The fastest, cheapest, most efficient open-source agent harness. Run more than 500 agents on a $10 VPS.
This report summarizes scanner evidence for tinyhumansai/openhuman, a Rust project with 41,795 GitHub stars. SynthScan examined 1,334,019 lines of code across 6344 source files, recording 6606 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 8.5 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 4422 finding(s).
Are imports declared and package/API names verified? 21 finding(s).
Are wrappers, guards, and repeated structures necessary? 2436 finding(s).
Which changes need focused human review? 6606 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 6606 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …/openhuman-tinyhumans/src/hosted/referral/ops_tests.rs | 63 | // ── credential resolution ──────────────────────────────── | COMMENT |
| MEDIUM | …/openhuman-tinyhumans/src/hosted/referral/ops_tests.rs | 94 | // ── get_stats ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/openhuman-tinyhumans/src/hosted/referral/ops_tests.rs | 121 | // ── claim_referral ─────────────────────────────────────────── | COMMENT |
| MEDIUM | …/openhuman-tinyhumans/src/hosted/webhooks/ops_tests.rs | 13 | // ── validation runs before the credential ───────────────────── | COMMENT |
| MEDIUM | …/openhuman-tinyhumans/src/hosted/webhooks/ops_tests.rs | 67 | // ── SDK round-trips against a mock backend ──────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/hosted/billing/ops.rs | 300 | // ── Coupon operations ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/openhuman-tinyhumans/src/backend/url.rs | 23 | //! ┌──────────┴──────────┐ | COMMENT |
| MEDIUM⚡ | crates/openhuman-tinyhumans/src/backend/url.rs | 25 | //! └──────────┬──────────┘ | COMMENT |
| MEDIUM⚡ | crates/openhuman-tinyhumans/src/backend/url.rs | 27 | //! ┌───────────────┼────────────────────┐ | COMMENT |
| MEDIUM⚡ | crates/openhuman-tinyhumans/src/backend/url.rs | 245 | /// ┌─ path ends with /v1/chat/completions ─────────────────────────────► TRUE | COMMENT |
| MEDIUM⚡ | crates/openhuman-tinyhumans/src/backend/url.rs | 249 | /// AND (port ∈ LOCAL_AI_PORTS OR path starts with /v1/) ──────────► TRUE | COMMENT |
| MEDIUM⚡ | crates/openhuman-tinyhumans/src/backend/url.rs | 251 | /// everything else ────────────────────────────────────────────────────► FALSE | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 50 | // ─── Public constants ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 68 | // ─── Known local-AI ports ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 85 | // ─── Effective URL resolvers ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 232 | // ─── URL classification ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 274 | // ── Signal 1: chat-completions path (wins regardless of host) ────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 280 | // ── Signal 2: loopback / private host + secondary LLM signal ─────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 366 | // ── Signal 1: known managed provider host (apex or subdomain) ────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 377 | // ── Signal 2: OpenAI-compatible bare `/v1` or `/api/v1` base path ────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 439 | // ─── Environment resolution ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 483 | // ─── Compile-time env accessors ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 499 | // ─── Logging helpers ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 523 | // ─── Private utilities ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url.rs | 550 | // ─── Tests ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 5 | // ── Test infrastructure ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 54 | // ── api_url ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 148 | // ── normalize_api_base_url ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 183 | // ── normalize_backend_api_base_url ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 215 | // ── app / api env resolution ────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 268 | // ── looks_like_local_ai_endpoint ───────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 362 | // ── openhuman_backend detection ─────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 380 | // ── effective_backend_api_url ───────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 494 | // ── GH #4153: remote managed inference providers parked in `api_url` ────── | COMMENT |
| MEDIUM | crates/openhuman-tinyhumans/src/backend/url_tests.rs | 494 | // ── GH #4153: remote managed inference providers parked in `api_url` ────── | COMMENT |
| MEDIUM | …openhuman-rpc/src/server/http/inference_route_tests.rs | 58 | // ── Tests ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 85 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 87 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 93 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 95 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 103 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 105 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 112 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 114 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 125 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 127 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 131 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 133 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 142 | # ========================= | COMMENT |
| MEDIUM⚡ | …ates/openhuman-app/permissions/allow-core-process.toml | 144 | # ========================= | COMMENT |
| MEDIUM | …ates/openhuman-app/permissions/allow-core-process.toml | 9 | # ========================= | COMMENT |
| MEDIUM | …ates/openhuman-app/permissions/allow-core-process.toml | 11 | # ========================= | COMMENT |
| MEDIUM | …ates/openhuman-app/permissions/allow-core-process.toml | 71 | # ========================= | COMMENT |
| MEDIUM | …ates/openhuman-app/permissions/allow-core-process.toml | 73 | # ========================= | COMMENT |
| MEDIUM | …ates/openhuman-app/permissions/allow-core-process.toml | 158 | # ========================= | COMMENT |
| MEDIUM | …ates/openhuman-app/permissions/allow-core-process.toml | 160 | # ========================= | COMMENT |
| MEDIUM | …ates/openhuman-app/permissions/allow-core-process.toml | 172 | # ========================= | COMMENT |
| MEDIUM | …ates/openhuman-app/permissions/allow-core-process.toml | 174 | # ========================= | COMMENT |
| MEDIUM | crates/openhuman-app/src/loopback_oauth_tests.rs | 33 | // ── classify_request ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/openhuman-app/src/loopback_oauth_tests.rs | 129 | // ── bind_loopback (integration: real OS socket) ───────────────────────── | COMMENT |
| 2097 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 1 | # Virtual workspace root. Members: `crates/openhuman-core` (package `openhuman`, | COMMENT |
| LOW | build.rs | 1 | //! Build script for the `openhuman` core crate. | COMMENT |
| LOW | build.rs | 21 | //! | COMMENT |
| LOW | docker-compose.yml | 1 | # OpenHuman Core — Docker Compose for self-hosted cloud deploy. | COMMENT |
| LOW | rust-toolchain.toml | 1 | [toolchain] | COMMENT |
| LOW | pnpm-workspace.yaml | 1 | packages: | COMMENT |
| LOW | .config/nextest.toml | 1 | # cargo-nextest settings. CI Fast's coverage lane runs the Rust suites with | COMMENT |
| LOW | .fly/fly.toml | 1 | # .fly/fly.toml — openhuman-core on Fly.io | COMMENT |
| LOW | crates/openhuman-tinyhumans/Cargo.toml | 41 | whatsapp-web = ["openhuman-embed/whatsapp-web"] | COMMENT |
| LOW | crates/openhuman-tinyhumans/Cargo.toml | 101 | # core once per distinct feature set of its dependencies, and the tests of | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/runtime.rs | 1 | //! [`RuntimeBuilder`]: an [`openhuman_embed::RuntimeBuilder`] that comes up | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/lib.rs | 1 | //! OpenHuman on the hosted TinyHumans backend. | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/lib.rs | 21 | //! | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/lib.rs | 41 | //! come through embed's `#[doc(hidden)] __host` list; it re-exports only its | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/jwt.rs | 1 | //! JWT helpers for TinyHumans session tokens, from the SDK. | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/install.rs | 21 | /// What [`install`] sets up. | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/install.rs | 181 | Ok(Wiring { | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/hosted/client.rs | 1 | //! The one way a hosted domain reaches the TinyHumans backend: a typed | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/hosted/mod.rs | 1 | //! Clients of the hosted TinyHumans backend. | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/hosted/mod.rs | 21 | //! (`auth.create_channel_link_token`, `channels.telegram_login_*`, | COMMENT |
| LOW | …es/openhuman-tinyhumans/src/hosted/channel_link/mod.rs | 1 | //! Linking the managed TinyHumans Telegram / Discord bots to the user's | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/hosted/oauth/types.rs | 1 | //! Serde shapes of the backend-brokered OAuth payloads (unchanged wire | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/hosted/oauth/handoff.rs | 41 | COMMENT | |
| LOW | crates/openhuman-tinyhumans/src/hosted/oauth/mod.rs | 1 | //! Backend-brokered OAuth integrations (`/auth/{provider}/connect`, | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/hosted/team/ops.rs | 1 | //! Team management RPC ops — thin adapters over the SDK's typed `teams()` | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/hosted/billing/ops.rs | 1 | //! Billing and payment RPC ops — thin adapters over the SDK's typed | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/mod.rs | 1 | //! Everything host-specific about reaching the TinyHumans backend: where it | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/headers.rs | 1 | //! Attribution headers and `reqwest` client profiles for TinyHumans backend | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/product.rs | 1 | //! Product identity attached to every backend-bound HTTP request. | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/product.rs | 21 | //! } | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/product.rs | 41 | /// Upper bound on the emitted header value. Mirrors the cap | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 1 | //! # API URL resolution & classification | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 21 | //! config.api_url | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 61 | /// OpenAI-compatible inference proxy. Joined onto [`effective_api_url`] when | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 81 | /// | 1234 | LM Studio | | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 121 | /// not for backend domain calls). | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 141 | /// **and** does not [`looks_like_openhuman_backend_endpoint`]. In that case | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 181 | // our own hosted backends (user deliberately set `api_url` to | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 221 | warn_backend_url_fallback_once(u); | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 241 | /// | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/backend/url.rs | 521 | } | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/jev/mod.rs | 1 | //! The Jev-backed `tool_search` ranker for a TinyHumans-connected core. | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/session/link.rs | 21 | /// message. | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/session/manager.rs | 41 | Rejected(String), | COMMENT |
| LOW | …ates/openhuman-tinyhumans/src/session/manager_tests.rs | 421 | .iter() | COMMENT |
| LOW | …ates/openhuman-tinyhumans/src/session/manager_tests.rs | 501 | /// just the core credential (matrix 1.4.3). | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/session/identity.rs | 1 | //! Process-global, synchronous peek at the signed-in user id. | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/session/mod.rs | 1 | //! TinyHumans login and backend-session ownership for OpenHuman hosts. | COMMENT |
| LOW | crates/openhuman-tinyhumans/src/session/cache_tests.rs | 141 | COMMENT | |
| LOW | crates/openhuman-rpc/src/host.rs | 1 | //! The shared host boot: one entry per host shape, so each host's `main` | COMMENT |
| LOW | crates/openhuman-rpc/src/host.rs | 21 | //! life of the process (see `server::shims::build_and_serve`), exactly as the | COMMENT |
| LOW | crates/openhuman-rpc/src/host.rs | 121 | /// backend itself, following the dispatcher's own grammar | COMMENT |
| LOW | crates/openhuman-rpc/src/host.rs | 301 | /// `CoreRuntime`. | COMMENT |
| LOW | crates/openhuman-rpc/src/lib.rs | 1 | //! OpenHuman's JSON-RPC protocol, on both sides of the wire. | COMMENT |
| LOW | crates/openhuman-rpc/src/lib.rs | 21 | //! [`http_host`], the static-directory file server whose `http_host.*` | COMMENT |
| LOW | crates/openhuman-rpc/src/envelope.rs | 1 | //! JSON-RPC 2.0 request and response envelopes. | COMMENT |
| LOW | crates/openhuman-rpc/src/envelope.rs | 21 | #[derive(Debug, Deserialize)] | COMMENT |
| LOW | crates/openhuman-rpc/src/envelope.rs | 61 | /// Contains a code, a message, and optional extra data for debugging. | COMMENT |
| LOW | crates/openhuman-rpc/src/origin.rs | 1 | //! Which browser origins may call a core's HTTP API. | COMMENT |
| LOW | crates/openhuman-rpc/src/origin.rs | 21 | //! extra allowlist in, which keeps this crate free of I/O and makes the rule | COMMENT |
| 3749 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/vite.config.ts | 88 | function guardCefRelListSupportsPlugin(): PluginOption { | CODE |
| LOW | app/test/wdio.conf.ts | 62 | async function resetMockBackendOncePerSpecFile(specFile: string | undefined): Promise<void> { | CODE |
| LOW | app/test/playwright/specs/notifications.spec.ts | 18 | async function waitForNotificationsSections(page: Page): Promise<void> { | CODE |
| LOW | app/test/playwright/specs/voice-mode.spec.ts | 62 | async function switchChatIntoMicComposer(page: Page): Promise<void> { | CODE |
| LOW | app/test/playwright/specs/app-shell-responsive.spec.ts | 30 | async function documentOverflowsHorizontally(page: Page): Promise<boolean> { | CODE |
| LOW | …test/playwright/specs/settings-advanced-config.spec.ts | 21 | async function waitForAdvancedRouteReady(page: Page): Promise<void> { | CODE |
| LOW | …playwright/specs/settings-channels-permissions.spec.ts | 10 | async function getDefaultMessagingChannel( | CODE |
| LOW | …/playwright/specs/settings-feature-preferences.spec.ts | 24 | async function getDefaultMessagingChannel(page: Page): Promise<string | null> { | CODE |
| LOW | …/playwright/specs/settings-feature-preferences.spec.ts | 89 | async function getPersistedSelectedMascotId(page: Page): Promise<string | null> { | CODE |
| LOW | …/playwright/specs/settings-feature-preferences.spec.ts | 108 | async function installMascotManifestMock(page: Page): Promise<void> { | CODE |
| LOW | …/playwright/specs/settings-account-preferences.spec.ts | 28 | async function ensureRecoveryPhraseGenerateMode(page: Page): Promise<void> { | CODE |
| LOW | app/test/playwright/specs/onboarding-modes.spec.ts | 47 | async function expectOnboardingCompleted(): Promise<void> { | CODE |
| LOW | app/test/playwright/specs/onboarding-modes.spec.ts | 66 | async function ensureHomeOrForceComplete(page: Page): Promise<void> { | CODE |
| LOW | …est/playwright/specs/privacy-what-leaves-sheet.spec.ts | 38 | async function bootIntoOnboardingWelcome(page: Page, userId: string): Promise<void> { | CODE |
| LOW | …est/playwright/specs/privacy-what-leaves-sheet.spec.ts | 68 | async function openSheetAndAssertDescribed(page: Page): Promise<void> { | CODE |
| LOW | app/test/playwright/helpers/core-rpc.ts | 78 | async function applyBrowserCoreModeInPage(page: Page): Promise<void> { | CODE |
| LOW | app/test/playwright/helpers/core-rpc.ts | 134 | export async function bootRuntimeReadyGuestPage(page: Page): Promise<void> { | CODE |
| LOW | app/test/playwright/helpers/core-rpc.ts | 149 | export async function bootRuntimeReadyExistingSessionPage(page: Page): Promise<void> { | CODE |
| LOW | app/test/playwright/helpers/core-rpc.ts | 332 | export async function dismissWalkthroughIfPresent(page: Page): Promise<void> { | CODE |
| LOW | app/test/playwright/helpers/core-rpc.ts | 415 | async function waitForAuthenticatedSnapshot(page: Page): Promise<void> { | CODE |
| LOW | app/test/e2e/specs/notifications.spec.ts | 30 | async function waitForNotificationsSections(timeout = 10_000): Promise<void> { | CODE |
| LOW | app/test/e2e/specs/chat-harness-wallet-flow.spec.ts | 71 | async function clickRecoveryConsentCheckbox(): Promise<void> { | CODE |
| LOW | app/test/e2e/specs/guided-tour-gates.spec.ts | 116 | async function dispatchWalkthroughRestart(): Promise<void> { | CODE |
| LOW | app/test/e2e/specs/credential-channels-flow.spec.ts | 49 | async function startImapHandshakeRejector(): Promise<{ | CODE |
| LOW | app/test/e2e/specs/credential-channels-flow.spec.ts | 75 | function seedEmailConfigForDisconnect(contents: string): string { | CODE |
| LOW | app/test/e2e/specs/settings-feature-preferences.spec.ts | 34 | async function defaultMessagingChannelFromStore(): Promise<string | null> { | CODE |
| LOW | app/test/e2e/specs/chat-harness-subagent.spec.ts | 136 | async function hasRenderedSubagentTimeline(): Promise<boolean> { | CODE |
| LOW | app/test/e2e/specs/harness-channel-bridge-flow.spec.ts | 144 | async function disconnectTelegramChannel(): Promise<void> { | CODE |
| LOW | app/test/e2e/helpers/shared-flows.ts | 62 | export async function waitForAddAccountModalClosed(timeout = 5_000): Promise<void> { | CODE |
| LOW | app/test/e2e/helpers/shared-flows.ts | 571 | async function onboardingOverlayLikelyVisible(): Promise<boolean> { | CODE |
| LOW | app/test/e2e/helpers/shared-flows.ts | 590 | export async function waitForOnboardingOverlayVisible(timeout = 10_000): Promise<boolean> { | CODE |
| LOW | app/test/e2e/helpers/shared-flows.ts | 599 | export async function dismissWalkthroughIfVisible(timeout = 6_000): Promise<boolean> { | CODE |
| LOW | app/test/e2e/helpers/shared-flows.ts | 639 | export async function dismissBootCheckGateIfVisible(timeoutMs = 12_000): Promise<boolean> { | CODE |
| LOW | app/test/e2e/helpers/shared-flows.ts | 679 | async function waitForPostOnboardingHome(logPrefix, timeout = 20_000) { | CODE |
| LOW | app/test/e2e/helpers/shared-flows.ts | 831 | export async function completeOnboardingIfVisible(logPrefix = '[E2E]') { | CODE |
| LOW | app/test/e2e/helpers/loopback-auth-helpers.ts | 155 | async function dismissBootCheckGateInline(): Promise<void> { | CODE |
| LOW | app/test/e2e/helpers/loopback-auth-helpers.ts | 174 | export async function triggerAuthLoopbackBypass(userId: string = 'e2e-user'): Promise<void> { | CODE |
| LOW | app/test/e2e/helpers/deep-link-helpers.ts | 74 | function supportsWebDriverScriptExecute(): boolean { | CODE |
| LOW | app/test/e2e/helpers/deep-link-helpers.ts | 97 | async function trySimulateDeepLinkInWebView(url: string): Promise<boolean> { | CODE |
| LOW | app/test/e2e/helpers/deep-link-helpers.ts | 377 | export async function triggerAuthDeepLinkBypass(userId: string = 'e2e-user'): Promise<void> { | CODE |
| LOW | app/test/e2e/helpers/deep-link-helpers.ts | 395 | async function dismissBootCheckGateIfVisibleInline(timeoutMs = 8_000): Promise<boolean> { | CODE |
| LOW | app/test/e2e/helpers/telegram.ts | 95 | function normalizeTelegramSentMessage(entry: SentMessage): SentMessage { | CODE |
| LOW | app/test/e2e/helpers/composio-helpers.ts | 55 | export async function assertConnectorCardVisible(name: string, timeout = 15_000): Promise<void> { | CODE |
| LOW | app/test/e2e/helpers/chat-harness.ts | 397 | export async function waitForAssistantReplyContaining( | CODE |
| LOW | app/src/providers/ChatRuntimeProvider.tsx | 201 | function getOrCreateSegmentDelivery( | CODE |
| LOW | app/src/providers/ChatRuntimeProvider.tsx | 201 | function getOrCreateSegmentDelivery( | CODE |
| LOW | app/src/providers/ChatRuntimeProvider.tsx | 241 | function hasCompleteSegmentDelivery( | CODE |
| LOW | app/src/providers/ChatRuntimeProvider.tsx | 292 | function chatCancelledExtraMetadata(event: ChatCancelledEvent): Record<string, unknown> { | CODE |
| LOW | app/src/providers/CoreStateProvider.tsx | 126 | export function coreStatePollFailureWarningMessage(failureCount: number): string | null { | CODE |
| LOW | app/src/providers/CoreStateProvider.tsx | 139 | export function coreStatePollFailureDebugMessage(failureCount: number): string | null { | CODE |
| LOW | app/src/providers/assistantUiMessages.ts | 158 | export function readOpenHumanToolArtifact(value: unknown): OpenHumanToolArtifact | undefined { | CODE |
| LOW | app/src/providers/assistantUiMessages.ts | 721 | function mergeAssistantRunUncached(messages: readonly ThreadMessage[]): ThreadMessage { | CODE |
| LOW | app/src/providers/assistantUiMessages.ts | 771 | function coalesceAssistantSegments(messages: readonly ThreadMessage[]): ThreadMessage[] { | CODE |
| LOW | app/src/providers/proactiveThreadPins.ts | 33 | export function isProactiveConversationSurface(incomingThreadId: string): boolean { | CODE |
| LOW | app/src/providers/proactiveThreadPins.ts | 58 | export function clearAllProactiveThreadPins(): void { | CODE |
| LOW | app/src/providers/AssistantUiRuntimeProvider.tsx | 62 | export function AssistantUiRuntimeProvider({ | CODE |
| LOW | app/src/providers/useOpenHumanExternalStore.ts | 93 | export function readOpenHumanThreadExtras(extras: unknown): OpenHumanThreadExtras | null { | CODE |
| LOW | app/src/providers/useOpenHumanExternalStore.ts | 144 | export function useCoreTranscriptProjection( | CODE |
| LOW | app/src/providers/useOpenHumanExternalStore.ts | 392 | export function useOpenHumanExternalStore( | CODE |
| LOW | …ders/__tests__/CoreStateProvider.identityFlip.test.tsx | 87 | function seedAccountsWithUserAData() { | CODE |
| 213 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | llms-full.txt | 324 | For asynchronous integration use `AgentSpec::approval_handler` or retain the handle returned by `Agent::handle_approvals | CODE |
| MEDIUM | crates/openhuman-embed/src/harness/provider.rs | 15 | //! (chat, reasoning, agentic, coding) and deliberately leaves the background | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 95 | # TinyAgents — Rust LLM orchestration framework (LangGraph/LangChain-style): | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 97 | # `.rag` workflow language. openhuman's agent engine + orchestration run on this | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 935 | # contracts scaffold. Default-ON. Slim builds opt out via | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 942 | # (agent tools only), and `openhuman::image` is currently unwired scaffold. | COMMENT |
| MEDIUM | crates/openhuman-core/Cargo.toml | 854 | # Wake-word gating, command routing and hallucination detection run in the | COMMENT |
| MEDIUM | crates/openhuman-core/src/tools/orchestrator_tools.rs | 18 | //! blocking agentic round-trip and a second prompt for work the parent could | COMMENT |
| MEDIUM | crates/openhuman-core/src/config/workspace/tools.rs | 8 | //! identity/scaffold, so they ship default-OFF via `tools/user_filter.rs` | COMMENT |
| MEDIUM | …es/openhuman-core/src/config/schema/ephemeral_route.rs | 27 | //! reasoning, agentic, coding. It deliberately leaves the background roles | COMMENT |
| MEDIUM | crates/openhuman-core/src/config/schema/local_ai.rs | 107 | /// to 2048 for many models which is too small for agentic use. | COMMENT |
| MEDIUM | …es/openhuman-core/src/config/schema/types/resolvers.rs | 21 | /// `"chat"`, `"reasoning"`, `"agentic"`, `"coding"`, `"vision"`, `"memory"`, | COMMENT |
| MEDIUM | …es/openhuman-core/src/config/schema/types/model_ids.rs | 8 | /// This replaced the abstract `chat-v1` / `agentic-v1` / … tier slugs: the | COMMENT |
| MEDIUM | …es/openhuman-core/src/desktop/provider_surfaces/mod.rs | 7 | //! The initial scaffold is intentionally minimal so the namespace can be | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/agent_tests.rs | 4 | //! covering every edge case an agentic tool loop must handle: | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/README.md | 178 | ### Sub-agents and orchestration | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/bus.rs | 4 | //! which executes a single end-to-end agentic turn (LLM call → tool calls → | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/bus.rs | 37 | /// Method name used to dispatch an agentic turn through the native bus. | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/bus.rs | 40 | /// Full owned payload for a single agentic turn executed through the bus. | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/bus.rs | 147 | /// Final response from an agentic turn. | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/bus.rs | 380 | /// allowing any part of the system to request an agentic turn without | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/tools/run_workflow.rs | 53 | /// Coarse, process-global spawn/await guardrails. See the module doc for why | COMMENT |
| MEDIUM | …s/openhuman-core/src/agent/subagent_host/autonomous.rs | 25 | /// every agentic loop awaited within — the orchestrator turn and the inline | COMMENT |
| MEDIUM | …gent/subagent_host/ops_tests_model_resolution_tests.rs | 416 | // Route `agentic` to the OpenHuman backend explicitly, and set a | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/harness/README.md | 47 | | `required_output.rs` | Pure validate/repair/synthesize primitives (issue #4117) that guarantee a required structured-o | CODE |
| MEDIUM | …an-core/src/agent/harness/definition/execution_spec.rs | 25 | /// Hints are resolved to the `hint:{hint}` role alias (e.g. `"agentic"` → | COMMENT |
| MEDIUM | …an-core/src/agent/harness/definition/execution_spec.rs | 26 | /// `"hint:agentic"`), which the inference factory translates to the role's | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/tinyagents/routes.rs | 28 | /// This is the canonical workload inventory (`chat`, `reasoning`, `agentic`, | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/tinyagents/routes.rs | 54 | /// - heavy reasoning/agentic siblings `reasoning ⇄ agentic`; | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/tinyagents/routes.rs | 55 | /// - `coding → agentic` (coding is tool-heavy, agentic-adjacent); | COMMENT |
| MEDIUM | …tes/openhuman-core/src/agent/tinyagents/turn_policy.rs | 294 | /// routes (chat→burst, reasoning→agentic, …) the way the harness registry can. | COMMENT |
| MEDIUM⚡ | …human-core/src/agent/tinyagents/host/model_resolver.rs | 98 | /// `chat`, matching the live session path rather than the tempting `agentic`. | COMMENT |
| MEDIUM⚡ | …human-core/src/agent/tinyagents/host/model_resolver.rs | 100 | /// A lead does drive the tool-heavy orchestration turn, so `agentic` looks | COMMENT |
| MEDIUM⚡ | …human-core/src/agent/tinyagents/host/model_resolver.rs | 105 | /// Defaulting a lead to `agentic` here would silently reroute it onto the | COMMENT |
| MEDIUM⚡ | …human-core/src/agent/tinyagents/host/model_resolver.rs | 106 | /// separately-configured agentic provider the moment this seam went live — a | COMMENT |
| MEDIUM⚡ | …human-core/src/agent/tinyagents/host/model_resolver.rs | 107 | /// behaviour change smuggled in as a default. `agentic` is reachable, but only | COMMENT |
| MEDIUM⚡ | …human-core/src/agent/tinyagents/host/model_resolver.rs | 108 | /// through an explicit `hint:agentic`. | COMMENT |
| MEDIUM | …human-core/src/agent/tinyagents/host/model_resolver.rs | 132 | /// as an agent-definition hint (`"hint:agentic"`), and all three are in live | COMMENT |
| MEDIUM | …core/src/agent/tinyagents/host/model_resolver_tests.rs | 60 | // A lead that says "summarization" gets summarization, not agentic — | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/orchestration/tools.rs | 2 | //! `#[path]`, since this file lives in `orchestration/` rather than a | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/orchestration/README.md | 1 | # orchestration | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/src/agent/orchestration/ops.rs | 53 | #[error("agent orchestration requires an active parent agent turn")] | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/src/agent/orchestration/ops.rs | 59 | #[error("orchestration agent '{0}' not found")] | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/src/agent/orchestration/ops.rs | 63 | #[error("orchestration task registry unavailable: {0:?}")] | COMMENT |
| MEDIUM | …re/src/agent/registry/agents/trigger_triage/agent.toml | 11 | # need the identity preamble, safety scaffolding, or skills catalog. | COMMENT |
| MEDIUM | …e/src/agent/registry/agents/trigger_reactor/agent.toml | 19 | # deliver. The `agentic` hint routes to the backend's agentic tier | COMMENT |
| MEDIUM | …core/src/agent/registry/agents/orchestrator/agent.toml | 229 | # agentic round-trip (over-delegation, #4744). `learn` writes the store | COMMENT |
| MEDIUM | …core/src/agent/registry/agents/orchestrator/agent.toml | 248 | # `orchestration::background_delivery`. Nothing has to block for it, so | COMMENT |
| MEDIUM | crates/openhuman-core/src/agent/session_host/types.rs | 31 | /// agentic task loop: no tools to loop on and no stale per-thread goal re-injected from a prior task. Each field is an | COMMENT |
| MEDIUM | …human-core/src/agent/session_host/runtime/accessors.rs | 547 | /// that never touch this get the unchanged full-agentic behaviour. See | COMMENT |
| MEDIUM | …an-core/src/inference/provider/fallback_diagnostics.rs | 13 | //! roles (`vision`, `embeddings`, `memory`, `agentic`, `burst`) | COMMENT |
| MEDIUM | …an-core/src/inference/provider/fallback_diagnostics.rs | 106 | /// `burst` has no knob of its own — it rides the agentic route — so it points | COMMENT |
| MEDIUM | …c/inference/provider/factory_route_resolution_tests.rs | 520 | // chat explicitly managed; only tool-use (agentic) is BYOK. The chat tier | COMMENT |
| MEDIUM | …c/inference/provider/factory_route_resolution_tests.rs | 521 | // still bills managed credits → chat role stays gated. (agentic itself is a | COMMENT |
| MEDIUM | …enhuman-core/src/inference/embedding_host/rpc_tests.rs | 264 | r#"openai embeddings returned HTTP 400 Bad Request: {"error":"this is not an embedding model"}"#, | CODE |
| MEDIUM | …enhuman-core/src/inference/embedding_host/rpc_tests.rs | 304 | r#"Embedding API error (403 Forbidden): {"error":{"message":"This is not an embedding model"}}"#, | CODE |
| MEDIUM | crates/openhuman-core/src/skills/tools.rs | 5 | //! logs, and (opt-in) scaffold / install / uninstall user workflows. Thin | COMMENT |
| MEDIUM | crates/openhuman-core/src/skills/ops_uninstall_tests.rs | 206 | // rather than silently replace the user's instructions with the scaffold. | COMMENT |
| MEDIUM | crates/openhuman-core/src/skills/ops_uninstall_tests.rs | 234 | // The original file is left untouched and no WORKFLOW.md scaffold is written. | COMMENT |
| MEDIUM | crates/openhuman-core/src/skills/tools/write.rs | 1 | //! Mutating workflow tools: scaffold and install-from-url. Uninstall lives in | COMMENT |
| 30 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 49 | # own. Redirect it to the copy tinyagents vendors — the one the harness and | COMMENT |
| MEDIUM | Cargo.toml | 51 | # `Tool` trait. Without this, MCP tools would not satisfy the harness's trait. | COMMENT |
| MEDIUM | crates/openhuman-app/Cargo.toml | 301 | # own. Redirect it to the copy tinyagents vendors — the one the harness and | COMMENT |
| MEDIUM | crates/openhuman-app/Cargo.toml | 303 | # `Tool` trait. Without this, MCP tools would not satisfy the harness's trait. | COMMENT |
| MEDIUM | crates/openhuman-app/src/core_process_tests.rs | 461 | // robust enough for a single-shot test. | COMMENT |
| MEDIUM | …man-app/src/imessage_scanner/imessage_scanner_tests.rs | 52 | // year is 2000 or 2001 — keeps the test robust across CI timezones. | COMMENT |
| MEDIUM | crates/openhuman-embed/src/harness/mod.rs | 57 | //! # Two things the harness cannot do for you | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 96 | # durable state graphs, agent-loop harness, model/tool registries, REPL + | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 99 | # #4249): every turn drives through the harness; the workflow phase DAG, team | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 106 | # directly on the members it actually uses — `tinyagents-harness` (agent loop, | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 111 | # The `sqlite` feature is enabled on the harness/graph crates now that openhuman's | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 116 | # (see the tinyagents-harness module list) — the comment that used to describe | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 121 | # web chat and the agent harness both resolve attachment markers on every turn | COMMENT |
| MEDIUM⚡ | crates/openhuman-core/Cargo.toml | 938 | # Enables `tinyagents-harness/media`, which pulls in `tinyinference-image` and | COMMENT |
| MEDIUM | crates/openhuman-core/Cargo.toml | 151 | # harness pipeline. Only the `voice` feature's `voice::live` uses it. | COMMENT |
| MEDIUM | crates/openhuman-core/Cargo.toml | 178 | # other — every tool in this crate would stop satisfying the harness's trait, | COMMENT |
| MEDIUM | crates/openhuman-core/Cargo.toml | 217 | # `Brain`, holistic recall (`ContextPack`) and `BackgroundJob`s. | COMMENT |
| MEDIUM | crates/openhuman-core/Cargo.toml | 907 | # the `node_runtime` harness-init step. Default-ON. Slim builds opt out via | COMMENT |
| MEDIUM | crates/openhuman-core/Cargo.toml | 1061 | # harness interactive loop. See AGENTS.md "channels gate" + `channels/mod.rs`. | COMMENT |
| MEDIUM | crates/openhuman-core/src/core/observability.rs | 2697 | /// prefix so the filter stays robust to future Sentry plumbing changes. | COMMENT |
| LOW | crates/openhuman-core/src/core/all_tests.rs | 1113 | /// `#[cfg]` in `crates/openhuman-core/src/core/all.rs` — the aggregators simply return empty vecs. | COMMENT |
| MEDIUM | crates/openhuman-core/src/core/runtime/bootstrap.rs | 242 | // Gated on the Skills domain (#4808 review): under `harness()`/`none()` the | COMMENT |
| MEDIUM | …/openhuman-core/src/platform/proc_metrics/mod_tests.rs | 52 | // close-paren, to prove the last-`)` split is robust. | COMMENT |
| MEDIUM | …ore/src/web_chat/web_tests_start_chat_ingress_tests.rs | 534 | // Issue #4746: the root-cause guard is the tinyagents harness policy | COMMENT |
| MEDIUM | …ore/src/web_chat/web_tests_start_chat_ingress_tests.rs | 586 | // Issue #5804. The harness `Timeout` used to be suppressed by the same arm | COMMENT |
| MEDIUM | crates/openhuman-core/src/web_chat/ops/turn_guards.rs | 153 | /// issue #4746) — the turn wedged outside the harness and produced no | COMMENT |
| MEDIUM | …ates/openhuman-core/src/agent/artifacts/store_tests.rs | 279 | // artifact_id + workspace_dir keeps the test robust against parallel | COMMENT |
| MEDIUM | …man-core/src/agent/subagent_host/ops/graph/dispatch.rs | 164 | // Live transcript snapshot sink (#4466): the harness owns the working message | COMMENT |
| MEDIUM | …man-core/src/agent/subagent_host/ops/graph/dispatch.rs | 279 | // #4466: the harness dropped its partial transcript, but the snapshot | COMMENT |
| MEDIUM | …enhuman-core/src/agent/tinyagents/turn_run_finalize.rs | 54 | // Context-compression provenance (issue #4249, 03.1 item 6): the harness's | COMMENT |
| MEDIUM | …tes/openhuman-core/src/agent/tinyagents/turn_policy.rs | 28 | /// (issue #4746). Applied as the harness `RunLimits::max_wall_clock_ms` so the | COMMENT |
| MEDIUM | …tes/openhuman-core/src/agent/tinyagents/turn_policy.rs | 41 | /// seconds (#5766). Applied as the harness `RunLimits::max_model_call_ms`, so | COMMENT |
| MEDIUM | …tes/openhuman-core/src/agent/tinyagents/turn_policy.rs | 316 | // Wall-clock ceiling for the whole turn (issue #4746). The harness bounds | COMMENT |
| MEDIUM | …core/src/agent/registry/agents/orchestrator/agent.toml | 5 | # Sized for code work (#6958): on the DeepSWE sample every other harness needed | COMMENT |
| MEDIUM | …core/src/agent/registry/agents/orchestrator/agent.toml | 15 | # in `subagents` below — handoff goes directly to `worker` specialists. See `AgentTier` in `crates/openhuman-core/src/ag | COMMENT |
| MEDIUM | …core/src/agent/registry/agents/orchestrator/agent.toml | 81 | # harness admits a deferred tool by name without a prior search, so the | COMMENT |
| MEDIUM | …core/src/agent/registry/agents/orchestrator/agent.toml | 186 | # reachable through the harness's intrinsic `tool_search` — ranked by Jev | COMMENT |
| MEDIUM | …core/src/agent/registry/agents/orchestrator/agent.toml | 325 | # harness injects the active goal into context each turn and can auto-continue | COMMENT |
| MEDIUM | …n-core/src/agent/session_host/runtime_session_tests.rs | 490 | /// Issue #6956 follow-up: the harness drops `goal_*` for a thread-less turn, so | COMMENT |
| MEDIUM | …an-core/src/integrations/composio/action_tool_tests.rs | 40 | /// A `#[tokio::test]` future runs on the test harness's own OS thread, | COMMENT |
| MEDIUM | crates/openhuman-core/src/skills/run_log.rs | 354 | // `:` and trimming both halves is robust to that padding without | COMMENT |
| MEDIUM | app/test/e2e/specs/chat-harness-send-stream.spec.ts | 167 | // asserting the whole map is empty) keeps the assertion robust to | COMMENT |
| MEDIUM | app/test/e2e/specs/voice-mode.spec.ts | 736 | // Tracked: issue #1610. Remove skip when the test harness supports audio | COMMENT |
| MEDIUM | app/test/e2e/specs/chat-tool-call-flow.spec.ts | 216 | // Accept >=2 to be robust against retries or additional system turns. | COMMENT |
| MEDIUM | app/test/e2e/specs/chat-harness-subagent.spec.ts | 16 | * called (#4517): the sub-agent's own harness loop plus any ancillary | COMMENT |
| MEDIUM | app/test/e2e/specs/chat-harness-subagent.spec.ts | 263 | // Accept ≥2 to stay robust against orchestrator-skipping or tool-loop | COMMENT |
| MEDIUM | app/scripts/e2e-web-build.sh | 19 | # Preserve explicit harness ports before loading a developer .env. That file | COMMENT |
| MEDIUM | app/scripts/e2e-run-spec.sh | 4 | # unified session runner. The harness no longer has separate driver paths | COMMENT |
| MEDIUM | app/scripts/e2e-web-session.sh | 142 | # remain unembedded. Keep this harness intentionally providerless so it covers | COMMENT |
| MEDIUM | app/scripts/e2e-web-session.sh | 177 | # bundle this harness cannot drive, and every spec then fails as though the | COMMENT |
| MEDIUM | app/scripts/e2e-web-session.sh | 286 | # disclosure choreography. Advertise the compiled tool packs for this harness | COMMENT |
| MEDIUM⚡ | app/scripts/e2e-run-all-flows.sh | 253 | # Chat & agent harness | COMMENT |
| MEDIUM | app/scripts/e2e-ports.sh | 5 | # The three harness ports used to be fixed constants, so two sessions on one | COMMENT |
| MEDIUM | app/src/features/wallet/walletDisplay.ts | 100 | // A robust way for scientific notation in JS: | COMMENT |
| MEDIUM | app/src/components/flows/WorkflowCopilotPanel.tsx | 428 | // promises ("keep building from the current draft"), not seamless | COMMENT |
| MEDIUM | tests/json_rpc_e2e.rs | 117 | // request body (`when_contains`). That gate is what makes the arc robust against | COMMENT |
| MEDIUM | scripts/test-rust-with-mock.sh | 45 | # The agent harness test surface includes very large async futures in debug | COMMENT |
| MEDIUM | scripts/test-rust-with-mock.sh | 52 | # The TinyAgents harness is the only agent engine on every build (issue #4249), | COMMENT |
| MEDIUM | scripts/test-rust-e2e.sh | 148 | # The agent-harness E2E surface drives very large async futures in debug builds | COMMENT |
| MEDIUM | scripts/test-memory-cortexdb-live.sh | 4 | # Boots the pinned CortexDB harness from vendor/tinymemory/integration/cortexdb | COMMENT |
| 11 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …penhuman-tinyhumans/src/hosted/channel_link/managed.rs | 109 | /// Step 1: create a Telegram link token and return the deep link URL. | COMMENT |
| LOW | …penhuman-tinyhumans/src/hosted/channel_link/managed.rs | 135 | /// Step 2: whether the user completed the Telegram link (clicked /start). | COMMENT |
| LOW | …penhuman-tinyhumans/src/hosted/channel_link/managed.rs | 165 | /// Step 1: create a Discord link token the user pastes into Discord as | COMMENT |
| LOW | …penhuman-tinyhumans/src/hosted/channel_link/managed.rs | 191 | /// Step 2: whether the user completed the Discord link (`discordId` set on | COMMENT |
| LOW⚡ | …curity/keyring/encrypted_store_key_management_tests.rs | 24 | // Step 1: create the key file and produce a ciphertext to decrypt later. | COMMENT |
| LOW⚡ | …curity/keyring/encrypted_store_key_management_tests.rs | 33 | // Step 2: clear the in-memory cache so the next decrypt reads from disk. | COMMENT |
| LOW⚡ | …curity/keyring/encrypted_store_key_management_tests.rs | 36 | // Step 3: corrupt the ACL — strip inheritance AND add an explicit DENY for | COMMENT |
| LOW | …curity/keyring/encrypted_store_key_management_tests.rs | 50 | // Step 4: check whether the lock actually made the file unreadable. | COMMENT |
| LOW | …openhuman-core/src/security/keyring/encrypted_store.rs | 557 | // Step 1: restore inheritance. | COMMENT |
| LOW | …openhuman-core/src/security/keyring/encrypted_store.rs | 584 | // Step 2: explicit grant for current user — handles CI environments | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 366 | // Step 1: check if already migrated. | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 372 | // Step 2: check if source file exists. | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 381 | // Step 3: read the file. | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 393 | // Step 4: write to backend. | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 397 | // Step 5: verify read-back matches. | COMMENT |
| LOW | crates/openhuman-core/src/security/keyring/ops.rs | 408 | // Step 6: delete the source file (only after verified write). | COMMENT |
| LOW | crates/openhuman-core/src/agent/artifacts/migrate.rs | 175 | // Step 1: copy to a hidden partial and flush it. | COMMENT |
| LOW | crates/openhuman-core/src/agent/artifacts/migrate.rs | 191 | // Step 2: claim a readable name and move the partial onto it. | COMMENT |
| LOW | crates/openhuman-core/src/agent/artifacts/migrate.rs | 210 | // Step 3: point the record at the moved file. | COMMENT |
| LOW | crates/openhuman-core/src/agent/artifacts/migrate.rs | 226 | // Step 4: the record no longer points at the legacy bytes. | COMMENT |
| LOW | app/test/e2e/specs/ptt-flow.spec.ts | 115 | // Step 1: settings → voice → PttSettingsPanel. | COMMENT |
| LOW | app/test/e2e/specs/ptt-flow.spec.ts | 219 | // Step 8: overlay window is created lazily by register_ptt_hotkey. | COMMENT |
| LOW | app/test/e2e/specs/harness-channel-bridge-flow.spec.ts | 681 | // Step 1: navigate to web chat and start sending (does NOT await reply yet). | COMMENT |
| LOW | app/test/e2e/specs/harness-channel-bridge-flow.spec.ts | 705 | // Step 2: While streaming, set up the Telegram forced response and inject | COMMENT |
| LOW | app/test/e2e/specs/harness-channel-bridge-flow.spec.ts | 736 | // Step 3: Wait for the web chat reply to complete (stream all chunks). | COMMENT |
| LOW⚡ | app/src/components/skills/inputs/RepoPicker.tsx | 59 | // Step 1: Is GitHub connected via Composio? | COMMENT |
| LOW⚡ | app/src/components/skills/inputs/RepoPicker.tsx | 68 | // Step 2: Fetch repos. | COMMENT |
| LOW⚡ | app/src/components/skills/inputs/RepoPicker.tsx | 72 | // Step 3: Parse — GitHub API returns an array of repo objects; | COMMENT |
| LOW | .claude/skills/migrate-to-submodule/SKILL.md | 48 | ## Step 1: Plan (freedom to decide the split) | COMMENT |
| LOW | .claude/skills/migrate-to-submodule/SKILL.md | 76 | ## Step 2: Move the code, upstream first | COMMENT |
| LOW | .claude/skills/migrate-to-submodule/SKILL.md | 107 | ## Step 3: Release the submodule | COMMENT |
| LOW | .claude/skills/migrate-to-submodule/SKILL.md | 123 | ## Step 4: Re-pin the host | COMMENT |
| LOW | .claude/skills/migrate-to-submodule/SKILL.md | 159 | ## Step 5: Open the OpenHuman PR | COMMENT |
| LOW | gitbooks/developing/quickstart.md | 28 | ## Step 1: add the dependency | COMMENT |
| LOW | gitbooks/developing/quickstart.md | 49 | ## Step 2: build the tokio runtime yourself | COMMENT |
| LOW | gitbooks/developing/quickstart.md | 72 | ## Step 3: your first agent | COMMENT |
| LOW | gitbooks/developing/quickstart.md | 111 | ## Step 4: many agents on one runtime | COMMENT |
| LOW | gitbooks/developing/quickstart.md | 180 | ## Step 5: multi-turn sessions and streaming | COMMENT |
| LOW | gitbooks/developing/quickstart.md | 210 | ## Step 6: managed inference with one API key | COMMENT |
| LOW | gitbooks/developing/quickstart.md | 236 | ## Step 7: going to scale | COMMENT |
| LOW | gitbooks/features/cloud-deploy.md | 537 | ### Step 1: Launch the app | COMMENT |
| LOW | gitbooks/features/cloud-deploy.md | 545 | ### Step 2: Configure `.fly/fly.toml` | COMMENT |
| LOW | gitbooks/features/cloud-deploy.md | 591 | ### Step 3: Create a persistent volume | COMMENT |
| LOW | gitbooks/features/cloud-deploy.md | 599 | ### Step 4: Set secrets | COMMENT |
| LOW | gitbooks/features/cloud-deploy.md | 619 | ### Step 5: Deploy | COMMENT |
| LOW | gitbooks/features/cloud-deploy.md | 631 | ### Step 6: Point the desktop app at the hosted core | COMMENT |
| LOW | docs/gitbooks/en/developing/quickstart.md | 28 | ## Step 1: add the dependency | COMMENT |
| LOW | docs/gitbooks/en/developing/quickstart.md | 49 | ## Step 2: build the tokio runtime yourself | COMMENT |
| LOW | docs/gitbooks/en/developing/quickstart.md | 72 | ## Step 3: your first agent | COMMENT |
| LOW | docs/gitbooks/en/developing/quickstart.md | 111 | ## Step 4: many agents on one runtime | COMMENT |
| LOW | docs/gitbooks/en/developing/quickstart.md | 180 | ## Step 5: multi-turn sessions and streaming | COMMENT |
| LOW | docs/gitbooks/en/developing/quickstart.md | 210 | ## Step 6: managed inference with one API key | COMMENT |
| LOW | docs/gitbooks/en/developing/quickstart.md | 236 | ## Step 7: going to scale | COMMENT |
| LOW | docs/gitbooks/en/features/cloud-deploy.md | 537 | ### Step 1: Launch the app | COMMENT |
| LOW | docs/gitbooks/en/features/cloud-deploy.md | 545 | ### Step 2: Configure `.fly/fly.toml` | COMMENT |
| LOW | docs/gitbooks/en/features/cloud-deploy.md | 591 | ### Step 3: Create a persistent volume | COMMENT |
| LOW | docs/gitbooks/en/features/cloud-deploy.md | 599 | ### Step 4: Set secrets | COMMENT |
| LOW | docs/gitbooks/en/features/cloud-deploy.md | 619 | ### Step 5: Deploy | COMMENT |
| LOW | docs/gitbooks/en/features/cloud-deploy.md | 631 | ### Step 6: Point the desktop app at the hosted core | COMMENT |
| LOW⚡ | scripts/test-ci-local.sh | 118 | # Step 1: Ensure OpenSSL is installed | COMMENT |
| 14 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …penhuman-tinyhumans/src/hosted/channel_link/managed.rs | 109 | /// Step 1: create a Telegram link token and return the deep link URL. | COMMENT |
| LOW | …penhuman-tinyhumans/src/hosted/channel_link/managed.rs | 135 | /// Step 2: whether the user completed the Telegram link (clicked /start). | COMMENT |
| LOW | …penhuman-tinyhumans/src/hosted/channel_link/managed.rs | 165 | /// Step 1: create a Discord link token the user pastes into Discord as | COMMENT |
| LOW | …penhuman-tinyhumans/src/hosted/channel_link/managed.rs | 191 | /// Step 2: whether the user completed the Discord link (`discordId` set on | COMMENT |
| LOW⚡ | …curity/keyring/encrypted_store_key_management_tests.rs | 24 | // Step 1: create the key file and produce a ciphertext to decrypt later. | COMMENT |
| LOW⚡ | …curity/keyring/encrypted_store_key_management_tests.rs | 33 | // Step 2: clear the in-memory cache so the next decrypt reads from disk. | COMMENT |
| LOW⚡ | …curity/keyring/encrypted_store_key_management_tests.rs | 36 | // Step 3: corrupt the ACL — strip inheritance AND add an explicit DENY for | COMMENT |
| LOW | …curity/keyring/encrypted_store_key_management_tests.rs | 50 | // Step 4: check whether the lock actually made the file unreadable. | COMMENT |
| LOW | …openhuman-core/src/security/keyring/encrypted_store.rs | 557 | // Step 1: restore inheritance. | COMMENT |
| LOW | …openhuman-core/src/security/keyring/encrypted_store.rs | 584 | // Step 2: explicit grant for current user — handles CI environments | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 366 | // Step 1: check if already migrated. | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 372 | // Step 2: check if source file exists. | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 381 | // Step 3: read the file. | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 393 | // Step 4: write to backend. | COMMENT |
| LOW⚡ | crates/openhuman-core/src/security/keyring/ops.rs | 397 | // Step 5: verify read-back matches. | COMMENT |
| LOW | crates/openhuman-core/src/security/keyring/ops.rs | 408 | // Step 6: delete the source file (only after verified write). | COMMENT |
| LOW | crates/openhuman-core/src/agent/artifacts/migrate.rs | 175 | // Step 1: copy to a hidden partial and flush it. | COMMENT |
| LOW | crates/openhuman-core/src/agent/artifacts/migrate.rs | 191 | // Step 2: claim a readable name and move the partial onto it. | COMMENT |
| LOW | crates/openhuman-core/src/agent/artifacts/migrate.rs | 210 | // Step 3: point the record at the moved file. | COMMENT |
| LOW | crates/openhuman-core/src/agent/artifacts/migrate.rs | 226 | // Step 4: the record no longer points at the legacy bytes. | COMMENT |
| LOW | app/test/e2e/specs/ptt-flow.spec.ts | 115 | // Step 1: settings → voice → PttSettingsPanel. | COMMENT |
| LOW | app/test/e2e/specs/ptt-flow.spec.ts | 219 | // Step 8: overlay window is created lazily by register_ptt_hotkey. | COMMENT |
| LOW | app/test/e2e/specs/harness-channel-bridge-flow.spec.ts | 681 | // Step 1: navigate to web chat and start sending (does NOT await reply yet). | COMMENT |
| LOW | app/test/e2e/specs/harness-channel-bridge-flow.spec.ts | 705 | // Step 2: While streaming, set up the Telegram forced response and inject | COMMENT |
| LOW | app/test/e2e/specs/harness-channel-bridge-flow.spec.ts | 736 | // Step 3: Wait for the web chat reply to complete (stream all chunks). | COMMENT |
| LOW⚡ | app/src/components/skills/inputs/RepoPicker.tsx | 59 | // Step 1: Is GitHub connected via Composio? | COMMENT |
| LOW⚡ | app/src/components/skills/inputs/RepoPicker.tsx | 68 | // Step 2: Fetch repos. | COMMENT |
| LOW⚡ | app/src/components/skills/inputs/RepoPicker.tsx | 72 | // Step 3: Parse — GitHub API returns an array of repo objects; | COMMENT |
| LOW⚡ | scripts/test-ci-local.sh | 118 | # Step 1: Ensure OpenSSL is installed | COMMENT |
| LOW⚡ | scripts/test-ci-local.sh | 122 | # Step 2: Install Node dependencies | COMMENT |
| LOW⚡ | scripts/test-ci-local.sh | 126 | # Step 3: Install skills dependencies and build | COMMENT |
| LOW⚡ | scripts/test-ci-local.sh | 130 | # Step 4: Build frontend | COMMENT |
| LOW⚡ | scripts/test-ci-local.sh | 134 | # Step 5: Build Tauri (aarch64) | COMMENT |
| LOW⚡ | scripts/deep-work/start.sh | 48 | # Step 0: Ensure we're on main and synced | COMMENT |
| LOW⚡ | scripts/deep-work/start.sh | 53 | # Step 1: Fetch issue details | COMMENT |
| LOW | scripts/deep-work/start.sh | 110 | # Step 2: Planning phase | COMMENT |
| LOW | scripts/deep-work/start.sh | 148 | # Step 3: Implementation phase | COMMENT |
| LOW | scripts/deep-work/start.sh | 191 | # Step 6: Commit | COMMENT |
| LOW | scripts/deep-work/start.sh | 215 | # Step 7: Merge main and resolve conflicts | COMMENT |
| LOW | scripts/deep-work/start.sh | 234 | # Step 8: Push and create draft PR | COMMENT |
| LOW | scripts/deep-work/start.sh | 288 | # Step 9: Review cycle | COMMENT |
| LOW | scripts/deep-work/start.sh | 309 | # Step 10: Mark ready for review (user confirmation) | COMMENT |
| LOW | scripts/deep-work/start.sh | 329 | # Step 11: Cleanup (user confirmation) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.yml | 7 | # Usage: | COMMENT |
| LOW | app/scripts/e2e-agent-review.sh | 8 | # Usage: | COMMENT |
| LOW | app/scripts/e2e-run-session.sh | 17 | # Usage: | COMMENT |
| LOW | scripts/debug-composio-login.sh | 27 | # Usage: | COMMENT |
| LOW⚡ | scripts/build-apt-repo.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/load-env-json.sh | 3 | # Usage: | COMMENT |
| LOW | scripts/build-macos-signed.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/weekly-code-review.sh | 20 | # Usage: | COMMENT |
| LOW | scripts/install.sh | 3 | # Usage: | COMMENT |
| LOW | scripts/test-rust-with-mock.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/run-macos-arm64-build.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/dev-staging.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/debug-skill.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/dev-setup-linker.sh | 15 | # Usage: | COMMENT |
| LOW | scripts/validate-release-assets.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/act-build-desktop.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/print-core-token.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/upload_sentry_symbols.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/load-dotenv.sh | 3 | # Usage: | COMMENT |
| LOW | scripts/test-rust-e2e.sh | 15 | # Usage: | COMMENT |
| LOW | scripts/live-flows-demo.sh | 17 | # Usage: | COMMENT |
| LOW⚡ | scripts/test-channel-messaging.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/test-release-act.sh | 15 | # Usage: | COMMENT |
| LOW | scripts/act-staging.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/load-env.sh | 3 | # Usage: | COMMENT |
| LOW | scripts/test-rust-inference-e2e.sh | 12 | # Usage: | COMMENT |
| LOW | scripts/kernel-floor.sh | 22 | # Usage: | COMMENT |
| LOW | scripts/test-ci-local.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/run-dev-web.sh | 34 | # Usage: | COMMENT |
| LOW | scripts/debug-agent-prompts.sh | 28 | # Usage: | COMMENT |
| LOW | scripts/debug-notion-live.sh | 12 | # Usage: | COMMENT |
| LOW | scripts/ci/assert-coverage-presence.sh | 20 | # Usage: | COMMENT |
| LOW | scripts/release/build-linux-arm64.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/release/update-homebrew.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/release/upload-macos-artifacts.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/release/publish-npm.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/release/build-apt-packages.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/release/repackage-dmg.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/release/macos-bundled-modules.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/release/render-homebrew-core-formula.sh | 4 | # Usage: | COMMENT |
| LOW | scripts/release/package-cli-tarball.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/release/sign-and-notarize-macos.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/dep-audit/run.sh | 14 | # Usage: | COMMENT |
| LOW | e2e/run-local.sh | 8 | # Usage: | COMMENT |
| LOW | e2e/docker-compose.yml | 11 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …man-app/src/imessage_scanner/imessage_scanner_tests.rs | 118 | assert!(chat_allowed("user@example.com", &allowed)); | CODE |
| LOW | …an-core/src/tools/impl/browser/browser_task_actions.rs | 179 | "placeholder" => LocateBy::Placeholder, | CODE |
| LOW | crates/openhuman-core/src/security/pii/pii_tests.rs | 186 | let r = scan("email me: bob@example.org"); | CODE |
| LOW | crates/openhuman-core/src/security/pii/pii_tests.rs | 221 | let one = scan("bob@example.org").score; | CODE |
| LOW | …e/src/agent/prompts/mod_tests_subagent_render_tests.rs | 210 | assert!(!rendered.contains("PROFILE.md") && !rendered.contains("Jane Doe")); | CODE |
| LOW | …man-core/src/integrations/tools/google_places_tests.rs | 49 | "formattedAddress": "123 Main St", | CODE |
| LOW | …man-core/src/integrations/tools/google_places_tests.rs | 100 | "formattedAddress": "123 Main St", | CODE |
| LOW | crates/openhuman-core/src/tinymemes/mod_tests.rs | 207 | "placeholder", | CODE |
| LOW | crates/openhuman-core/src/tinymemes/mod_tests.rs | 220 | "placeholder", | CODE |
| LOW | …c/flows/ops_validate_warnings_and_connections_tests.rs | 350 | Some("user@example.com"), | CODE |
| LOW | app/src/components/memory/MemorySyncedSources.test.tsx | 106 | 'placeholder', | CODE |
| LOW | app/src/components/chat/__tests__/ChatComposer.test.tsx | 122 | expect(textarea).toHaveAttribute('placeholder', 'chat.typeMessage'); | CODE |
| LOW | app/src/components/chat/__tests__/ChatComposer.test.tsx | 669 | expect(screen.getByRole('textbox')).toHaveAttribute('placeholder', 'chat.followupHint'); | CODE |
| LOW | …/src/components/composio/ComposioConnectModal.test.tsx | 167 | accountEmail: 'foo@bar.com', | CODE |
| LOW | …/src/components/composio/ComposioConnectModal.test.tsx | 212 | accountEmail: 'foo@bar.com', | CODE |
| LOW | scripts/i18n-react-audit.ts | 13 | "placeholder", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | scripts/build-apt-repo.sh | 9 | # Set APT_SIGNING_KEY_ID to select the key; leave unset to use the default. | COMMENT |
| LOW | scripts/release/strip-appimage-graphics-libs.sh | 707 | # Check if the file is a shell script (not an ELF binary). | COMMENT |
| LOW | scripts/deep-work/continue.sh | 47 | # Check if worktree exists | COMMENT |
| LOW | scripts/deep-work/continue.sh | 168 | # Check if we have unpushed commits | COMMENT |
| LOW | scripts/deep-work/status.sh | 76 | # Check if working tree is clean | COMMENT |
| LOW | scripts/deep-work/status.sh | 92 | # Check if PR exists | COMMENT |
| LOW | scripts/deep-work/lib.sh | 38 | # Check if worktree exists for issue | COMMENT |
| LOW | scripts/deep-work/lib.sh | 51 | # Check if we're in a worktree by looking for oh-<number> pattern | COMMENT |
| LOW | scripts/deep-work/list.sh | 50 | # Check if we found any worktrees (need to use a different approach since the while loop runs in a subshell) | COMMENT |
| LOW | scripts/deep-work/cleanup.sh | 37 | # Check if worktree exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …es/openhuman-core/src/agent/subagent_host/lifecycle.rs | 1043 | cost_source: cost_source_of(pause.outcome.usage.usage.charged_amount.as_ref()), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ponents/settings/panels/ai/ProviderConnectControls.tsx | 88 | : (builtinCloudProvider(slug)?.keyPlaceholder ?? 'your-api-key'); | CODE |
| HIGH | …ponents/settings/panels/ai/ProviderConnectControls.tsx | 89 | const keyPlaceholder = builtinCloudProvider(slug)?.keyPlaceholder ?? 'your-api-key'; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | crates/openhuman-core/src/agent/hooks.rs | 194 | /// Run the tool as requested. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/weekly-code-review.sh | 110 | except Exception as e: | CODE |
| LOW | scripts/weekly-code-review.sh | 240 | except Exception: | CODE |
| MEDIUM | scripts/weekly-code-review.sh | 237 | def parse(s): | CODE |
| LOW | scripts/install.sh | 186 | except Exception as e: | CODE |
| LOW | scripts/bootstrap-embed-consumer.py | 112 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/dep-sim.py | 166 | CODE | |
| LOW | scripts/prompt-eval/score.py | 83 | CODE | |
| LOW | scripts/debug/tui-profile.py | 122 | CODE | |
| LOW | scripts/debug/tui-profile.py | 43 | CODE | |
| LOW | scripts/debug/tui-profile.py | 173 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/prompt-eval/score.py | 195 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/release/validate-appimage-runtime.sh | 4 | # This file is sourceable for fixture tests. When executed directly it extracts | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/dep-sim.py | 43 | CODE | |
| LOW | scripts/bootstrap-embed-consumer.py | 3 | CODE |