1.1

Adjusted Signal

1.1

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

57.1K

Stars

Language

789.3K

Lines of Code

2.1K

Files

587

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 451 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.8/100 · LOW

Are imports declared and package/API names verified? 134 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2 finding(s).

PR Review Velocity Impact 5.2/100 · LOW

Which changes need focused human review? 587 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 26MEDIUM 67LOW 494

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 587 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block278 hits · 250 pts

Severity	File	Line	Snippet	Context
LOW	config.example.yaml	1	# Configuration template using the v8 layout.	COMMENT
LOW	config.example.yaml	21	devin-catalog: ""	COMMENT
LOW	config.example.yaml	41	response-compression:	COMMENT
LOW	config.example.yaml	61	tls:	COMMENT
LOW	config.example.yaml	81	# - "_chat-completions"	COMMENT
LOW	config.example.yaml	101	# Leave empty to disable the Management API entirely (404 for /v0/management and /v8/management routes).	COMMENT
LOW	config.example.yaml	121	api-keys:	COMMENT
LOW	config.example.yaml	141	# cleanup-interval: "5s"	COMMENT
LOW	config.example.yaml	161	# Routing strategy for selecting credentials when multiple match.	COMMENT
LOW	config.example.yaml	181	# Guardian reviews (X-Openai-Subagent: guardian) may inherit across models from the	COMMENT
LOW	config.example.yaml	201	# Number of additional credential retry rounds after the first round exhausts	COMMENT
LOW	config.example.yaml	241	proxy-url: ""	COMMENT
LOW	config.example.yaml	261	# Streaming behavior (SSE keep-alives + safe bootstrap retries).	COMMENT
LOW	config.example.yaml	281	# - "tools.#(type==\"web_search\").type"	COMMENT
LOW	config.example.yaml	301	# - name: "gpt-" # Supports wildcards (e.g., "gpt-")	COMMENT
LOW	config.example.yaml	321	# - "generationConfig.thinkingConfig.thinkingBudget"	COMMENT
LOW	config.example.yaml	341	# into standard user messages for non-Codex upstream protocols.	COMMENT
LOW	config.example.yaml	361	# custom base URLs, and SIWC requests are never compressed). A 400/415	COMMENT
LOW	config.example.yaml	381	# keeps the downstream response headers uncommitted long enough to transparently retry on	COMMENT
LOW	config.example.yaml	401	# Those seconds bound what the buffer holds, not when the response headers are committed. Headers	COMMENT
LOW	config.example.yaml	421	# Recommendation: If your CPA is deployed behind a reverse proxy with a strict read timeout	COMMENT
LOW	config.example.yaml	441	# than cooling down the entire credential across all sibling models.	COMMENT
LOW	config.example.yaml	461	# prompt cache. Default 7; an explicit 0 keeps the continuity-scoped pin (1h lifetime).	COMMENT
LOW	config.example.yaml	481	# anything else is dropped so the outgoing set stays one a real client could produce.	COMMENT
LOW	config.example.yaml	501	# timezone: "Asia/Singapore" # fallback IANA timezone for cloaked currentDate; a credential JSON "timezone" takes	COMMENT
LOW	config.example.yaml	521	inject-x-search: false	COMMENT
LOW	config.example.yaml	541	# # Gemini API keys	COMMENT
LOW	config.example.yaml	561	# X-Custom-Header: "custom-value"	COMMENT
LOW	config.example.yaml	581	# - "gemini-2.5-pro" # exclude specific models from this provider (exact match)	COMMENT
LOW	config.example.yaml	601	# keys:	COMMENT
LOW	config.example.yaml	621	# # Values starting with "$" dynamically copy the header value from downstream client requests.	COMMENT
LOW	config.example.yaml	641	# vertex:	COMMENT
LOW	config.example.yaml	661	# - name: "gemini-2.5-pro"	COMMENT
LOW	config.example.yaml	681	# action: "stop-and-cooldown"	COMMENT
LOW	config.example.yaml	701	# thinking: # optional: exact thinking capability for this configured model	COMMENT
LOW	config.example.yaml	721	# - name: claude-2	COMMENT
LOW	config.example.yaml	741	# display-name: "Claude Sonnet" # optional catalog display name	COMMENT
LOW	config.example.yaml	761	# # This "cloak" block applies to this api-keys.claude key entry only. For Claude OAuth	COMMENT
LOW	config.example.yaml	781	# # Official api.anthropic.com API keys do not add extra CLI betas/identity unless	COMMENT
LOW	config.example.yaml	801	# # CCH: the billing block may carry a per-request cch hash. CPA emits it exactly where	COMMENT
LOW	config.example.yaml	821	# # {	COMMENT
LOW	config.example.yaml	841	# request-scoped-errors: # optional: custom rules to classify upstream errors by status and body patterns	COMMENT
LOW	config.example.yaml	861	# thinking: # optional: exact thinking capability for this configured model	COMMENT
LOW	config.example.yaml	881	# models:	COMMENT
LOW	config.example.yaml	901	# - status: 400	COMMENT
LOW	config.example.yaml	921	# - name: "moonshotai/kimi-k2:free" # The actual model name.	COMMENT
LOW	config.example.yaml	941	# - name: "kimi-k2.5"	COMMENT
LOW	config.example.yaml	961	# unique aliases/prefixes or avoid overlapping names.	COMMENT
LOW	config.example.yaml	981	# - name: "gemini-2.5-pro"	COMMENT
LOW	config.example.yaml	1001	# xai:	COMMENT
LOW	config.example.yaml	1021	# OAuth provider excluded models	COMMENT
LOW	config.example.yaml	1041	# - "grok-3-mini"	COMMENT
LOW	config.example.yaml	1061	# antigravity:	COMMENT
LOW	config.example.yaml	1081	# xai:	COMMENT
LOW	config.example.yaml	1101	# Terminate and relay Codex Live WebRTC audio and DataChannel traffic in this process.	COMMENT
LOW	config.example.yaml	1121	# - urls:	COMMENT
LOW	config.example.yaml	1141	# sensitive-words: # optional: words to obfuscate with zero-width characters in system instructions	COMMENT
LOW	config.example.yaml	1161	# Devin provider behavior.	COMMENT
LOW	config.example.yaml	1221	# If the same provider is configured as OpenAI-compatible, the native executor wins.	COMMENT
LOW	config.example.yaml	1241	# apply-to: ["registry", "artifact"]	COMMENT
218 more matches not shown…

Magic Placeholder Names18 hits · 130 pts

Severity	File	Line	Snippet	Context
HIGH⚡	config.example.yaml	122	- "your-api-key-1"	CODE
HIGH⚡	config.example.yaml	123	- "your-api-key-2"	CODE
HIGH⚡	config.example.yaml	124	- "your-api-key-3"	CODE
HIGH	config.example.yaml	1287	# api-keys: ["your-api-key-1"] # now access.api-keys	COMMENT
HIGH	cmd/server/main_test.go	45	APIKeys: []string{"real-key", " your-api-key-1 "},	CODE
HIGH⚡	internal/safemode/example_api_keys.go	9	"your-api-key-1": {},	CODE
HIGH⚡	internal/safemode/example_api_keys.go	10	"your-api-key-2": {},	CODE
HIGH⚡	internal/safemode/example_api_keys.go	11	"your-api-key-3": {},	CODE
HIGH⚡	internal/safemode/example_api_keys_test.go	11	" your-api-key-1 ",	CODE
HIGH⚡	internal/safemode/example_api_keys_test.go	12	"your-api-key",	CODE
HIGH⚡	internal/safemode/example_api_keys_test.go	14	"your-api-key-2",	CODE
HIGH⚡	internal/safemode/example_api_keys_test.go	15	"your-api-key-2",	CODE
HIGH⚡	internal/safemode/example_api_keys_test.go	16	"your-api-key-3",	CODE
HIGH⚡	internal/safemode/example_api_keys_test.go	20	want := []string{"your-api-key-1", "your-api-key-2", "your-api-key-3"}	CODE
HIGH⚡	internal/safemode/example_api_keys_test.go	32	keys := []string{"your-api-key", "change-me", "changeme", "your-api-key-4", "my-your-api-key-1"}	CODE
HIGH⚡	internal/safemode/example_api_keys_test.go	42	body := ExampleAPIKeyWarningPageHTML([]string{"your-api-key-1"}, "/management.html?safe-mode=configure")	CODE
HIGH⚡	internal/safemode/example_api_keys_test.go	43	for _, want := range []string{"Example API key detected", "your-api-key-1", "Open Management", `href="/management.html?	CODE
HIGH	internal/api/server_test.go	1852	cfg.APIKeys = []string{"your-api-key-1"}	CODE

Fake / Example Data107 hits · 110 pts

Severity	File	Line	Snippet	Context
LOW	config.example.yaml	973	# "email": "user@example.com",	COMMENT
LOW	internal/pluginhost/auth_callbacks_test.go	322	fileData := []byte(`{"type":"openai","base_url":"https://disk-proxy.example.com/v1","email":"user@example.com"}`)	CODE
LOW	internal/pluginhost/auth_callbacks_test.go	574	initialPayload := []byte(`{"type":"demo","email":"user@example.com","access_token":"tok-1"}`)	CODE
LOW	internal/pluginhost/auth_callbacks_test.go	629	JSON: json.RawMessage(`{"type":"demo","email":"user@example.com","access_token":"tok-2"}`),	CODE
LOW⚡	internal/pluginhost/auth_callbacks_test.go	679	if errWrite := os.WriteFile(filePath, []byte(`{"type":"demo","email":"user@example.com","access_token":"tok-1"}`), 0o60	CODE
LOW⚡	internal/pluginhost/auth_callbacks_test.go	688	Label: "user@example.com",	CODE
LOW⚡	internal/pluginhost/auth_callbacks_test.go	696	"email": "user@example.com",	CODE
LOW	internal/pluginhost/auth_callbacks_test.go	710	JSON: json.RawMessage(`{"type":"demo","email":"user@example.com","access_token":"tok-2"}`),	CODE
LOW	internal/watcher/watcher_test.go	120	"email": "user@example.com",	CODE
LOW	internal/watcher/synthesizer/file_test.go	1043	"email": "user@example.com",	CODE
LOW	internal/auth/claude/filename_test.go	36	email: "user@example.com",	CODE
LOW	internal/auth/claude/filename_test.go	43	email: "user@example.com",	CODE
LOW	internal/auth/claude/filename_test.go	72	const email = "user@example.com"	CODE
LOW	internal/auth/claude/anthropic_auth_test.go	88	"account":{"uuid":"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa","email_address":"user@example.com"},	CODE
LOW	internal/auth/claude/anthropic_auth_test.go	93	"account":{"uuid":"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa","email":"user@example.com"},	CODE
LOW	internal/auth/claude/anthropic_auth_test.go	158	"account":{"uuid":"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa","email":"user@example.com"},	CODE
LOW	internal/auth/claude/anthropic_auth_test.go	224	if bundle.TokenData.Email != "user@example.com" {	CODE
LOW	internal/auth/claude/anthropic_auth_test.go	586	"account":{"uuid":"aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa","email":"user@example.com"},	CODE
LOW	internal/auth/claude/anthropic_auth_test.go	600	if profile.Account.UUID != "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa" \|\| profile.Account.Email != "user@example.com" {	CODE
LOW	internal/auth/claude/anthropic_auth_test.go	610	Email: "user@example.com",	CODE
LOW	internal/auth/claude/anthropic_auth_test.go	621	if storage.Email != "user@example.com" {	CODE
LOW	internal/auth/claude/token_test.go	16	Email: "user@example.com",	CODE
LOW	internal/auth/codex/openai_auth_test.go	202	"email": "user@example.com",	CODE
LOW	internal/auth/codex/openai_auth_test.go	239	"email": "user@example.com",	CODE
LOW⚡	internal/auth/codex/filename_test.go	16	email: "user@example.com",	CODE
LOW⚡	internal/auth/codex/filename_test.go	24	email: "user@example.com",	CODE
LOW⚡	internal/auth/codex/filename_test.go	32	email: "user@example.com",	CODE
LOW⚡	internal/auth/codex/filename_test.go	48	email: "user@example.com",	CODE
LOW⚡	internal/auth/codex/filename_test.go	56	email: "user@example.com",	CODE
LOW⚡	internal/auth/codex/filename_test.go	64	email: "user@example.com",	CODE
LOW⚡	internal/auth/codex/filename_test.go	72	email: "user@example.com",	CODE
LOW	internal/auth/codex/siwc_auth_test.go	235	Email: "user@example.com",	CODE
LOW	internal/auth/codex/siwc_auth_test.go	264	Email: "user@example.com",	CODE
LOW	internal/auth/codex/token_test.go	16	Email: "user@example.com",	CODE
LOW	internal/auth/codex/jwt_parser_test.go	48	"email": "user@example.com",	CODE
LOW	internal/auth/codex/jwt_parser_test.go	63	"email": "user@example.com",	CODE
LOW	internal/auth/meta/meta_auth_test.go	148	if got := CredentialFileName("user@example.com", ""); !strings.HasPrefix(got, "meta-user_example.com-") \|\| !strings.Has	CODE
LOW	internal/auth/meta/meta_auth_test.go	169	Email: "user@example.com",	CODE
LOW	internal/auth/meta/meta_auth_test.go	238	Email: "user@example.com",	CODE
LOW	internal/runtime/executor/xai_executor_test.go	190	"email": "user@example.com",	CODE
LOW	internal/runtime/executor/xai_executor_test.go	4953	Attributes: map[string]string{"base_url": server.URL, "api_key": "fake-token"},	CODE
LOW	…nal/runtime/executor/claude_executor_auth_race_test.go	32	profile.Account.Email = "user@example.com"	CODE
LOW	internal/runtime/executor/codex_executor_auth_test.go	36	"email": "user@example.com",	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	1180	Metadata: map[string]any{"email": "user@example.com"},	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	1230	Metadata: map[string]any{"email": "user@example.com"},	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	1312	Metadata: map[string]any{"email": "user@example.com"},	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	1340	Metadata: map[string]any{"email": "user@example.com"},	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	1366	Metadata: map[string]any{"email": "user@example.com"},	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	1396	Metadata: map[string]any{"email": "user@example.com"},	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	1681	Metadata: map[string]any{"email": "user@example.com"},	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	1822	Metadata: map[string]any{"email": "user@example.com"},	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	1881	Metadata: map[string]any{"email": "user@example.com"},	CODE
LOW	…nal/runtime/executor/codex_websockets_executor_test.go	2289	"email": "user@example.com",	CODE
LOW	internal/runtime/executor/claude_executor_auth_test.go	88	profile.Account.Email = "user@example.com"	CODE
LOW	internal/redisqueue/plugin_test.go	43	Source: "user@example.com",	CODE
LOW	internal/redisqueue/plugin_test.go	279	Source: "user@example.com",	CODE
LOW	internal/redisqueue/plugin_test.go	310	Source: "user@example.com",	CODE
LOW	internal/redisqueue/plugin_test.go	362	Source: "user@example.com",	CODE
LOW	…/api/handlers/management/auth_files_pagination_test.go	156	if errWrite := os.WriteFile(path, []byte(`{"type":"codex","email":"user@example.com"}`), 0o600); errWrite != nil {	CODE
LOW	…/api/handlers/management/auth_files_project_id_test.go	23	if errWrite := os.WriteFile(filePath, []byte(`{"type":"antigravity","email":"user@example.com","project_id":"project-a"	CODE
47 more matches not shown…

Verbosity Indicators43 hits · 82 pts

Severity	File	Line	Snippet	Context
LOW⚡	internal/pluginhost/management_test.go	242	// Step 1: GET the configuration	COMMENT
LOW⚡	internal/pluginhost/management_test.go	252	// Step 2: PUT the unmodified configuration back	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	454	// Step 1: Edit file to B; Watcher queues snapshot B.	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	464	// Step 2: Before B is consumed by manager.Update, reformat file on disk with	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	474	// Step 3: Consume B into manager.Update; canonical digest matches B' on disk.	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	509	// Step 1: Edit file to B (prefix=pfx-edited, ignored=v1) and pop batchB.	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	519	// Step 2: Before batchB is consumed, change only the unmapped JSON field (ignored=v2).	COMMENT
LOW	internal/watcher/dispatcher_snapshot_test.go	530	// Step 3: Applying batchB (superseded on disk) followed by batchB2 commits pfx-edited.	COMMENT
LOW	internal/config/plugin_config_save_test.go	352	// Step 1: remove plugin-a, keep plugin-b	COMMENT
LOW	internal/config/plugin_config_save_test.go	378	// Step 2: clear all configs	COMMENT
LOW⚡	internal/runtime/executor/xai_executor_test.go	4754	// Step 1: added event for a non-dispatcher tool (e.g. web_search or regular function)	COMMENT
LOW⚡	internal/runtime/executor/xai_executor_test.go	4761	// Step 2: arguments.done for non_disp_1 containing a "name" property	COMMENT
LOW	…/runtime/executor/antigravity_executor_credits_test.go	858	// Step 1: Exhaust weekly quota (QUOTA_EXHAUSTED) and credits (INSUFFICIENT_G1_CREDITS_BALANCE).	COMMENT
LOW	…/runtime/executor/antigravity_executor_credits_test.go	888	// Step 2: Top up credits and expire the cached hint/throttle window while model remains in 1h quota cooldown.	COMMENT
LOW	…/runtime/executor/antigravity_executor_credits_test.go	906	// Step 3: Request recovers via credits fallback while model cooldown is active and triggers loadCodeAssist refresh.	COMMENT
LOW⚡	…sponses/interactions_openai_responses_response_test.go	1029	// Step 0: thought	COMMENT
LOW⚡	…sponses/interactions_openai_responses_response_test.go	1030	// Step 1: title_0 (title: Triage issue 5802)	COMMENT
LOW⚡	…sponses/interactions_openai_responses_response_test.go	1031	// Step 2: bash_1 (gh issue view ... 2>&1 \| head -100)	COMMENT
LOW⚡	…esponses/interactions_openai_responses_request_test.go	578	// Step 0: function_call with qualified name	COMMENT
LOW⚡	…esponses/interactions_openai_responses_request_test.go	586	// Step 1: function_result with qualified name	COMMENT
LOW⚡	…esponses/interactions_openai_responses_request_test.go	591	// Step 2: custom_tool_call with qualified name and input in arguments	COMMENT
LOW⚡	…esponses/interactions_openai_responses_request_test.go	599	// Step 3: custom_tool_call_output resolves name from functionNamesByCallID	COMMENT
LOW⚡	…/chat-completions/interactions_openai_response_test.go	313	// Step 0: thought	COMMENT
LOW⚡	…/chat-completions/interactions_openai_response_test.go	317	// Step 1: model_output	COMMENT
LOW⚡	…/chat-completions/interactions_openai_response_test.go	321	// Step 2: function_call 1 (step index = 2, tool call index should be 0)	COMMENT
LOW⚡	…/chat-completions/interactions_openai_response_test.go	325	// Step 3: function_call 2 (step index = 3, tool call index should be 1)	COMMENT
LOW	…api/handlers/management/auth_files_status_sync_test.go	258	// Step 1: Confirm models exist before disabling	COMMENT
LOW	…api/handlers/management/auth_files_status_sync_test.go	273	// Step 2: Disable the credential	COMMENT
LOW	…api/handlers/management/auth_files_status_sync_test.go	293	// Step 3: Re-enable the credential	COMMENT
LOW	…api/handlers/management/auth_files_status_sync_test.go	304	// Step 4: Confirm models are restored without restart	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1294	// Step 2: Synchronous disable hook runs (assigns revision 2)	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1302	// Step 3: Credential is immediately re-enabled (advances revision to 3)	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1324	// Step 5: The delayed stale disable update from Step 1 is delivered now via consumer	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1328	// Step 6: Verify the stale async event was prevented from overwriting the newer enable state!	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1512	// Step 2: Before the queue consumer can process fileUpdate, an API request completes.	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1521	// Step 3: Now the queue consumer processes the fileUpdate (revision 2).	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1527	// Step 4: Verify the file update successfully took effect!	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1275	// Step 1: Credential is disabled (Generation advances)	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1313	// Step 4: Synchronous enable hook runs (assigns revision 3)	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1397	// Step 1: Simulate the watcher generating an unversioned Auth snapshot during a disable	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1421	// Step 2: In the meantime, the credential was synchronously re-enabled via management API	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1443	// Step 3: Now the delayed unversioned watcher event from Step 1 arrives via the queue consumer	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1494	// Step 1: A file change occurs on disk (e.g. user disables credential in auth file).	COMMENT

Structural Annotation Overuse43 hits · 82 pts

Severity	File	Line	Snippet	Context
LOW⚡	internal/pluginhost/management_test.go	242	// Step 1: GET the configuration	COMMENT
LOW⚡	internal/pluginhost/management_test.go	252	// Step 2: PUT the unmodified configuration back	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	454	// Step 1: Edit file to B; Watcher queues snapshot B.	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	464	// Step 2: Before B is consumed by manager.Update, reformat file on disk with	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	474	// Step 3: Consume B into manager.Update; canonical digest matches B' on disk.	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	509	// Step 1: Edit file to B (prefix=pfx-edited, ignored=v1) and pop batchB.	COMMENT
LOW⚡	internal/watcher/dispatcher_snapshot_test.go	519	// Step 2: Before batchB is consumed, change only the unmapped JSON field (ignored=v2).	COMMENT
LOW	internal/watcher/dispatcher_snapshot_test.go	530	// Step 3: Applying batchB (superseded on disk) followed by batchB2 commits pfx-edited.	COMMENT
LOW	internal/config/plugin_config_save_test.go	352	// Step 1: remove plugin-a, keep plugin-b	COMMENT
LOW	internal/config/plugin_config_save_test.go	378	// Step 2: clear all configs	COMMENT
LOW⚡	internal/runtime/executor/xai_executor_test.go	4754	// Step 1: added event for a non-dispatcher tool (e.g. web_search or regular function)	COMMENT
LOW⚡	internal/runtime/executor/xai_executor_test.go	4761	// Step 2: arguments.done for non_disp_1 containing a "name" property	COMMENT
LOW	…/runtime/executor/antigravity_executor_credits_test.go	858	// Step 1: Exhaust weekly quota (QUOTA_EXHAUSTED) and credits (INSUFFICIENT_G1_CREDITS_BALANCE).	COMMENT
LOW	…/runtime/executor/antigravity_executor_credits_test.go	888	// Step 2: Top up credits and expire the cached hint/throttle window while model remains in 1h quota cooldown.	COMMENT
LOW	…/runtime/executor/antigravity_executor_credits_test.go	906	// Step 3: Request recovers via credits fallback while model cooldown is active and triggers loadCodeAssist refresh.	COMMENT
LOW⚡	…sponses/interactions_openai_responses_response_test.go	1029	// Step 0: thought	COMMENT
LOW⚡	…sponses/interactions_openai_responses_response_test.go	1030	// Step 1: title_0 (title: Triage issue 5802)	COMMENT
LOW⚡	…sponses/interactions_openai_responses_response_test.go	1031	// Step 2: bash_1 (gh issue view ... 2>&1 \| head -100)	COMMENT
LOW⚡	…esponses/interactions_openai_responses_request_test.go	578	// Step 0: function_call with qualified name	COMMENT
LOW⚡	…esponses/interactions_openai_responses_request_test.go	586	// Step 1: function_result with qualified name	COMMENT
LOW⚡	…esponses/interactions_openai_responses_request_test.go	591	// Step 2: custom_tool_call with qualified name and input in arguments	COMMENT
LOW⚡	…esponses/interactions_openai_responses_request_test.go	599	// Step 3: custom_tool_call_output resolves name from functionNamesByCallID	COMMENT
LOW⚡	…/chat-completions/interactions_openai_response_test.go	313	// Step 0: thought	COMMENT
LOW⚡	…/chat-completions/interactions_openai_response_test.go	317	// Step 1: model_output	COMMENT
LOW⚡	…/chat-completions/interactions_openai_response_test.go	321	// Step 2: function_call 1 (step index = 2, tool call index should be 0)	COMMENT
LOW⚡	…/chat-completions/interactions_openai_response_test.go	325	// Step 3: function_call 2 (step index = 3, tool call index should be 1)	COMMENT
LOW	…api/handlers/management/auth_files_status_sync_test.go	258	// Step 1: Confirm models exist before disabling	COMMENT
LOW	…api/handlers/management/auth_files_status_sync_test.go	273	// Step 2: Disable the credential	COMMENT
LOW	…api/handlers/management/auth_files_status_sync_test.go	293	// Step 3: Re-enable the credential	COMMENT
LOW	…api/handlers/management/auth_files_status_sync_test.go	304	// Step 4: Confirm models are restored without restart	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1294	// Step 2: Synchronous disable hook runs (assigns revision 2)	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1302	// Step 3: Credential is immediately re-enabled (advances revision to 3)	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1324	// Step 5: The delayed stale disable update from Step 1 is delivered now via consumer	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1328	// Step 6: Verify the stale async event was prevented from overwriting the newer enable state!	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1512	// Step 2: Before the queue consumer can process fileUpdate, an API request completes.	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1521	// Step 3: Now the queue consumer processes the fileUpdate (revision 2).	COMMENT
LOW⚡	sdk/cliproxy/service_auth_sync_test.go	1527	// Step 4: Verify the file update successfully took effect!	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1275	// Step 1: Credential is disabled (Generation advances)	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1313	// Step 4: Synchronous enable hook runs (assigns revision 3)	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1397	// Step 1: Simulate the watcher generating an unversioned Auth snapshot during a disable	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1421	// Step 2: In the meantime, the credential was synchronously re-enabled via management API	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1443	// Step 3: Now the delayed unversioned watcher event from Step 1 arrives via the queue consumer	COMMENT
LOW	sdk/cliproxy/service_auth_sync_test.go	1494	// Step 1: A file change occurs on disk (e.g. user disables credential in auth file).	COMMENT

AI Slop Vocabulary30 hits · 75 pts

Severity	File	Line	Snippet	Context
MEDIUM	…nal/translator/gemini/claude/gemini_claude_response.go	6	// multiple response chunks to provide a seamless streaming experience.	COMMENT
MEDIUM	…ernal/translator/codex/claude/codex_claude_response.go	6	// multiple response chunks to provide a seamless streaming experience.	COMMENT
MEDIUM	…ator/antigravity/claude/antigravity_claude_response.go	6	// multiple response chunks to provide a seamless streaming experience.	COMMENT
MEDIUM	…penai/openai/chat-completions/openai_openai_request.go	31	// For now, we'll return the original, but in a real scenario, logging or a more robust error	COMMENT
MEDIUM⚡	internal/registry/models/codex_client_models.json	80	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	80	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	183	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	183	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	265	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	265	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	368	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	368	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	587	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	587	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	690	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	690	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	772	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	772	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	875	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	875	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1098	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1098	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1201	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1201	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1880	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1880	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1983	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1983	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM	sdk/api/handlers/claude/code_handlers.go	5	// between Claude API format and the underlying Gemini backend, providing seamless	COMMENT
MEDIUM	sdk/api/handlers/claude/code_handlers.go	6	// API compatibility while maintaining robust error handling and connection management.	COMMENT

Modern AI Meta-Vocabulary22 hits · 59 pts

Severity	File	Line	Snippet	Context
MEDIUM	config.example.yaml	338	# When true, optimize Codex Desktop, codex-tui, and codex_cli_rs requests for multi-agent v2.	COMMENT
MEDIUM	config.example.yaml	571	# max-context-length: 1048576 # optional: override Codex client context window metadata	COMMENT
MEDIUM	config.example.yaml	629	# max-context-length: 1048576 # optional: override Codex client context window metadata	COMMENT
MEDIUM	config.example.yaml	694	# max-context-length: 1048576 # optional: override Codex client context window metadata	COMMENT
MEDIUM	config.example.yaml	697	# # client.codex.optimize-multi-agent-v2 applies to both OAuth and API-key credentials.	COMMENT
MEDIUM	config.example.yaml	742	# max-context-length: 1048576 # optional: override Codex client context window metadata	COMMENT
MEDIUM	config.example.yaml	858	# max-context-length: 1048576 # optional: override Codex client context window metadata	COMMENT
MEDIUM	config.example.yaml	924	# max-context-length: 1048576 # optional: override Codex client context window metadata	COMMENT
MEDIUM	config.example.yaml	1012	# Allows overriding model-level capabilities (such as context window) for OAuth credentials.	COMMENT
MEDIUM	config.example.yaml	1017	# max-context-length: 524288 # overrides context window advertised to Codex clients	COMMENT
MEDIUM	internal/runtime/executor/antigravity_executor.go	49	// systemInstruction = "You are Antigravity, a powerful agentic AI coding assistant designed by the Google	COMMENT
MEDIUM	…/runtime/executor/openai_compat_executor_video_test.go	53	payload := `{"model":"client-alias","messages":[{"role":"user","content":[{"type":"text","text":"Describe the videos	CODE
MEDIUM	…/runtime/executor/openai_compat_executor_video_test.go	55	payload = `{"model":"client-alias","input":[{"role":"user","content":[{"type":"input_text","text":"Describe the vid	CODE
MEDIUM	internal/discovery/types.go	39	// SubtypeSearch identifies agentic web/code search.	COMMENT
MEDIUM	…i/openai/responses/gemini_openai-responses_response.go	1808	// Base response scaffold	COMMENT
MEDIUM	…openai/responses/openai_openai-responses_video_test.go	30	part: `{"type":"input_video","video_url":"https://example.com/clip.webm","processing":"agentic"}`,	CODE
MEDIUM	…openai/responses/openai_openai-responses_video_test.go	31	want: `{"type":"video_url","video_url":{"url":"https://example.com/clip.webm","processing":"agentic"}}`,	CODE
MEDIUM	…openai/responses/openai_openai-responses_video_test.go	45	part: `{"type":"input_video","video_url":{"url":"https://example.com/clip.mp4","processing":"static"},"processing":"a	CODE
MEDIUM	…openai/responses/openai_openai-responses_video_test.go	46	want: `{"type":"video_url","video_url":{"url":"https://example.com/clip.mp4","processing":"agentic"}}`,	CODE
MEDIUM	…i/openai/responses/openai_openai-responses_response.go	1072	// Basic response scaffold	COMMENT
MEDIUM	…pi/handlers/management/config_v8_compatibility_test.go	314	raw := "# LEGACY DOCUMENT\ncodex:\n # OPTIMIZE HEAD\n optimize-multi-agent-v2: true # OPTIMIZE INLINE\n response-ste	CODE
MEDIUM	docs/management-api-v8.md	67	### Codex multi-agent configuration migration	COMMENT

Slop Phrases34 hits · 47 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	internal/registry/models/codex_client_models.json	80	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	183	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	265	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	368	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	587	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	690	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1880	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
MEDIUM⚡	internal/registry/models/codex_client_models.json	1983	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
LOW⚡	internal/registry/models/codex_client_models.json	80	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	internal/registry/models/codex_client_models.json	183	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
LOW⚡	internal/registry/models/codex_client_models.json	265	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	internal/registry/models/codex_client_models.json	368	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
LOW⚡	internal/registry/models/codex_client_models.json	587	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	internal/registry/models/codex_client_models.json	690	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
LOW⚡	internal/registry/models/codex_client_models.json	772	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	internal/registry/models/codex_client_models.json	875	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
LOW⚡	internal/registry/models/codex_client_models.json	1098	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	internal/registry/models/codex_client_models.json	1201	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
LOW⚡	internal/registry/models/codex_client_models.json	1880	"instructions_template": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your	CODE
LOW⚡	internal/registry/models/codex_client_models.json	1983	"base_instructions": "You are Codex, an agent based on GPT-6. You and the user share one workspace, and your job i	CODE
LOW	internal/registry/models/codex_client_models.json	953	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	internal/registry/models/codex_client_models.json	1020	"base_instructions": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your job i	CODE
LOW	internal/registry/models/codex_client_models.json	1283	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	internal/registry/models/codex_client_models.json	1350	"base_instructions": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your job i	CODE
LOW	internal/registry/models/codex_client_models.json	1432	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	internal/registry/models/codex_client_models.json	1499	"base_instructions": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your job i	CODE
LOW	internal/registry/models/codex_client_models.json	1577	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	internal/registry/models/codex_client_models.json	1644	"base_instructions": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your job i	CODE
LOW	internal/registry/models/codex_client_models.json	1722	"instructions_template": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your	CODE
LOW	internal/registry/models/codex_client_models.json	1796	"base_instructions": "You are Codex, an agent based on GPT-5. You and the user share one workspace, and your job i	CODE
MEDIUM	examples/custom-provider/main.go	9	// for demonstration purposes. In a real implementation, you would replace	COMMENT
MEDIUM	examples/custom-provider/main.go	48	// init registers trivial translators for demonstration purposes.	COMMENT
MEDIUM	examples/custom-provider/main.go	65	// MyExecutor is a minimal provider implementation for demonstration purposes.	COMMENT
MEDIUM	examples/http-request/main.go	26	// EchoExecutor is a minimal provider implementation for demonstration purposes.	COMMENT

Cross-Language Confusion8 hits · 40 pts

Severity	File	Line	Snippet	Context
HIGH	examples/plugin/scripts/generate_examples.py	241	\tif (stored_host == NULL \|\| stored_host->call == NULL) {{	CODE
HIGH	examples/plugin/scripts/generate_examples.py	248	\tif (stored_host != NULL && stored_host->free_buffer != NULL && ptr != NULL) {{	CODE
HIGH	examples/plugin/scripts/generate_examples.py	354	\tif response == nil \|\| len(raw) == 0 {{	CODE
HIGH	examples/plugin/scripts/generate_examples.py	374	\tif C.call_host_api(cMethod, req, C.size_t(len(payload)), &response) == 0 && response.ptr != nil {{	CODE
HIGH	examples/plugin/scripts/generate_examples.py	454	\tif (response == NULL \|\| text == NULL) {{	CODE
HIGH	examples/plugin/scripts/generate_examples.py	470	\tif (stored_host == NULL \|\| stored_host->call == NULL \|\| method == NULL) {{	CODE
HIGH	examples/plugin/scripts/generate_examples.py	476	\tif (stored_host->call(stored_host->host_ctx, method, request, request_len, &response) == 0 && response.ptr != NULL &&	CODE
HIGH	examples/plugin/scripts/generate_examples.py	661	method_bytes.push(0);	CODE

Decorative Section Separators2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	internal/tui/i18n.go	50	// ──────────────────────────────────────────	COMMENT
MEDIUM	internal/tui/i18n.go	52	// ──────────────────────────────────────────	COMMENT

Self-Referential Comments1 hit · 1 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/plugin/scripts/generate_examples.py	542	cargo_lock = f"""# This file is automatically @generated by Cargo.	STRING

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	examples/plugin/scripts/generate_examples.py	2		CODE

router-for-me/CLIProxyAPI

Open-Source Code Quality, Security and Technical Debt Review