Orca is the ADE for working with a fleet of parallel agents. Run any coding agent with your own subscription. Available on desktop, mobile and remote runtime.
This report summarizes scanner evidence for stablyai/orca, a TypeScript project with 89,290 GitHub stars. SynthScan examined 6,241,190 lines of code across 33733 source files, recording 26157 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 4.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 25418 finding(s).
Are imports declared and package/API names verified? 318 finding(s).
Are wrappers, guards, and repeated structures necessary? 25167 finding(s).
Which changes need focused human review? 26157 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 26157 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | electron.vite.config.ts | 71 | function createStartupDiagnosticsBanner(chunkName: string): string { | CODE |
| LOW | electron.vite.config.ts | 185 | function createMainBootstrapPlugin() { | CODE |
| LOW | native/computer-use-linux/runtime.py | 349 | def render_accessibility_tree(root, window_rect, root_path, compact_browser_tabs=False): | CODE |
| LOW | native/computer-use-linux/runtime.py | 448 | def compact_rendered_browser_tabs(records, lines, start_line, depth): | CODE |
| LOW | native/computer-use-linux/runtime.py | 482 | def is_direct_rendered_browser_tab_line(line, depth): | CODE |
| LOW | native/computer-use-linux/runtime.py | 492 | def is_active_rendered_browser_tab_line(line, depth, records_by_index): | CODE |
| LOW | native/computer-use-linux/runtime_render_test.py | 110 | def test_named_non_generic_node_skips_unused_summary_walk(self): | CODE |
| LOW | native/computer-use-linux/runtime_render_test.py | 120 | def test_wide_labeled_controls_never_enumerate_suppressed_children(self): | CODE |
| LOW | native/computer-use-linux/runtime_render_test.py | 138 | def test_control_value_or_identifier_keeps_suppression(self): | CODE |
| LOW⚡ | native/computer-use-linux/runtime_render_test.py | 154 | def test_unlabeled_controls_keep_child_indices_and_depth(self): | CODE |
| LOW⚡ | native/computer-use-linux/runtime_render_test.py | 164 | def test_suppressed_child_failure_keeps_control_output(self): | CODE |
| LOW⚡ | native/computer-use-linux/runtime_render_test.py | 174 | def test_named_generic_node_skips_unused_summary_walk(self): | CODE |
| LOW⚡ | native/computer-use-linux/runtime_render_test.py | 183 | def test_unnamed_generic_node_keeps_plain_text_summary(self): | CODE |
| LOW | native/computer-use-linux/runtime_render_test.py | 195 | def test_row_keeps_its_specific_summary_walk(self): | CODE |
| LOW⚡ | native/computer-use-linux/runtime_render_test.py | 208 | def test_empty_generic_wrapper_keeps_elision_path_and_depth(self): | CODE |
| LOW⚡ | native/computer-use-linux/runtime_render_test.py | 216 | def test_child_failure_keeps_fail_soft_row_output(self): | CODE |
| LOW⚡ | native/computer-use-linux/runtime_render_test.py | 225 | def test_node_limit_keeps_exact_prefix_and_truncation(self): | CODE |
| LOW | native/computer-use-linux/runtime_render_test.py | 239 | def test_depth_limit_keeps_exact_prefix_and_flag(self): | CODE |
| LOW | config/build-plugins/plain-node-entry-guard.ts | 83 | function assertEntryNamesAreRollupInputs(input: NormalizedInputOptions['input']): void { | CODE |
| LOW | config/build-plugins/plain-node-entry-guard.ts | 257 | export function createPlainNodeEntryGuardPlugin( | CODE |
| LOW | config/build-plugins/pdfjs-viewer-assets.ts | 55 | export function createPdfjsViewerAssetsPlugin(root = pdfjsRoot()): Plugin { | CODE |
| LOW | config/build-plugins/bootstrap-fatal-exit-banner.ts | 6 | export function createBootstrapFatalExitBanner(): string { | CODE |
| LOW | config/build-plugins/process-host-dev-rebuild.ts | 47 | export function createProcessHostDevRebuildPlugin(root = process.cwd()): Plugin { | CODE |
| LOW | config/scripts/vitest-real-agent-home-write-guard.ts | 191 | export function clearInheritedAgentStateEnv(): void { | CODE |
| LOW | config/scripts/vitest-real-agent-home-write-guard.ts | 205 | export function takeRealAgentHomeWriteViolations(): string[] { | CODE |
| LOW | config/scripts/native-chat-live-session-benchmark.ts | 82 | function legacyMessageUpdateSession(messages: NativeChatMessage[]): NativeChatSession { | CODE |
| LOW | config/scripts/native-chat-live-session-benchmark.ts | 89 | function directMessageUpdateSession(messages: NativeChatMessage[]): NativeChatSession { | CODE |
| LOW | config/scripts/plain-node-entry-guard.test.ts | 193 | function countElectronRequireScans(run: () => void): number { | CODE |
| LOW | config/scripts/happy-dom-mutation-observer-retention.ts | 32 | export function retainedMutationCallbackCount(observer: MutationObserver): number { | CODE |
| LOW | config/scripts/happy-dom-mutation-observer-retention.ts | 36 | export function installHappyDomMutationObserverRetention(): boolean { | CODE |
| LOW | config/scripts/session-search-write-benchmark.ts | 28 | function recordTransactionDurations(durations: number[]): () => void { | CODE |
| LOW | config/scripts/happy-dom-offscreen-canvas.ts | 24 | export function installHappyDomOffscreenCanvasCompatibility(): boolean { | CODE |
| LOW | config/scripts/vitest-host-ports-setup.ts | 52 | export function installFakeAppEnvironment(overrides: Partial<AppEnvironment> = {}): void { | CODE |
| LOW | tests/e2e/terminal-pty-readiness.ts | 20 | export async function getTerminalContentForPtyId( | CODE |
| LOW | …2e/terminal-document-visibility-webgl-recovery.spec.ts | 56 | async function writeStableTerminalContent(page: Page): Promise<void> { | CODE |
| LOW | …2e/terminal-document-visibility-webgl-recovery.spec.ts | 243 | async function tryBrowserWindowVisibilityCycle( | CODE |
| LOW | …2e/terminal-document-visibility-webgl-recovery.spec.ts | 261 | async function dispatchDocumentVisibilityCycle(page: Page): Promise<void> { | CODE |
| LOW | tests/e2e/combined-diff-scroll-restore.spec.ts | 50 | function createCombinedDiffScrollRepo(): CombinedDiffScrollRepo { | CODE |
| LOW | tests/e2e/combined-diff-scroll-restore.spec.ts | 215 | async function waitForStableViewportAnchor(page: Page): Promise<ViewportAnchor> { | CODE |
| LOW | tests/e2e/combined-diff-scroll-restore.spec.ts | 249 | async function waitForRestoredViewportAnchor( | CODE |
| LOW | tests/e2e/combined-diff-scroll-restore.spec.ts | 271 | async function startCombinedDiffScrollProbe(page: Page): Promise<void> { | CODE |
| LOW | tests/e2e/combined-diff-scroll-restore.spec.ts | 303 | async function stopCombinedDiffScrollProbe(page: Page): Promise<ScrollProbeSample[]> { | CODE |
| LOW | tests/e2e/combined-diff-scroll-restore.spec.ts | 339 | function getLargestBackwardScrollJump(samples: readonly ScrollProbeSample[]): number { | CODE |
| LOW | tests/e2e/synchronized-output-blackout-probe.ts | 60 | export async function startSynchronizedOutputBlackoutProbe( | CODE |
| LOW | tests/e2e/synchronized-output-blackout-probe.ts | 143 | export async function stopSynchronizedOutputBlackoutProbe( | CODE |
| LOW | tests/e2e/staging-skill-sharing.spec.ts | 430 | async function expectManagedRemoteVersion( | CODE |
| LOW | tests/e2e/diff-note-layout.spec.ts | 11 | async function assertCardClearsFollowingLine(page: Page): Promise<void> { | CODE |
| LOW | …sts/e2e/korean-ime-terminal-shift-enter-commit.spec.ts | 247 | async function dispatchCommittingEnterChord( | CODE |
| LOW | tests/e2e/typing-load-workspaces.ts | 8 | export async function createTypingLoadWorkspaces( | CODE |
| LOW | tests/e2e/typing-load-workspaces.ts | 55 | export async function removeTypingLoadWorkspaces( | CODE |
| LOW | tests/e2e/terminal-ime-observed-event-sequences.ts | 3 | async function dispatchObservedIbusHangulSequence( | CODE |
| LOW | tests/e2e/terminal-ime-observed-event-sequences.ts | 83 | export async function dispatchObservedIbusHangulMixedSequence(page: Page): Promise<void> { | CODE |
| LOW | tests/e2e/terminal-ime-observed-event-sequences.ts | 87 | export async function dispatchObservedIbusHangulRetainedCommitSequence(page: Page): Promise<void> { | CODE |
| LOW | tests/e2e/tab-strip-scroll-render-isolation.spec.ts | 41 | async function addBackgroundTerminalTabs( | CODE |
| LOW | tests/e2e/setup-script-import.spec.ts | 128 | async function openImportedSetupSettingsFromToast(page: Page, repoId: string): Promise<Locator> { | CODE |
| LOW | tests/e2e/setup-script-import.spec.ts | 141 | async function expectSettingsCommandValue( | CODE |
| LOW⚡ | …ired-remote-terminal-parked-scrollback-restart.spec.ts | 163 | function runtimePartitionBufferLength(readings: OnDiskPartitionReading[]): number { | CODE |
| LOW⚡ | …ired-remote-terminal-parked-scrollback-restart.spec.ts | 170 | function localPartitionBufferLength(readings: OnDiskPartitionReading[]): number { | CODE |
| LOW⚡ | …ired-remote-terminal-parked-scrollback-restart.spec.ts | 175 | async function waitForRuntimePartitionCapture( | CODE |
| LOW | …ired-remote-terminal-parked-scrollback-restart.spec.ts | 218 | async function parkRemoteTerminalWithToken( | CODE |
| 24686 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/e2e/terminal-reattach-mouse-mode-leak.spec.ts | 71 | // ── First launch: arm the leak through the real daemon ───────────── | COMMENT |
| MEDIUM | tests/e2e/terminal-reattach-mouse-mode-leak.spec.ts | 146 | // ── Second launch: reattach must disarm the leaked modes ──────────── | COMMENT |
| MEDIUM | tests/e2e/global-setup.ts | 53 | // ── 1. Build the Electron app ────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/global-setup.ts | 123 | // ── 2. Create a seeded test git repo ─────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/terminal-parked-memory.spec.ts | 379 | // ─────────────────────── C1 retention budget outcome ─────────────────────── | COMMENT |
| MEDIUM | tests/e2e/resource-usage-warm-reattach.spec.ts | 61 | // ── First launch: seed a daemon-backed PTY ───────────────────────── | COMMENT |
| MEDIUM | tests/e2e/resource-usage-warm-reattach.spec.ts | 94 | // ── Second launch: verify hydration restored coverage ────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-config-host-picker.spec.ts | 66 | // ── P1 ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-config-host-picker.spec.ts | 86 | // ── P2 ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-config-host-picker.spec.ts | 107 | // ── P3 + N3 ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-config-host-picker.spec.ts | 149 | // ── P4 ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-config-host-picker.spec.ts | 170 | // ── P8 ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/terminal-restart-persistence.spec.ts | 64 | // ── First launch ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/terminal-restart-persistence.spec.ts | 86 | // ── Second launch ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/terminal-restart-persistence.spec.ts | 186 | // ── First launch ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/terminal-restart-persistence.spec.ts | 213 | // ── Second launch ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/terminal-reattach-tui-mouse-mode.spec.ts | 161 | // ── First launch: a real TUI arms mouse reporting ────────────────── | COMMENT |
| MEDIUM | tests/e2e/terminal-reattach-tui-mouse-mode.spec.ts | 191 | // ── Second launch: warm reattach to the still-running TUI ────────── | COMMENT |
| MEDIUM | tests/e2e/terminal-reattach-tui-mouse-mode.spec.ts | 232 | // ── And the wheel must still reach the TUI as mouse reports ───────── | COMMENT |
| MEDIUM | tests/e2e/ssh-config-host-import.spec.ts | 89 | // ── P5 ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-config-host-import.spec.ts | 118 | // ── P6 ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-config-host-import.spec.ts | 156 | // ── P7 ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-config-host-import.spec.ts | 189 | // ── P9 ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-host-form-modal.spec.ts | 125 | // ── Add flow ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/ssh-host-form-modal.spec.ts | 160 | // ── Edit flow stays in viewport even with a long list above ───── | COMMENT |
| MEDIUM | tests/e2e/markdown-table-row-backspace.spec.ts | 81 | // ── Tab / Shift-Tab cell navigation ──────────────────────────── | COMMENT |
| MEDIUM | tests/e2e/markdown-table-row-backspace.spec.ts | 118 | // ── Empty-row Backspace deletes the whole row ────────────────── | COMMENT |
| MEDIUM | tests/e2e/helpers/terminal-input-probes.ts | 30 | // ─── Page-based probes (healthy CDP session) ──────────────────────── | COMMENT |
| MEDIUM | tests/e2e/helpers/terminal-input-probes.ts | 89 | // ─── Main-process-based probes (post-renderer-crash) ──────────────── | COMMENT |
| MEDIUM | tests/e2e/helpers/terminal-input-probes.ts | 271 | // ─── Failure report ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/src/components/pr-sidebar/mobile-pr-sidebar-styles.ts | 285 | // ─── Reviewer picker (BottomDrawer) ─────────────────────────────────────── | COMMENT |
| MEDIUM | mobile/src/session/use-mobile-pr-actions.test.ts | 67 | // ─── mutation wrappers: prRepo / param shapes ─────────────────────────────── | COMMENT |
| MEDIUM | mobile/src/session/use-mobile-pr-actions.test.ts | 157 | // ─── engine: merge / state / reviewers / rerun ────────────────────────────── | COMMENT |
| MEDIUM | mobile/src/session/use-mobile-pr-actions.test.ts | 269 | // ─── permanent vs transient + last-intent-wins ────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-cut.yml | 1638 | # ── Windows inner-binary signing (issue #7785) ───────────────────── | COMMENT |
| MEDIUM | .github/workflows/release-cut.yml | 1940 | # ── End Windows inner-binary signing ─────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/runtime/remote-server-parity.test.ts | 183 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/runtime/remote-server-parity.test.ts | 185 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/runtime/remote-server-parity.test.ts | 215 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/runtime/remote-server-parity.test.ts | 217 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/runtime/remote-server-parity.test.ts | 257 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/runtime/remote-server-parity.test.ts | 259 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/runtime/remote-server-parity.test.ts | 279 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/runtime/remote-server-parity.test.ts | 281 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …runtime/sync-runtime-graph-projection-hot-path.test.ts | 36 | // ── Reference implementations: the pre-change bodies, kept verbatim ──────────────────── | COMMENT |
| MEDIUM | …runtime/sync-runtime-graph-projection-hot-path.test.ts | 144 | // ── Fixtures ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …renderer/src/components/UpdateCard.error-card.test.tsx | 238 | // ── Linux package-install recovery routing ─────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/components/UpdateCard.test.ts | 13 | // ── Helpers ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/components/UpdateCard.test.ts | 38 | // ── Store-level tests for setUpdateStatus / changelog caching ──────── | COMMENT |
| MEDIUM | src/renderer/src/components/UpdateCard.test.ts | 137 | // ── dismissUpdate ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/components/UpdateCard.test.ts | 169 | // ── dismissUpdate nudge-aware path ─────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/components/UpdateCard.test.ts | 212 | // ── updateCardCollapsed ────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/components/UpdateCard.test.ts | 259 | // ── markUpdateReassuranceSeen ──────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/components/UpdateCard.test.ts | 273 | // ── hydratePersistedUI for update fields ───────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/components/UpdateCard.test.ts | 310 | // ── Visibility gate logic (pure function extraction) ───────────────── | COMMENT |
| MEDIUM | src/renderer/src/components/UpdateCard.test.ts | 581 | // ── Full update lifecycle through the store ────────────────────────── | COMMENT |
| MEDIUM | …enderer/src/components/use-task-page-provider-state.ts | 59 | // ── GitLab task-source state ────────────────────────────────────── | COMMENT |
| MEDIUM | src/renderer/src/components/sidebar/AddRepoSteps.tsx | 21 | // ── SSH host project hook ─────────────────────────────────────────── | COMMENT |
| MEDIUM | …enderer/src/components/sidebar/WorktreeCardHelpers.tsx | 6 | // ── Pure helper functions ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …enderer/src/components/sidebar/WorktreeCardHelpers.tsx | 31 | // ── Stable empty arrays for tabs fallback ──────────────────────────── | COMMENT |
| 353 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | config/scripts/vitest-node-runtime-pool.ts | 34 | child.stdout.on('error', (error) => this.options.project.vitest.logger.error(error)) | CODE |
| CRITICAL | config/scripts/vitest-node-runtime-pool.ts | 35 | child.stderr.on('error', (error) => this.options.project.vitest.logger.error(error)) | CODE |
| CRITICAL | tests/e2e/terminal-split-activation-latency.spec.ts | 690 | `focusP50=${reportResult.measuredSummary.distributions.shortcutToFocusMs.p50.toFixed(1)}ms ` + | CODE |
| CRITICAL | tests/e2e/terminal-split-activation-latency.spec.ts | 691 | `echoP50=${reportResult.measuredSummary.distributions.shortcutToFirstEchoMs.p50.toFixed(1)}ms` | CODE |
| CRITICAL | tests/e2e/terminal-webgl-atlas-budget.spec.ts | 414 | A.addon._renderer._glyphRenderer.value.setAtlas(atlasB) | CODE |
| CRITICAL | tests/e2e/computer-windows.e2e.ts | 123 | expect(envelope.result.snapshot.app.name.toLowerCase()).toBe('notepad') | CODE |
| CRITICAL | mobile/src/files/mobile-file-media-download.test.ts | 73 | expect(r.client.sendRequest.mock.calls.map((call) => call[0])).toEqual([ | CODE |
| CRITICAL | …c/components/sidebar/WorktreeVisibilityDialog.test.tsx | 755 | const update = mocks.state.updateRepo.mock.calls.at(-1)?.[1] as { | CODE |
| CRITICAL | …rminal-pane/pty-connection-interrupt-inference.test.ts | 832 | terminalTarget.target.addEventListener.mock.calls.filter(([type]) => type === 'keydown') | CODE |
| CRITICAL | …rminal-pane/pty-connection-interrupt-inference.test.ts | 835 | terminalTarget.target.removeEventListener.mock.calls.filter(([type]) => type === 'keydown') | CODE |
| CRITICAL | …minal-pane/pty-connection-hidden-delivery-gate.test.ts | 215 | const written = pane.terminal.write.mock.calls.map(([data]) => data as string) | CODE |
| CRITICAL | …minal-pane/pty-connection-hidden-delivery-gate.test.ts | 291 | expect(pane.terminal.write.mock.calls.map((call) => String(call[0])).join('')).not.toContain( | CODE |
| CRITICAL | …minal-pane/pty-connection-hidden-delivery-gate.test.ts | 300 | expect(pane.terminal.write.mock.calls.map((call) => String(call[0])).join('')).toContain( | CODE |
| CRITICAL | …-pane/pty-connection-cold-restore-agent-resume.test.ts | 378 | const writeCalls = pane.terminal.write.mock.calls.map(([data]) => data) | CODE |
| CRITICAL | …nal-pane/pty-connection-stalled-hidden-restore.test.ts | 211 | const written = pane.terminal.write.mock.calls.map(([data]) => data as string) | CODE |
| CRITICAL | …nal-pane/pty-connection-stalled-hidden-restore.test.ts | 284 | const written = pane.terminal.write.mock.calls.map(([data]) => data as string) | CODE |
| CRITICAL | …nal-pane/pty-connection-stalled-hidden-restore.test.ts | 327 | const written = pane.terminal.write.mock.calls.map(([data]) => data as string) | CODE |
| CRITICAL | …nal-pane/pty-connection-stalled-hidden-restore.test.ts | 384 | const written = pane.terminal.write.mock.calls.map(([data]) => data as string) | CODE |
| CRITICAL | …nal-pane/pty-connection-stalled-hidden-restore.test.ts | 493 | const written = pane.terminal.write.mock.calls.map(([data]) => data as string) | CODE |
| CRITICAL | …/terminal-pane/pty-connection-hibernation-wake.test.ts | 189 | const writesAfterExit = pane.terminal.write.mock.calls.flat().join('') | CODE |
| CRITICAL | …ane/pty-connection-restored-baseline-shortfall.test.ts | 139 | return pane.terminal.write.mock.calls.map((call) => String(call[0])).join('') | CODE |
| CRITICAL | …al-pane/pty-connection-hidden-backlog-snapshot.test.ts | 499 | const written = pane.terminal.write.mock.calls.map(([data]) => data as string) | CODE |
| CRITICAL⚡ | …al-pane/pty-connection-hidden-backlog-snapshot.test.ts | 796 | const writtenAfterAbandon = pane.terminal.write.mock.calls.map(([data]) => data as string) | CODE |
| CRITICAL⚡ | …al-pane/pty-connection-hidden-backlog-snapshot.test.ts | 805 | expect(pane.terminal.write.mock.calls.map(([data]) => data as string).join('')).not.toContain( | CODE |
| CRITICAL⚡ | …al-pane/pty-connection-hidden-backlog-snapshot.test.ts | 814 | expect(pane.terminal.write.mock.calls.map(([data]) => data as string).join('')).toContain( | CODE |
| CRITICAL | …e/pty-connection-deferred-reattach-live-output.test.ts | 533 | const written = pane.terminal.write.mock.calls.map((call) => String(call[0])).join('') | CODE |
| CRITICAL | …inal-pane/pty-connection-hidden-output-restore.test.ts | 584 | const written = pane.terminal.write.mock.calls.map((call) => String(call[0])).join('') | CODE |
| CRITICAL | …inal-pane/pty-connection-hidden-output-restore.test.ts | 659 | const written = pane.terminal.write.mock.calls.map((call) => String(call[0])).join('') | CODE |
| CRITICAL | …/pty-connection-hidden-snapshot-resize-signals.test.ts | 476 | const writtenText = (): string => pane.terminal.write.mock.calls.map((c) => c[0]).join('') | CODE |
| CRITICAL | …nal-pane/pty-connection-daemon-snapshot-replay.test.ts | 505 | const resizeToSnapshotCall = pane.terminal.resize.mock.invocationCallOrder.find( | CODE |
| CRITICAL | …nal-pane/pty-connection-daemon-snapshot-replay.test.ts | 511 | const snapshotWriteCall = pane.terminal.write.mock.invocationCallOrder.find( | CODE |
| CRITICAL | …ane/pty-connection-hidden-restore-fit-overflow.test.ts | 191 | const output = pane.terminal.write.mock.calls.map(([data]) => data).join('') | CODE |
| CRITICAL | …e/pty-connection-hidden-backlog-reconciliation.test.ts | 198 | return pane.terminal.write.mock.calls.map((call) => String(call[0])).join('') | CODE |
| CRITICAL | …e/pty-connection-hidden-backlog-reconciliation.test.ts | 447 | return pane.terminal.write.mock.calls.map((call) => String(call[0])).join('') | CODE |
| CRITICAL⚡ | …hidden-output-restore-unavailable-banner.repro.test.ts | 421 | writtenChunks: () => pane.terminal.write.mock.calls.map(([data]) => String(data)) | CODE |
| CRITICAL | …rminal-pane/pty-connection-reattach-mode-reset.test.ts | 245 | const tailWriteCall = pane.terminal.write.mock.invocationCallOrder.find( | CODE |
| CRITICAL | …rminal-pane/pty-connection-reattach-mode-reset.test.ts | 248 | const resetWriteCall = pane.terminal.write.mock.invocationCallOrder.find((_order, index) => | CODE |
| CRITICAL⚡ | …t-ssh-hidden-output-restore-unavailable-banner.test.ts | 187 | writtenChunks: () => pane.terminal.write.mock.calls.map(([data]) => String(data)) | CODE |
| CRITICAL⚡ | …nal-pane/remote-hidden-output-restore-outcomes.test.ts | 412 | writtenChunks: () => pane.terminal.write.mock.calls.map(([data]) => String(data)) | CODE |
| CRITICAL | …utomations/AutomationsPage.create-destination.test.tsx | 382 | return api.automations.update.mock.calls.map( | CODE |
| CRITICAL | …ts/automations/AutomationsPage.external-scope.test.tsx | 50 | return api.automations.listExternalManagerForOwner.mock.calls.map( | CODE |
| CRITICAL | …er/src/components/automations/AutomationsPage.test.tsx | 203 | const owners = api.automations.runExternalActionForOwner.mock.calls.map( | CODE |
| CRITICAL | …ructured-agent-session-queued-messages.resume.test.tsx | 347 | pending = hook.result.current.submits.queuedMessages.resume() | CODE |
| CRITICAL | …ructured-agent-session-queued-messages.resume.test.tsx | 389 | expect(await origin.result.current.submits.queuedMessages.resume()).toBe(false) | CODE |
| CRITICAL | …s/native-chat/use-native-chat-composer-submit.test.tsx | 97 | act(() => withGoals.hook.result.current.goalMode.interceptPick(pick)(MODEL_ITEM)) | CODE |
| CRITICAL | …s/native-chat/use-native-chat-composer-submit.test.tsx | 101 | act(() => withoutGoals.hook.result.current.goalMode.interceptPick(pick)(GOAL_ITEM)) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 230 | expect(hook.result.current.registry.loadingIndicesRef.current.has(0)).toBe(true) | CODE |
| CRITICAL⚡ | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 251 | hook.result.current.registry.renderedIndicesRef.current.add(0) | CODE |
| CRITICAL⚡ | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 253 | expect(hook.result.current.registry.sectionLoadTokensRef.current.get(0)).toBe(1) | CODE |
| CRITICAL⚡ | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 260 | expect(hook.result.current.registry.sectionLoadTokensRef.current.get(0)).toBe(2) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 289 | hook.result.current.registry.renderedIndicesRef.current.add(0) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 304 | expect(hook.result.current.registry.loadingIndicesRef.current.has(0)).toBe(true) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 334 | hook.result.current.registry.renderedIndicesRef.current.add(0) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 344 | expect(hook.result.current.registry.sectionLoadTokensRef.current.get(0)).toBe(2) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 407 | expect(hook.result.current.registry.loadedIndicesRef.current.has(0)).toBe(true) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 430 | hook.result.current.registry.loadedIndicesRef.current.delete(0) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 436 | hook.result.current.registry.loadedIndicesRef.current.delete(0) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 464 | expect(hook.result.current.registry.loadedIndicesRef.current.has(0)).toBe(true) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 504 | expect(hook.result.current.registry.loadingIndicesRef.current.has(0)).toBe(true) | CODE |
| CRITICAL | …ions/combined-diff-stale-analysis-work-budget.test.tsx | 517 | hook.result.current.registry.renderedIndicesRef.current.add(0) | CODE |
| 51 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | electron.vite.config.ts | 41 | // Why: the telemetry transport is gated by two compile-time constants that | COMMENT |
| LOW | pnpm-workspace.yaml | 1 | # The desktop host and internal packages share an install. `mobile/` is a separate workspace | COMMENT |
| LOW | native/windows-cli-launcher/src/main.rs | 1 | //! Launches the Orca CLI by running the packaged Electron binary as Node. | COMMENT |
| LOW | config/owner-routing-baseline.txt | 1 | # Renderer call sites that route by the Active Server focus setting: | COMMENT |
| LOW | config/runtime-electron-baseline.txt | 1 | # Modules reachable from the Orca runtime or structured-chat code that import `electron`. | COMMENT |
| LOW | config/scripts/setup-hourly-release-token.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | config/scripts/setup-daily-release-repo.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | config/scripts/setup-adhoc-release-repo.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …nfig/scripts/mobile-web-app-frame-budget-sweep.test.ts | 261 | }) | COMMENT |
| LOW | …ixtures__/websocket-server-wildcard-bind-allowlist.txt | 1 | # Files allowed to construct a `ws` server that binds a port without pinning `host`. | COMMENT |
| LOW | …/paired-remote-browser-ghost-subscriber-rejoin.spec.ts | 21 | // | COMMENT |
| LOW | tests/e2e/tab-close-navigation.spec.ts | 241 | test('closing the last visible surface returns the app to Landing', async ({ orcaPage }) => { | COMMENT |
| LOW | …sts/e2e/terminal-reveal-stale-pty-resize-repro.spec.ts | 81 | { width: 1280, height: 800 }, | COMMENT |
| LOW | tests/e2e/terminal-attention.spec.ts | 381 | } | COMMENT |
| LOW | tests/e2e/terminal-attention.spec.ts | 461 | // Mode 1004 reset succeeded iff no focus escapes are emitted — we assert | COMMENT |
| LOW | tests/e2e/terminal-reattach-mouse-mode-leak.spec.ts | 101 | .catch(() => false) | COMMENT |
| LOW | tests/e2e/terminal-parked-memory.spec.ts | 21 | // Why: production cold-park hysteresis is 30s. The fast-park env override is | COMMENT |
| LOW | tests/e2e/terminal-parked-memory.spec.ts | 381 | // the retention budget exists for: hidden worktrees ordinary parking can never | COMMENT |
| LOW | tests/e2e/tab-sidebar-closed-overlap.spec.ts | 41 | // regression that broke the Cmd+B binding, carved the chord out for a | COMMENT |
| LOW | tests/e2e/file-open.spec.ts | 101 | // There should be a new open file | COMMENT |
| LOW | tests/e2e/artificial-opencode-terminal-load.spec.ts | 121 | const DEFAULT_FRAME_COUNT = 180 | COMMENT |
| LOW | …sts/e2e/terminal-inline-tui-reveal-convergence.spec.ts | 21 | // Field bug (v1.4.144-rc.4): switching back to a workspace whose Codex TUI kept | COMMENT |
| LOW | tests/e2e/worktree.spec.ts | 61 | // 1. Open the composer through the visible affordance so the lazy modal | COMMENT |
| LOW | …wire/preflight-workspace-scoped-downgrade.unit.test.ts | 1 | // Workspace-scoped agent detection, paired across two builds: current code against the newest | COMMENT |
| LOW | …ion-wire/cross-version-agent-session-wire.unit.test.ts | 1 | // Cross-version coverage for the structured agent-session surface, paired the same | COMMENT |
| LOW | …ire/workspace-ports-host-scoped-downgrade.unit.test.ts | 1 | // Host-scoped workspace port scan and Stop, paired across two builds: current code against the | COMMENT |
| LOW | …sion-wire/cross-version-registered-agents.unit.test.ts | 1 | // A structured agent beyond Claude and Codex, paired across two builds: current code against the | COMMENT |
| LOW | …cross-version-structured-attention-frames.unit.test.ts | 1 | // Mixed-version coverage for the structured attention stream, with real frames on it. | COMMENT |
| LOW | …rsion-wire/runtime-source-fence-downgrade.unit.test.ts | 1 | // The host-side runtime-source fence, paired across two builds over a real socket: current code | COMMENT |
| LOW | tests/e2e/helpers/orca-app.ts | 221 | // Why: testInfo.outputDir is created lazily by Playwright; on Windows the | COMMENT |
| LOW | mobile/app/h/[hostId]/[...page].tsx | 1 | // The body lives under src/ so its `.web.tsx` sibling has a plain stem: expo-router 55 reads a | COMMENT |
| LOW | mobile/web-entry/index.tsx | 21 | import { publishPageHostProfile } from '../src/mobile-web-shell/bridge/page-host-profile' | COMMENT |
| LOW | mobile/scripts/repro-mobile-foreground-stall.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …-mobile-web-shell/ios/MobileWebShellAppliedProps.swift | 1 | import Foundation | COMMENT |
| LOW | …s/orca-mobile-web-shell/ios/MobileWebShellBridge.swift | 1 | import Foundation | COMMENT |
| LOW | …ules/orca-mobile-web-shell/ios/MobileWebShellCsp.swift | 1 | enum MobileWebShellCsp { | COMMENT |
| LOW | …ules/orca-mobile-web-shell/ios/MobileWebShellCsp.swift | 21 | // pins the skip in a test. All three are anticipated surfaces, and C7.10 is where they become | COMMENT |
| LOW | …ile-web-shell/ios/MobileWebShellNavigationPolicy.swift | 1 | import Foundation | COMMENT |
| LOW | …ile-web-shell/ios/MobileWebShellNavigationPolicy.swift | 21 | /// | COMMENT |
| LOW | …ile-web-shell/ios/MobileWebShellNavigationPolicy.swift | 41 | /// WKWebView, off-device: a sandboxed subframe navigating the top frame to the document URL | COMMENT |
| LOW | …rca-mobile-web-shell/ios/MobileWebShellLoadState.swift | 21 | /// Pure, and the same rule as the Kotlin copy, so `swiftc` can check it without a device. | COMMENT |
| LOW | …es/orcamobilewebshell/MobileWebShellResponseHeaders.kt | 21 | // `orca-mobile-web://<sessionId>/` and carries the id verbatim. Either is something | COMMENT |
| LOW | …a/expo/modules/orcamobilewebshell/MobileWebShellCsp.kt | 21 | // | COMMENT |
| LOW | mobile/src/tasks/mobile-tasks-capability.ts | 1 | // Runtime capability the desktop advertises when it supports the mobile Tasks RPC | COMMENT |
| LOW | mobile/src/tasks/task-provider-entity-reply-schema.ts | 1 | import { z } from 'zod' | COMMENT |
| LOW | mobile/src/tasks/task-project-board-reply-schema.ts | 21 | // load-bearing there, so an envelope without it is an incompatible reply rather than the | COMMENT |
| LOW | mobile/src/transport/connection-health.ts | 1 | import { isTailscaleEndpoint } from '../../../src/shared/remote-runtime-tailscale-hint' | COMMENT |
| LOW | mobile/src/transport/connection-health.ts | 81 | // Why: the rpc-client's lastConnectedAt is a one-shot timestamp; we have | COMMENT |
| LOW | mobile/src/transport/rpc-params-contract.ts | 1 | // Why: mobile's only entry to the host's params contract, and type-only on purpose. | COMMENT |
| LOW | …transport/cellular-handshake-stall-real-socket.test.ts | 1 | import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' | COMMENT |
| LOW | mobile/src/transport/unvalidated-rpc-request-port.ts | 1 | import type { RpcResponse } from './types' | COMMENT |
| LOW | …le/src/transport/foreground-stale-dial-restart.test.ts | 1 | import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' | COMMENT |
| LOW | …rc/transport/unvalidated-rpc-request-port-inventory.ts | 41 | { file: 'src/transport/mobile-endpoint-supervisor-test-fakes.ts', references: 2 }, | COMMENT |
| LOW | …rc/transport/unvalidated-rpc-request-port-inventory.ts | 61 | // `sendRequest` and its forward. The name each physical send is filed under has to be taken in | COMMENT |
| LOW | …rc/transport/unvalidated-rpc-request-port-inventory.ts | 81 | COMMENT | |
| LOW | …rc/transport/unvalidated-rpc-request-port-inventory.ts | 101 | // src/host-screen/ — host screen catalog and actions. The repo and label metadata reads, the | COMMENT |
| LOW | …rc/transport/unvalidated-rpc-request-port-inventory.ts | 121 | // mobile-diff-review-git-operations.ts. The terminal input surface followed: the composed send, | COMMENT |
| LOW | …rc/transport/unvalidated-rpc-request-port-inventory.ts | 141 | // that falls back to its own copy when the host refuses with an empty message, so no existing | COMMENT |
| LOW | …rc/transport/unvalidated-rpc-request-port-inventory.ts | 161 | // source scanner rather than sending anything. | COMMENT |
| LOW | mobile/src/transport/rpc-stale-dial.ts | 1 | import type { ConnectionState } from './types' | COMMENT |
| 453 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | cloud/apps/relay-ops/src/pre-drain-sample-cli.ts | 118 | print(JSON.stringify({ | CODE |
| HIGH | cloud/apps/relay-ops/src/pre-drain-sample-cli.ts | 133 | print(JSON.stringify({ | CODE |
| HIGH | cloud/apps/relay-ops/src/pre-drain-sample-cli.ts | 142 | print(JSON.stringify({ | CODE |
| HIGH | src/relay/pty-shell-overlay-wrappers.ts | 63 | elif [[ -f "$HOME/.bash_login" ]]; then | CODE |
| HIGH | src/relay/pty-shell-overlay-wrappers.ts | 65 | elif [[ -f "$HOME/.profile" ]]; then | CODE |
| HIGH | src/relay/pty-shell-overlay-wrappers.ts | 115 | elif [[ "\${FUNCNAME[1]:-}" == "__orca_run_prompt_command_array" || "$BASH_COMMAND" == "__orca_run_prompt_command_ar | CODE |
| HIGH | src/main/shell-templates.ts | 136 | elif [[ "\${HISTFILE:-}" == "$ZDOTDIR/.zsh_history" ]]; then | CODE |
| HIGH | src/main/shell-templates.ts | 179 | elif (( \${+widgets[zle-line-init]} )) && [[ "\${widgets[zle-line-init]}" == user:* ]]; then | CODE |
| HIGH | src/main/zsh-deferred-startup-line-init.ts | 10 | elif [[ "\${widgets[zle-line-init]:-}" == user:__orca_prompt_mark ]]; then | CODE |
| HIGH | src/main/zsh-deferred-startup-line-init.ts | 43 | elif [[ "\${widgets[zle-line-init]:-}" == user:__orca_deferred_line_init ]]; then | CODE |
| HIGH | …counts/legacy-wsl-runtime-auth-drain-shell-commands.ts | 30 | elif [ -f "$target_auth" ] && [ ! -L "$target_auth" ] && [ "$target_auth" -ef "$2" ]; then | CODE |
| HIGH | …counts/legacy-wsl-runtime-auth-drain-shell-commands.ts | 52 | elif [ -e "$session_link_manifest" ] || [ -L "$session_link_manifest" ]; then | CODE |
| HIGH | …counts/legacy-wsl-runtime-auth-drain-shell-commands.ts | 66 | elif [ -e "$session_link_manifest" ] || [ -L "$session_link_manifest" ]; then | CODE |
| HIGH⚡ | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 49 | elif [ -f "$source_quarantine_auth" ] && [ ! -L "$source_quarantine_auth" ]; then | CODE |
| HIGH⚡ | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 52 | elif [ -e "$source_recovery_auth" ] || [ -L "$source_recovery_auth" ]; then | CODE |
| HIGH⚡ | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 60 | elif [ -e "$destination_recovery_path" ] || [ -L "$destination_recovery_path" ]; then | CODE |
| HIGH | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 79 | elif [ ! -e "$source_credentials" ] && [ ! -L "$source_credentials" ]; then | CODE |
| HIGH⚡ | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 150 | elif [ -f "$source_quarantine_auth" ] && [ ! -L "$source_quarantine_auth" ] && [ "$(hash_file "$source_quarantine_au | CODE |
| HIGH⚡ | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 154 | elif [ ! -f "$drain_marker" ]; then | CODE |
| HIGH⚡ | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 157 | elif [ -f "$drain_marker" ]; then | CODE |
| HIGH⚡ | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 165 | elif [ -e "$destination_recovery_auth" ] || [ -L "$destination_recovery_auth" ]; then | CODE |
| HIGH⚡ | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 169 | elif [ -f "$destination_recovery_path" ] && [ ! -L "$destination_recovery_path" ]; then | CODE |
| HIGH | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 182 | elif [ -e "$session_scan_watermark" ] && [ ! -L "$session_scan_watermark" ]; then exit 46 | CODE |
| HIGH | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 195 | elif [ "$9" = missing ] && [ ! -e "$target_credentials" ] && [ ! -L "$target_credentials" ]; then | CODE |
| HIGH | …odex-accounts/legacy-wsl-runtime-auth-drain-scripts.ts | 229 | elif [ "\${10}" = recent ]; then | CODE |
| HIGH | …ex-accounts/legacy-wsl-runtime-auth-finalize-script.ts | 37 | elif [ -e "$destination_recovery_path" ] || [ -L "$destination_recovery_path" ]; then | CODE |
| HIGH | …ex-accounts/legacy-wsl-runtime-auth-finalize-script.ts | 51 | elif [ -e "$destination_recovery_path" ] || [ -L "$destination_recovery_path" ]; then | CODE |
| HIGH⚡ | src/main/pty/legacy-terminal-posix-tombstone.ts | 149 | elif [[ -n "$legacy_target" && "$normalized" == "$legacy_target" ]]; then | CODE |
| HIGH⚡ | src/main/pty/legacy-terminal-posix-tombstone.ts | 151 | elif [[ "$legacy_target" == /* && "$entry" -ef "$legacy_target" ]]; then | CODE |
| HIGH⚡ | src/main/pty/legacy-terminal-posix-tombstone.ts | 160 | elif [[ "$entry" -ef "$wrapper_dir" ]]; then | CODE |
| HIGH | src/main/providers/local-pty-shell-ready-bash-rcfile.ts | 31 | elif [[ -f "$HOME/.bash_login" ]]; then | CODE |
| HIGH | src/main/providers/local-pty-shell-ready-bash-rcfile.ts | 33 | elif [[ -f "$HOME/.profile" ]]; then | CODE |
| HIGH | src/main/providers/local-pty-shell-ready-bash-rcfile.ts | 102 | elif [[ "\${FUNCNAME[1]:-}" == "__orca_run_prompt_command_array" || "$BASH_COMMAND" == "__orca_run_prompt_command_ar | CODE |
| HIGH⚡ | …in/codex/codex-hook-file-entry-binary-contract.test.ts | 523 | if done and done(): return True | CODE |
| HIGH⚡ | …in/codex/codex-hook-file-entry-binary-contract.test.ts | 527 | except OSError: return False | CODE |
| HIGH⚡ | …in/codex/codex-hook-file-entry-binary-contract.test.ts | 528 | if not d: return False | CODE |
| HIGH | src/main/cli/wsl-cli-scripts.ts | 8 | elif [ -x /mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe ]; then | CODE |
| HIGH | src/main/cli/wsl-cli-installer.test.ts | 46 | elif [ -x /mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe ]; then | CODE |
| HIGH | src/main/daemon/daemon-bash-shell-ready-rcfile.ts | 22 | elif [[ -f "$HOME/.bash_login" ]]; then | CODE |
| HIGH | src/main/daemon/daemon-bash-shell-ready-rcfile.ts | 24 | elif [[ -f "$HOME/.profile" ]]; then | CODE |
| HIGH | src/main/daemon/daemon-bash-shell-ready-rcfile.ts | 83 | elif [[ "\${FUNCNAME[1]:-}" == "__orca_run_prompt_command_array" || "$BASH_COMMAND" == "__orca_run_prompt_command_ar | CODE |
| HIGH | …/agent-session-wire/structured-agent-session-logger.ts | 98 | print( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/terminal-ibus-hangul-native.spec.ts | 293 | ? `${target.tagName}#${target.id}[${target.getAttribute('placeholder') ?? ''}]` | CODE |
| LOW | skill-guides/orca-emulator-android.md | 61 | | Type text | `ORCA emulator type "user@example.com" --json` | US-ASCII, spa | CODE |
| LOW | skill-guides/orca-emulator.md | 96 | ORCA emulator type "user@example.com" --json | CODE |
| LOW | …nderer/src/web/web-preload-api-agent-providers.test.ts | 163 | await expect(api.opencodeGoCredentials.saveApiKey('fake-key')).rejects.toThrow(/desktop app/i) | CODE |
| LOW | src/renderer/src/web/web-preload-api-jira.test.ts | 73 | email: 'user@example.com', | CODE |
| LOW | …rc/components/window-close-request-coordinator.test.ts | 110 | const error = new Error('placeholder') | CODE |
| LOW | …ents/NewWorkspaceComposerCard.quick-file-drop.test.tsx | 99 | expect(container.querySelector('textarea')?.getAttribute('placeholder')).toBe('Write a note') | CODE |
| LOW | …ts/settings/SettingsFormControls.number-field.test.tsx | 27 | expect(input.getAttribute('placeholder')).toBe('Auto') | CODE |
| LOW | …nderer/src/components/settings/CommitMessageAiPane.tsx | 248 | translate('auto.components.settings.CommitMessageAiPane.fc1a525fa5', 'placeholder') | CODE |
| LOW | …nderer/src/components/settings/CommitMessageAiPane.tsx | 263 | keywords={['custom', 'command', 'cli', 'binary', 'prompt', 'placeholder']} | CODE |
| LOW | …components/tab-bar/TabBarCreateEntry.keyboard.test.tsx | 308 | const placeholder = input.getAttribute('placeholder') | CODE |
| LOW | …components/tab-bar/TabBarCreateEntry.keyboard.test.tsx | 324 | ).toBe(container.querySelector('input')!.getAttribute('placeholder')) | CODE |
| LOW | …ce/SmartWorkspaceNameField.jira-accessibility.test.tsx | 320 | expect(screen.getByRole('textbox').getAttribute('placeholder')).toBe( | CODE |
| LOW | …expected-signout/unexpected-signout-visibility.test.ts | 14 | email: 'user@example.com', | CODE |
| LOW | …ts/unexpected-signout/unexpected-signout-card.test.tsx | 17 | email: 'user@example.com', | CODE |
| LOW | …-chat/NativeChatStructuredSession.host-outage.test.tsx | 241 | expect(mocks.composerProps?.structuredTransport).not.toHaveProperty('placeholder') | CODE |
| LOW | …ts/editor/markdown-rich-mode-eligibility-cache.test.ts | 10 | const OVERSIZED_BODY = `${'lorem ipsum dolor sit amet '.repeat(2_500)}\n<span>tail</span>\n` | CODE |
| LOW | …ts/editor/markdown-rich-mode-eligibility-cache.test.ts | 10 | const OVERSIZED_BODY = `${'lorem ipsum dolor sit amet '.repeat(2_500)}\n<span>tail</span>\n` | CODE |
| LOW | …c/components/editor/rich-markdown-details-extension.ts | 41 | Extract<PlaceholderOptions['placeholder'], (...args: never[]) => string> | CODE |
| LOW | src/renderer/src/lib/shutdown-checkpoint-guard.test.ts | 97 | const error = new Error('placeholder') | CODE |
| LOW | …manager/terminal-foreground-repair-convergence.test.ts | 129 | const SCROLLBACK_SEED = `${Array.from({ length: 40 }, (_, i) => `line ${i} ${'lorem ipsum '.repeat(3)}`).join('\r\n')}\r | CODE |
| LOW | src/renderer/src/i18n/en-runtime-required.json | 3122 | "placeholder": { | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 6669 | "placeholder": "留空以使用 /connect 或 OPENCODE_API_KEY 保存的密钥", | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 11468 | "placeholder": "自动检测" | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 11501 | "placeholder": "与终端字体相同" | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 11615 | "placeholder": "/Users/you/plugins/my-plugin or C:\\Users\\you\\plugins\\my-plugin", | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 14452 | "placeholder": "home.example.com:8443 或 https://example.com/orca", | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 16722 | "placeholder": "搜索...", | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 16744 | "placeholder": "选择主机", | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 17495 | "placeholder": "搜索...", | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 17923 | "placeholder": "随便问，@ 提及文件，/ 使用命令", | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 18327 | "placeholder": "描述您的目标，定义可衡量的结果以获得最佳结果", | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 18839 | "placeholder": { | CODE |
| LOW | src/renderer/src/i18n/locales/zh.json | 18900 | "placeholder": "搜索工作树、项目或智能体…", | CODE |
| LOW | src/shared/browser-grab-types.ts | 213 | 'placeholder', | CODE |
| LOW | …ed/new-workspace/smart-workspace-linear-intent.test.ts | 21 | it.each(['2026-09', '555-1234', '8080-8090', '1_2-3'])( | CODE |
| LOW | src/shared/linear/links.test.ts | 68 | '555-1234', | CODE |
| LOW | src/cli/specs/bundled-guide-flags.test.ts | 65 | flags: new Map([[invocation.flag, 'placeholder']]) | CODE |
| LOW | src/relay/git-handler-test-setup.ts | 12 | const TEST_GIT_USER_EMAIL = 'test@test.com' | CODE |
| LOW | …git-response-pty-echo-backpressure.integration.test.ts | 182 | run(['config', 'user.email', 'test@test.com']) | CODE |
| LOW | src/relay/subprocess.test.ts | 251 | execFileSync('git', ['config', 'user.email', 'test@test.com'], { cwd: tmpDir, stdio: 'pipe' }) | CODE |
| LOW | src/relay/git-handler-remote-sync.test.ts | 186 | execFileSync('git', ['config', 'user.email', 'test@test.com'], { | CODE |
| LOW | src/relay/git-handler-remote-sync.test.ts | 281 | execFileSync('git', ['config', 'user.email', 'test@test.com'], { | CODE |
| LOW | src/relay/git-handler-remote-sync.test.ts | 461 | execFileSync('git', ['config', 'user.email', 'test@test.com'], { | CODE |
| LOW | src/relay/git-handler-remote-sync.test.ts | 540 | execFileSync('git', ['config', 'user.email', 'test@test.com'], { | CODE |
| LOW | src/relay/git-handler-pull-reconciliation.test.ts | 56 | execGit(cwd, ['config', 'user.email', 'test@test.com']) | CODE |
| LOW | src/relay/integration.test.ts | 29 | execFileSync('git', ['config', 'user.email', 'test@test.com'], { cwd: dir, stdio: 'pipe' }) | CODE |
| LOW | …n/orca-profiles/profile-artifact-cloud-cleanup.test.ts | 198 | email: 'user@example.com', | CODE |
| LOW | …codex-accounts/service-reset-credit-durability.test.ts | 111 | email: 'user@example.com', | CODE |
| LOW | …codex-accounts/service-reset-credit-durability.test.ts | 230 | email: 'user@example.com', | CODE |
| LOW | …codex-accounts/service-reset-credit-durability.test.ts | 287 | email: 'user@example.com', | CODE |
| LOW | …codex-accounts/service-reset-credit-durability.test.ts | 359 | email: 'user@example.com', | CODE |
| LOW | …codex-accounts/service-reset-credit-durability.test.ts | 418 | email: 'user@example.com', | CODE |
| LOW | …codex-accounts/service-reset-credit-durability.test.ts | 471 | email: 'user@example.com', | CODE |
| LOW | …codex-accounts/service-reset-credit-durability.test.ts | 571 | email: 'user@example.com', | CODE |
| LOW | …odex-accounts/runtime-home-catalog-account-key.test.ts | 115 | createCodexAuthJson('user@example.com', 'acct-1', 'refresh-1') | CODE |
| LOW | …odex-accounts/runtime-home-catalog-account-key.test.ts | 121 | createCodexAccountRecord('account-1', 'user@example.com', 'acct-1', managedHomePath) | CODE |
| LOW | …x-accounts/service-reset-credit-home-ownership.test.ts | 212 | email: 'user@example.com', | CODE |
| LOW | src/main/codex-accounts/service.test.ts | 52 | email: 'user@example.com', | CODE |
| LOW | src/main/codex-accounts/service.test.ts | 90 | email: 'user@example.com', | CODE |
| 98 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | mobile/src/components/NewWorkspaceFab.tsx | 15 | // Phone-only floating "+" for creating a workspace. Absolutely positioned so it | COMMENT |
| MEDIUM | .github/workflows/win-crash-survival-e2e.yml | 5 | # update-survival harness. Builds an (unsigned) installer FROM THIS BRANCH, | COMMENT |
| MEDIUM | .github/workflows/win-crash-survival-e2e.yml | 44 | # This job only builds and runs the harness locally; it never pushes. | COMMENT |
| MEDIUM | .github/workflows/win-crash-survival-e2e.yml | 67 | # tests/reliability metadata so harness-only edits skip electron-builder. | COMMENT |
| MEDIUM | .github/workflows/win-crash-survival-e2e.yml | 129 | # Why: silent-install the branch build so the crash harness has a packaged | COMMENT |
| MEDIUM | .github/workflows/win-crash-survival-e2e.yml | 131 | # location (%LOCALAPPDATA%\Programs\Orca), which the harness auto-locates. | COMMENT |
| MEDIUM | .github/workflows/pr.yml | 917 | # Why fetch-depth 0: the harness extracts the newest release tag to skew | COMMENT |
| MEDIUM | .github/workflows/pr.yml | 1351 | # Why this is not in verify's needs: it is the first PR-gate run of a harness whose reliability | COMMENT |
| MEDIUM⚡ | .github/workflows/release-cut.yml | 1883 | # pristine elevate.exe from its download cache over resources\elevate.exe | COMMENT |
| MEDIUM⚡ | .github/workflows/release-cut.yml | 1889 | # so later runs may see elevate.exe as already signed and skip staging it — | COMMENT |
| MEDIUM⚡ | .github/workflows/release-cut.yml | 1891 | # elevate.exe in the shipped installer unconditionally. | COMMENT |
| MEDIUM⚡ | .github/workflows/release-cut.yml | 1896 | # shipped an unsigned elevate.exe that way. A miss now fails the step. | COMMENT |
| MEDIUM | .github/workflows/release-cut.yml | 1908 | # test-certificate elevate.exe must never be staged into a release cache. | COMMENT |
| MEDIUM | .github/workflows/release-cut.yml | 2172 | # Why elevate.exe is always appended: staging skips already-signed | COMMENT |
| MEDIUM | .github/workflows/release-cut.yml | 2174 | # previously signed elevate.exe — so it may be absent from the list | COMMENT |
| MEDIUM | .github/workflows/windows-signing-rehearsal.yml | 360 | # exactly one file (resources\elevate.exe, below) and must not be | COMMENT |
| MEDIUM⚡ | .github/workflows/windows-signing-rehearsal.yml | 511 | # Why elevate.exe alone is advisory: app-builder-lib re-copies the | COMMENT |
| MEDIUM⚡ | .github/workflows/windows-signing-rehearsal.yml | 512 | # pristine cached elevate.exe over resources\elevate.exe on EVERY nsis | COMMENT |
| MEDIUM⚡ | .github/workflows/windows-signing-rehearsal.yml | 522 | # electron-builder cache ("Replace cached elevate.exe with the signed | COMMENT |
| MEDIUM | .github/workflows/windows-signing-rehearsal.yml | 536 | # Fixing elevate.exe belongs in its own PR - it is a UAC elevation | COMMENT |
| MEDIUM | .github/workflows/win-update-e2e.yml | 8 | # install, so running the harness on a machine with a real Orca install would | COMMENT |
| MEDIUM | .github/workflows/win-update-e2e.yml | 15 | # own tree. The paths filter keeps it to harness/workflow edits so ordinary | COMMENT |
| MEDIUM | .github/workflows/win-update-e2e.yml | 92 | # Why: the harness only needs its runtime deps (the Playwright Electron | COMMENT |
| MEDIUM | .github/workflows/win-update-e2e.yml | 98 | # installer, rather than deep inside the harness. | COMMENT |
| MEDIUM | .github/workflows/win-update-e2e.yml | 116 | # the harness installs to the default per-user location and owns it — the | COMMENT |
| MEDIUM | .github/workflows/win-update-e2e.yml | 123 | # Why: on a driving failure the harness dumps a screenshot + DOM state | COMMENT |
| MEDIUM | .github/workflows/win-orcad-serve-switch-e2e.yml | 49 | # Same key inputs as win-update-survival-e2e: a harness-only edit skips the installer build. | COMMENT |
| MEDIUM | .github/workflows/win-orcad-serve-switch-e2e.yml | 76 | # The win32-x64 template the harness drops into the install, which is where serve looks. | COMMENT |
| MEDIUM | .github/workflows/win-update-survival-e2e.yml | 5 | # BRANCH, then runs the win-update-e2e harness with --expect survival: install, | COMMENT |
| MEDIUM | .github/workflows/win-update-survival-e2e.yml | 67 | # This job only builds and runs the harness locally; it never pushes. | COMMENT |
| MEDIUM | .github/workflows/win-update-survival-e2e.yml | 81 | # harness-only edit skips the ~20 min electron-builder build. The daemon | COMMENT |
| MEDIUM | .github/workflows/win-update-survival-e2e.yml | 141 | # Only the harness and its children inherit the test policy. | COMMENT |
| MEDIUM | …mponents/activity/activity-portal-churn-budget.test.ts | 44 | // A user hopping between threads must keep the seamless path, however long they keep hopping. | COMMENT |
| MEDIUM | …/terminal-pane/terminal-render-desync-sentinel.test.ts | 183 | // count (not the write count) keeps this robust to persist microtask depth. | COMMENT |
| MEDIUM | …nts/feature-wall/agents-orchestration/StatusesPage.tsx | 211 | // -50% translate loop reads as seamless infinite scroll. | COMMENT |
| MEDIUM | …/renderer/src/components/editor/monaco-reveal-range.ts | 21 | // to a one-column range keeps reveal robust if stale or malformed payloads | COMMENT |
| MEDIUM | …n/daemon/headless-emulator-snapshot-cost.bench.test.ts | 193 | describe.skipIf(!benchEnabled)('headless emulator snapshot cost (issue #5096 harness)', () => { | CODE |
| MEDIUM | …main/antigravity/windows-hook-payload-delivery.test.ts | 97 | // expansion (#9358/#9941), and a harness pinned to `/v:off` could never fail on it. | COMMENT |
| MEDIUM | src/main/stats/collector.ts | 194 | // keep stat recording robust — a buggy listener must not lose the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cloud/apps/relay/src/cell-flags.ts | 14 | // Step 5: `reserve` admits booked and recently seated hosts without the database. | COMMENT |
| LOW | cloud/apps/relay/src/assignment-store.ts | 150 | // Step 5: the flag workflow records each cell's admitMode here (reserve before the cell's | COMMENT |
| LOW | cloud/apps/relay/src/assignment-store.ts | 989 | // Step 5: a fresh placement may first be booked on a reserve-mode cell, outside any | COMMENT |
| LOW | cloud/apps/relay/src/app.ts | 445 | // Step 5: switched-on cells answer from the map; anything else keeps today's path below. | COMMENT |
| LOW | cloud/apps/relay/src/app.ts | 1230 | // Step 5: the flag workflow's record of a cell's admitMode, which every sweep reads. Without | COMMENT |
| LOW | cloud/apps/relay/src/shadow-seat-directory.ts | 6 | // Step 3: each director polls every cell's seat feed and keeps who is seated | COMMENT |
| LOW | cloud/apps/relay/src/shadow-seat-directory.ts | 33 | // Step 5: on `reserve`, and on the join a booking admitted. | COMMENT |
| LOW | cloud/apps/relay/src/shadow-seat-directory.ts | 65 | // Step 5: live bookings, every unit the cell's ledger counts, and its placement ceiling. | COMMENT |
| LOW | cloud/apps/relay/src/shadow-seat-directory.ts | 148 | // Step 5: when the answered poll was sent, and the cell's own reserve numbers. | COMMENT |
| LOW | cloud/apps/relay/src/shadow-directory-compare.ts | 4 | // Step 3: compares the shadow seat map with the database answer on the two | COMMENT |
| LOW | cloud/apps/relay/src/relay-observability.ts | 66 | // Step 5: a starting director's map, a never-seen host with the database down, or intake. | COMMENT |
| LOW | cloud/apps/relay/src/cell-seat-feed-route.ts | 27 | // Step 5: what a director needs to estimate a seat and a booking here. | COMMENT |
| LOW | cloud/apps/relay/src/relay-server.ts | 319 | // Step 5: a booking may fill the cell only to the ceiling the directors place against. | COMMENT |
| LOW | …er/src/components/automations/AutomationsPage.test.tsx | 339 | // Step 6: the request names the owner captured when the row was listed. | COMMENT |
| LOW | …er/src/components/automations/AutomationsPage.test.tsx | 373 | // Step 6: hydration re-reads the row's own scope; the ambient list is untouched. | COMMENT |
| LOW⚡ | src/shared/terminal-synchronized-output-scan.ts | 132 | // Step 1: never hand over a severed marker. If an ESC near the boundary cannot | COMMENT |
| LOW | src/shared/terminal-synchronized-output-scan.ts | 143 | // Step 2: the delivered half must not end inside an open frame. | COMMENT |
| LOW⚡ | src/main/rate-limits/opencode-go-usage-fetcher.ts | 179 | // Step 1: resolve workspace IDs to try. | COMMENT |
| LOW | src/main/daemon/daemon-provider-restart.ts | 55 | // Step 1: synthesize pty:exit for every active session BEFORE teardown — the daemon's shutdown path never fans onExit | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 72 | // Step 2: detach renderer listeners — after step 1 (so synthesized exits land) and before step 6 (no stale binding). | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 75 | // Step 3: kill the current-protocol daemon process; legacy adapters untouched. | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 80 | // Step 4: reuse the existing spawner so the respawn closure baked into long-lived adapters stays valid (do NOT new | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 89 | // Step 5: build a fresh current adapter against the respawned daemon. | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 154 | // Step 6: swap module state (adapter + localProvider) atomically. | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 157 | // Step 7: rebind renderer listeners against the new provider. | COMMENT |
| LOW | src/main/daemon/daemon-init-restart-sequence.test.ts | 210 | // Step 7: rebind must run *after* Step 6 (the provider swap). | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 64 | // Step 1: write reattach payload (what pty-connection writes to xterm.js) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 66 | // Step 2: write SIGWINCH repaint data (what the TUI sends after receiving SIGWINCH) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 361 | // Step 1: write snapshot (simulating pty-connection) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 365 | // Step 2: NO clear — cursor stays where snapshot left it (end of line 3) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 367 | // Step 3: Ink-style SIGWINCH repaint: move cursor up 3 lines, | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 389 | // Step 1: write snapshot (3 lines, cursor at end of line 3) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 392 | // Step 2: clear — cursor moves to (1,1) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 395 | // Step 3: Ink-style repaint: cursor-up-3 from (1,1) → clamped to (1,1) | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 154 | // Step 1: register handlers and trigger initial cache build with only | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 162 | // Step 2: simulate the CLI creating a new worktree — git now lists it, | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 181 | // Step 3: branchCompare on the new worktree should fail — this is the | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 190 | // Step 4: invalidate the cache (what our fix does after CLI create). | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 193 | // Step 5: the same branchCompare should now succeed. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cloud/apps/relay/src/assignment-store.ts | 150 | // Step 5: the flag workflow records each cell's admitMode here (reserve before the cell's | COMMENT |
| LOW | cloud/apps/relay/src/assignment-store.ts | 989 | // Step 5: a fresh placement may first be booked on a reserve-mode cell, outside any | COMMENT |
| LOW | cloud/apps/relay/src/app.ts | 445 | // Step 5: switched-on cells answer from the map; anything else keeps today's path below. | COMMENT |
| LOW | cloud/apps/relay/src/app.ts | 1230 | // Step 5: the flag workflow's record of a cell's admitMode, which every sweep reads. Without | COMMENT |
| LOW | cloud/apps/relay/src/shadow-seat-directory.ts | 6 | // Step 3: each director polls every cell's seat feed and keeps who is seated | COMMENT |
| LOW | cloud/apps/relay/src/shadow-seat-directory.ts | 33 | // Step 5: on `reserve`, and on the join a booking admitted. | COMMENT |
| LOW | cloud/apps/relay/src/shadow-seat-directory.ts | 65 | // Step 5: live bookings, every unit the cell's ledger counts, and its placement ceiling. | COMMENT |
| LOW | cloud/apps/relay/src/shadow-seat-directory.ts | 148 | // Step 5: when the answered poll was sent, and the cell's own reserve numbers. | COMMENT |
| LOW | cloud/apps/relay/src/shadow-directory-compare.ts | 4 | // Step 3: compares the shadow seat map with the database answer on the two | COMMENT |
| LOW | cloud/apps/relay/src/relay-observability.ts | 66 | // Step 5: a starting director's map, a never-seen host with the database down, or intake. | COMMENT |
| LOW | cloud/apps/relay/src/cell-seat-feed-route.ts | 27 | // Step 5: what a director needs to estimate a seat and a booking here. | COMMENT |
| LOW | cloud/apps/relay/src/relay-server.ts | 319 | // Step 5: a booking may fill the cell only to the ceiling the directors place against. | COMMENT |
| LOW | …er/src/components/automations/AutomationsPage.test.tsx | 339 | // Step 6: the request names the owner captured when the row was listed. | COMMENT |
| LOW | …er/src/components/automations/AutomationsPage.test.tsx | 373 | // Step 6: hydration re-reads the row's own scope; the ambient list is untouched. | COMMENT |
| LOW⚡ | src/shared/terminal-synchronized-output-scan.ts | 132 | // Step 1: never hand over a severed marker. If an ESC near the boundary cannot | COMMENT |
| LOW | src/shared/terminal-synchronized-output-scan.ts | 143 | // Step 2: the delivered half must not end inside an open frame. | COMMENT |
| LOW⚡ | src/main/rate-limits/opencode-go-usage-fetcher.ts | 179 | // Step 1: resolve workspace IDs to try. | COMMENT |
| LOW | src/main/daemon/daemon-provider-restart.ts | 55 | // Step 1: synthesize pty:exit for every active session BEFORE teardown — the daemon's shutdown path never fans onExit | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 72 | // Step 2: detach renderer listeners — after step 1 (so synthesized exits land) and before step 6 (no stale binding). | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 75 | // Step 3: kill the current-protocol daemon process; legacy adapters untouched. | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 80 | // Step 4: reuse the existing spawner so the respawn closure baked into long-lived adapters stays valid (do NOT new | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 89 | // Step 5: build a fresh current adapter against the respawned daemon. | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 154 | // Step 6: swap module state (adapter + localProvider) atomically. | COMMENT |
| LOW⚡ | src/main/daemon/daemon-provider-restart.ts | 157 | // Step 7: rebind renderer listeners against the new provider. | COMMENT |
| LOW | src/main/daemon/daemon-init-restart-sequence.test.ts | 210 | // Step 7: rebind must run *after* Step 6 (the provider swap). | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 64 | // Step 1: write reattach payload (what pty-connection writes to xterm.js) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 66 | // Step 2: write SIGWINCH repaint data (what the TUI sends after receiving SIGWINCH) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 361 | // Step 1: write snapshot (simulating pty-connection) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 365 | // Step 2: NO clear — cursor stays where snapshot left it (end of line 3) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 367 | // Step 3: Ink-style SIGWINCH repaint: move cursor up 3 lines, | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 389 | // Step 1: write snapshot (3 lines, cursor at end of line 3) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 392 | // Step 2: clear — cursor moves to (1,1) | COMMENT |
| LOW⚡ | src/main/daemon/reattach-snapshot.test.ts | 395 | // Step 3: Ink-style repaint: cursor-up-3 from (1,1) → clamped to (1,1) | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 154 | // Step 1: register handlers and trigger initial cache build with only | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 162 | // Step 2: simulate the CLI creating a new worktree — git now lists it, | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 181 | // Step 3: branchCompare on the new worktree should fail — this is the | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 190 | // Step 4: invalidate the cache (what our fix does after CLI create). | COMMENT |
| LOW⚡ | src/main/ipc/filesystem-branch-compare-diff.test.ts | 193 | // Step 5: the same branchCompare should now succeed. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | skill-guides/orchestration.md | 13 | # Orca orchestration | COMMENT |
| MEDIUM | src/shared/agent-session-conversation-outline.ts | 127 | // Newest first, so a long agentic turn reads one message, not every aside before it. | COMMENT |
| MEDIUM | src/cli/bundled-skill-guides.ts | 24 | const ORCA_CLI_MARKDOWN = "---\nname: orca-cli\ndescription: >-\n Operate Orca-managed worktrees, folder contexts, term | CODE |
| MEDIUM | src/cli/bundled-skill-guides.ts | 27 | const ORCA_CLI_FULL_MARKDOWN = "---\nname: orca-cli\ndescription: >-\n Operate Orca-managed worktrees, folder contexts, | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 48 | const ORCA_PER_WORKSPACE_ENV_MARKDOWN = "---\nname: orca-per-workspace-env\ndescription: >-\n Set up, review, debug, or | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 51 | const ORCA_PER_WORKSPACE_ENV_FULL_MARKDOWN = "---\nname: orca-per-workspace-env\ndescription: >-\n Set up, review, debu | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 51 | const ORCA_PER_WORKSPACE_ENV_FULL_MARKDOWN = "---\nname: orca-per-workspace-env\ndescription: >-\n Set up, review, debu | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 66 | const ORCA_PER_WORKSPACE_ENV_WINDOWS_SCRIPTS_REFERENCE_MARKDOWN = "# Windows local-side scripts\n\nLoad this when the us | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 69 | const ORCHESTRATION_MARKDOWN = "---\nname: orchestration\ndescription: >-\n Coordinate supervised Orca workers: threade | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 72 | const ORCHESTRATION_FULL_MARKDOWN = "---\nname: orchestration\ndescription: >-\n Coordinate supervised Orca workers: th | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 75 | const ORCHESTRATION_COORDINATOR_LOOP_REFERENCE_MARKDOWN = "# Coordinator loop\n\nLoad this reference for expanded DAG wa | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 78 | const ORCHESTRATION_LEGACY_CONTRACT_MIGRATION_REFERENCE_MARKDOWN = "# Legacy contract migration\n\nLoad this reference o | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 81 | const ORCHESTRATION_LOW_LEVEL_TOPOLOGY_REFERENCE_MARKDOWN = "# Low-level topology\n\nLoad this reference only when `work | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 84 | const ORCHESTRATION_MESSAGING_AND_GATES_REFERENCE_MARKDOWN = "# Messaging and gates\n\nLoad this reference for inbox rep | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 87 | const ORCHESTRATION_PLACEMENT_AND_REMOTE_REFERENCE_MARKDOWN = "# Placement and remote execution\n\nLoad this reference b | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 90 | const ORCHESTRATION_RECOVERY_AND_CLEANUP_REFERENCE_MARKDOWN = "# Recovery and cleanup\n\nLoad this reference only after | CODE |
| MEDIUM⚡ | src/cli/bundled-skill-guides.ts | 93 | const ORCHESTRATION_WORKER_CONTRACT_REFERENCE_MARKDOWN = "# Worker contract\n\nThe injected preamble is authoritative. C | CODE |
| MEDIUM⚡ | src/main/skills/skill-discovery-wsl-bash-filter.test.ts | 33 | await writeSkill(root, 'empty-quoted', '---\nname: ""\n---\n# orchestration\n') | CODE |
| MEDIUM⚡ | src/main/skills/skill-discovery-wsl-bash-filter.test.ts | 34 | await writeSkill(root, 'one-quote', '---\nname: "\n---\n# orchestration\n') | CODE |
| MEDIUM⚡ | src/main/skills/skill-discovery-wsl-bash-filter.test.ts | 38 | await writeSkill(root, 'missing-close', '---\nname: unrelated\n# orchestration\n') | CODE |
| MEDIUM⚡ | src/main/skills/skill-discovery-wsl-bash-filter.test.ts | 48 | `---\ndescription: |\n${' x\n'.repeat(70_000)}name: unrelated\n---\n# orchestration\n` | CODE |
| MEDIUM⚡ | src/main/skills/skill-discovery-wsl-bash-filter.test.ts | 53 | `---\ndescription: ${'한'.repeat(90_000)}\nname: unrelated\n---\n# orchestration\n` | CODE |
| MEDIUM | src/main/skills/discovery.test.ts | 226 | await writeFile(join(repoSkill, 'SKILL.md'), '# orchestration') | CODE |
| MEDIUM | src/main/skills/discovery.test.ts | 348 | await writeFile(join(claudeSkills, 'orchestration', 'SKILL.md'), '# orchestration') | CODE |
| MEDIUM | src/main/skills/discovery.test.ts | 531 | await writeFile(join(realSkill, 'SKILL.md'), '# orchestration\n\nCoordinate agents.') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | mobile/src/components/MobileMarkdown.test.ts | 161 | expect(normalizeMobileMarkdownPreviewHtml('Replace <your-api-key> now')).toBe( | CODE |
| HIGH⚡ | mobile/src/components/MobileMarkdown.test.ts | 162 | 'Replace <your-api-key> now' | CODE |
| HIGH⚡ | mobile/src/components/MobileMarkdown.test.ts | 166 | '<span title="</your-api-key>"></span> Replace <your-api-key> now' | CODE |
| HIGH⚡ | mobile/src/components/MobileMarkdown.test.ts | 168 | ).toBe('Replace <your-api-key> now') | CODE |
| HIGH⚡ | mobile/src/components/MobileMarkdown.test.ts | 174 | '<span title=</your-api-key>></span> Replace <your-api-key> now' | CODE |
| HIGH⚡ | mobile/src/components/MobileMarkdown.test.ts | 176 | ).toBe('Replace <your-api-key> now') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | README.md | 127 | <a href="https://www.onorca.dev/docs/review/annotate-ai-diff"><picture><source srcset="docs/site/public/docs/annotate- | CODE |
| HIGH | …c/components/feature-wall/ReviewShipAnimatedVisual.tsx | 20 | // the user sees commit + PR generated by AI back-to-back. | COMMENT |
| HIGH | src/main/ai-vault/session-scanner-opencode-parser.ts | 115 | // Why: the summary fallbacks are AI-generated. Seed the copyable first | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | native/computer-use-linux/runtime.py | 68 | except Exception: | CODE |
| LOW | native/computer-use-linux/runtime.py | 1134 | except Exception: | CODE |
| LOW | native/computer-use-linux/runtime.py | 1149 | except Exception as exc: | CODE |
| MEDIUM | native/computer-use-linux/runtime.py | 64 | def attempt(fn, fallback=None): | CODE |
| MEDIUM | native/computer-use-linux/runtime.py | 803 | def require_positive_integer(value, name): | CODE |
| MEDIUM | native/computer-use-linux/runtime.py | 1143 | def main(): | CODE |
| MEDIUM | …bile/packages/expo-two-way-audio/ios/AudioEngine.swift | 139 | print("Error: Could not access channel data") | CODE |
| MEDIUM | …bile/packages/expo-two-way-audio/ios/AudioEngine.swift | 164 | print("Error: Could not access channel data") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | native/computer-use-linux/runtime.py | 788 | def perform_action(node, index): | CODE |
| LOW | mobile/scripts/mock-server-rpc-handlers.ts | 107 | export function handleRequest( | CODE |
| LOW | …r/src/components/terminal-pane/pty-output-processor.ts | 203 | function processData( | CODE |
| LOW | …wser-pane/browser-client-page-renderer-installation.ts | 89 | async function handleRequest( | CODE |
| LOW | src/shared/remote-runtime-shared-control-test-server.ts | 152 | function handleRequest( | CODE |
| LOW | src/main/usage/usage-scan-worker-entry.ts | 180 | async function handleRequest(request: UsageScanWorkerRequest): Promise<UsageScanWorkerResponse> { | CODE |
| LOW | src/main/ai-vault/session-scanner-service-entry.ts | 122 | async function handleRequest(request: AiVaultServiceRequest): Promise<void> { | CODE |
| LOW | src/main/ports/port-scan-command-worker-entry.ts | 24 | async function handleRequest(request: PortScanCommandRequest): Promise<PortScanCommandResponse> { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | native/computer-use-linux/runtime.py | 349 | CODE | |
| LOW | native/computer-use-linux/runtime.py | 1027 | CODE | |
| LOW | native/computer-use-linux/runtime.py | 354 | CODE | |
| LOW | native/computer-use-linux/runtime.py | 358 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config/scripts/dev-fresh-profile.sh | 6 | # Usage: | COMMENT |
| LOW | config/scripts/macos-launch-diagnostics.sh | 4 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cloud/infra/terraform/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | resources/notebook/kernel-bridge.py | 48 | CODE |