A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
This report presents the forensic synthetic code analysis of qwibitai/nanoclaw, a TypeScript project with 30,231 GitHub stars. SynthScan v2.0 examined 101,370 lines of code across 610 source files, recording 219 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 3.6 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 219 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | nanoclaw.sh | 28 | # ─── --uninstall: short-circuit before any setup work ────────────────── | COMMENT |
| MEDIUM | nanoclaw.sh | 78 | # ─── log helpers ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | nanoclaw.sh | 137 | # ─── bash-side "clack-alike" status line ──────────────────────────────── | COMMENT |
| MEDIUM | nanoclaw.sh | 163 | # ─── fresh-run setup ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | nanoclaw.sh | 178 | # ─── pre-flight: minimum hardware specs ──────────────────────────────── | COMMENT |
| MEDIUM | nanoclaw.sh | 228 | # ─── pre-flight: Google Cloud VM warning (Linux) ────────────────────── | COMMENT |
| MEDIUM | nanoclaw.sh | 255 | # ─── pre-flight: root user warning (Linux) ──────────────────────────── | COMMENT |
| MEDIUM | nanoclaw.sh | 288 | # ─── pre-flight: Homebrew on macOS ───────────────────────────────────── | COMMENT |
| MEDIUM | nanoclaw.sh | 336 | # ─── first step: install the basics (Node + pnpm + native modules) ───── | COMMENT |
| MEDIUM | nanoclaw.sh | 389 | # ─── hand off to setup:auto ──────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 111 | # ─── output helpers ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 131 | # ─── init logs ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 145 | # ─── phase 0a: bootstrap prerequisites ────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 192 | # ─── phase 0b: find v1 install ────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 241 | # ─── phase 0c: validate v1 DB ─────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 277 | # ─── run_step helper ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 324 | # ─── phase 1: core state ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 353 | # ─── phase 2: channels (interactive) ──────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 427 | # ─── phase 3: infrastructure ──────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 556 | # ─── service switchover ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 681 | # ─── phase 4: handoff ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | migrate-v2.sh | 736 | # ─── hand off to Claude ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | setup/auto.ts | 727 | // ─── first-chat step ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | setup/auto.ts | 834 | // ─── auth step (select → branch) ──────────────────────────────────────── | COMMENT |
| MEDIUM | setup/auto.ts | 1128 | // ─── timezone step ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | setup/auto.ts | 1254 | // ─── prompts owned by the sequencer ──────────────────────────────────── | COMMENT |
| MEDIUM | setup/auto.ts | 1340 | // ─── interactive / env helpers ───────────────────────────────────────── | COMMENT |
| MEDIUM | setup/auto.ts | 1436 | // ─── intro + progression-log init ────────────────────────────────────── | COMMENT |
| MEDIUM | setup/migrate-v2/shared.ts | 5 | // ── JID parsing ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | setup/migrate-v2/shared.ts | 98 | // ── Trigger mapping ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | setup/migrate-v2/shared.ts | 128 | // ── ID generation ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | setup/migrate-v2/shared.ts | 134 | // ── Channel auth registry ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | setup/lib/setup-config.ts | 171 | // ─── name derivation ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docs/ollama.md | 15 | │ http://host.docker. │ ┌──────────────────┐ | CODE |
| MEDIUM | src/host-sweep.test.ts | 158 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/host-sweep.test.ts | 169 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup/environment.ts | 61 | export function detectExistingDisplayName(projectRoot: string): string | null { | CODE |
| LOW | setup/onecli.ts | 123 | function removeLegacyOnecliContainers(): string { | CODE |
| LOW | setup/lib/captured-token.ts | 40 | function normalizeCapturedTerminalOutput(raw: string): string { | CODE |
| LOW | …aude/skills/migrate-from-openclaw/scripts/transform.ts | 296 | export function approximateIntervalAsCron(everyMs: number): string | null { | CODE |
| LOW | …redential-proxy/native-credential-proxy-wiring.test.ts | 35 | function isSpreadPushOfCredentialArgs(node: ts.Node): boolean { | CODE |
| LOW | docs/SPEC.md | 154 | export function getRegisteredChannelNames(): string[] { | CODE |
| LOW | container/agent-runner/src/poll-loop.ts | 310 | function formatMessagesWithCommands(messages: MessageInRow[], nativeSlashCommands: boolean): string { | CODE |
| LOW | container/agent-runner/src/destinations.ts | 84 | export function buildSystemPromptAddendum(assistantName?: string, mode: SessionMode = { kind: 'chat' }): string { | CODE |
| LOW | container/agent-runner/src/db/session-state.ts | 52 | export function migrateLegacyContinuation(providerName: string): string | undefined { | CODE |
| LOW | container/agent-runner/src/db/connection.ts | 140 | export function clearContainerToolInFlight(): void { | CODE |
| LOW | src/router.ts | 126 | export function registerMessageInterceptor(fn: MessageInterceptorFn): void { | CODE |
| LOW | src/host-sweep.ts | 284 | function enforceRunningContainerSla( | CODE |
| LOW | src/container-restart.ts | 22 | export function restartAgentGroupContainers(agentGroupId: string, reason: string, wakeMessage?: string): number { | CODE |
| LOW | src/claude-md-compose.ts | 170 | export function migrateGroupsToClaudeLocal(): void { | CODE |
| LOW | src/container-runtime.ts | 37 | export function ensureContainerRuntimeRunning(): void { | CODE |
| LOW | src/container-runner.ts | 248 | function resolveProviderContribution( | CODE |
| LOW | src/group-skills.ts | 40 | export function materializeTemplateSkills(agentGroupId: string, destSkillsDir: string): void { | CODE |
| LOW | src/delivery.ts | 486 | export function reenterGuardedDeliveryAction(action: string) { | CODE |
| LOW | src/providers/provider-container-registry.ts | 81 | export function registerProviderContainerConfig( | CODE |
| LOW⚡ | src/providers/provider-container-registry.ts | 92 | export function getProviderContainerConfig(name: string): ProviderContainerConfigFn | undefined { | CODE |
| LOW⚡ | src/providers/provider-container-registry.ts | 101 | export function providerProvidesAgentSurfaces(name: string | null | undefined): boolean { | CODE |
| LOW⚡ | src/providers/provider-container-registry.ts | 106 | export function listProviderContainerConfigNames(): string[] { | CODE |
| LOW | src/cli/resources/destinations.ts | 20 | export async function projectDestinationsToSessions(agentGroupId: string): Promise<void> { | CODE |
| LOW | src/cli/commands/help.ts | 72 | export function registerResourceHelpCommands(): void { | CODE |
| LOW | src/db/session-db.ts | 214 | export function deleteOrphanProcessingClaims(outDb: Database.Database): number { | CODE |
| LOW | src/db/session-db.ts | 343 | export function getInboundSourceSessionId(db: Database.Database, messageId: string): string | null { | CODE |
| LOW | src/db/session-db.ts | 361 | export function getMostRecentPeerSourceSessionId(db: Database.Database, peerAgentGroupId: string): string | null { | CODE |
| LOW | src/db/container-configs.ts | 76 | export function updateContainerConfigScalars( | CODE |
| LOW | src/db/container-configs.ts | 106 | export function updateContainerConfigJson( | CODE |
| LOW | src/db/sessions.ts | 231 | export function updatePendingApprovalStatus(approvalId: string, status: PendingApproval['status']): void { | CODE |
| LOW | src/db/sessions.ts | 242 | export function markApprovalAwaitingReason(approvalId: string, expiresAt: string): void { | CODE |
| LOW | src/db/sessions.ts | 249 | export function getExpiredAwaitingReasonApprovals(nowIso: string): PendingApproval[] { | CODE |
| LOW | src/db/sessions.ts | 261 | export function getPendingApprovalsByAction(action: string): PendingApproval[] { | CODE |
| LOW | src/db/messaging-groups.ts | 44 | export function getMessagingGroupByPlatform( | CODE |
| LOW | src/db/messaging-groups.ts | 84 | export function getMessagingGroupWithAgentCount( | CODE |
| LOW | src/db/messaging-groups.ts | 113 | export function getMessagingGroupsByChannel(channelType: string): MessagingGroup[] { | CODE |
| LOW | src/db/messaging-groups.ts | 151 | export function setMessagingGroupDeniedAt(id: string, deniedAt: string | null): void { | CODE |
| LOW | src/db/messaging-groups.ts | 170 | export function createMessagingGroupAgent(mga: MessagingGroupAgent): void { | CODE |
| LOW | src/db/messaging-groups.ts | 213 | export function ensureAgentDestinationForWiring(mga: MessagingGroupAgent): void { | CODE |
| LOW | src/db/messaging-groups.ts | 248 | export function getMessagingGroupAgentByPair( | CODE |
| LOW | src/db/messaging-groups.ts | 263 | export function updateMessagingGroupAgent( | CODE |
| LOW | src/db/messaging-groups.ts | 288 | export function deleteMessagingGroupAgent(id: string): void { | CODE |
| LOW | src/db/messaging-groups.ts | 293 | export function getMessagingGroupsByAgentGroup(agentGroupId: string): MessagingGroup[] { | CODE |
| LOW | src/modules/mount-security/index.ts | 411 | export function generateAllowlistTemplate(): string { | CODE |
| LOW | src/modules/self-mod/request.ts | 58 | export async function requestInstallPackagesHold(content: Record<string, unknown>, session: Session): Promise<void> { | CODE |
| LOW | src/modules/permissions/channel-approval.ts | 81 | function visibleAgentGroupsForApprover( | CODE |
| LOW | src/modules/permissions/channel-approval.ts | 293 | export function buildAgentSelectionOptions( | CODE |
| LOW | src/modules/permissions/index.ts | 235 | async function handleSenderApprovalResponse(payload: ResponsePayload): Promise<boolean> { | CODE |
| LOW | src/modules/permissions/index.ts | 418 | async function handleChannelApprovalResponse(payload: ResponsePayload): Promise<boolean> { | CODE |
| LOW | src/modules/permissions/db/pending-channel-approvals.ts | 26 | export function createPendingChannelApproval(row: PendingChannelApproval): void { | CODE |
| LOW⚡ | src/modules/permissions/db/pending-channel-approvals.ts | 41 | export function getPendingChannelApproval(messagingGroupId: string): PendingChannelApproval | undefined { | CODE |
| LOW⚡ | src/modules/permissions/db/pending-channel-approvals.ts | 47 | export function hasInFlightChannelApproval(messagingGroupId: string): boolean { | CODE |
| LOW⚡ | src/modules/permissions/db/pending-channel-approvals.ts | 54 | export function updatePendingChannelApprovalCard(messagingGroupId: string, title: string, optionsJson: string): void { | CODE |
| LOW⚡ | src/modules/permissions/db/pending-channel-approvals.ts | 60 | export function deletePendingChannelApproval(messagingGroupId: string): void { | CODE |
| LOW | src/modules/permissions/db/pending-sender-approvals.ts | 28 | export function createPendingSenderApproval(row: PendingSenderApproval): void { | CODE |
| LOW | src/modules/permissions/db/pending-sender-approvals.ts | 51 | export function hasInFlightSenderApproval(messagingGroupId: string, senderIdentity: string): boolean { | CODE |
| LOW | src/modules/permissions/db/pending-sender-approvals.ts | 58 | export function deletePendingSenderApproval(id: string): void { | CODE |
| LOW | src/modules/agent-to-agent/db/agent-destinations.ts | 115 | export function deleteAllDestinationsTouching(agentGroupId: string): void { | CODE |
| LOW | src/modules/agent-to-agent/db/agent-destinations.ts | 129 | export function getDestinationReferencers(targetAgentGroupId: string): string[] { | CODE |
| LOW | src/modules/typing/index.ts | 173 | export function pauseTypingRefreshAfterDelivery(sessionId: string): void { | CODE |
| 12 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/qodo-pr-resolver/SKILL.md | 61 | ### Step 0: Check code push status | COMMENT |
| LOW⚡ | .claude/skills/qodo-pr-resolver/SKILL.md | 88 | ### Step 1: Detect git provider | COMMENT |
| LOW⚡ | .claude/skills/qodo-pr-resolver/SKILL.md | 94 | ### Step 2: Find the open PR/MR | COMMENT |
| LOW⚡ | .claude/skills/qodo-pr-resolver/SKILL.md | 100 | ### Step 3: Get Qodo review comments | COMMENT |
| LOW | .claude/skills/qodo-pr-resolver/SKILL.md | 130 | ### Step 4: Parse and display the issues | COMMENT |
| LOW | .claude/skills/qodo-pr-resolver/SKILL.md | 185 | ### Step 5: Ask user for fix preference | COMMENT |
| LOW | .claude/skills/qodo-pr-resolver/SKILL.md | 199 | ### Step 6: Review and fix issues (manual mode) | COMMENT |
| LOW | .claude/skills/qodo-pr-resolver/SKILL.md | 243 | ### Step 7: Auto-fix mode | COMMENT |
| LOW | .claude/skills/qodo-pr-resolver/SKILL.md | 261 | ### Step 8: Post summary to PR/MR | COMMENT |
| LOW | .claude/skills/qodo-pr-resolver/SKILL.md | 275 | ### Step 9: Push to remote | COMMENT |
| LOW⚡ | .claude/skills/get-qodo-rules/SKILL.md | 41 | ### Step 1: Check if Rules Already Loaded | COMMENT |
| LOW⚡ | .claude/skills/get-qodo-rules/SKILL.md | 45 | ### Step 2: Verify working in a git repository | COMMENT |
| LOW⚡ | .claude/skills/get-qodo-rules/SKILL.md | 53 | ### Step 3: Verify Qodo Configuration | COMMENT |
| LOW⚡ | .claude/skills/get-qodo-rules/SKILL.md | 60 | ### Step 4: Fetch Rules with Pagination | COMMENT |
| LOW⚡ | .claude/skills/get-qodo-rules/SKILL.md | 70 | ### Step 5: Format and Output Rules | COMMENT |
| LOW⚡ | .claude/skills/get-qodo-rules/SKILL.md | 79 | ### Step 6: Apply Rules by Severity | COMMENT |
| LOW⚡ | .claude/skills/get-qodo-rules/SKILL.md | 87 | ### Step 7: Report | COMMENT |
| LOW | .claude/skills/update-nanoclaw/SKILL.md | 71 | # Step 0: Preflight (stop early if unsafe) | COMMENT |
| LOW | .claude/skills/update-nanoclaw/SKILL.md | 95 | # Step 1: Create a safety net | COMMENT |
| LOW | .claude/skills/update-nanoclaw/SKILL.md | 106 | # Step 2: Preview what upstream changed (no edits yet) | COMMENT |
| LOW | .claude/skills/update-nanoclaw/SKILL.md | 137 | # Step 3: Conflict preview (before committing anything) | COMMENT |
| LOW | .claude/skills/update-nanoclaw/SKILL.md | 198 | # Step 5: Validation | COMMENT |
| LOW | .claude/skills/update-nanoclaw/SKILL.md | 224 | # Step 6: Breaking changes check | COMMENT |
| LOW | .claude/skills/update-nanoclaw/SKILL.md | 249 | # Step 7: Skill updates (part of updating NanoClaw) | COMMENT |
| LOW | .claude/skills/update-nanoclaw/SKILL.md | 324 | # Step 8: Summary + rollback instructions | COMMENT |
| LOW⚡ | .claude/skills/add-karpathy-llm-wiki/SKILL.md | 12 | ## Step 1: Read the pattern | COMMENT |
| LOW⚡ | .claude/skills/add-karpathy-llm-wiki/SKILL.md | 16 | ## Step 2: Choose a group | COMMENT |
| LOW⚡ | .claude/skills/add-karpathy-llm-wiki/SKILL.md | 26 | ## Step 3: Design collaboratively | COMMENT |
| LOW | .claude/skills/add-karpathy-llm-wiki/SKILL.md | 64 | ## Step 4: Source handling capabilities | COMMENT |
| LOW | .claude/skills/add-karpathy-llm-wiki/SKILL.md | 79 | ## Step 5: Optional lint schedule | COMMENT |
| LOW | .claude/skills/add-karpathy-llm-wiki/SKILL.md | 89 | ## Step 6: Restart | COMMENT |
| LOW⚡ | .claude/skills/migrate-memory/SKILL.md | 19 | ## Step 1: Identify the group, both providers, and the direction | COMMENT |
| LOW⚡ | .claude/skills/migrate-memory/SKILL.md | 28 | ## Step 2: flat → scaffold (`CLAUDE.local.md` → `memory/`) | COMMENT |
| LOW⚡ | .claude/skills/migrate-memory/SKILL.md | 36 | ## Step 3: scaffold → flat (`memory/` → `CLAUDE.local.md`) | COMMENT |
| LOW⚡ | .claude/skills/migrate-memory/SKILL.md | 42 | ## Step 4: Restart and verify | COMMENT |
| LOW | .claude/skills/update-skills/SKILL.md | 34 | # Step 0: Preflight | COMMENT |
| LOW | .claude/skills/update-skills/SKILL.md | 50 | # Step 1: Detect installed skills | COMMENT |
| LOW | .claude/skills/update-skills/SKILL.md | 60 | # Step 2: Present results | COMMENT |
| LOW | .claude/skills/update-skills/SKILL.md | 73 | # Step 3: Re-apply each selected skill | COMMENT |
| LOW | .claude/skills/update-skills/SKILL.md | 83 | # Step 4: Validation | COMMENT |
| LOW | .claude/skills/update-skills/SKILL.md | 98 | # Step 5: Summary | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup.sh | 1 | #!/bin/bash | COMMENT |
| LOW | nanoclaw.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | nanoclaw.sh | 21 | # HOST_PATTERN OneCLI host pattern (default: api.anthropic.com) | COMMENT |
| LOW | migrate-v2.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | migrate-v2-reset.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | setup/probe.sh | 1 | #!/bin/bash | COMMENT |
| LOW | setup/register-claude-token.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | setup/install-signal-cli.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | setup/install-claude.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | setup/register.ts | 301 | channelType: parsed.channel, | COMMENT |
| LOW | setup/onecli.ts | 101 | COMMENT | |
| LOW | setup/providers/index.ts | 1 | // Setup-side provider barrel. Provider payloads with their own setup surface | COMMENT |
| LOW | setup/lib/install-slug.sh | 1 | # install-slug.sh — shell mirror of setup/lib/install-slug.ts. | COMMENT |
| LOW | setup/lib/channels-remote.sh | 1 | # channels-remote.sh — resolve the git remote that carries the `channels` | COMMENT |
| LOW | setup/lib/diagnostics.sh | 1 | # diagnostics.sh — shared PostHog emitter for bash-side setup code. | COMMENT |
| LOW | setup/channels/imessage-configure.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .claude/skills/add-clidash/add/tools/clidash/docs.js | 1 | // Read-only file viewer for clidash. | COMMENT |
| LOW | container/build.sh | 1 | #!/bin/bash | COMMENT |
| LOW | container/install-cli-tools.sh | 1 | #!/bin/sh | COMMENT |
| LOW | container/entrypoint.sh | 1 | #!/bin/bash | COMMENT |
| LOW | container/agent-runner/src/poll-loop.ts | 381 | const pending = getPendingMessages(); | COMMENT |
| LOW | container/agent-runner/src/poll-loop.ts | 401 | // Thread routing is the router's concern — if a message landed in this | COMMENT |
| LOW | container/agent-runner/src/poll-loop.ts | 501 | // (send_message) mid-turn, or the message may not need a response | COMMENT |
| LOW | scripts/skill-inputs.ts | 1 | // inputsFromEnv — the pipeline consumer's input path (docs/skill-engine-seam.md §6). | COMMENT |
| LOW | scripts/skill-apply.ts | 1 | // The skill application engine — executes `nc:` directives parsed from a SKILL.md. | COMMENT |
| LOW | scripts/skill-apply.ts | 41 | COMMENT | |
| LOW | scripts/skill-apply.ts | 221 | vars: Record<string, string>; | COMMENT |
| LOW | scripts/skill-apply.ts | 241 | // headless run; a prompt with neither defers. | COMMENT |
| LOW | scripts/skill-apply.ts | 501 | if (cur === null || typeof cur !== 'object') return undefined; | COMMENT |
| LOW | scripts/skill-apply.ts | 601 | journal.push({ op: 'ran', cmd: `pnpm add ${d.body.join(' ')}`, undo: `pnpm remove ${names}` }); | COMMENT |
| LOW | scripts/skill-apply.ts | 741 | const normalize = typeof d.attrs.normalize === 'string' ? d.attrs.normalize : undefined; | COMMENT |
| LOW | scripts/skill-apply.ts | 781 | // Always collect the human-facing instructions into the result so a | COMMENT |
| LOW | scripts/skill-conformance.test.ts | 1 | // CI conformance for programmatic skill apply. | COMMENT |
| LOW | scripts/skill-directives.ts | 1 | // Extract `nc:` skill directives embedded in a SKILL.md. | COMMENT |
| LOW | scripts/skill-directives.ts | 21 | // append to:<file> [at:<marker>] body: line(s) to add skip if present | COMMENT |
| LOW | scripts/skill-directives.ts | 41 | // capture). Degrades to an agent when no streaming exec is wired. | COMMENT |
| LOW | scripts/skill-directives.ts | 61 | // operator body: instructions for the human operator output-only | COMMENT |
| LOW | scripts/skill-directives.ts | 81 | // deferred — so one skill can express mutually-exclusive branches (e.g. a local | COMMENT |
| LOW | scripts/cleanup-sessions.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/skill-policy.ts | 1 | // Shared, UI-free driver policy for `nc:operator` blocks — presentation derived | COMMENT |
| LOW | src/router.ts | 281 | COMMENT | |
| LOW | src/delivery.ts | 301 | } | COMMENT |
| LOW | src/providers/index.ts | 1 | // Host-side provider container-config barrel. | COMMENT |
| LOW | src/cli/dispatch.ts | 161 | try { | COMMENT |
| LOW | src/channels/index.ts | 1 | // Channel self-registration barrel. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | .claude/skills/migrate-memory/SKILL.md | 28 | ## Step 2: flat → scaffold (`CLAUDE.local.md` → `memory/`) | COMMENT |
| MEDIUM⚡ | .claude/skills/migrate-memory/SKILL.md | 36 | ## Step 3: scaffold → flat (`memory/` → `CLAUDE.local.md`) | COMMENT |
| MEDIUM | …tainer/agent-runner/src/memory-scaffold.wiring.test.ts | 5 | // Wiring guard for the memory-scaffold seam: the boot gate in index.ts | COMMENT |
| MEDIUM | …tainer/agent-runner/src/memory-scaffold.wiring.test.ts | 7 | // single functional reach-in. The unit tests in memory-scaffold.test.ts drive | COMMENT |
| MEDIUM | scripts/init-first-agent.ts | 251 | // scaffold). A reused group keeps its provider (INSERT OR IGNORE). | COMMENT |
| MEDIUM | src/provider-surfaces.test.ts | 84 | // Claude surfaces; its seed lands in the scaffold's conventional file, | COMMENT |
| MEDIUM | src/provider-surfaces.test.ts | 85 | // which the container-side scaffold preserves at boot. | COMMENT |
| MEDIUM | src/group-init.ts | 56 | // brand-new group that resolves to the instance default, so the scaffold and | COMMENT |
| MEDIUM | src/group-init.ts | 78 | // goes into the memory scaffold's conventional landing file instead | COMMENT |
| MEDIUM | src/group-init.ts | 79 | // (memory/memories/imported-agent-memory.md): the container-side scaffold | COMMENT |
| MEDIUM | src/modules/agent-to-agent/create-agent.ts | 144 | // Passing it explicitly to initGroupFilesystem pins the child's scaffold and | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | .github/workflows/label-pr.yml | 36 | const author = context.payload.pull_request.user.login.toLowerCase(); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup/channels/run-channel-skill.test.ts | 94 | await runChannelSkill('teams', 'Acme Corp', { | CODE |
| LOW | …ills/add-clidash/add/tools/clidash/test/server.test.js | 181 | writeFileSync(join(viewsDir, '..', 'placeholder'), ''); // ensure tmp exists | CODE |
| LOW | docs/templates.md | 193 | "env": { "ACME_API_KEY": "placeholder" } | CODE |
| LOW | container/skills/agent-browser/SKILL.md | 179 | agent-browser fill @e1 "user@example.com" | CODE |
| LOW | scripts/skill-inputs.test.ts | 48 | NC_INPUT_BOT_TOKEN: 'xoxb-fake-token', | CODE |
| LOW | scripts/skill-inputs.test.ts | 54 | bot_token: 'xoxb-fake-token', | CODE |
| LOW | src/providers/claude.ts | 25 | env.ANTHROPIC_AUTH_TOKEN = 'placeholder'; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | setup/signal-auth.ts | 195 | // rather than scraping stdout — more robust across signal-cli versions. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | repo-tokens/recount.py | 8 | pip install tiktoken && python3 repo-tokens/recount.py | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/skill-apply.test.ts | 812 | '## Create the bot', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | migrate-v2.sh | 597 | # Check if v1 service is running | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | repo-tokens/action.yml | 92 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/modules/approvals/onecli-approvals.ts | 113 | async function handleRequest(request: ApprovalRequest): Promise<Decision> { | CODE |