The Open Framework for Building Agents
This report summarizes scanner evidence for vercel/eve, a TypeScript project with 5,522 GitHub stars. SynthScan examined 719,932 lines of code across 4963 source files, recording 3406 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 7.0 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3385 finding(s).
Are imports declared and package/API names verified? 9 finding(s).
Are wrappers, guards, and repeated structures necessary? 2421 finding(s).
Which changes need focused human review? 3406 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 3406 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | research/programmatic-agent-sources.md | 205 | function defineProgrammaticAgentSource(input: ProgrammaticAgentSource): ProgrammaticAgentSource; | CODE |
| LOW | research/programmatic-agent-sources.md | 227 | function createAgentSourceRegistry( | CODE |
| LOW | research/programmatic-agent-sources.md | 358 | function instantiateProgrammaticTemplate(input: { | CODE |
| LOW | packages/eve-git/extension/lib/signed-commit.ts | 80 | function ensureNoUnstagedTrackedChanges() { | CODE |
| LOW | packages/eve-code/extension/lib/prwatch-github.ts | 70 | export function initialPullRequestWatchNotificationState(): PullRequestWatchNotificationState { | CODE |
| LOW | packages/eve-code/extension/lib/prwatch-github.ts | 78 | export function framePullRequestWatchWake(instruction: string): string { | CODE |
| LOW | packages/eve-code/extension/lib/prwatch-github.ts | 92 | export function advancePullRequestWatchNotification(input: { | CODE |
| LOW | packages/eve-code/extension/lib/prwatch-github.ts | 140 | export function shouldRefreshPullRequestWatchToken(error: unknown): boolean { | CODE |
| LOW | packages/eve-code/extension/lib/prwatch-github.ts | 144 | export function isRetryablePullRequestWatchError(error: unknown): boolean { | CODE |
| LOW | packages/eve-code/extension/lib/prwatch-github.ts | 264 | async function readPullRequestWatchSnapshotWithToken( | CODE |
| LOW | packages/eve-code/extension/lib/prwatch-github.ts | 287 | export async function readPullRequestWatchSnapshot( | CODE |
| LOW | packages/eve-code/extension/lib/workspace-root.ts | 67 | export async function resolveWorkspaceDirectory( | CODE |
| LOW | packages/eve-code/extension/lib/github-compat.ts | 10 | export function deprecatedGitHubConfigured(): boolean { | CODE |
| LOW | packages/eve-code/extension/lib/prwatch-registry.ts | 48 | export function isPrwatchCancelledInState( | CODE |
| LOW | packages/eve-code/extension/lib/generated-paths.ts | 56 | export function findGeneratedPatchTargets(patchText: string): readonly GeneratedPathMatch[] { | CODE |
| LOW | packages/eve-code/extension/lib/generated-paths.ts | 66 | export function generatedPatchTargetsError(matches: readonly GeneratedPathMatch[]): string { | CODE |
| LOW | packages/eve-code/extension/lib/patch.ts | 668 | function formatMissingContextError( | CODE |
| LOW | packages/eve-code/test/scenario/tooling-sources.test.ts | 209 | function assertSignedCommitSourceOrder() { | CODE |
| LOW | packages/eve/test/runtime-tool-registry.test.ts | 186 | function createResolvedToolDefinition(input: { | CODE |
| LOW | packages/eve/test/dev-send-message.test.ts | 29 | function createControlledStreamResponse(): { | CODE |
| LOW | packages/eve/test/dev-send-message.test.ts | 58 | function createStartedMessageResponse(sessionId: string, location: string): Response { | CODE |
| LOW | packages/eve/test/dev-send-message.test.ts | 69 | function createResumedMessageResponse(): Response { | CODE |
| LOW | packages/eve/test/runtime-subagent-registry.test.ts | 80 | function createResolvedRuntimeSubagentNode(input: { | CODE |
| LOW | packages/eve/test/build-profile-report.test.ts | 53 | async function loadBuildProfileReportModule(): Promise<BuildProfileReportModule> { | CODE |
| LOW | packages/eve/test/client.test.ts | 32 | function createControlledStreamResponse(deliveryId = "delivery_turn_001"): { | CODE |
| LOW | packages/eve/test/client.test.ts | 66 | function createStartedMessageResponse( | CODE |
| LOW | packages/eve/test/client.test.ts | 79 | function createResumedMessageResponse(deliveryId = "delivery_turn_002"): Response { | CODE |
| LOW | packages/eve/test/client.test.ts | 86 | function createEagerStreamResponse( | CODE |
| LOW | packages/eve/test/tui-client/target/create-target.ts | 31 | function freezeTestTargetCapabilities( | CODE |
| LOW | …ckages/eve/test/tui-client/target/local-environment.ts | 47 | export function createLocalTestEnvironment( | CODE |
| LOW | …ckages/eve/test/tui-client/target/local-environment.ts | 280 | async function resolveOwnedWorkflowDataDir(input: { | CODE |
| LOW | …ckages/eve/test/tui-client/target/local-environment.ts | 380 | function localTargetKindToServerMode(kind: LocalTestTargetRequest["kind"]): AgentServerMode { | CODE |
| LOW | packages/eve/test/tui-client/lib/server.ts | 116 | export function createAgentServerCommandPlan(input: { | CODE |
| LOW | packages/eve/test/tui-client/lib/server.ts | 252 | export function getAgentNameFromInfoPayload(payload: unknown): string | undefined { | CODE |
| LOW | packages/eve/test/setup/mock-ai-gateway.ts | 42 | function createGatewayModelCatalogResponse(modelIds: ReadonlySet<string>): Response { | CODE |
| LOW | packages/eve/test/setup/mock-ai-gateway.ts | 86 | function collectGatewayModelIdsFromDirectory(directoryPath: string, ids: Set<string>): void { | CODE |
| LOW | packages/eve/test/setup/mock-ai-gateway.ts | 110 | function collectGatewayModelIdsFromSource(source: string, ids: Set<string>): void { | CODE |
| LOW | packages/eve/test/dev-client-harness/url.ts | 1 | function createDevelopmentServerBaseUrl(serverUrl: string): URL { | CODE |
| LOW | packages/eve/test/dev-client-harness/url.ts | 19 | export function resolveDevelopmentServerRouteUrl(input: { | CODE |
| LOW | packages/eve/test/dev-client-harness/url.ts | 36 | export function resolveDevelopmentServerResourceUrl(input: { | CODE |
| LOW | packages/eve/test/dev-client-harness/stream.ts | 34 | export function countCurrentTurnBoundaryEvents(events: readonly MessageStreamEvent[]): number { | CODE |
| LOW | packages/eve/test/dev-client-harness/stream.ts | 44 | export function extractCurrentTurnBoundaryEvent( | CODE |
| LOW | packages/eve/test/dev-client-harness/live-stream.ts | 4 | function isDevelopmentMessageStreamDisconnectError(error: unknown): boolean { | CODE |
| LOW | packages/eve/test/dev-client-harness/live-stream.ts | 231 | export function openDevelopmentMessageStream(input: { | CODE |
| LOW | packages/eve/test/dev-client-harness/session.ts | 26 | export function createDevelopmentSessionState( | CODE |
| LOW | packages/eve/test/dev-client-harness/session.ts | 44 | export function createDevelopmentMessageRequest(input: { | CODE |
| LOW | packages/eve/test/dev-client-harness/session.ts | 57 | export function updateDevelopmentSessionState(input: { | CODE |
| LOW | packages/eve/test/dev-client-harness/send-message.ts | 25 | async function fetchDevelopmentSessionStreamResponse(input: { | CODE |
| LOW | packages/eve/test/dev-client-harness/send-message.ts | 64 | async function openDevelopmentSessionStream(input: { | CODE |
| LOW | packages/eve/test/dev-client-harness/send-message.ts | 79 | async function readDevelopmentTurnEvents(input: { | CODE |
| LOW | packages/eve/test/dev-client-harness/send-message.ts | 251 | function createMessageRouteHeaders(headers?: DevelopmentRequestHeaders): DevelopmentRequestHeaders { | CODE |
| LOW | packages/eve/test/dev-client-harness/send-message.ts | 257 | function copyDevelopmentRequestHeaders( | CODE |
| LOW | packages/eve/test/dev-client-harness/request-headers.ts | 25 | export async function createDevelopmentRequestHeadersAsync(input: { | CODE |
| LOW | …test/scenarios/dev-server-connections.scenario.test.ts | 95 | function createBlockedInstrumentationSource(): string { | CODE |
| LOW | …test/scenarios/compiled-vendor-assets.scenario.test.ts | 33 | function rewriteDeclarationImports( | CODE |
| LOW | …es/eve/test/scenarios/dev-environment.scenario.test.ts | 47 | function clearDevelopmentEnvironment(): void { | CODE |
| LOW | …st/scenarios/eval-command-environment.scenario.test.ts | 93 | function clearDevelopmentEnvironment(): void { | CODE |
| LOW | …st/scenarios/bundle-module-evaluation.scenario.test.ts | 36 | async function bundleEveDistAsSingleChunk(input: RolldownInputOptions): Promise<string> { | CODE |
| LOW | …es/eve/test/scenarios/dev-server-apps.scenario.test.ts | 138 | function createWorkspaceExtensionToolSource(description: string): string { | CODE |
| LOW | …es/eve/test/scenarios/dev-server-apps.scenario.test.ts | 151 | async function workspaceExtensionToolDescription(serverUrl: string): Promise<string | undefined> { | CODE |
| 2349 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …c/tracing/agent-telemetry-contract.integration.test.ts | 53 | import { createPresentedRuntimeActionRequestFromToolCall } from "#harness/action-presentation.js"; | CODE |
| MEDIUM | …eve/src/tracing/invoke-tool-parity.integration.test.ts | 22 | import type { HarnessToolDefinition } from "#harness/execute-tool.js"; | CODE |
| MEDIUM | …eve/src/tracing/invoke-tool-parity.integration.test.ts | 23 | import { buildToolSet } from "#harness/tools.js"; | CODE |
| MEDIUM | packages/eve/src/tracing/agent-trace-context-store.ts | 15 | import type { SessionStateMap } from "#harness/types.js"; | CODE |
| MEDIUM | packages/eve/src/tracing/agent-trace-context-store.ts | 16 | import { getBlockingWorkflowToolRuns } from "#harness/workflow-tool-runs.js"; | CODE |
| MEDIUM | packages/eve/src/tracing/agent-otel-content.test.ts | 3 | import type { FrameworkMessageKind } from "#harness/messages.js"; | CODE |
| MEDIUM | packages/eve/src/tracing/agent-otel-provider.test.ts | 22 | import { createPresentedRuntimeActionRequestFromToolCall } from "#harness/action-presentation.js"; | CODE |
| MEDIUM | packages/eve/src/tracing/agent-otel-provider.test.ts | 23 | import type { HarnessToolMap } from "#harness/types.js"; | CODE |
| MEDIUM | packages/eve/src/tracing/agent-otel-content.ts | 1 | import { isUserMessageKind } from "#harness/messages.js"; | CODE |
| MEDIUM | …ve/src/tool-stubs/validate-targets.integration.test.ts | 2 | import { createTestRuntime } from "#internal/testing/app-harness.js"; | CODE |
| MEDIUM | packages/eve/src/evals/mock-model.ts | 6 | import { isPendingApprovalsSnippet } from "#harness/hitl/approval-prompt.js"; | CODE |
| MEDIUM | packages/eve/src/evals/tool-stubs.integration.test.ts | 11 | import { createTestRuntime } from "#internal/testing/app-harness.js"; | CODE |
| MEDIUM | packages/eve/src/tools/tool-label.test.ts | 8 | import { resolveWebSearchActivityLabel } from "#harness/provider-tool-schemas.js"; | CODE |
| MEDIUM | packages/eve/src/tools/provided/task-wait.ts | 3 | import type { HarnessToolDefinition } from "#harness/execute-tool.js"; | CODE |
| MEDIUM | packages/eve/src/tools/provided/task-cancel.ts | 6 | import type { HarnessToolDefinition } from "#harness/execute-tool.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/tool.ts | 11 | import type { HarnessSession } from "#harness/types.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/invocation.ts | 1 | import type { StepInput } from "#harness/types.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/token-budget.test.ts | 4 | import { bumpSessionRuntimeUsageLimits, setTurnUsageState } from "#harness/turn-tag-state.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/token-budget.test.ts | 5 | import type { HarnessSession, SessionLimits } from "#harness/types.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/hitl-proxy.ts | 3 | import { resolveInputOutcome } from "#harness/input-request-resolution.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/hitl-proxy.ts | 4 | import { firstOpenInput } from "#harness/open-input-request.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/hitl-proxy.ts | 5 | import { storedProjection } from "#harness/session-machine/view.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/hitl-proxy.ts | 6 | import type { StepCoordinates as PendingInputBatchEvent } from "#harness/session-machine/view.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/hitl-proxy.ts | 7 | import { getProxyInputRequests, resolvedByChild } from "#harness/proxy-input-requests.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/hitl-proxy.ts | 8 | import type { WorkflowAskRoute, ProxyInputRequest } from "#harness/proxy-input-requests.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/hitl-proxy.ts | 9 | import type { SessionStateMap } from "#harness/types.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/hitl-proxy.ts | 14 | import { SESSION_LIMIT_STOP_OPTION_ID } from "#harness/hitl/budget-request.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/tool.test.ts | 4 | import type { HarnessSession } from "#harness/types.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/hitl-proxy.test.ts | 7 | } from "#harness/proxy-input-requests.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/hitl-proxy.test.ts | 8 | import type { HarnessSession } from "#harness/types.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/event-proxy-step.ts | 20 | } from "#harness/proxy-input-requests.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/event-proxy-step.ts | 21 | import { currentProjection } from "#harness/session-machine/current.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/event-proxy-step.ts | 22 | import { applyTransition, sessionView } from "#harness/session-machine/commit.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/event-proxy-step.ts | 23 | import { relay } from "#harness/session-machine/transitions.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/subagents/event-proxy-step.ts | 24 | import type { WorkflowAskRoute } from "#harness/proxy-input-requests.js"; | CODE |
| MEDIUM | …kages/eve/src/subagents/hitl-proxy.integration.test.ts | 1 | import { toProxyInputRequestEntries } from "#harness/proxy-input-requests.js"; | CODE |
| MEDIUM⚡ | …kages/eve/src/subagents/hitl-proxy.integration.test.ts | 13 | import { applyTransition, sessionView } from "#harness/session-machine/commit.js"; | CODE |
| MEDIUM⚡ | …kages/eve/src/subagents/hitl-proxy.integration.test.ts | 14 | import { relay } from "#harness/session-machine/transitions.js"; | CODE |
| MEDIUM⚡ | …kages/eve/src/subagents/hitl-proxy.integration.test.ts | 15 | import { storedProjection } from "#harness/session-machine/view.js"; | CODE |
| MEDIUM⚡ | …kages/eve/src/subagents/hitl-proxy.integration.test.ts | 17 | import { hasProxyInputRequests, upsertProxyInputRequests } from "#harness/proxy-input-requests.js"; | CODE |
| MEDIUM⚡ | …kages/eve/src/subagents/hitl-proxy.integration.test.ts | 18 | import type { HarnessEmitFn, HarnessSession } from "#harness/types.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/adapter.ts | 8 | import { resolvedForParent } from "#harness/proxy-input-requests.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/token-budget.ts | 2 | import { getSessionRemainingUsageQuota } from "#harness/turn-tag-state.js"; | CODE |
| MEDIUM | packages/eve/src/subagents/token-budget.ts | 3 | import type { HarnessSession } from "#harness/types.js"; | CODE |
| MEDIUM | …kages/eve/src/subagents/auth-proxy.integration.test.ts | 13 | import type { HarnessSession } from "#harness/types.js"; | CODE |
| MEDIUM⚡ | …eve/src/subagents/event-proxy-step.integration.test.ts | 16 | import { enterSessionProjection } from "#harness/session-machine/current.js"; | CODE |
| MEDIUM⚡ | …eve/src/subagents/event-proxy-step.integration.test.ts | 18 | import { createSessionLimitContinuationRequest } from "#harness/hitl/budget-request.js"; | CODE |
| MEDIUM⚡ | …eve/src/subagents/event-proxy-step.integration.test.ts | 19 | import { getProxyInputRequests } from "#harness/proxy-input-requests.js"; | CODE |
| MEDIUM | …rc/context/build-base-tool-context.integration.test.ts | 4 | import { createTestRuntime } from "#internal/testing/app-harness.js"; | CODE |
| MEDIUM | packages/eve/src/context/schedule-collection-tools.ts | 14 | import { isApprovalRecheck } from "#harness/approval-recheck.js"; | CODE |
| MEDIUM | packages/eve/src/context/keys.ts | 29 | import type { UserModelMessage } from "#harness/messages.js"; | CODE |
| MEDIUM | packages/eve/src/context/keys.ts | 30 | import type { HandleEventFn } from "#harness/types.js"; | CODE |
| MEDIUM | packages/eve/src/context/keys.ts | 120 | /** Last announced value per keyed announcement (see `#harness/announcements.js`). */ | COMMENT |
| MEDIUM | …kages/eve/src/context/dynamic-instruction-lifecycle.ts | 20 | import { createFrameworkUserMessage, type UserModelMessage } from "#harness/messages.js"; | CODE |
| MEDIUM | packages/eve/src/context/provider.ts | 1 | import type { HarnessSessionBase } from "#harness/types.js"; | CODE |
| MEDIUM | packages/eve/src/context/run-step.ts | 1 | import type { HarnessSession, HarnessSessionBase, StepResult } from "#harness/types.js"; | CODE |
| MEDIUM | packages/eve/src/context/accessors.integration.test.ts | 6 | import { createTestRuntime } from "#internal/testing/app-harness.js"; | CODE |
| MEDIUM | packages/eve/src/context/build-dynamic-tools.ts | 2 | import type { HarnessToolDefinition } from "#harness/execute-tool.js"; | CODE |
| MEDIUM | packages/eve/src/context/dynamic-subagent-lifecycle.ts | 14 | import { createPreparedWorkflowToolHarnessDefinition } from "#execution/tools/workflow/harness-definition.js"; | CODE |
| MEDIUM | packages/eve/src/context/dynamic-subagent-lifecycle.ts | 15 | import type { HarnessToolDefinition } from "#harness/execute-tool.js"; | CODE |
| 792 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/eve/README.md | 171 | - [Getting Started](https://eve.dev/docs/getting-started) — install, scaffold, and run locally | CODE |
| MEDIUM | …ckages/eve/test/tui-client/tui-packed-install-model.ts | 91 | // `--min-release-age=0` matches eve's own scaffold install (the packed | COMMENT |
| MEDIUM | …ckages/eve/test/tui-client/tui-packed-install-model.ts | 102 | // Match the scaffold's layout while keeping eve's install free of devDependencies. | COMMENT |
| MEDIUM | packages/eve/test/scenarios/eve-init.scenario.test.ts | 183 | // scaffold install's release-age bypass. | COMMENT |
| MEDIUM⚡ | packages/eve/src/setup/state.ts | 1 | import type { ChannelKind, ConnectionInput, ConnectionProtocol } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/setup/state.ts | 4 | // Re-exported from the scaffold's project module, the single owner of the "." sentinel. | COMMENT |
| MEDIUM⚡ | packages/eve/src/setup/state.ts | 5 | export { CURRENT_DIRECTORY_PROJECT_NAME } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | packages/eve/src/setup/slackbot.ts | 7 | import { SLACK_CHANNEL_DEFAULT_ROUTE } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | packages/eve/src/setup/slackbot.ts | 17 | import { updateSlackChannelConnectorUid } from "#setup/scaffold/update/update-slack-channel.js"; | CODE |
| MEDIUM | packages/eve/src/setup/slackbot.test.ts | 6 | import { updateSlackChannelConnectorUid } from "#setup/scaffold/update/update-slack-channel.js"; | CODE |
| MEDIUM | packages/eve/src/setup/slackbot.test.ts | 29 | vi.mock("#setup/scaffold/update/update-slack-channel.js", () => ({ | CODE |
| MEDIUM⚡ | packages/eve/src/setup/build.ts | 3 | // overlay, and the `web-tanstack` host config files, applies the declared scaffold transforms, | COMMENT |
| MEDIUM⚡ | packages/eve/src/setup/build.ts | 4 | // and writes `scaffold/create/web-template.ts`. Not part of the shipped package: it is | COMMENT |
| MEDIUM⚡ | packages/eve/src/setup/build.ts | 9 | // walks the whole dist and stamps the scaffold's __*_VERSION__ tokens for free. | COMMENT |
| MEDIUM | packages/eve/src/setup/primitives/run-vercel.test.ts | 331 | // The project parent does not exist until scaffold; account lookups must not | COMMENT |
| MEDIUM | …/eve/src/setup/integrations/self-modification/setup.ts | 23 | import { ensurePackageDependencies } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | …/eve/src/setup/integrations/self-modification/setup.ts | 27 | } from "#setup/scaffold/version-tokens.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/discord/setup.ts | 5 | import { deriveSlackConnectorSlug } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/discord/setup.ts | 6 | import { writeTextFile } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM | …tup/integrations/web/auth-scaffold.integration.test.ts | 9 | import { pathExists, writeTextFile } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM | …tup/integrations/web/auth-scaffold.integration.test.ts | 15 | } from "#setup/scaffold/create/web-template.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/web/setup.ts | 7 | import { WEB_APP_TANSTACK_TEMPLATE_FILES } from "#setup/scaffold/create/web-template.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/web/framework.ts | 4 | import { pathExists } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM⚡ | …ckages/eve/src/setup/integrations/web/auth-scaffold.ts | 5 | import { writeTextFile } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM⚡ | …ckages/eve/src/setup/integrations/web/auth-scaffold.ts | 10 | } from "#setup/scaffold/create/web-template.js"; | CODE |
| MEDIUM⚡ | …ckages/eve/src/setup/integrations/web/auth-scaffold.ts | 11 | import { resolveWebPackageVersions } from "#setup/scaffold/update/web-options.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/web/hosting.ts | 6 | import { WEB_CHANNEL_TEMPLATES } from "#setup/scaffold/create/web-template.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/web/hosting.ts | 7 | import { pathExists, writeTextFile } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/linear/setup.ts | 5 | import { deriveSlackConnectorSlug, normalizeSlackConnectorSlug } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/linear/setup.ts | 6 | import { writeTextFile } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/shopify/setup.ts | 5 | import { writeTextFile } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/linq/setup.ts | 6 | import { deriveSlackConnectorSlug } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/linq/setup.ts | 7 | import { writeTextFile } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/linq/setup.test.ts | 6 | vi.mock("#setup/scaffold/index.js", () => ({ | CODE |
| MEDIUM | packages/eve/src/setup/integrations/github/setup.ts | 5 | import { deriveSlackConnectorSlug } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/github/setup.ts | 6 | import { writeTextFile } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/teams/setup.ts | 6 | import { writeTextFile } from "#setup/scaffold/files.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/slack/setup.ts | 9 | } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/slack/setup.ts | 10 | import { readSlackChannelFile } from "#setup/scaffold/update/update-slack-channel.js"; | CODE |
| MEDIUM | packages/eve/src/setup/integrations/slack/setup.test.ts | 10 | import type { SlackConnectorSlug } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | …kages/eve/src/setup/scaffold/index.integration.test.ts | 309 | // .vercel/output/config.json at build time, so the scaffold only writes a | COMMENT |
| MEDIUM | …kages/eve/src/setup/scaffold/index.integration.test.ts | 633 | // withEve() owns eve service generation, so the scaffold leaves an existing | COMMENT |
| MEDIUM | …kages/eve/src/setup/scaffold/index.integration.test.ts | 1158 | // Every scaffold ships @types/node plus tsconfig `types: ["node"]` so agent | COMMENT |
| MEDIUM | packages/eve/src/setup/scaffold/version-tokens.ts | 49 | // The published name; rule 28 keeps the scaffold layer free of `#internal/*` | COMMENT |
| MEDIUM | packages/eve/src/setup/scaffold/version-tokens.ts | 132 | // the fallback must never turn a loud failure into a corrupt scaffold. | COMMENT |
| MEDIUM | packages/eve/src/setup/scaffold/create/project.ts | 169 | // scaffold ships (see `packageJsonTemplate`). | COMMENT |
| MEDIUM | packages/eve/src/setup/scaffold/create/extension.ts | 89 | // Same trailing engines block the agent scaffold appends for non-workspace roots. | COMMENT |
| MEDIUM | packages/eve/src/setup/boxes/resolve-provisioning.ts | 3 | import { byokProviderEnvVar } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | packages/eve/src/setup/boxes/resolve-provisioning.ts | 412 | // "Use my own provider API key": no managed credential. The scaffold writes | COMMENT |
| MEDIUM | …kages/eve/src/internal/vercel/build-agent-workspace.ts | 13 | import { buildMultiAgentLandingPage } from "#internal/vercel/build-multi-agent-landing-page.js"; | CODE |
| MEDIUM | …ro/routes/agent-info/build-agent-info-response.test.ts | 165 | // The shipped BYOK scaffold places the owner's provider key under | COMMENT |
| MEDIUM | packages/eve/src/cli/dev/tui/prompt-placeholder.test.ts | 5 | import { AGENT_INSTRUCTIONS_TEMPLATE } from "#setup/scaffold/create/instructions-template.js"; | CODE |
| MEDIUM | packages/eve/src/cli/dev/tui/prompt-placeholder.ts | 2 | import { AGENT_INSTRUCTIONS_TEMPLATE } from "#setup/scaffold/create/instructions-template.js"; | CODE |
| MEDIUM | packages/eve/src/cli/dev/tui/prompt-placeholder.ts | 3 | import { SCAFFOLDED_AGENT_PATHS } from "#setup/scaffold/create/agent-paths.js"; | CODE |
| MEDIUM | packages/eve/src/cli/dev/tui/mcp-connection-status.ts | 1 | import { CONNECTION_CATALOG } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | …src/cli/dev/tui/prompt-placeholder.integration.test.ts | 7 | import { AGENT_INSTRUCTIONS_TEMPLATE } from "#setup/scaffold/create/instructions-template.js"; | CODE |
| MEDIUM | packages/eve/src/cli/commands/integration-connect.ts | 20 | import { updateConnectionConnectorUid } from "#setup/scaffold/update/update-connection-connector.js"; | CODE |
| MEDIUM | packages/eve/src/cli/commands/preconditions.ts | 3 | import { isEveProject } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM | …ckages/eve/src/cli/commands/deploy.integration.test.ts | 14 | import { isEveProject } from "#setup/scaffold/index.js"; | CODE |
| MEDIUM⚡ | packages/eve/src/cli/commands/init.ts | 33 | import { addAgentToProject } from "#setup/scaffold/create/add-to-project.js"; | CODE |
| 34 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/eve/src/execution/sandbox/write-file.ts | 55 | // ── Read current file ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/eve/src/execution/sandbox/write-file.ts | 77 | // ── File exists — enforce read-before-write ───────────────────────── | COMMENT |
| MEDIUM | packages/eve/src/execution/sandbox/write-file.ts | 87 | // ── Stale-read detection ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/eve/src/execution/sandbox/write-file.ts | 103 | // ── Write and refresh stamp ───────────────────────────────────────── | COMMENT |
| MEDIUM | packages/eve/src/execution/sandbox/read-file.ts | 84 | // ── Classify as PDF, text, image, or unsupported binary ─────────── | COMMENT |
| MEDIUM | packages/eve/src/execution/sandbox/read-file.ts | 102 | // ── Validate offset / limit ───────────────────────────────────────── | COMMENT |
| MEDIUM | packages/eve/src/execution/sandbox/read-file.ts | 110 | // ── Split into lines ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/eve/src/execution/sandbox/read-file.ts | 122 | // ── Validate offset against file length ───────────────────────────── | COMMENT |
| MEDIUM | packages/eve/src/execution/sandbox/read-file.ts | 134 | // ── Persist full-file stamp ───────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/eve/src/execution/sandbox/read-file.ts | 146 | // ── Handle empty file ─────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/eve/src/execution/sandbox/read-file.ts | 156 | // ── Apply offset and limit ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/eve/src/execution/sandbox/read-file.ts | 161 | // ── Number and truncate lines, cap at MAX_OUTPUT_BYTES ────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/eve/src/runtime/channels/registry.test.ts | 41 | COMMENT | |
| LOW | packages/eve/src/setup/ask.ts | 1 | // The single ask channel of the setup contract. A box owns data acquisition | COMMENT |
| LOW | …e/src/internal/workflow-bundle/workflow-transformer.ts | 501 | node.declaration.kind === "const" && | COMMENT |
| LOW | packages/eve/src/cli/dev/tui/terminal-renderer.ts | 441 | /** | COMMENT |
| LOW | packages/eve/src/cli/dev/tui/terminal-renderer.ts | 461 | #logLevelHintActive = false; | COMMENT |
| LOW | packages/eve/src/cli/commands/agent-instructions.ts | 1 | import { readFileSync } from "node:fs"; | COMMENT |
| LOW | packages/eve/src/execution/sandbox/glob-tool.ts | 181 | COMMENT | |
| LOW | apps/docs/wgsl-env.d.ts | 1 | /// <reference types="@vgpu/wgsl/wgsl-types" /> | COMMENT |
| LOW | apps/docs/app/(nights)/nights/nights-galaxy.tsx | 201 | // initial values; the scene effect overwrites them once it knows canvas | COMMENT |
| LOW | apps/docs/app/(nights)/nights/nights-galaxy.tsx | 221 | const fieldStrength = uniform(0.58); | COMMENT |
| LOW | apps/docs/app/(nights)/nights/nights-galaxy.tsx | 261 | // loop computes `target * easedProgress` and assigns to the uniform each | COMMENT |
| LOW | apps/docs/app/(nights)/nights/nights-galaxy.tsx | 401 | // Created up-front so the star material can sample `densityRT.texture` | COMMENT |
| LOW | apps/docs/app/(nights)/nights/nights-galaxy.tsx | 541 | // The product gives a non-periodic envelope (no two stars share a | COMMENT |
| LOW | apps/docs/app/(nights)/nights/nights-galaxy.tsx | 801 | COMMENT | |
| LOW | apps/docs/scripts/render-eve-5.ts | 1 | // This script uses @vgpu/adapter-node, which requires native Vulkan support and a | COMMENT |
| LOW | apps/docs/scripts/render-eve-5.ts | 21 | // Set EVE_LOGO_RENDER_THEME=light|dark and EVE_LOGO_RENDER_WIDTH/HEIGHT when | COMMENT |
| LOW | apps/docs/registry/connections/notion.ts | 1 | import { connect } from "@vercel/connect/eve"; | COMMENT |
| LOW | apps/templates/eve-chat-template/scripts/setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …c/internal/nitro/host/start-development-server.test.ts | 510 | const call = mocks.devServer.setControlHandler.mock.calls.at(-1); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | apps/docs/lib/integrations/connection-setup.test.ts | 21 | "BROWSER_USE_API_KEY=your_api_key", | CODE |
| HIGH | apps/docs/lib/integrations/connection-setup.ts | 164 | `${spec.apiKey.env}=your_api_key`, | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/eve/src/setup/integrations/photon/management.test.ts | 148 | phoneNumber: "555-1234", | CODE |
| LOW | packages/eve/src/cli/dev/tui/blocks.test.ts | 387 | const long = "lorem ipsum ".repeat(40).trim(); | CODE |
| LOW⚡ | packages/eve/src/harness/provider-safety.test.ts | 12 | attributes: { email: "user@example.com" }, | CODE |
| LOW | …ages/eve/src/public/models/openai/chatgpt/auth.test.ts | 20 | extractCodexAccountLabelFromToken(createUnsignedJwt({ email: "user@example.com" })), | CODE |
| LOW | …ages/eve/src/public/models/openai/chatgpt/auth.test.ts | 21 | ).toBe("user@example.com"); | CODE |
| LOW | …emplate/apps/web/app/components/profile/PhoneInput.vue | 109 | :placeholder="placeholder" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/eve/src/harness/tool-loop.test.ts | 8542 | // Step 1: tool call → harness continues (next === runStep). | COMMENT |
| LOW | packages/eve/src/harness/tool-loop.test.ts | 8568 | // Step 2: continuation — model responds with text, turn ends. | COMMENT |
| LOW | packages/eve/src/harness/tool-loop.test.ts | 8586 | // Step 3: new turn with compaction. The mock simulates the | COMMENT |
| LOW | packages/eve/src/harness/tool-loop.test.ts | 9615 | // Step 1: tool call → continues | COMMENT |
| LOW | packages/eve/src/harness/tool-loop.test.ts | 9649 | // Step 2: simulate step boundary by creating a NEW harness (as durableRunStep does). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/eve/src/harness/tool-loop.test.ts | 8542 | // Step 1: tool call → harness continues (next === runStep). | COMMENT |
| LOW | packages/eve/src/harness/tool-loop.test.ts | 8568 | // Step 2: continuation — model responds with text, turn ends. | COMMENT |
| LOW | packages/eve/src/harness/tool-loop.test.ts | 8586 | // Step 3: new turn with compaction. The mock simulates the | COMMENT |
| LOW | packages/eve/src/harness/tool-loop.test.ts | 9615 | // Step 1: tool call → continues | COMMENT |
| LOW | packages/eve/src/harness/tool-loop.test.ts | 9649 | // Step 2: simulate step boundary by creating a NEW harness (as durableRunStep does). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/eve/test/tui-client/lib/mcp-stub-server.ts | 128 | async function handleRequest( | CODE |
| LOW | …mputer-use/extension/lib/computer-use-driver-source.ts | 3 | 'import { setTimeout as delay } from "node:timers/promises";\nimport { execFile, execFileSync } from "node:child_proce | CODE |