Tiny, Fast, and Deployable anywhere — automate the mundane, unleash your creativity
This report presents the forensic synthetic code analysis of sipeed/picoclaw, a Go project with 29,748 GitHub stars. SynthScan v2.0 examined 368,593 lines of code across 1330 source files, recording 476 pattern matches distributed across 12 syntactic categories. The overall adjusted score of 3.4 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 476 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | web/backend/api/config.go | 699 | cfg.Tools.Skills.Github.Token.Set(token) | CODE |
| CRITICAL⚡ | web/backend/api/tools.go | 582 | APIKeySet: cfg.Tools.Web.Gemini.APIKey.String() != "", | CODE |
| CRITICAL⚡ | web/backend/api/tools.go | 587 | APIKeySet: len(cfg.Tools.Web.Brave.APIKeys.Values()) > 0, | CODE |
| CRITICAL⚡ | web/backend/api/tools.go | 593 | APIKeySet: len(cfg.Tools.Web.Tavily.APIKeys.Values()) > 0, | CODE |
| CRITICAL⚡ | web/backend/api/tools.go | 599 | APIKeySet: len(cfg.Tools.Web.Kagi.APIKeys.Values()) > 0, | CODE |
| CRITICAL⚡ | web/backend/api/tools.go | 604 | APIKeySet: len(cfg.Tools.Web.Perplexity.APIKeys.Values()) > 0, | CODE |
| CRITICAL | web/backend/api/tools.go | 615 | APIKeySet: cfg.Tools.Web.GLMSearch.APIKey.String() != "", | CODE |
| CRITICAL | web/backend/api/tools.go | 621 | APIKeySet: cfg.Tools.Web.BaiduSearch.APIKey.String() != "", | CODE |
| CRITICAL | web/backend/api/tools_test.go | 508 | if got := updated.Tools.Web.Brave.APIKeys.Values(); len(got) != 2 || | CODE |
| CRITICAL | web/backend/api/tools_test.go | 537 | if got := updated.Tools.Web.Brave.APIKeys.Values(); len(got) != 2 || | CODE |
| CRITICAL⚡ | pkg/tools/integration/web.go | 1508 | BraveAPIKeys: cfg.Tools.Web.Brave.APIKeys.Values(), | CODE |
| CRITICAL⚡ | pkg/tools/integration/web.go | 1511 | TavilyAPIKeys: cfg.Tools.Web.Tavily.APIKeys.Values(), | CODE |
| CRITICAL⚡ | pkg/tools/integration/web.go | 1515 | KagiAPIKeys: cfg.Tools.Web.Kagi.APIKeys.Values(), | CODE |
| CRITICAL⚡ | pkg/tools/integration/web.go | 1523 | GeminiAPIKey: cfg.Tools.Web.Gemini.APIKey.String(), | CODE |
| CRITICAL⚡ | pkg/tools/integration/web.go | 1527 | PerplexityAPIKeys: cfg.Tools.Web.Perplexity.APIKeys.Values(), | CODE |
| CRITICAL⚡ | pkg/tools/integration/web.go | 1533 | GLMSearchAPIKey: cfg.Tools.Web.GLMSearch.APIKey.String(), | CODE |
| CRITICAL⚡ | pkg/tools/integration/web.go | 1538 | BaiduSearchAPIKey: cfg.Tools.Web.BaiduSearch.APIKey.String(), | CODE |
| CRITICAL | pkg/config/security.go | 148 | if cfg.Tools.Skills.Github.Token.String() == "" && legacyGitHub.Token.String() != "" { | CODE |
| CRITICAL | pkg/config/security.go | 159 | if name == "github" && cfg.Tools.Skills.Github.Token.String() != "" { | CODE |
| CRITICAL | pkg/config/security_integration_test.go | 124 | assert.Equal(t, "ghp-from-security-yml", cfg.Tools.Skills.Github.Token.String()) | CODE |
| CRITICAL⚡ | pkg/config/security_integration_test.go | 473 | t.Logf("GLMSearch APIKey(): %s", cfg.Tools.Web.GLMSearch.APIKey.String()) | CODE |
| CRITICAL⚡ | pkg/config/security_integration_test.go | 474 | assert.Equal(t, "glm-test-glm-search-key", cfg.Tools.Web.GLMSearch.APIKey.String()) | CODE |
| CRITICAL⚡ | pkg/config/security_integration_test.go | 477 | assert.Equal(t, "ghp-github-from-file-abc123", cfg.Tools.Skills.Github.Token.String()) | CODE |
| CRITICAL⚡ | pkg/config/security_integration_test.go | 478 | t.Logf("Github Token(): %s", cfg.Tools.Skills.Github.Token.String()) | CODE |
| CRITICAL | pkg/config/security_integration_test.go | 645 | assert.Equal(t, "legacy-github-token", cfg.Tools.Skills.Github.Token.String()) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_reply.go | 139 | resp, err := c.client.Im.V1.Message.Get(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 257 | resp, err := c.client.Im.V1.Message.Patch(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 282 | resp, err := c.client.Im.V1.Message.Delete(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 319 | resp, err := c.client.Im.V1.Message.Create(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 445 | resp, err := c.client.Im.V1.MessageReaction.Create(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 482 | _, _ = c.client.Im.V1.MessageReaction.Delete(context.Background(), delReq) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 915 | resp, err := c.client.Im.V1.MessageResource.Get(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 955 | resp, err := c.client.Im.V1.Image.Get(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 1085 | resp, err := c.client.Im.V1.Message.Create(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 1118 | resp, err := c.client.Im.V1.Message.Create(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 1147 | uploadResp, err := c.client.Im.V1.Image.Create(ctx, uploadReq) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 1172 | resp, err := c.client.Im.V1.Message.Create(ctx, req) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 1203 | uploadResp, err := c.client.Im.V1.File.Create(ctx, uploadReq) | CODE |
| CRITICAL | pkg/channels/feishu/feishu_64.go | 1228 | resp, err := c.client.Im.V1.Message.Create(ctx, req) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/security/ANTIGRAVITY_AUTH.ja.md | 694 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/security/ANTIGRAVITY_AUTH.vi.md | 694 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/security/ANTIGRAVITY_AUTH.md | 692 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/security/ANTIGRAVITY_AUTH.fr.md | 694 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/security/ANTIGRAVITY_AUTH.zh.md | 694 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/security/ANTIGRAVITY_AUTH.pt-br.md | 694 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/project/README.zh.md | 377 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/project/README.fr.md | 380 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/project/README.it.md | 376 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/project/README.ja.md | 377 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/project/README.pt-br.md | 377 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/project/README.id.md | 376 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/project/README.vi.md | 377 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/guides/docker.vi.md | 95 | "api_keys": ["sk-your-api-key"], | CODE |
| HIGH | docs/guides/docker.vi.md | 101 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/guides/docker.ms.md | 94 | "api_keys": ["sk-your-api-key"], | CODE |
| HIGH | docs/guides/docker.ms.md | 100 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/guides/providers.md | 90 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/guides/providers.zh.md | 85 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/guides/docker.pt-br.md | 95 | "api_keys": ["sk-your-api-key"], | CODE |
| HIGH | docs/guides/docker.pt-br.md | 101 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/guides/providers.fr.md | 76 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/guides/docker.ja.md | 97 | "api_keys": ["sk-your-api-key"], | CODE |
| HIGH | docs/guides/docker.ja.md | 103 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/guides/configuration.zh.md | 548 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/guides/providers.pt-br.md | 76 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/guides/configuration.md | 752 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/guides/providers.ja.md | 77 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/guides/docker.fr.md | 95 | "api_keys": ["sk-your-api-key"], | CODE |
| HIGH | docs/guides/docker.fr.md | 101 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/guides/docker.zh.md | 98 | "api_keys": ["sk-your-api-key"], | CODE |
| HIGH | docs/guides/docker.zh.md | 105 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/guides/docker.md | 99 | "api_keys": ["sk-your-api-key"], | CODE |
| HIGH | docs/guides/docker.md | 106 | "api_keys": ["your-api-key"], | CODE |
| HIGH | docs/guides/providers.vi.md | 76 | "api_keys": ["sk-your-api-key"] | CODE |
| HIGH | docs/migration/model-list-migration.md | 211 | "api_keys": ["your-api-key"], | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cmd/picoclaw/internal/cliui/mcp_show.go | 49 | // ── plain (narrow / non-TTY) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | cmd/picoclaw/internal/cliui/mcp_show.go | 110 | // ── fancy (wide TTY) ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cmd/picoclaw/internal/cliui/mcp_show.go | 240 | // ── mcp list ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cmd/picoclaw/internal/cliui/mcp_show.go | 355 | // ── helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.full.yml | 2 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.full.yml | 5 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.full.yml | 21 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.full.yml | 24 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.yml | 2 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.yml | 5 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.yml | 23 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.yml | 26 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.yml | 42 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM | docker/docker-compose.yml | 45 | # ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/docker-build.yml | 26 | # ── Checkout ────────────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/docker-build.yml | 32 | # ── Docker Buildx ───────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/docker-build.yml | 36 | # ── Login to GHCR ───────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/docker-build.yml | 44 | # ── Login to Docker Hub ──────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/docker-build.yml | 52 | # ── Metadata (tags & labels) ────────────── | COMMENT |
| MEDIUM | .github/workflows/docker-build.yml | 63 | # ── Build & Push ────────────────────────── | COMMENT |
| MEDIUM⚡ | pkg/config/config_channel_test.go | 466 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | pkg/config/config_channel_test.go | 468 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | pkg/config/config_channel_test.go | 525 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | pkg/config/config_channel_test.go | 527 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | pkg/config/config_channel_test.go | 828 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | pkg/config/config_channel_test.go | 830 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | pkg/config/config_channel_test.go | 1005 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | pkg/config/config_channel_test.go | 1007 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 32 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 34 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 99 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 101 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 310 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 312 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 354 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 356 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 374 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 376 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 400 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 402 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 430 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 432 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 625 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 627 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 668 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 670 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 740 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 742 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 776 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 778 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 937 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 939 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 1068 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/config/config_channel_test.go | 1070 | // ═══════════════════════════════════════════════════ | COMMENT |
| MEDIUM | pkg/utils/bm25.go | 21 | // ── Tuning defaults ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pkg/routing/router_test.go | 10 | // ── ExtractFeatures ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pkg/routing/router_test.go | 146 | // ── RuleClassifier ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pkg/routing/router_test.go | 242 | // ── Router ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pkg/routing/router_test.go | 365 | // ── newWithClassifier (internal testing hook) ───────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | workspace/skills/skill-creator/SKILL.md | 222 | ### Step 1: Understanding the Skill with Concrete Examples | COMMENT |
| LOW | workspace/skills/skill-creator/SKILL.md | 239 | ### Step 2: Planning the Reusable Skill Contents | COMMENT |
| LOW | workspace/skills/skill-creator/SKILL.md | 263 | ### Step 3: Creating the Skill Directory | COMMENT |
| LOW | workspace/skills/skill-creator/SKILL.md | 300 | ### Step 4: Edit the Skill | COMMENT |
| LOW | workspace/skills/skill-creator/SKILL.md | 336 | ### Step 5: Verifying the Skill | COMMENT |
| LOW | workspace/skills/skill-creator/SKILL.md | 349 | ### Step 6: Iterate | COMMENT |
| LOW | docs/security/ANTIGRAVITY_AUTH.md | 45 | #### Step 1: Generate PKCE Parameters | COMMENT |
| LOW | docs/security/ANTIGRAVITY_AUTH.md | 54 | #### Step 2: Build Authorization URL | COMMENT |
| LOW | docs/security/ANTIGRAVITY_AUTH.md | 85 | #### Step 3: Handle OAuth Callback | COMMENT |
| LOW | docs/security/ANTIGRAVITY_AUTH.md | 98 | #### Step 4: Exchange Code for Tokens | COMMENT |
| LOW | docs/security/ANTIGRAVITY_AUTH.md | 129 | #### Step 5: Fetch Additional User Data | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 126 | ### Step 1: Create .security.yml | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 133 | ### Step 2: Fill in your actual values | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 137 | ### Step 3: Set proper permissions | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 143 | ### Step 4: Simplify config.json (Recommended) | COMMENT |
| LOW | docs/security/security_configuration.md | 189 | ### Step 5: Verify | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 591 | ### Step 1: Backup your config | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 599 | ### Step 2: Create .security.yml | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 605 | ### Step 3: Fill in your API keys | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 609 | ### Step 4: Remove sensitive fields from config.json | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 617 | ### Step 5: Set proper permissions | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 623 | ### Step 6: Test | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 629 | ### Step 7: Verify functionality | COMMENT |
| LOW⚡ | docs/security/security_configuration.md | 633 | ### Step 8: Clean up (optional) | COMMENT |
| LOW | docs/reference/config-versioning.md | 63 | ### Step 1: Define the New Version Struct | COMMENT |
| LOW | docs/reference/config-versioning.md | 76 | ### Step 2: Update Current Config Version | COMMENT |
| LOW | docs/reference/config-versioning.md | 82 | ### Step 3: Add a Loader Function | COMMENT |
| LOW | docs/reference/config-versioning.md | 104 | ### Step 4: Add Migration Logic | COMMENT |
| LOW | docs/reference/config-versioning.md | 116 | ### Step 5: Update LoadConfig Switch | COMMENT |
| LOW | docs/reference/config-versioning.md | 139 | ### Step 6: Test Your Migration | COMMENT |
| LOW | pkg/seahorse/store.go | 1202 | // Step 1: Move all items to temp negative ordinals | COMMENT |
| LOW | pkg/seahorse/store.go | 1215 | // Step 2: Insert new summary at the end with positive ordinal | COMMENT |
| LOW | pkg/seahorse/store.go | 1227 | // Step 3: Update each temp item to its final positive ordinal | COMMENT |
| LOW | pkg/tools/fs/filesystem_test.go | 903 | // Step 2: Read the second chunk (10 bytes) --- | COMMENT |
| LOW | pkg/tools/fs/filesystem_test.go | 922 | // Step 3: Read the final chunk (remaining 6 bytes) --- | COMMENT |
| LOW | pkg/config/config_channel.go | 760 | // Step 2: validate singleton constraints | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 471 | // Step 1: Load from extend.json | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 488 | // Step 2: Load secure from security.yml | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 498 | // Step 3: Merge | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 501 | // Step 4: Decode merged result | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 508 | // Step 5: Save extend.json → token masked as [NOT_HERE] | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 516 | // Step 6: Save security.yml → only token | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 833 | // Step 1: Load from extend.json | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 846 | // Step 2: Merge secure from security.yml | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 856 | // Step 3: Decode — both SecureString and SecureStrings should be populated | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 865 | // Step 4: Save extend.json — both secure fields removed | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 875 | // Step 5: Save security.yml — only secure fields | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 976 | // Step 2: Merge enc:// token from security.yml | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 979 | // Step 3: Decode — SecureString.fromRaw resolves enc:// → plaintext | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 988 | // Step 4: Save extend.json → token masked as [NOT_HERE] | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 995 | // Step 5: Save security.yml → token preserved as enc:// | COMMENT |
| LOW | pkg/config/config_channel_test.go | 958 | // Step 1: Load from extend.json (token is [NOT_HERE]) | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 337 | ## Step 1: Backup your config | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 342 | ## Step 2: Create .security.yml | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 347 | ## Step 3: Fill in your API keys | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 350 | ## Step 4: Simplify config.json (Recommended) | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 357 | ## Step 5: Set permissions | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 362 | ## Step 6: Test | COMMENT |
| LOW | pkg/utils/bm25.go | 123 | // Step 4: score via posting lists | COMMENT |
| LOW | pkg/utils/bm25.go | 145 | // Step 5: top-K via fixed-size min-heap | COMMENT |
| 14 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config/config.example.json | 174 | "placeholder": { | CODE |
| LOW | config/config.example.json | 214 | "placeholder": { | CODE |
| LOW | …ontend/src/components/channels/channel-config-page.tsx | 99 | "placeholder", | CODE |
| LOW | …rc/components/channels/channel-forms/telegram-form.tsx | 143 | onChange("placeholder", { | CODE |
| LOW | …rc/components/channels/channel-forms/telegram-form.tsx | 155 | onChange("placeholder", { | CODE |
| LOW | …src/components/channels/channel-forms/generic-form.tsx | 44 | "placeholder", | CODE |
| LOW | …src/components/channels/channel-forms/generic-form.tsx | 275 | (config.placeholder !== undefined && !hiddenFieldSet.has("placeholder")) || | CODE |
| LOW | …src/components/channels/channel-forms/generic-form.tsx | 397 | !hiddenFieldSet.has("placeholder") && ( | CODE |
| LOW | …src/components/channels/channel-forms/generic-form.tsx | 404 | onChange("placeholder", { | CODE |
| LOW | …src/components/channels/channel-forms/generic-form.tsx | 416 | onChange("placeholder", { | CODE |
| LOW | web/frontend/src/i18n/locales/zh.json | 41 | "placeholder": "输入新消息...", | CODE |
| LOW | web/frontend/src/i18n/locales/en.json | 41 | "placeholder": "Start a new message...", | CODE |
| LOW | web/frontend/src/i18n/locales/bn-in.json | 41 | "placeholder": "একটি নতুন বার্তা শুরু করুন...", | CODE |
| LOW | web/frontend/src/i18n/locales/pt-br.json | 41 | "placeholder": "Inicie uma nova mensagem...", | CODE |
| LOW | web/frontend/src/i18n/locales/cs.json | 41 | "placeholder": "Napište zprávu...", | CODE |
| LOW | web/backend/api/channels.go | 172 | settings["placeholder"] = bc.Placeholder | CODE |
| LOW | workspace/skills/agent-browser/SKILL.md | 24 | agent-browser fill @e1 "user@example.com" | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.ja.md | 608 | "email": "user@example.com", | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.vi.md | 608 | "email": "user@example.com", | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.md | 606 | "email": "user@example.com", | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.fr.md | 608 | "email": "user@example.com", | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.zh.md | 608 | "email": "user@example.com", | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.pt-br.md | 608 | "email": "user@example.com", | CODE |
| LOW | docs/channels/discord/README.md | 25 | "placeholder": { | CODE |
| LOW | docs/channels/deltachat/README.md | 36 | "allow_from": ["friend@example.org"], | CODE |
| LOW | docs/channels/matrix/README.zh.md | 24 | "placeholder": { | CODE |
| LOW | docs/channels/matrix/README.fr.md | 24 | "placeholder": { | CODE |
| LOW | docs/channels/matrix/README.md | 24 | "placeholder": { | CODE |
| LOW | docs/channels/matrix/README.ja.md | 24 | "placeholder": { | CODE |
| LOW | docs/channels/matrix/README.pt-br.md | 24 | "placeholder": { | CODE |
| LOW | docs/channels/matrix/README.vi.md | 24 | "placeholder": { | CODE |
| LOW | pkg/credential/credential_test.go | 200 | if err := os.WriteFile(sshKeyPath, []byte("fake-key\n"), 0o600); err != nil { | CODE |
| LOW | pkg/credential/credential_test.go | 271 | if err := os.WriteFile(sshKeyPath, []byte("fake-key\n"), 0o600); err != nil { | CODE |
| LOW | pkg/config/defaults.go | 528 | "placeholder": map[string]any{"enabled": true, "text": []string{"Thinking... 💭"}}, | CODE |
| LOW | pkg/config/defaults.go | 546 | "placeholder": map[string]any{"enabled": true, "text": []string{"Thinking... 💭"}}, | CODE |
| LOW | pkg/config/config_channel.go | 548 | "placeholder": {}, | CODE |
| LOW | pkg/config/config_test.go | 1176 | if !strings.Contains(string(data), `"placeholder": {`) { | CODE |
| LOW | pkg/config/config_test.go | 2215 | "placeholder": { | CODE |
| LOW⚡ | pkg/commands/executor_test.go | 98 | {Name: "placeholder"}, | CODE |
| LOW⚡ | pkg/commands/executor_test.go | 106 | if res.Command != "placeholder" { | CODE |
| LOW⚡ | pkg/commands/executor_test.go | 107 | t.Fatalf("command=%q, want=%q", res.Command, "placeholder") | CODE |
| LOW⚡ | pkg/commands/executor_test.go | 115 | {Name: "placeholder"}, | CODE |
| LOW⚡ | pkg/commands/executor_test.go | 123 | if res.Command != "placeholder" { | CODE |
| LOW⚡ | pkg/commands/executor_test.go | 124 | t.Fatalf("command=%q, want=%q", res.Command, "placeholder") | CODE |
| LOW | pkg/channels/pico/protocol.go | 28 | PayloadKeyPlaceholder = "placeholder" | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 117 | {"display name", "hey PicoBot can you help", "PicoBot", "bot@example.org", true}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 118 | {"case insensitive name", "hey picobot", "PicoBot", "bot@example.org", true}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 119 | {"short display name exact", "hey bot can you help", "bot", "bot@example.org", true}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 120 | {"short display name with punctuation", "AI, summarize this", "ai", "bot@example.org", true}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 121 | {"multi word display name", "hey PicoClaw Bot, can you help", "PicoClaw Bot", "bot@example.org", true}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 122 | {"email local part", "@bot please summarize", "", "bot@example.org", true}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 123 | {"email local part with punctuation", "please summarize, @bot.", "", "bot@example.org", true}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 124 | {"no mention", "just chatting here", "PicoBot", "bot@example.org", false}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 125 | {"local part without @", "the robot is cool", "", "bot@example.org", false}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 126 | {"short display name inside word", "the robot is cool", "bot", "bot@example.org", false}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 127 | {"short display name inside mail", "please email me later", "ai", "bot@example.org", false}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 128 | {"display name with prefix word", "hey SuperPicoClaw Bot", "PicoClaw Bot", "bot@example.org", false}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 129 | {"email local part inside handle", "hello @botanic", "", "bot@example.org", false}, | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 860 | ChatID: "friend@example.org", | CODE |
| LOW⚡ | pkg/channels/deltachat/deltachat_test.go | 862 | Context: bus.InboundContext{ChatID: "42", SenderID: "admin@example.org"}, | CODE |
| 38 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/frontend/src/features/chat/history.ts | 64 | function normalizeMessageTimestamp(timestamp: number | string): string { | CODE |
| LOW | web/frontend/src/features/chat/state.ts | 53 | export function getInitialActiveSessionId(): string { | CODE |
| LOW | …/frontend/src/features/chat/assistant-message-state.ts | 22 | function normalizeAssistantMessageKind( | CODE |
| LOW | …/frontend/src/features/chat/assistant-message-state.ts | 32 | function parseAssistantMessageKind( | CODE |
| LOW | …/frontend/src/features/chat/assistant-message-state.ts | 46 | function hasExplicitAssistantKindPayload( | CODE |
| LOW | …/frontend/src/features/chat/assistant-message-state.ts | 65 | export function parseAssistantMessageCreateState( | CODE |
| LOW | …/frontend/src/features/chat/assistant-message-state.ts | 78 | export function parseAssistantMessageUpdateState( | CODE |
| LOW | web/frontend/src/features/chat/detail-visibility.ts | 40 | function serializeAssistantDetailVisibility( | CODE |
| LOW | web/frontend/src/features/chat/detail-visibility.ts | 58 | function parseAssistantDetailVisibility( | CODE |
| LOW | web/frontend/src/features/chat/detail-visibility.ts | 78 | function parseLegacyShowAssistantDetails( | CODE |
| LOW | web/frontend/src/features/chat/detail-visibility.ts | 100 | export function resolveAssistantDetailVisibilityPreference( | CODE |
| LOW | web/frontend/src/features/chat/detail-visibility.ts | 136 | export function syncAssistantDetailVisibilityStorage( | CODE |
| LOW | web/frontend/src/features/chat/detail-visibility.ts | 238 | export function shouldShowAssistantMessage( | CODE |
| LOW | web/frontend/src/features/chat/image-input.ts | 60 | function getSupportedImageMimeType(file: File): string | null { | CODE |
| LOW | web/frontend/src/features/chat/image-input.ts | 70 | function normalizeImageFileForDataUrl(file: File, filename: string): File { | CODE |
| LOW | web/frontend/src/features/chat/image-input.ts | 123 | export async function buildChatImageAttachments( | CODE |
| LOW | web/frontend/src/features/chat/tool-calls.ts | 3 | function parseLegacyToolFeedbackContent( | CODE |
| LOW | web/frontend/src/features/chat/tool-calls.ts | 107 | export function parseToolCallsFromContent( | CODE |
| LOW | web/frontend/src/features/chat/controller.ts | 69 | function needsActiveSessionHydration(): boolean { | CODE |
| LOW | web/frontend/src/components/chat/chat-page.tsx | 51 | function resolveChatInputDisabledReason({ | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 31 | function findFirstDescendantByTagName( | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 57 | export function extractTextFromMarkdownNode( | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 83 | export function stripSingleTrailingLineBreak(value: string): string { | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 87 | export function extractCodeBlockFromPreNode(node: MarkdownNode | undefined): { | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 99 | export function extractCodeBlockRenderState(children: ReactNode): { | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 180 | function splitHighlightedHtmlIntoNodeLines( | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 200 | export function splitHighlightedHtmlIntoLines(highlightedHtml: string): string[] { | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 221 | export function trimTrailingEmptyStringLine(lines: string[]): string[] { | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 249 | export function trimTrailingEmptyRenderedCodeLine( | CODE |
| LOW | …ontend/src/components/chat/message-code-block.utils.ts | 327 | export function splitRenderedCodeContentIntoLines( | CODE |
| LOW | …omponents/agent/tools/web-search-provider-settings.tsx | 42 | export function WebSearchProviderSettings({ | CODE |
| LOW | web/frontend/src/components/agent/hub/tool-support.ts | 15 | export function buildUnavailableToolMessages({ | CODE |
| LOW⚡ | web/frontend/src/components/models/provider-registry.ts | 118 | export function getProviderDefaultAPIBase( | CODE |
| LOW⚡ | web/frontend/src/components/models/provider-registry.ts | 125 | export function getProviderDefaultAuthMethod( | CODE |
| LOW⚡ | web/frontend/src/components/models/provider-registry.ts | 132 | export function isProviderAuthMethodLocked( | CODE |
| LOW | …components/credentials/antigravity-credential-card.tsx | 22 | export function AntigravityCredentialCard({ | CODE |
| LOW | …ontend/src/components/channels/channel-config-page.tsx | 85 | function serializeGroupTriggerForSubmit(value: unknown): unknown { | CODE |
| LOW | …ntend/src/components/channels/channel-config-fields.ts | 76 | export function getFieldValueForValidation( | CODE |
| LOW | …ntend/src/components/channels/channel-config-fields.ts | 94 | export function getSecretInputPlaceholder( | CODE |
| LOW | …rontend/src/components/channels/channel-array-utils.ts | 50 | export function parseConservativeStringListInput(raw: string): string[] { | CODE |
| LOW | …rontend/src/components/channels/channel-array-utils.ts | 67 | export function serializeStringArrayForSubmit(value: unknown): unknown { | CODE |
| LOW | web/frontend/src/hooks/use-highlight-theme.ts | 22 | function getOrCreateThemeStyleElement(): HTMLStyleElement { | CODE |
| LOW | web/frontend/src/hooks/use-highlight-theme.ts | 22 | function getOrCreateThemeStyleElement(): HTMLStyleElement { | CODE |
| LOW | web/frontend/src/hooks/use-sidebar-channels.ts | 46 | function getChannelImportanceOrder(language: string): string[] { | CODE |
| LOW | web/frontend/src/lib/clipboard.ts | 33 | function getDefaultClipboardEnvironment(): ClipboardEnvironment { | CODE |
| LOW | web/frontend/src/lib/restart-required.ts | 10 | export function showSaveSuccessOrRestartToast( | CODE |
| LOW | web/frontend/src/api/launcher-auth.ts | 9 | export async function postLauncherDashboardLogin( | CODE |
| LOW | web/frontend/src/api/launcher-auth.ts | 44 | export async function postLauncherDashboardLogout(): Promise<boolean> { | CODE |
| LOW | web/frontend/src/api/launcher-auth.ts | 56 | export async function postLauncherDashboardSetup( | CODE |
| LOW | web/frontend/src/store/gateway.ts | 45 | function clearGatewayStoppingTimeout() { | CODE |
| LOW | web/frontend/src/store/gateway.ts | 52 | function normalizeGatewayStoreState( | CODE |
| LOW | web/frontend/src/store/gateway.ts | 86 | export function beginGatewayStoppingTransition() { | CODE |
| LOW | web/frontend/src/store/gateway.ts | 102 | export function cancelGatewayStoppingTransition() { | CODE |
| LOW | web/frontend/src/store/gateway.ts | 109 | export function applyGatewayStatusToStore( | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.ja.md | 508 | export function sanitizeAntigravityThinkingBlocks( | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.vi.md | 508 | export function sanitizeAntigravityThinkingBlocks( | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.md | 506 | export function sanitizeAntigravityThinkingBlocks( | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.fr.md | 508 | export function sanitizeAntigravityThinkingBlocks( | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.zh.md | 508 | export function sanitizeAntigravityThinkingBlocks( | CODE |
| LOW | docs/security/ANTIGRAVITY_AUTH.pt-br.md | 508 | export function sanitizeAntigravityThinkingBlocks( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | pkg/seahorse/store.go | 1202 | // Step 1: Move all items to temp negative ordinals | COMMENT |
| LOW | pkg/seahorse/store.go | 1215 | // Step 2: Insert new summary at the end with positive ordinal | COMMENT |
| LOW | pkg/seahorse/store.go | 1227 | // Step 3: Update each temp item to its final positive ordinal | COMMENT |
| LOW | pkg/tools/fs/filesystem_test.go | 903 | // Step 2: Read the second chunk (10 bytes) --- | COMMENT |
| LOW | pkg/tools/fs/filesystem_test.go | 922 | // Step 3: Read the final chunk (remaining 6 bytes) --- | COMMENT |
| LOW | pkg/config/config_channel.go | 760 | // Step 2: validate singleton constraints | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 471 | // Step 1: Load from extend.json | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 488 | // Step 2: Load secure from security.yml | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 498 | // Step 3: Merge | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 501 | // Step 4: Decode merged result | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 508 | // Step 5: Save extend.json → token masked as [NOT_HERE] | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 516 | // Step 6: Save security.yml → only token | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 833 | // Step 1: Load from extend.json | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 846 | // Step 2: Merge secure from security.yml | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 856 | // Step 3: Decode — both SecureString and SecureStrings should be populated | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 865 | // Step 4: Save extend.json — both secure fields removed | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 875 | // Step 5: Save security.yml — only secure fields | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 976 | // Step 2: Merge enc:// token from security.yml | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 979 | // Step 3: Decode — SecureString.fromRaw resolves enc:// → plaintext | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 988 | // Step 4: Save extend.json → token masked as [NOT_HERE] | COMMENT |
| LOW⚡ | pkg/config/config_channel_test.go | 995 | // Step 5: Save security.yml → token preserved as enc:// | COMMENT |
| LOW | pkg/config/config_channel_test.go | 958 | // Step 1: Load from extend.json (token is [NOT_HERE]) | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 337 | ## Step 1: Backup your config | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 342 | ## Step 2: Create .security.yml | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 347 | ## Step 3: Fill in your API keys | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 350 | ## Step 4: Simplify config.json (Recommended) | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 357 | ## Step 5: Set permissions | COMMENT |
| LOW⚡ | pkg/config/example_security_usage.go | 362 | ## Step 6: Test | COMMENT |
| LOW | pkg/utils/bm25.go | 123 | // Step 4: score via posting lists | COMMENT |
| LOW | pkg/utils/bm25.go | 145 | // Step 5: top-K via fixed-size min-heap | COMMENT |
| LOW | pkg/skills/clawhub_registry.go | 278 | // Step 1: Fetch metadata (with fallback). | COMMENT |
| LOW⚡ | pkg/skills/clawhub_registry.go | 292 | // Step 2: Resolve version. | COMMENT |
| LOW⚡ | pkg/skills/clawhub_registry.go | 302 | // Step 3: Download ZIP to temp file (streams in ~32KB chunks). | COMMENT |
| LOW | pkg/skills/clawhub_registry.go | 321 | // Step 4: Extract from file on disk. | COMMENT |
| LOW⚡ | pkg/channels/marker_test.go | 92 | // Step 1: Marker split should give us 2 chunks | COMMENT |
| LOW⚡ | pkg/channels/marker_test.go | 97 | // Step 2: Length split should be applied to each marker chunk | COMMENT |
| LOW | pkg/channels/manager.go | 1477 | // Step 1: Try marker-based splitting if enabled. | COMMENT |
| LOW⚡ | pkg/channels/manager.go | 1493 | // Step 2: Fallback to length-based splitting if no chunks from marker | COMMENT |
| LOW⚡ | pkg/channels/manager.go | 1498 | // Step 3: Send all chunks | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | onboard_workspace_embed.go | 1 | package picoclaw | COMMENT |
| LOW | web/backend/app_runtime.go | 21 | // - Disables HTTP keep-alive to prevent new connections during shutdown | COMMENT |
| LOW | pkg/seahorse/fts5_sanitize.go | 1 | package seahorse | COMMENT |
| LOW | pkg/seahorse/fts5_sanitize.go | 21 | // treats it as a literal phrase token. User-quoted phrases ("...") are | COMMENT |
| LOW | pkg/seahorse/store_test.go | 741 | // | COMMENT |
| LOW | pkg/seahorse/store_test.go | 761 | {Ordinal: 104, ItemType: "message", MessageID: msgs[4], TokenCount: 2}, | COMMENT |
| LOW | pkg/seahorse/store_test.go | 781 | // After delete: 100, 104 | COMMENT |
| LOW | pkg/seahorse/store_test.go | 821 | } | COMMENT |
| LOW | pkg/seahorse/short_engine_test.go | 1741 | // Uses (role, content, token_count) multi-dimensional comparison. | COMMENT |
| LOW | pkg/credential/credential.go | 1 | // Package credential resolves API credential values for model_list entries. | COMMENT |
| LOW | pkg/credential/credential.go | 41 | ) | COMMENT |
| LOW | pkg/tools/shell.go | 101 | COMMENT | |
| LOW | pkg/tools/shared/result.go | 41 | // Used for internal error handling and logging. | COMMENT |
| LOW | pkg/tools/shared/result.go | 101 | // result := NewToolResult("File updated successfully") | COMMENT |
| LOW | pkg/tools/shared/result.go | 121 | ForLLM: forLLM, | COMMENT |
| LOW | pkg/tools/shared/result.go | 161 | } | COMMENT |
| LOW | pkg/tools/shared/base.go | 161 | // AsyncExecutor is an optional interface that tools can implement to support | COMMENT |
| LOW | pkg/fileutil/file.go | 21 | // - Unchanged (if any step fails before rename) | COMMENT |
| LOW | pkg/fileutil/file.go | 41 | // | COMMENT |
| LOW | pkg/config/migration_integration_test.go | 721 | } | COMMENT |
| LOW | pkg/config/migration_integration_test.go | 741 | // for _, m := range v1.ModelList { | COMMENT |
| LOW | pkg/config/migration_integration_test.go | 761 | // | COMMENT |
| LOW | pkg/config/migration_integration_test.go | 781 | //func TestMigrateModelEnabled_ExplicitEnabledPreserved(t *testing.T) { | COMMENT |
| LOW | pkg/config/migration_integration_test.go | 801 | // {ModelName: "gpt-4", Model: "openai/gpt-4", APIKeys: SimpleSecureStrings("sk-test"), Enabled: false}, | COMMENT |
| LOW | pkg/config/migration_integration_test.go | 821 | // Model: "openai/gpt-4", | COMMENT |
| LOW | pkg/config/migration_integration_test.go | 841 | // assertEnabled("with-key", true) | COMMENT |
| LOW | pkg/config/migration_integration_test.go | 861 | // "group_trigger": map[string]any{"mention_only": true}, | COMMENT |
| LOW | pkg/config/migration_integration_test.go | 881 | // ModelList: []*ModelConfig{ | COMMENT |
| LOW | pkg/config/envkeys.go | 21 | const ( | COMMENT |
| LOW | pkg/config/config_channel.go | 201 | } | COMMENT |
| LOW | pkg/providers/factory_provider.go | 41 | } | COMMENT |
| LOW | pkg/providers/openai_compat/provider_test.go | 861 | } | COMMENT |
| LOW | pkg/utils/bm25.go | 1 | // Package utils provides shared, reusable algorithms. | COMMENT |
| LOW | pkg/agent/subturn.go | 81 | // | COMMENT |
| LOW | pkg/agent/subturn.go | 101 | // } | COMMENT |
| LOW | pkg/agent/subturn.go | 121 | // When Async = true (asynchronous sub-turn): | COMMENT |
| LOW | pkg/agent/subturn.go | 141 | // When parent finishes with hard abort (Finish(true)): | COMMENT |
| LOW | pkg/agent/subturn.go | 161 | MaxContextRunes int | COMMENT |
| LOW | pkg/agent/subturn.go | 521 | // IMPORTANT: This function is ONLY called for asynchronous sub-turns (Async=true). | COMMENT |
| LOW | pkg/agent/context_budget.go | 1 | // PicoClaw - Ultra-lightweight personal AI agent | COMMENT |
| LOW | pkg/agent/steering.go | 561 | // - Automated workflows that need to chain multiple turns | COMMENT |
| LOW | pkg/agent/agent_media.go | 41 | return currentTurnStart | COMMENT |
| LOW | pkg/agent/agent.go | 301 | // "scope": msg.MediaScope, | COMMENT |
| LOW | pkg/agent/agent.go | 501 | // SetReloadFunc sets the callback function for triggering config reload. | COMMENT |
| LOW | pkg/agent/agent.go | 641 | COMMENT | |
| LOW | pkg/agent/agent.go | 661 | // hasMediaRefs checks if any message has media references. | COMMENT |
| LOW | pkg/agent/context.go | 841 | COMMENT | |
| LOW | pkg/mcp/manager_real_server_integration_test.go | 21 | // | COMMENT |
| LOW | pkg/routing/classifier.go | 1 | package routing | COMMENT |
| LOW | pkg/routing/classifier.go | 21 | // token > 200 (≈600 chars): 0.35 — very long prompts are almost always complex | COMMENT |
| LOW | pkg/gateway/channel_matrix.go | 1 | //go:build !mipsle && !netbsd && !(freebsd && arm) && !android | COMMENT |
| LOW | pkg/channels/registry.go | 21 | COMMENT | |
| LOW | pkg/channels/marker.go | 1 | // PicoClaw - Ultra-lightweight personal AI agent | COMMENT |
| LOW | pkg/channels/base.go | 141 | // A value of 0 means no limit. | COMMENT |
| LOW | pkg/channels/telegram/parse_markdown_to_md_v2.go | 81 | // | COMMENT |
| LOW | pkg/session/session_store.go | 1 | package session | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | web/backend/api/session_test.go | 598 | t.Fatalf("thought message = %#v, want assistant thought/internal chain of thought", resp.Messages[1]) | CODE |
| MEDIUM | pkg/routing/classifier.go | 24 | // tool calls > 3 (recent): 0.25 — dense tool usage signals an agentic workflow | COMMENT |
| MEDIUM | pkg/routing/classifier.go | 61 | // Recent tool call density — indicates an ongoing agentic workflow | COMMENT |
| MEDIUM | pkg/routing/features.go | 28 | // history entries. A high density indicates an active agentic workflow. | COMMENT |
| MEDIUM | pkg/channels/README.md | 54 | ├── manager.go # Unified orchestration: Worker queues, rate limiting, retries, Typing/Placeholder, shared HTTP | CODE |
| MEDIUM | pkg/channels/README.md | 741 | ### 3.4 Inbound-side Typing/Reaction/Placeholder Auto-orchestration | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/architecture/hooks/README.zh.md | 577 | except Exception as exc: | CODE |
| LOW | docs/architecture/hooks/plugin-tool-injection.zh.md | 173 | except Exception as exc: | CODE |
| LOW | docs/architecture/hooks/plugin-tool-injection.zh.md | 445 | except Exception as e: | CODE |
| LOW | docs/architecture/hooks/README.md | 577 | except Exception as exc: | CODE |
| LOW | docs/architecture/hooks/plugin-tool-injection.md | 173 | except Exception as exc: | CODE |
| LOW | docs/architecture/hooks/plugin-tool-injection.md | 445 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | pkg/credential/credential.go | 242 | // Uses filepath.IsLocal on the relative path for robust cross-platform traversal detection. | COMMENT |
| MEDIUM | pkg/routing/features.go | 83 | // the content string, so it is robust to any message format. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | pkg/skills/loader_test.go | 411 | content := "<!--\n# COPYRIGHT NOTICE\n# This file is part of the \"Universal Biomedical Skills\" project.\n# Copyright | CODE |