3.1

Adjusted Signal

3.1

Raw Pattern Score

100%

Time Factor

2026-10-08

Last Push

3.9K

Stars

TypeScript

Language

1.8M

Lines of Code

7.6K

Files

5.3K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 14.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 5289 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 56 finding(s).

Agent Over-Engineering Ratio 13.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 5156 finding(s).

PR Review Velocity Impact 14.2/100 · LOW

Which changes need focused human review? 5346 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 4MEDIUM 14LOW 5328

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 5346 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers5155 hits · 5293 pts

Severity	File	Line	Snippet	Context
LOW	docs/architecture/workspace-terminal.md	243	export function createTerminalNodeFeature(	CODE
LOW	docs/architecture/workspace-terminal.md	382	export function createTerminalWorkbenchNodeDefinition(	CODE
LOW	docs/architecture/workspace-terminal.md	386	export function createTerminalWorkbenchLaunchHandler(	CODE
LOW	docs/architecture/workbench-contributions.md	234	function resolveWorkbenchHostConfig(	CODE
LOW	packages/commerce/web/src/core/membershipPolicy.ts	25	export function resolveInsufficientCreditsSemantic(	CODE
LOW	packages/commerce/web/src/core/tierVisual.ts	11	export function resolveMembershipTierVisual(	CODE
LOW	…/commerce/web/src/react/AgentConfigCommerceContent.tsx	41	export function AgentConfigCommerceContent({	CODE
LOW	…ges/commerce/web/src/react/commerceMenuPresentation.ts	10	export function resolveCommerceMembershipActionLabel(	CODE
LOW	packages/clients/tuttid-ts/src/agentProvidersClient.ts	23	export function createAgentProvidersClient(	CODE
LOW	…kages/clients/tuttid-ts/src/collaborationRunsClient.ts	19	export function createCollaborationRunsClient(	CODE
LOW	packages/clients/tuttid-ts/src/eventStreamClient.ts	120	export function createTuttidEventStreamClient(	CODE
LOW	packages/clients/tuttid-ts/src/errors.ts	86	export function getTuttidProtocolErrorCode(error: unknown): string \| null {	CODE
LOW	packages/clients/tuttid-ts/src/errors.ts	130	function extractProtocolErrorDetails(error: unknown): ApiErrorDetails \| null {	CODE
LOW	packages/clients/tuttid-ts/src/workspaceAgentClient.ts	134	export function createWorkspaceAgentClient(	CODE
LOW	packages/clients/tuttid-ts/src/workspaceAgentClient.ts	915	function agentCommandRequestOptions(	CODE
LOW	packages/clients/tuttid-ts/src/workspaceAppsClient.ts	71	export function createWorkspaceAppsClient(client: Client): WorkspaceAppsClient {	CODE
LOW	packages/clients/tuttid-ts/src/connectorMarketClient.ts	55	export function isConnectorMarketClientError(	CODE
LOW	packages/clients/tuttid-ts/src/connectorMarketClient.ts	102	export function createConnectorMarketClient(	CODE
LOW	packages/clients/tuttid-ts/src/connectorMarketClient.ts	228	function connectorMarketErrorDetails(	CODE
LOW	packages/clients/tuttid-ts/src/connectorMarketClient.ts	245	function isConnectorMarketErrorDetails(	CODE
LOW	…ges/clients/tuttid-ts/src/tuttiModeActivationClient.ts	15	export function createTuttiModeActivationClient(	CODE
LOW	…kages/clients/tuttid-ts/src/workspaceWorkflowClient.ts	16	export function createWorkspaceWorkflowClient(	CODE
LOW	…nts/tuttid-ts/src/workspaceAgentConfigurationClient.ts	111	export function createWorkspaceAgentConfigurationClient(	CODE
LOW	…nts/tuttid-ts/src/workspaceIssueOrchestrationClient.ts	23	export function createWorkspaceIssueOrchestrationClient(	CODE
LOW	packages/ui/react-hooks/src/useComposedInputValue.ts	44	export function resolveComposedInputValueSync(	CODE
LOW	packages/ui/system/src/plugins/vite.ts	804	function resolvePackageStyleDependency(dependencyName: string): string {	CODE
LOW	packages/ui/system/src/plugins/vite.ts	824	function findDependencyPackageDirectory(dependencyName: string): string {	CODE
LOW	packages/ui/system/src/components/toast/toast.tsx	43	function stripToastTrailingSentencePunctuation(value: string): string {	CODE
LOW	…onents/viewport-menu-surface/viewport-menu-surface.tsx	157	function resolveMenuBoundaryFromPoint(point: {	CODE
LOW	…onents/viewport-menu-surface/viewport-menu-surface.tsx	189	function clampMenuPositionToBoundary(options: {	CODE
LOW	…s/ui/system/src/components/date-picker/date-picker.tsx	69	function defaultDisplayValueFormatter(date: Date): string {	CODE
LOW	…s/ui/system/src/components/date-picker/date-picker.tsx	77	function defaultMonthLabelFormatter(date: Date): string {	CODE
LOW	…s/ui/system/src/components/date-picker/date-picker.tsx	134	function subscribeScrollableAncestors(	CODE
LOW	…s/ui/system/src/components/scroll-area/scroll-area.tsx	684	function hasAlwaysVisibleScrollbarSelector(	CODE
LOW	…s/ui/system/src/components/scroll-area/scroll-area.tsx	721	function requestAnimationFrameSafely(callback: FrameRequestCallback): number {	CODE
LOW	…s/ui/system/src/components/scroll-area/scroll-area.tsx	729	function cancelAnimationFrameSafely(frameId: number): void {	CODE
LOW	packages/ui/system/src/icons/system-icons.tsx	509	export function LockGridHorizontalLinedIcon(props: IconProps) {	CODE
LOW	packages/ui/system/src/icons/system-icons.tsx	517	export function LockGridVerticalLinedIcon(props: IconProps) {	CODE
LOW	packages/ui/system/src/icons/system-icons.tsx	1110	export function NavApplicationsFilledIcon(props: IconProps) {	CODE
LOW	packages/ui/system/src/icons/layout-preset-icons.tsx	68	function BalancedLayoutPresetGlyph({	CODE
LOW	packages/ui/system/src/lib/date-format.ts	6	export function getCurrentTuttiDateLocale(): TuttiDateLocale {	CODE
LOW	packages/ui/system/src/lib/date-format.ts	49	function getShortDateTimeFormatter(locale: string): Intl.DateTimeFormat {	CODE
LOW⚡	packages/ui/rich-text/src/core/richTextDocument.ts	220	function isReservedMentionScopeKey(key: string): boolean {	CODE
LOW⚡	packages/ui/rich-text/src/core/richTextDocument.ts	224	function isPresentationMentionContextKey(key: string): boolean {	CODE
LOW⚡	packages/ui/rich-text/src/core/richTextDocument.ts	228	function isUnsafeMentionContextValue(value: string, maxValueLength: number) {	CODE
LOW⚡	packages/ui/rich-text/src/core/richTextDocument.ts	237	export function sanitizeRichTextMentionScopeForAgentContext(	CODE
LOW⚡	packages/ui/rich-text/src/core/richTextDocument.ts	622	export function serializeRichTextDocumentToContent(	CODE
LOW⚡	packages/ui/rich-text/src/core/richTextDocument.ts	632	function createRichTextParagraphNode(paragraph: string): JSONContent {	CODE
LOW⚡	packages/ui/rich-text/src/core/richTextDocument.ts	639	function createRichTextInlineNodes(text: string): JSONContent[] {	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	86	function convertLegacyDocumentString(value: string): string {	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	98	function renderLegacyNodesToMarkdown(nodes: LegacyJSONContentNode[]): string {	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	105	function renderLegacyNodeToMarkdown(	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	270	export function sanitizeRichTextMentionForAgentContext(	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	314	export function createRichTextMentionHref(	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	332	export function createRichTextMentionMarkdown(	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	397	export function normalizeRichTextLinkHref(	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	404	export function createRichTextLinkMarkdown(input: RichTextLinkInput): string {	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	418	export function createRichTextMarkdownLink(input: {	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	430	export function appendRichTextLinksToContent(	CODE
LOW	packages/ui/rich-text/src/core/richTextDocument.ts	456	export function extractRichTextLinksFromContent(	CODE
5095 more matches not shown…

Over-Commented Block112 hits · 112 pts

Severity	File	Line	Snippet	Context
LOW	tools/scripts/rescue-edit-retry-poison-pill.sh	1	#!/usr/bin/env bash	COMMENT
LOW	packages/clients/device-authority-go/doc.go	1	// Package deviceauthority implements the shared Device Authority owner	COMMENT
LOW	packages/device-link/relaytransport/doc.go	1	// Package relaytransport provides product-neutral byte-stream transport over a	COMMENT
LOW	packages/device-link/icequic/agent.go	61	// NetworkPolicySystem follows OS routing, including TUN interfaces, while	COMMENT
LOW	packages/device-link/networkchange/doc.go	1	// Package networkchange provides a process-local network environment monitor.	COMMENT
LOW	packages/device-link/linkmanager/doc.go	1	// Package linkmanager owns product-neutral DeviceLink connection lifecycle	COMMENT
LOW	packages/device-link/candidateexchange/doc.go	1	// Package candidateexchange owns the product-neutral Trickle ICE coordination	COMMENT
LOW	packages/agent/host/types.go	361	InternalRuntimeContext map[string]any	COMMENT
LOW	packages/agent/host/ports.go	301		COMMENT
LOW	packages/agent/host/doc.go	1	// Package agenthost defines the provider-neutral application contract for	COMMENT
LOW	packages/agent/claude-sdk-sidecar/src/executablePath.ts	1	// Resolves which claude executable the SDK should spawn.	COMMENT
LOW	packages/agent/activity-core/src/engine/types.ts	1	// Workspace session engine contract types	COMMENT
LOW	packages/agent/runtimeprep/codex.go	301	}	COMMENT
LOW	packages/agent/runtimeprep/types.go	61	// immutable WorkspaceAgent revision selected for this session. They are	COMMENT
LOW	packages/agent/runtimeprep/types.go	81	// Rendered into session policy as a deterministic unique list, or "none".	COMMENT
LOW	packages/agent/runtimeprep/types.go	101	// branching on a provider ID.	COMMENT
LOW	packages/agent/runtimeprep/claude.go	21	// bundled native SDK binary — it is the operator escape hatch.	COMMENT
LOW	packages/agent/store-sqlite/store.go	21	// sessions into rail sections. Hosts typically back this with their own	COMMENT
LOW	packages/agent/store-sqlite/store.go	41	NormalizeTarget func(Target) (Target, error)	COMMENT
LOW	packages/agent/store-sqlite/migrations_turns.go	1	package storesqlite	COMMENT
LOW	packages/agent/store-sqlite/migrations.go	341	return err	COMMENT
LOW	packages/agent/store-sqlite/canonical/projection.go	461	if existingLastEventUnixMS > 0 &&	COMMENT
LOW	packages/agent/daemon/providerregistry/doc.go	1	// Package providerregistry owns the cross-layer declaration for migrated agent	COMMENT
LOW	packages/agent/daemon/runtimecmd/proxy.go	21	// HTTPS_PROXY/HTTP_PROXY into the spawned process. Without it, a child agent	COMMENT
LOW	packages/agent/daemon/runtimecmd/proxy.go	81	// Resolver.Env() — managed-runtime installs, agent logins, workspace terminals —	COMMENT
LOW	packages/agent/daemon/activity/service.go	81	// pulls where it left off, cursor advances are written through, and entries	COMMENT
LOW	packages/agent/daemon/activity/syncer.go	21	// or 5xx) the session's message sync is skipped until the backoff window	COMMENT
LOW	packages/agent/daemon/activity/repo.go	21	// is a ready-made file-backed implementation.	COMMENT
LOW	packages/agent/daemon/activity/repo.go	41	// MessageCursorStore persists per-session message sync cursors: the highest	COMMENT
LOW	…gent/daemon/activity/events/turn_lifecycle_snapshot.go	1	package events	COMMENT
LOW	packages/agent/daemon/runtime/codex_appserver_turn.go	281	// or model error) or externally canceled (client hiccup) while codex's	COMMENT
LOW	…s/agent/daemon/runtime/codex_appserver_turn_machine.go	81	func (a *CodexAppServerAdapter) failActiveTurnFromAppServerError(agentSessionID string, params map[string]any) {	COMMENT
LOW	…kages/agent/daemon/runtime/controller_live_sessions.go	341	}	COMMENT
LOW	…kages/agent/daemon/runtime/controller_live_sessions.go	461	// recreateAdapterSession starts a brand new provider session for an existing	COMMENT
LOW	packages/agent/daemon/runtime/visible_error.go	481	// so the session was interrupted — not "request failed". When no numeric code	COMMENT
LOW	…kages/agent/daemon/runtime/activity_projection_test.go	881	}	COMMENT
LOW	…/daemon/runtime/codex_appserver_adapter_cancel_test.go	581	t.Fatalf("Exec did not finish after force cancel")	COMMENT
LOW	packages/agent/daemon/runtime/standard_acp_adapter.go	41	// Some providers, such as Claude Agent, require richer terminal/auth capability	COMMENT
LOW	packages/agent/daemon/runtime/standard_acp_adapter.go	61	// before startup and before live settings reach the provider. Generic ACP	COMMENT
LOW	packages/agent/daemon/runtime/standard_acp_adapter.go	81	// only be applied at process start).	COMMENT
LOW	packages/agent/daemon/runtime/types.go	221	Metadata map[string]any	COMMENT
LOW	packages/agent/daemon/runtime/types.go	421	// lower-seq snapshots arriving over a slower channel are dropped.	COMMENT
LOW	packages/agent/daemon/runtime/acp_providers.go	1	package agentruntime	COMMENT
LOW	packages/agent/daemon/runtime/acp_providers.go	21	// providers start with a descriptor and use the shared standard ACP adapter;	COMMENT
LOW	packages/agent/daemon/runtime/claude_sdk_goal.go	41	// Claude Code's goal is a session-level entity inside the CLI (a condition	COMMENT
LOW	packages/agent/daemon/runtime/acp_auto_continue.go	1	package agentruntime	COMMENT
LOW	…ages/agent/daemon/runtime/controller_session_commit.go	1	package agentruntime	COMMENT
LOW	packages/agent/daemon/runtime/claude_sdk_adapter.go	81	lifecycleSeq uint64	COMMENT
LOW	packages/agent/daemon/runtime/acp_turn_normalizer.go	421	// A tool call still pending when its own turn reaches a normal terminal	COMMENT
LOW	packages/agent/daemon/runtime/acp_provider_cursor.go	1	package agentruntime	COMMENT
LOW	…ent/daemon/runtime/standard_acp_test_transport_test.go	141	// canceledDeferredPromptRetriableTail makes the deferred prompt settle with	COMMENT
LOW	…ckages/agent/daemon/runtime/codex_appserver_adapter.go	121	// permission mode. Network proxy configuration remains a separate concern.	COMMENT
LOW	…ckages/agent/daemon/runtime/codex_appserver_adapter.go	201	// defaultCodexAppServerCancelGraceWindow is how long Cancel waits for codex to	COMMENT
LOW	…ckages/agent/daemon/runtime/codex_appserver_adapter.go	261	// process is force-closed. Zero falls back to the default.	COMMENT
LOW	…ckages/agent/daemon/runtime/codex_appserver_adapter.go	321	// Goal provenance is deliberately separate from the mutable desired Goal	COMMENT
LOW	…ckages/agent/daemon/runtime/codex_appserver_adapter.go	341	goalTurnEvidence map[string]*codexGoalTurnEvidence	COMMENT
LOW	…ckages/agent/daemon/runtime/codex_appserver_adapter.go	361	// goalStateVersion fences asynchronous reads that started before a newer	COMMENT
LOW	…ckages/agent/daemon/runtime/codex_appserver_adapter.go	381	tuttiModeHostContext string	COMMENT
LOW	…ckages/agent/daemon/runtime/codex_appserver_adapter.go	401	// explicit canonical turn clears the boundary in beginActiveTurn.	COMMENT
LOW	packages/agent/daemon/runtime/standard_acp_setup.go	21		COMMENT
52 more matches not shown…

Fake / Example Data50 hits · 52 pts

Severity	File	Line	Snippet	Context
LOW	packages/auth/bridge-go/authbridge_test.go	445	if user == nil \|\| user.UserID != "user-1" \|\| user.Email != "user@example.com" {	CODE
LOW	packages/auth/bridge-go/authbridge_test.go	505	"email": "user@example.com",	CODE
LOW	…nternal/reference/ReferenceSourcePicker.render.test.ts	212	dom.window.document.querySelector("input")?.getAttribute("placeholder"),	CODE
LOW	packages/agent/daemon/providerstatus/auth_test.go	29	output: `{"loggedIn":true,"authMethod":"oauth","email":"user@example.com"}`,	CODE
LOW	packages/agent/daemon/providerstatus/auth_test.go	30	wantStatus: AuthAuthenticated, wantLabel: "user@example.com", wantMethod: "oauth", wantParsed: true,	CODE
LOW	packages/agent/daemon/providerstatus/auth_test.go	48	wantLabel: "user@example.com", wantParsed: true,	CODE
LOW	…s/agent/daemon/providerstatus/auth_observation_test.go	7	Status: AuthAuthenticated, AccountLabel: "user@example.com", AuthMethod: "oauth",	CODE
LOW	…s/agent/daemon/providerstatus/auth_observation_test.go	27	if info.Status != AuthConfigured \|\| info.AccountLabel != "user@example.com" \|\| info.AuthMethod != "oauth" {	CODE
LOW	…ages/agent/daemon/runtime/claude_sdk_transport_test.go	594	for _, sensitive := range []string{"sk-secret", "user@example.com", "/Users/private", "TypeError"} {	CODE
LOW	…/schema/json/codex_app_server_protocol.v2.schemas.json	11384	"placeholder": {	CODE
LOW	…oto/schema/json/codex_app_server_protocol.schemas.json	13106	"placeholder": {	CODE
LOW	…emon/runtime/codexproto/schema/json/ClientRequest.json	2750	"placeholder": {	CODE
LOW	…runtime/codexproto/schema/json/ServerNotification.json	2756	"placeholder": {	CODE
LOW	…ime/codexproto/schema/json/v2/ThreadStartResponse.json	765	"placeholder": {	CODE
LOW	…runtime/codexproto/schema/json/v2/TurnStartParams.json	257	"placeholder": {	CODE
LOW	…codexproto/schema/json/v2/ItemStartedNotification.json	390	"placeholder": {	CODE
LOW	…dexproto/schema/json/v2/TurnCompletedNotification.json	508	"placeholder": {	CODE
LOW	…dexproto/schema/json/v2/ItemCompletedNotification.json	390	"placeholder": {	CODE
LOW	…dexproto/schema/json/v2/ThreadStartedNotification.json	614	"placeholder": {	CODE
LOW	…/codexproto/schema/json/v2/ThreadRollbackResponse.json	614	"placeholder": {	CODE
LOW	…codexproto/schema/json/v2/TurnStartedNotification.json	508	"placeholder": {	CODE
LOW	…time/codexproto/schema/json/v2/ThreadReadResponse.json	614	"placeholder": {	CODE
LOW	…runtime/codexproto/schema/json/v2/TurnSteerParams.json	50	"placeholder": {	CODE
LOW	…ntime/codexproto/schema/json/v2/TurnStartResponse.json	508	"placeholder": {	CODE
LOW	…codexproto/schema/json/v2/ThreadUnarchiveResponse.json	614	"placeholder": {	CODE
LOW	…time/codexproto/schema/json/v2/ThreadForkResponse.json	765	"placeholder": {	CODE
LOW	…proto/schema/json/v2/ThreadMetadataUpdateResponse.json	614	"placeholder": {	CODE
LOW	…time/codexproto/schema/json/v2/ThreadListResponse.json	614	"placeholder": {	CODE
LOW	…me/codexproto/schema/json/v2/ThreadResumeResponse.json	765	"placeholder": {	CODE
LOW	…ime/codexproto/schema/json/v2/ReviewStartResponse.json	508	"placeholder": {	CODE
LOW	…s/agent/gui/shared/agentEnv/agentEnvWizardFlow.spec.ts	262	accountDetail: { kind: "text", text: "user@example.com" },	CODE
LOW	…s/agent/gui/shared/agentEnv/agentEnvWizardFlow.spec.ts	276	text: "user@example.com"	CODE
LOW	…pace-agent/services/internal/agentEnvTelemetry.test.ts	26	auth: { status: "authenticated", accountLabel: "user@example.com" },	CODE
LOW	…pace-agent/services/internal/agentEnvTelemetry.test.ts	41	assert.ok(!serialized.includes("user@example.com"), "must not leak email");	CODE
LOW	…pace-agent/services/internal/agentEnvTelemetry.test.ts	100	!JSON.stringify(params).includes("user@example.com"),	CODE
LOW	…ace-workbench/services/internal/accountService.test.ts	40	email: "user@example.com"	CODE
LOW	…ace-workbench/services/internal/accountService.test.ts	48	email: "user@example.com"	CODE
LOW	apps/mobile/src/screens/SettingsScreenView.test.tsx	100	email: "user@example.com",	CODE
LOW	services/tuttid/api/daemon_account_test.go	23	User: &authbridge.UserInfo{UserID: "user-1", Email: "user@example.com"},	CODE
LOW	services/tuttid/service/agentstatus/service_test.go	203	"userEmail": "user@example.com"	CODE
LOW	services/tuttid/service/account/service_test.go	88	_, _ = w.Write([]byte(`{"code":0,"data":{"userId":"user-1","email":"user@example.com"}}`))	CODE
LOW	services/tuttid/service/agentextension/manager_test.go	1179	raw: `{"schemaVersion":"tutti.agent.composer.v1","launchSettings":{"permission":{"placeholder":"${unknown}"}},"permi	CODE
LOW	services/tuttid/service/agentextension/manager_test.go	1183	raw: `{"schemaVersion":"tutti.agent.composer.v1","launchSettings":{"permission":{"placeholder":"${permissionMode}"}}	CODE
LOW⚡	services/tuttid/service/agentextension/manager_test.go	1195	raw: `{"schemaVersion":"tutti.agent.composer.v1","launchSettings":{"permission":{"placeholder":"${permissionMode}"}}	CODE
LOW⚡	services/tuttid/service/agentextension/manager_test.go	1199	raw: `{"schemaVersion":"tutti.agent.composer.v1","launchSettings":{"permission":{"placeholder":"${permissionMode}"}}	CODE
LOW⚡	services/tuttid/service/agentextension/manager_test.go	1203	raw: `{"schemaVersion":"tutti.agent.composer.v1","launchSettings":{"permission":{"placeholder":"${permissionMode}","	CODE
LOW	services/tuttid/service/agentextension/manager_test.go	1270	"launchSettings":{"permission":{"placeholder":"${permissionMode}"}},	CODE
LOW	services/tuttid/service/agentextension/manager_test.go	1303	"launchSettings":{"permission":{"placeholder":"${permissionMode}"}},	CODE
LOW	services/tuttid/service/agentextension/manager_test.go	1339	"launchSettings":{"permission":{"placeholder":"${permissionMode}"}},	CODE
LOW	services/tuttid/service/agentextension/profiles.go	31	Placeholder string `json:"placeholder"`	CODE

Modern AI Meta-Vocabulary12 hits · 29 pts

Severity	File	Line	Snippet	Context
MEDIUM	README.md	126	#### Task orchestration and multi-project work	COMMENT
MEDIUM	AGENT_GUI_REFACTOR_REMAINING_ISSUES.md	91	### Latest main adds oversized Agent desktop orchestration files	COMMENT
MEDIUM	…cs/conventions/troubleshooting/agent-provider-setup.md	563	### Claude SDK context window shows 200k for 1M models	COMMENT
MEDIUM	packages/workspace/file-manager/CONTRACT.md	114	### 3. Session orchestration	COMMENT
MEDIUM	…es/agent/store-sqlite/activity_update_settings_test.go	68	t.Fatalf("usage=%#v, want unchanged context window", updated.Metadata.Usage)	CODE
MEDIUM	packages/agent/daemon/runtime/claude_sdk_usage_test.go	32	t.Fatalf("usage events = %#v, want none before context window is known", events)	CODE
MEDIUM	packages/agent/daemon/runtime/claude_sdk_usage_test.go	36	t.Fatalf("runtime usage = %#v, want unavailable before context window is known", usage)	CODE
MEDIUM	packages/agent/daemon/runtime/claude_sdk_usage_test.go	102	t.Fatalf("totalTokens = %#v, want model usage context window", contextWindow["totalTokens"])	CODE
MEDIUM	packages/agent/daemon/runtime/claude_sdk_usage_test.go	244	t.Fatalf("totalTokens = %#v, want previous published context window until the new model window is known", contextWindo	CODE
MEDIUM	packages/agent/daemon/runtime/claude_sdk_usage_test.go	281	t.Fatalf("totalTokens = %#v, want retained same-model context window", contextWindow["totalTokens"])	CODE
MEDIUM	packages/agent/daemon/runtime/claude_sdk_usage_test.go	338	t.Fatalf("totalTokens = %#v, want model context window", contextWindow["totalTokens"])	CODE
MEDIUM	…es/agent/daemon/runtime/codex_appserver_events_test.go	1667	// quickly in agentic sessions: after ten 27 K-token calls the cumulative total	COMMENT

Cross-Language Confusion (JS/TS)4 hits · 20 pts

Severity	File	Line	Snippet	Context
HIGH	…/workbench-node/src/electron-main/electronMain.test.ts	2158	print(	CODE
HIGH	apps/desktop/src/main/host/openWithApplications.ts	108	print("\\(name)\\t\\(bundlePath)\\t\\(bundleIdentifier)\\t\\(iconBase64)")	CODE
HIGH	apps/desktop/src/main/host/openWithApplications.ts	163	print(iconBase64)	CODE
HIGH	apps/desktop/src/main/host/openWithApplications.ts	178	print("\\(name)\\t\\(bundlePath)")	CODE

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	services/tuttid/service/agent/provider_auth_watcher.go	274	// fsnotify) keeps the watcher robust against atomic rename rewrites, files	COMMENT
MEDIUM	services/tuttid/service/agent/external_import_parse.go	418	// pattern-matching a specific segment shape, to stay robust across formats.	COMMENT

Overly Generic Function Names3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	packages/ui/system/src/dev-server/server.ts	47	async function handleRequest(	CODE
LOW	packages/agent/claude-sdk-sidecar/src/main.ts	28	export async function handleRequest(	CODE
LOW	…r/workbench-node/src/electron-main/automationServer.ts	96	async function handleRequest(	CODE

Unused Imports2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	…e/app_factory_reference/scripts/check_local_dev_app.py	4		CODE
LOW	…actory_reference/scripts/validate_tutti_app_package.py	4		CODE

Deep Nesting2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	…e/app_factory_reference/scripts/check_local_dev_app.py	177		CODE
LOW	…actory_reference/scripts/validate_tutti_app_package.py	111		CODE

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	tools/scripts/rescue-edit-retry-poison-pill.sh	18	# Usage:	COMMENT

Verbosity Indicators1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…/agent/gui/shared/workspaceAgentMessageOverlay.spec.ts	173	// Step 9: optimistic echoes live outside the durable version domain	COMMENT

Structural Annotation Overuse1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…/agent/gui/shared/workspaceAgentMessageOverlay.spec.ts	173	// Step 9: optimistic echoes live outside the durable version domain	COMMENT

Excessive Try-Catch Wrapping1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	packages/agent/runtimeprep/extension_runtime.go	402	except Exception as exc:	CODE

tutti-os/tutti

Open-Source Code Quality, Security and Technical Debt Review