LOW | ui/storybook/stories/successful-run-handoff.stories.tsx | 138 | function HandoffLivenessComparisonPanel() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 212 | function SuccessfulRunHandoffPinnedNotice() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 216 | function SuccessfulRunHandoffInFlightNoticeStory() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 220 | function SuccessfulRunHandoffLivenessComparison() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 228 | function SuccessfulRunHandoffActivityEvents() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 232 | function SuccessfulRunHandoffIssueCard() { | CODE |
| LOW⚡ | ui/storybook/stories/successful-run-handoff.stories.tsx | 236 | function SuccessfulRunHandoffEscalationComment() { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 251 | function seedIssueListLocalStorage() { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 298 | function IssuePropertiesLongValuePane({ inline = false }: { inline?: boolean }) { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 327 | function IssuePropertiesModelOverridePane() { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 348 | function IssuePropertiesMobileBlockerActionsPane() { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 382 | function ColumnConfigurationMatrix() { | CODE |
| LOW | ui/storybook/stories/issue-management.stories.tsx | 970 | function ModelProfileLedgerStandalone() { | CODE |
| LOW | ui/storybook/stories/blocked-inbox.stories.tsx | 211 | function BlockedReasonChipsCatalog() { | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 139 | function InteractiveSuggestedTasksCard() { | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 199 | function InteractiveAskUserQuestionsCard() { | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 216 | function InteractiveRequestConfirmationCard() { | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 241 | function InteractiveRequestCheckboxConfirmationCard({ | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 282 | function InteractiveRequestItemVerdictsCard({ | CODE |
| LOW | …torybook/stories/issue-thread-interactions.stories.tsx | 329 | function AutoOpenDeclineRequestConfirmationCard({ | CODE |
| LOW | ui/storybook/stories/external-objects.stories.tsx | 626 | function FilterPopoverWithExternalChecked() { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 645 | function ExecutionWorkspaceDialogStory({ blocked }: { blocked?: boolean }) { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 709 | function findAssigneeOptionsButton() { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 716 | function useCheapLaneAdapterOverrides(variant: CheapLaneVariant) { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 765 | function CheapLaneIssueDialogOpener({ variant }: { variant: CheapLaneVariant }) { | CODE |
| LOW | ui/storybook/stories/dialogs-modals.stories.tsx | 821 | function PathInstructionsModalStory() { | CODE |
| LOW | ui/storybook/stories/chat-comments.stories.tsx | 946 | function CompactRecoveryNoticeReview() { | CODE |
| LOW | ui/storybook/stories/search.stories.tsx | 414 | function SearchOperatorInputPreview() { | CODE |
| LOW | ui/storybook/stories/search.stories.tsx | 447 | function CommandPaletteWithSearchAll({ | CODE |
| LOW | ui/storybook/stories/navigation-layout.stories.tsx | 127 | function MobileBottomNavActiveStateMatrix() { | CODE |
| LOW | ui/storybook/stories/navigation-layout.stories.tsx | 370 | function SidebarIconAlignmentHarness() { | CODE |
| LOW | ui/storybook/stories/document-annotations.stories.tsx | 370 | function DirtyDraftWithIntegratedHeader() { | CODE |
| LOW | ui/storybook/stories/forms-editors.stories.tsx | 467 | function EnvironmentVariablesEditorGallery() { | CODE |
| LOW | ui/storybook/stories/work-timeline.stories.tsx | 22 | function withStorybookTimelineDetails(data: WorkTimelineResult): WorkTimelineResult { | CODE |
| LOW | ui/src/App.tsx | 361 | function LegacySkillStudioRedirect() { | CODE |
| LOW | ui/src/App.tsx | 433 | function LegacyToolsSettingsRedirect() { | CODE |
| LOW | ui/src/App.tsx | 445 | function legacyToolsRedirectTarget(tab?: string) { | CODE |
| LOW | ui/src/App.tsx | 551 | function StatusCardsLegacyRedirect() { | CODE |
| LOW | ui/src/main.tsx | 55 | function CompanyAwareBreadcrumbProvider({ children }: { children: React.ReactNode }) { | CODE |
| LOW | ui/src/context/EditorAutocompleteContext.tsx | 41 | export function EditorAutocompleteProvider({ children }: { children: ReactNode }) { | CODE |
| LOW⚡ | ui/src/context/FileViewerContext.tsx | 66 | export function getCurrentFileViewerSearch(fallbackSearch: string): string { | CODE |
| LOW⚡ | ui/src/context/FileViewerContext.tsx | 71 | export function shouldNavigateFileViewerSearch(nextSearch: string, fallbackSearch: string): boolean { | CODE |
| LOW⚡ | ui/src/context/FileViewerContext.tsx | 75 | export function readFileViewerStateFromSearch(search: string): FileViewerUrlState | null { | CODE |
| LOW | ui/src/context/FileViewerContext.tsx | 100 | export function writeFileViewerStateToSearch(current: string, next: FileViewerUrlState | null): string { | CODE |
| LOW | ui/src/context/FileViewerContext.tsx | 137 | export function readBrowseStateFromSearch(search: string): FileViewerBrowseState | null { | CODE |
| LOW | ui/src/context/FileViewerContext.tsx | 152 | export function writeFolderViewerStateToSearch( | CODE |
| LOW | ui/src/context/FileViewerContext.tsx | 212 | function EnabledFileViewerProvider({ issueId, children }: Omit<FileViewerProviderProps, "enabled">) { | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 53 | function dispatchLiveEventToSubscribers( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 237 | function resolveVisibleIssueRouteContext( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 290 | function shouldSuppressActivityToastForVisibleIssue( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 306 | function shouldSuppressRunStatusToastForVisibleIssue( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 322 | function invalidateVisibleIssueRunQueries( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 423 | function readRunLiveStatusPatchFromPayload( | CODE |
| LOW | ui/src/context/LiveUpdatesProvider.tsx | 466 | function applyRunLiveStatusPatchToCaches( | CODE |
| 4380 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ui/src/adapters/registry.ts | 170 | // ── Builtin override lifecycle ────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/registry.ts | 226 | // ── Non-builtin externals ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/schema-config-fields.tsx | 16 | // ── Select field (extracted to keep hooks at component top level) ────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 14 | // ── Message protocol ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 27 | // ── Worker bootstrap source ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 41 | // ── 1. Lock down dangerous globals ────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 82 | // ── 2. Parser state ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 88 | // ── 3. Message handler ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/sandboxed-parser-worker.ts | 158 | // ── Public API ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/dynamic-loader.ts | 35 | // ── Types ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/dynamic-loader.ts | 49 | // ── State ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/dynamic-loader.ts | 69 | // ── Internal helpers ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/adapters/dynamic-loader.ts | 210 | // ── Public API ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/components/PipelineItemBodyDocument.tsx | 281 | // ── Body content (edit / preview / read) ────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/components/transcript/RunTranscriptView.tsx | 743 | // ── Diff entries — accumulate into diff_group blocks ────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 71 | // ── Import-specific helpers ─────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 167 | // ── Import file tree customization ─────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 199 | // ── Preview pane ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 286 | // ── Conflict item type ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 408 | // ── Post-import activation ─────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 431 | // ── Conflict resolution UI ─────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 557 | // ── Adapter type options for import ─────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 564 | // ── Adapter picker for imported agents ─────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 684 | // ── Helpers ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 715 | // ── Chunked transfer flow for large local zips ─────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 742 | // ── Async import job flow ───────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyImport.tsx | 842 | // ── Main page ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/OrgChart.tsx | 29 | // ── Tree layout types ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/OrgChart.tsx | 56 | // ── Layout algorithm ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/OrgChart.tsx | 160 | // ── Status dot colors (raw hex for SVG) ───────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/OrgChart.tsx | 174 | // ── Main component ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyExport.tsx | 359 | // ── Frontmatter card (export-specific: skill click support) ────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyExport.tsx | 404 | // ── Client-side README generation ──────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyExport.tsx | 502 | // ── Preview pane ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ui/src/pages/CompanyExport.tsx | 587 | // ── Main page ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/nux-phase4-screenshots.spec.ts | 60 | // ── Section A: create-company path (name → mission → hire) ──────────── | COMMENT |
| MEDIUM | tests/e2e/nux-phase4-screenshots.spec.ts | 92 | // ── Section B: front door + growth intake ───────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/nux-phase4-screenshots.spec.ts | 123 | // ── Section C: Conference Room (BoardChat) ──────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/nux-phase4-screenshots.spec.ts | 139 | // ── Section D: Artifacts ────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/plugin-routes-authz.test.ts | 966 | // ─── Agent JWT tool execution (cherry-picked from #5549) ───────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/plugin-routes-authz.test.ts | 966 | // ─── Agent JWT tool execution (cherry-picked from #5549) ───────────────────── | COMMENT |
| MEDIUM | …rc/__tests__/agents-adapter-config-user-secret.test.ts | 248 | // ── test-environment ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …rc/__tests__/agents-adapter-config-user-secret.test.ts | 371 | // ── claude-login ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 50 | // ── The exact allowlist ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 93 | // ── Documentation phrases ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 108 | // ── Command extraction ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 318 | // ── Repository walk ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 381 | // ── Backslash line continuation ─────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 486 | // ── The extraction and allowlist logic, in isolation ───────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 541 | // ── Fail closed on an ambiguous quote context before the marker ────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 703 | // ── Direct assertions on the runtime-generated instruction surfaces ────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 753 | // ── Runtime surfaces and their fixed literal lifecycle hints ───────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 813 | // ── The safe-invocation note ───────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/__tests__/cli-invocation-safety.test.ts | 848 | // ── Backslash line continuation ────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/adapters.ts | 644 | // ── POST /api/adapters/:type/reinstall ────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/adapters.ts | 714 | // ── GET /api/adapters/:type/config-schema ──────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/adapters.ts | 758 | // ── GET /api/adapters/:type/ui-parser.js ───────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/org-chart-svg.ts | 30 | // ── Style theme definitions ────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/routes/org-chart-svg.ts | 54 | // ── Role config with Twemoji SVG inlines (viewBox 0 0 36 36) ───── | COMMENT |
| MEDIUM | server/src/routes/org-chart-svg.ts | 159 | // ── Style themes ───────────────────────────────────────────────── | COMMENT |
| 150 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/src/App.activity-routing.test.tsx | 1 | // @vitest-environment jsdom | COMMENT |
| LOW | ui/src/App.cases-routing.test.tsx | 1 | // @vitest-environment jsdom | COMMENT |
| LOW | ui/src/context/SidebarContext.tsx | 21 | // True while a secondary sidebar forces the rail: the collapse is locked, so | COMMENT |
| LOW | ui/src/components/AttentionQueueRow.tsx | 161 | const compactActions = !isHidden ? collectCompactActions(item) : []; | COMMENT |
| LOW | ui/src/components/OnboardingWizardTheme.test.tsx | 1 | // @vitest-environment node | COMMENT |
| LOW | ui/src/components/OnboardingWizardTheme.test.tsx | 41 | // case for a hardcoded colour anywhere else in the wizard, reporting a | COMMENT |
| LOW | ui/src/components/TaskChatThread.tsx | 341 | ); | COMMENT |
| LOW | ui/src/components/TaskChatThread.tsx | 421 | // Anchored turns follow their run's reply comment; comment-less turns | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 221 | COMMENT | |
| LOW | ui/src/components/OnboardingWizard.tsx | 241 | // has no bearing on whether it is junk. | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 261 | // you do not own" and deletes it. | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 301 | // persist effect would overwrite the customer's own draft with defaults | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 461 | (saved?.createdProjectId as string) ?? null | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 481 | // Same shape for the hire. Greptile (round-3 PR): with "Test now" gone the | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 581 | COMMENT | |
| LOW | ui/src/components/OnboardingWizard.tsx | 601 | // that merely names the one already in hand - the wizard created it, | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 621 | // prevent, reached by a path it could not see. | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 1101 | } | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 1121 | // here with one meant nothing had been typed since. Hydration breaks | COMMENT |
| LOW | ui/src/components/OnboardingWizard.tsx | 1481 | } | COMMENT |
| LOW | ui/src/components/IssueLinkQuicklook.tsx | 301 | COMMENT | |
| LOW | ui/src/components/AgentConfigForm.tsx | 481 | // fixed `CLAUDE_CODE_OAUTH_TOKEN` binding as present. The form sends the claim | COMMENT |
| LOW | ui/src/components/AgentConfigForm.tsx | 601 | ); | COMMENT |
| LOW | ui/src/components/AgentConfigForm.tsx | 901 | // Test can be clicked before the settings query settles (or after it | COMMENT |
| LOW | ui/src/components/AgentConfigForm.tsx | 1001 | // session state clears with it. Hold `reset` in a ref so the effect does not | COMMENT |
| LOW | ui/src/components/AgentConfigForm.tsx | 2101 | {label} | COMMENT |
| LOW | ui/src/components/AgentConfigForm.tsx | 2321 | // route and the prompt route every two seconds. The server can leave a session | COMMENT |
| LOW | ui/src/components/AgentConfigForm.tsx | 2361 | // server `stored` state, the only success state. | COMMENT |
| LOW | ui/src/components/AgentConfigForm.tsx | 2461 | clearActiveSession(); | COMMENT |
| LOW | ui/src/components/transcript/useLiveRunTranscripts.ts | 21 | const LOG_POLL_INTERVAL_MS = 2000; | COMMENT |
| LOW | ui/src/components/issue-properties/IssueProperties.tsx | 201 | // flag OFF — including while settings load — renders the chat-style tab | COMMENT |
| LOW | …nvironment-variables-editor/ConvertToSecretPopover.tsx | 1 | // The "Store as secret" (convert) flow shares its form with the create flow; | COMMENT |
| LOW | ui/src/components/environment-variables-editor/Row.tsx | 481 | // anchored here. Those controls close by returning focus to | COMMENT |
| LOW | ui/src/hooks/useSignOut.ts | 61 | onSignedOut?.(); | COMMENT |
| LOW | ui/src/hooks/useSignOut.ts | 81 | // across the whole sign-out/sign-in cycle. Reset notifies them, so the | COMMENT |
| LOW | ui/src/lib/sentry.ts | 1 | // Optional Sentry error monitoring for the browser. | COMMENT |
| LOW | ui/src/lib/sentry.ts | 21 | // chain (`enqueue`) instead of running at once. One operation runs at a | COMMENT |
| LOW | ui/src/lib/sentry.ts | 101 | // Read the client before detaching it. The scope holds no client after | COMMENT |
| LOW | ui/src/lib/status-colors.ts | 201 | // Softer, full-width banner surface derived from the same brand hue anchors as | COMMENT |
| LOW | ui/src/lib/status-colors.ts | 321 | // unknown → backlog hue (muted, dashed circle) | COMMENT |
| LOW | ui/src/lib/attention.ts | 81 | COMMENT | |
| LOW | ui/src/pages/Dashboard.tsx | 121 | // out of signup. | COMMENT |
| LOW | ui/src/pages/IssueDetail.test.tsx | 1381 | // React Query returns a new mutation result object on render. The panel | COMMENT |
| LOW | ui/src/pages/InviteLanding.test.tsx | 761 | COMMENT | |
| LOW | ui/src/pages/InviteLanding.tsx | 241 | // account, so another account's list is unreachable rather than merely | COMMENT |
| LOW | evals/promptfoo/promptfooconfig.yaml | 1 | # yaml-language-server: $schema=https://promptfoo.dev/config-schema.json | COMMENT |
| LOW | docker/docker-compose.quickstart.yml | 1 | # Quickstart: single-container Paperclip with embedded database. | COMMENT |
| LOW | server/vitest.config.ts | 21 | // graceful shutdown can occasionally cross vitest's default 10s hookTimeout, | COMMENT |
| LOW | server/src/sentry.ts | 1 | // Optional Sentry error monitoring for the server process. | COMMENT |
| LOW | server/src/sentry.ts | 21 | // - `Console` turns a `console.*` call into a breadcrumb with the raw | COMMENT |
| LOW | server/src/agent-auth-jwt.ts | 41 | if (!secret) return null; | COMMENT |
| LOW | server/src/agent-auth-jwt.ts | 181 | const signingInput = `${headerB64}.${claimsB64}`; | COMMENT |
| LOW | server/src/app.ts | 441 | // every client request (SR-7). This complements the allowlist for managed | COMMENT |
| LOW | server/src/app.ts | 881 | // (pluginLifecycleManager(db, { workerManager }) — no `loader` option), so | COMMENT |
| LOW | server/src/index.ts | 781 | logger.error({ err, backupDir: config.databaseBackupDir, trigger }, `${label} database backup failed`); | COMMENT |
| LOW | server/src/index.ts | 1121 | // provider sandbox costs money whether or not the instance schedules | COMMENT |
| LOW | server/src/instrumentation.ts | 1 | // Optional OpenTelemetry auto-instrumentation for HTTP / Express / PG / … | COMMENT |
| LOW | server/src/instrumentation.ts | 21 | // logs one diagnostic and leaves the server running without tracing; it | COMMENT |
| LOW | server/src/instrumentation.ts | 541 | new Promise<void>((_, reject) => { | COMMENT |
| LOW | server/src/middleware/trust-proxy.ts | 41 | // | COMMENT |
| 290 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/signoff-policy.spec.ts | 417 | // Step 1: Executor marks done → should route to reviewer | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 435 | // Step 2: Navigate to issue in UI and verify execution label | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 439 | // Step 3: Reviewer approves → should route to approver | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 453 | // Step 4: Verify UI shows approval pending | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 457 | // Step 5: Approver approves → should complete | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 71 | // Step 0: front door (skipped when the wizard opens on the create path). | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 75 | // Step 1: company name. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 81 | // Step 3: name the agent. The role picker is gone — the arc asks for a | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 87 | // Step 4: adapter (claude_local default); heartbeat is intercepted. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 90 | // Step 5: review → Get started creates the first task and opens its | COMMENT |
| LOW⚡ | tests/release-smoke/docker-auth-onboarding.spec.ts | 95 | // Step 1: name the organization. "Continue" creates the company itself and | COMMENT |
| LOW⚡ | tests/release-smoke/docker-auth-onboarding.spec.ts | 102 | // Step 3: name the team lead. The name is the step's only question and it | COMMENT |
| LOW⚡ | tests/release-smoke/docker-auth-onboarding.spec.ts | 112 | // Step 4: keep the default adapter and connect (hire) the lead. Connect | COMMENT |
| LOW | tests/release-smoke/docker-auth-onboarding.spec.ts | 126 | // Step 5: review, then launch. "Get started" provisions the onboarding | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 33 | ### Step 1: Gather Context | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 40 | ### Step 2: Interview (Use AskUserQuestion) | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 88 | ### Step 3: Read the Spec | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 100 | ### Step 4: Generate the Package | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 159 | ### Step 5: Confirm Output Location | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 167 | ### Step 6: Write README.md and LICENSE | COMMENT |
| LOW | .agents/skills/company-creator/SKILL.md | 180 | ### Step 7: Write Files and Summarize | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 26 | ## Step 0: Fetch the Advisory Details | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 37 | ## Step 1: Acknowledge the Report | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 47 | ## Step 2: Create the Temporary Private Fork | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 78 | ## Step 3: Develop and Validate the Fix | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 103 | ## Step 4: Coordinate with the Reporter | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 111 | ## Step 5: Request a CVE | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 123 | ## Step 6: Publish Everything Simultaneously | COMMENT |
| LOW | .agents/skills/deal-with-security-advisory/SKILL.md | 208 | ## Step 7: Post-Publication Verification | COMMENT |
| LOW⚡ | server/src/routes/access.ts | 1965 | ## Step 2: Wait for board approval | COMMENT |
| LOW⚡ | server/src/routes/access.ts | 1968 | ## Step 3: Claim API key (one-time) | COMMENT |
| LOW | server/src/routes/access.ts | 1891 | ## Step 1: Submit agent join request | COMMENT |
| LOW | server/src/routes/access.ts | 1985 | ## Step 4: Install Paperclip skill | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2700 | // Step 1: Resolve the plugin | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2707 | // Step 2: Validate the plugin is in 'ready' state | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2715 | // Step 3: Validate the plugin has webhooks.receive capability | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2775 | // Step 7: Dispatch to the worker via handleWebhook RPC | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2785 | // Step 8: Update delivery record to success | COMMENT |
| LOW | server/src/routes/plugins.ts | 2730 | // Step 4: Validate the endpointKey exists in the manifest's webhook declarations | COMMENT |
| LOW | server/src/routes/plugins.ts | 2742 | // Step 5: Extract request data | COMMENT |
| LOW | server/src/routes/plugins.ts | 2761 | // Step 6: Record the delivery in the database | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 246 | // Step 1: Look up the plugin | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 268 | // Step 2: Verify the plugin is ready and has UI declared | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 407 | // Step 3: Resolve the plugin's UI directory | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 424 | // Step 4: Resolve the requested file path and prevent traversal (including symlinks) | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 427 | // Step 5: Check that the file exists and is a regular file | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 459 | // Step 6: Determine cache strategy based on filename | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 463 | // Step 7: Set cache headers | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 481 | // Step 8: Set Content-Type | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 488 | // Step 9: Set CORS headers (plugin UI may be loaded from different origin in dev) | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 491 | // Step 10: Send the file | COMMENT |
| LOW⚡ | server/src/services/plugin-worker-manager.ts | 3259 | // Step 2: Send SIGTERM and wait | COMMENT |
| LOW⚡ | server/src/services/plugin-worker-manager.ts | 3268 | // Step 3: Forcefully kill with SIGKILL | COMMENT |
| LOW | server/src/services/plugin-worker-manager.ts | 3235 | // Step 1: Send shutdown RPC and wait for the worker to exit gracefully. | COMMENT |
| LOW⚡ | server/src/services/environment-run-orchestrator.ts | 282 | // Step 1: Resolve environment | COMMENT |
| LOW⚡ | server/src/services/environment-run-orchestrator.ts | 289 | // Step 2: Acquire lease | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 301 | // Step 3: Log lease acquisition activity | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 323 | // Step 4: Resolve execution transport | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 379 | // Step 1: Build workspace realization request | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 392 | // Step 2: Realize workspace in the environment via the runtime driver | COMMENT |
| 63 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 1009 | const uploadCall = sandbox.fs.uploadFile.mock.calls.find( | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 1880 | const snapshotCalls = sandbox.process.getSessionCommandLogs.mock.calls.filter( | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 3460 | const mvCall = sandbox.process.executeCommand.mock.calls.find(([cmd]) => String(cmd).includes("mv -f")); | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 3861 | const mkdirCall = sandbox.process.executeCommand.mock.calls.find( | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 3869 | const extractCall = sandbox.process.executeCommand.mock.calls.find(([cmd]) => String(cmd).includes("tar -xf")); | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4002 | const guardCall = sandbox.process.executeCommand.mock.calls.find( | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4159 | const cleanupCall = sandbox.process.executeCommand.mock.calls.find( | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4397 | sandbox.process.executeCommand.mock.calls.find(([c]) => c === cmd); | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4403 | const idx = sandbox.process.executeCommand.mock.calls.findIndex(([c]) => c === cmd); | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4452 | sandbox.process.executeCommand.mock.calls.some(([c]) => c === "should-not-run"), | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4499 | const mvCalls = sandbox.process.executeCommand.mock.calls.filter(([cmd]) => | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4507 | const idx = sandbox.process.executeCommand.mock.calls.findIndex(([c]) => c === cmd); | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4567 | sandbox.process.executeCommand.mock.calls.some(([c]) => c === cmd); | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4648 | const destinations = sandbox.fs.uploadFiles.mock.calls.flatMap( | CODE |
| CRITICAL | …s/plugins/sandbox-providers/daytona/src/plugin.test.ts | 4688 | const sources = sandbox.fs.downloadFiles.mock.calls.flatMap( | CODE |
| CRITICAL | …kages/plugins/sandbox-providers/e2b/src/plugin.test.ts | 306 | const stdinCall = sandbox.commands.run.mock.calls.find(([cmd]: [string]) => cmd.includes("'printf'")); | CODE |
| CRITICAL | …kages/plugins/sandbox-providers/e2b/src/plugin.test.ts | 363 | const fgCall = sandbox.commands.run.mock.calls.find(([cmd]: [string]) => cmd.includes("'printf'")); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/signoff-policy.spec.ts | 417 | // Step 1: Executor marks done → should route to reviewer | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 435 | // Step 2: Navigate to issue in UI and verify execution label | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 439 | // Step 3: Reviewer approves → should route to approver | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 453 | // Step 4: Verify UI shows approval pending | COMMENT |
| LOW⚡ | tests/e2e/signoff-policy.spec.ts | 457 | // Step 5: Approver approves → should complete | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 71 | // Step 0: front door (skipped when the wizard opens on the create path). | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 75 | // Step 1: company name. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 81 | // Step 3: name the agent. The role picker is gone — the arc asks for a | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 87 | // Step 4: adapter (claude_local default); heartbeat is intercepted. | COMMENT |
| LOW⚡ | tests/e2e/conference-room-typing-intro.spec.ts | 90 | // Step 5: review → Get started creates the first task and opens its | COMMENT |
| LOW⚡ | tests/release-smoke/docker-auth-onboarding.spec.ts | 95 | // Step 1: name the organization. "Continue" creates the company itself and | COMMENT |
| LOW⚡ | tests/release-smoke/docker-auth-onboarding.spec.ts | 102 | // Step 3: name the team lead. The name is the step's only question and it | COMMENT |
| LOW⚡ | tests/release-smoke/docker-auth-onboarding.spec.ts | 112 | // Step 4: keep the default adapter and connect (hire) the lead. Connect | COMMENT |
| LOW | tests/release-smoke/docker-auth-onboarding.spec.ts | 126 | // Step 5: review, then launch. "Get started" provisions the onboarding | COMMENT |
| LOW⚡ | server/src/routes/access.ts | 1965 | ## Step 2: Wait for board approval | COMMENT |
| LOW⚡ | server/src/routes/access.ts | 1968 | ## Step 3: Claim API key (one-time) | COMMENT |
| LOW | server/src/routes/access.ts | 1891 | ## Step 1: Submit agent join request | COMMENT |
| LOW | server/src/routes/access.ts | 1985 | ## Step 4: Install Paperclip skill | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2700 | // Step 1: Resolve the plugin | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2707 | // Step 2: Validate the plugin is in 'ready' state | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2715 | // Step 3: Validate the plugin has webhooks.receive capability | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2775 | // Step 7: Dispatch to the worker via handleWebhook RPC | COMMENT |
| LOW⚡ | server/src/routes/plugins.ts | 2785 | // Step 8: Update delivery record to success | COMMENT |
| LOW | server/src/routes/plugins.ts | 2730 | // Step 4: Validate the endpointKey exists in the manifest's webhook declarations | COMMENT |
| LOW | server/src/routes/plugins.ts | 2742 | // Step 5: Extract request data | COMMENT |
| LOW | server/src/routes/plugins.ts | 2761 | // Step 6: Record the delivery in the database | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 246 | // Step 1: Look up the plugin | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 268 | // Step 2: Verify the plugin is ready and has UI declared | COMMENT |
| LOW | server/src/routes/plugin-ui-static.ts | 407 | // Step 3: Resolve the plugin's UI directory | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 424 | // Step 4: Resolve the requested file path and prevent traversal (including symlinks) | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 427 | // Step 5: Check that the file exists and is a regular file | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 459 | // Step 6: Determine cache strategy based on filename | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 463 | // Step 7: Set cache headers | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 481 | // Step 8: Set Content-Type | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 488 | // Step 9: Set CORS headers (plugin UI may be loaded from different origin in dev) | COMMENT |
| LOW⚡ | server/src/routes/plugin-ui-static.ts | 491 | // Step 10: Send the file | COMMENT |
| LOW⚡ | server/src/services/plugin-worker-manager.ts | 3259 | // Step 2: Send SIGTERM and wait | COMMENT |
| LOW⚡ | server/src/services/plugin-worker-manager.ts | 3268 | // Step 3: Forcefully kill with SIGKILL | COMMENT |
| LOW | server/src/services/plugin-worker-manager.ts | 3235 | // Step 1: Send shutdown RPC and wait for the worker to exit gracefully. | COMMENT |
| LOW⚡ | server/src/services/environment-run-orchestrator.ts | 282 | // Step 1: Resolve environment | COMMENT |
| LOW⚡ | server/src/services/environment-run-orchestrator.ts | 289 | // Step 2: Acquire lease | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 301 | // Step 3: Log lease acquisition activity | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 323 | // Step 4: Resolve execution transport | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 379 | // Step 1: Build workspace realization request | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 392 | // Step 2: Realize workspace in the environment via the runtime driver | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 495 | // Step 3: Persist realization metadata on lease and execution workspace | COMMENT |
| LOW | server/src/services/environment-run-orchestrator.ts | 519 | // Step 4: Resolve execution target for the adapter | COMMENT |
| LOW | server/src/services/plugin-tool-dispatcher.ts | 330 | // Step 1: Load tools from all currently-ready plugins | COMMENT |
| LOW | server/src/services/plugin-tool-dispatcher.ts | 350 | // Step 2: Subscribe to lifecycle events for dynamic updates | COMMENT |
| LOW⚡ | server/src/services/plugin-loader.ts | 1288 | // Step 4: Reject incompatible plugin API versions | COMMENT |
| LOW⚡ | server/src/services/plugin-loader.ts | 1296 | // Step 5: Validate manifest capabilities are consistent | COMMENT |
| LOW | server/src/services/plugin-loader.ts | 1267 | // Step 3: Read and validate plugin manifest | COMMENT |
| LOW | server/src/services/plugin-loader.ts | 1307 | // Step 6: Reject plugins that require a newer host than the running server | COMMENT |
| LOW | server/src/services/plugin-loader.ts | 1715 | // Step 6: Persist install record and apply plugin-owned schema migrations | COMMENT |
| LOW | server/src/services/setup-token-transport-binding.ts | 202 | // Step 1: lock and conditionally transition the exact durable row to | COMMENT |
| LOW | server/src/services/setup-token-transport-binding.ts | 217 | // Step 2: write or rotate the secret on the same transaction handle. A | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/storybook/stories/apps-connect-name.stories.tsx | 57 | (i) => i.getAttribute("placeholder") === "My app", | CODE |
| LOW | ui/src/App.test.tsx | 106 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 109 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 129 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 132 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 180 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/App.test.tsx | 217 | user: { id: "user-1", email: "user@example.com", name: "User", image: null }, | CODE |
| LOW | ui/src/plugins/slots.tsx | 772 | missingBehavior?: "hidden" | "placeholder"; | CODE |
| LOW | ui/src/plugins/slots.tsx | 893 | missingBehavior?: "hidden" | "placeholder"; | CODE |
| LOW | ui/src/plugins/slots.test.ts | 74 | missingBehavior: "placeholder", | CODE |
| LOW | ui/src/components/CommentThread.tsx | 379 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/CommentThread.tsx | 414 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/SidebarProjects.tsx | 219 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/IssueProperties.test.tsx | 2371 | const textInput = inputs.find((input) => input.getAttribute("placeholder") === "What should the agent re-check?"); | CODE |
| LOW | ui/src/components/IssueProperties.test.tsx | 2575 | .find((node) => node.getAttribute("placeholder")?.includes("watchdog")); | CODE |
| LOW | ui/src/components/Layout.tsx | 189 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/Sidebar.tsx | 261 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/components/Sidebar.tsx | 291 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/IssueDetail.tsx | 4931 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/IssueDetail.tsx | 4958 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/IssueDetail.tsx | 5465 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ExecutionWorkspaceDetail.tsx | 1186 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ExecutionWorkspaceDetail.tsx | 1683 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ProjectDetail.tsx | 860 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ProjectDetail.tsx | 973 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/PluginSettings.tsx | 252 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/ProjectWorkspaceDetail.tsx | 748 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/CompanySettingsPluginPage.tsx | 86 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/PluginPage.tsx | 182 | missingBehavior="placeholder" | CODE |
| LOW | ui/src/pages/apps/AppsConnect.test.tsx | 122 | ).find((i) => i.getAttribute("placeholder")?.startsWith("https://")); | CODE |
| LOW | ui/src/pages/apps/AppsConnect.test.tsx | 201 | (i) => i.getAttribute("placeholder") === "My app", | CODE |
| LOW | ui/src/pages/apps/AppsConnect.test.tsx | 613 | ).find((i) => i.getAttribute("placeholder")?.startsWith("https://")); | CODE |
| LOW | ui/src/pages/apps/AppsConnect.test.tsx | 794 | i.getAttribute("placeholder")?.startsWith("https://example.com/actions"), | CODE |
| LOW | ui/src/pages/apps/AppsConnect.test.tsx | 797 | expect(linkInput?.getAttribute("placeholder")).toBe("https://example.com/actions"); | CODE |
| LOW | ui/src/pages/apps/AppsConnect.test.tsx | 810 | (i) => i.getAttribute("placeholder") === "My app", | CODE |
| LOW | ui/src/pages/apps/AppsConnect.test.tsx | 877 | (i) => i.getAttribute("placeholder") === "My app", | CODE |
| LOW | …r/src/__tests__/workspace-login-handoff-issuer.test.ts | 276 | stubDb({ adminRows: [{ id: "admin-1", email: "admin@example.com", createdAt: new Date(0) }] }), | CODE |
| LOW | …r/src/__tests__/workspace-login-handoff-issuer.test.ts | 279 | ).resolves.toEqual({ userId: "admin-1", email: "admin@example.com" }); | CODE |
| LOW | server/src/__tests__/auth-session-route.test.ts | 52 | email: "user@example.com", | CODE |
| LOW | server/src/__tests__/auth-session-route.test.ts | 68 | userEmail: "user@example.com", | CODE |
| LOW | …/src/__tests__/codex-local-adapter-environment.test.ts | 54 | JSON.stringify({ accessToken: "fake-token", accountId: "acct-1" }), | CODE |
| LOW | server/src/__tests__/redact-sensitive.test.ts | 6 | const body = { email: "user@example.com", password: "founding6gomez6croaking" }; | CODE |
| LOW | server/src/__tests__/redact-sensitive.test.ts | 10 | expect(out.email).toBe("user@example.com"); | CODE |
| LOW | server/src/__tests__/redact-sensitive.test.ts | 52 | user: { email: "user@example.com", password: "secret-pass" }, | CODE |
| LOW | server/src/__tests__/redact-sensitive.test.ts | 56 | expect((out.user as Record<string, unknown>).email).toBe("user@example.com"); | CODE |
| LOW | server/src/__tests__/work-timeline-service.test.ts | 92 | email: "user@example.com", | CODE |
| LOW | server/src/__tests__/cli-auth-routes.test.ts | 212 | user: { id: "user-1", name: "User One", email: "user@example.com" }, | CODE |
| LOW | …runner/runner/crates/runner-core/src/codex_provider.rs | 634 | "placeholder": "Enter another answer", | CODE |
| LOW | …rclip-runner/protocol/schemas/question-set.schema.json | 36 | "placeholder": { "type": "string", "maxLength": 1000 } | CODE |
| LOW | …box-providers/kubernetes/test/unit/kube-client.test.ts | 22 | token: fake-token | CODE |
| LOW | packages/plugins/create-paperclip-plugin/README.md | 17 | --author "Acme Inc" | CODE |
| LOW | packages/shared/src/app-definitions/anthropic.json | 36 | "placeholder": "sk-ant-api03-...", | CODE |
| LOW | packages/shared/src/app-definitions/oauth-generic.json | 33 | "placeholder": "Paste the client ID", | CODE |
| LOW | packages/shared/src/app-definitions/oauth-generic.json | 41 | "placeholder": "Paste the client secret", | CODE |
| LOW | …ckages/shared/src/app-definitions/api-key-generic.json | 32 | "placeholder": "Paste the API key", | CODE |
| LOW | packages/shared/src/app-definitions/github.json | 36 | "placeholder": "github_pat_...", | CODE |
| LOW | packages/shared/src/app-definitions/zapier.json | 36 | "placeholder": "Paste your Zapier token", | CODE |
| LOW | packages/shared/src/validators/app-definition.ts | 3 | const field=z.object({key:z.string().min(1),label:z.string().min(1),type:z.enum(["text","password","textarea","datetime" | CODE |
| LOW | packages/db/src/client.test.ts | 258 | VALUES ('user-1', 'User One', 'user@example.com', true, now(), now()) | CODE |
| LOW | doc/plans/2026-02-18-agent-authentication.md | 126 | "name": "Acme Corp" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .agents/skills/paperclip-create-plugin/SKILL.md | 40 | ## 3. CLI-first scaffold workflow | COMMENT |
| MEDIUM | .agents/skills/paperclip-create-plugin/SKILL.md | 92 | ## 5. After scaffolding, sanity-check the package | COMMENT |
| MEDIUM | packages/plugins/create-paperclip-plugin/README.md | 44 | ## Workflow after scaffolding | COMMENT |
| MEDIUM | …bundled/paperclip-operations/reflection-coach/SKILL.md | 48 | ## Hard guardrails | COMMENT |
| MEDIUM | …bundled/paperclip-operations/reflection-coach/SKILL.md | 86 | ### 3) Read the target's current guardrails | COMMENT |
| MEDIUM | doc/plans/2026-04-08-agent-os-technical-report.md | 219 | ### 1. Its built-in orchestration primitives overlap the wrong layer | COMMENT |
| MEDIUM | doc/plans/2026-02-21-humans-and-permissions.md | 331 | ## Phase 1: Mode and guardrails | COMMENT |
| MEDIUM | …ans/2026-03-10-workspace-strategy-and-git-worktrees.md | 624 | ### 11. Runtime service orchestration | COMMENT |
| MEDIUM | doc/plugins/ideas-from-opencode.md | 429 | ## 3. Prefer event-driven extensions over core-logic mutation | COMMENT |
| MEDIUM | …perclip-create-agent/references/baseline-role-guide.md | 128 | ## Minimal scaffold | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ui/storybook/stories/skills-store-detail.stories.tsx | 22 | markdown: "# deep-research\n\nResearch harness.", | CODE |
| MEDIUM | …er/src/__tests__/execution-lock-orphan-cleanup.test.ts | 269 | // make us robust against it. | COMMENT |
| MEDIUM | server/src/__tests__/helpers/wake-message.ts | 5 | // them robust to serialization formatting/key-order changes. | COMMENT |
| MEDIUM | …es/plugins/plugin-llm-wiki/tests/screenshots/entry.tsx | 5 | if (!container) throw new Error("No #root in harness host"); | CODE |
| MEDIUM | .github/workflows/release-smoke.yml | 104 | # Fixed here rather than read back out of the harness, so the `always()` | COMMENT |
| MEDIUM | .github/workflows/release-smoke.yml | 169 | # harness already tore the container down it wrote this file on its | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | evals/promptfoo/promptfooconfig.yaml | 8 | # Usage: | COMMENT |
| LOW | scripts/build-npm.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/kill-agent-browsers.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/kill-workspaces.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/kill-dev.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/kill-vitest.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/backup-db.sh | 7 | # Usage: | COMMENT |