Bash for Agents
This report presents the forensic synthetic code analysis of vercel-labs/just-bash, a TypeScript project with 4,100 GitHub stars. SynthScan v2.0 examined 358,653 lines of code across 1274 source files, recording 643 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 4.1 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 643 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | packages/just-bash/src/interpreter/control-flow.test.ts | 48 | elif [ $x -eq 2 ]; then | CODE |
| HIGH | packages/just-bash/src/interpreter/control-flow.test.ts | 50 | elif [ $x -eq 3 ]; then | CODE |
| HIGH | …ty/prototype-pollution/prototype-pollution-awk.test.ts | 61 | print (1 in ${keyword}) ? "exists" : "deleted" | CODE |
| HIGH | …ty/prototype-pollution/prototype-pollution-awk.test.ts | 73 | print ("key" in ${keyword}) ? "yes" : "no" | CODE |
| HIGH | …ty/prototype-pollution/prototype-pollution-awk.test.ts | 74 | print ("missing" in ${keyword}) ? "yes" : "no" | CODE |
| HIGH | …y/sandbox/python-sqlite-information-disclosure.test.ts | 11 | print("LEAK" if bad else "SAFE") | CODE |
| HIGH⚡ | …es/just-bash/src/commands/python3/python3.http.test.ts | 175 | print("no error") | CODE |
| HIGH⚡ | …es/just-bash/src/commands/python3/python3.http.test.ts | 177 | print("error raised") | CODE |
| HIGH⚡ | …es/just-bash/src/commands/python3/python3.http.test.ts | 193 | print("success") | CODE |
| HIGH⚡ | …es/just-bash/src/commands/python3/python3.http.test.ts | 195 | print("network error") | CODE |
| HIGH⚡ | …es/just-bash/src/commands/python3/python3.http.test.ts | 214 | print("success") | CODE |
| HIGH⚡ | …es/just-bash/src/commands/python3/python3.http.test.ts | 216 | print("access denied") | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 47 | print(response.status_code) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 48 | print(response.ok) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 73 | print('content-type' in response.headers) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 97 | print(type(data).__name__) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 98 | print(data["key"]) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 124 | print(data["headers"].get("X-Custom", "not found")) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 148 | print(response.status_code) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 149 | print(response.ok) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 242 | print(response.status_code) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 266 | print(data["json"]["key"]) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 293 | print(response.status_code) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 294 | print(len(response.text)) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 316 | print(response.status_code) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 338 | print(response.status_code) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 360 | print(response.status_code) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 387 | print(type(r.content).__name__) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 388 | print(list(r.content[:4])) | CODE |
| HIGH | …es/just-bash/src/commands/python3/python3.http.test.ts | 416 | print("saved") | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 143 | print("VULNERABLE:", f.read()[:50]) | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 145 | print("SAFE: no /etc/passwd in VFS") | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 161 | print("VULNERABLE:", f.read()[:50]) | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 163 | print("SAFE: /etc/shadow not accessible") | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 180 | print("VULNERABLE: TCP connected") | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 182 | print("SAFE:", e) | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 207 | print("LEAKED:", leaked) | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 209 | print("SAFE: no host env vars leaked") | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 235 | print(files) | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 248 | print(f'root={root}, files={files}') | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 262 | print('exists:', p.exists()) | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 263 | print('content:', p.read_text().strip()) | CODE |
| HIGH | …ust-bash/src/commands/python3/python3.security.test.ts | 277 | print(os.getcwd()) | CODE |
| HIGH⚡ | …ust-bash/src/commands/python3/python3.security.test.ts | 301 | print('HTTP_OK:', resp.status_code) | CODE |
| HIGH⚡ | …ust-bash/src/commands/python3/python3.security.test.ts | 305 | print('OK: bridge works, network not configured') | CODE |
| HIGH⚡ | …ust-bash/src/commands/python3/python3.security.test.ts | 307 | print('OK: bridge works, got error:', msg[:80]) | CODE |
| HIGH | …s/just-bash/src/commands/python3/python3.files.test.ts | 12 | print("Hello from script") | CODE |
| HIGH | …s/just-bash/src/commands/python3/python3.files.test.ts | 23 | print(f"Args: {sys.argv[1:]}") | CODE |
| HIGH | …s/just-bash/src/commands/python3/python3.files.test.ts | 34 | print(sys.argv[0]) | CODE |
| HIGH | …s/just-bash/src/commands/python3/python3.files.test.ts | 55 | print(result) | CODE |
| HIGH | …s/just-bash/src/commands/python3/python3.files.test.ts | 69 | print(json.dumps(data)) | CODE |
| HIGH | …s/just-bash/src/commands/python3/python3.files.test.ts | 80 | print("hello" | CODE |
| HIGH | …s/just-bash/src/commands/python3/python3.files.test.ts | 140 | print(f"executed: {__file__}") | CODE |
| HIGH | …s/just-bash/src/commands/python3/python3.files.test.ts | 171 | print(files) | CODE |
| HIGH | …s/just-bash/src/commands/python3/python3.files.test.ts | 205 | print(mymodule.greet("World")) | CODE |
| HIGH | …ges/just-bash/src/commands/python3/python3.env.test.ts | 82 | it("should return None for undefined env var with get()", async () => { | CODE |
| HIGH | …ges/just-bash/src/commands/python3/python3.env.test.ts | 264 | print(list(data)) | CODE |
| HIGH | …ges/just-bash/src/commands/python3/python3.env.test.ts | 280 | print(len(data), data[5]) | CODE |
| HIGH⚡ | …ges/just-bash/src/commands/python3/python3.env.test.ts | 293 | print('line1') | CODE |
| HIGH⚡ | …ges/just-bash/src/commands/python3/python3.env.test.ts | 294 | print('line2') | CODE |
| 109 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …website/app/components/terminal-parts/agent-command.ts | 21 | "<path>", | COMMENT |
| LOW | packages/just-bash/src/interpreter/type-command.ts | 101 | } | COMMENT |
| LOW | packages/just-bash/src/interpreter/redirections.ts | 441 | } | COMMENT |
| LOW | packages/just-bash/src/interpreter/redirections.ts | 821 | } | COMMENT |
| LOW | packages/just-bash/src/interpreter/builtins/local.ts | 281 | // Validate variable name: must start with letter/underscore, contain only alphanumeric/_ | COMMENT |
| LOW | …ages/just-bash/src/interpreter/expansion/word-split.ts | 181 | // The quoted part "AxBxC" is protected from internal splitting. | COMMENT |
| LOW | …ages/just-bash/src/interpreter/expansion/word-split.ts | 301 | return joined ? [joined] : []; | COMMENT |
| LOW | …ages/just-bash/src/interpreter/expansion/word-split.ts | 321 | let currentWord = ""; | COMMENT |
| LOW | packages/just-bash/src/interpreter/helpers/array.ts | 201 | if (word.parts.length < 2) return null; | COMMENT |
| LOW | packages/just-bash/src/security/defense-in-depth-box.ts | 1101 | // Protect process.execPath (string primitive, needs defineProperty) | COMMENT |
| LOW | packages/just-bash/src/parser/lexer.ts | 1381 | let depth = 1; | COMMENT |
| LOW | packages/just-bash/src/parser/lexer.ts | 1841 | // This is important for proper handling by parseWordParts | COMMENT |
| LOW | packages/just-bash/src/spec-tests/grep/skips.ts | 141 | // -L option (print files without matches) | COMMENT |
| LOW | packages/just-bash/src/spec-tests/bash/spec.test.ts | 41 | COMMENT | |
| LOW | packages/just-bash/src/spec-tests/bash/spec.test.ts | 81 | // "extglob-files.test.sh", // Testing | COMMENT |
| LOW | packages/just-bash/src/spec-tests/bash/spec.test.ts | 101 | COMMENT | |
| LOW | …st-bash/src/spec-tests/bash/cases/builtin-echo.test.sh | 61 | COMMENT | |
| LOW | …st-bash/src/spec-tests/bash/cases/builtin-echo.test.sh | 81 | # ## END | COMMENT |
| LOW | …st-bash/src/spec-tests/bash/cases/builtin-echo.test.sh | 201 | echo -en '\03777' | od -A n -t x1 | sed 's/ \+/ /g' | COMMENT |
| LOW | …st-bash/src/spec-tests/bash/cases/builtin-echo.test.sh | 241 | a b c d 006 | COMMENT |
| LOW | …ust-bash/src/spec-tests/bash/cases/command-sub.test.sh | 1 | ## compare_shells: dash bash mksh | COMMENT |
| LOW | …ust-bash/src/spec-tests/bash/cases/command-sub.test.sh | 21 | foo=FOO; echo `echo $foo`bar`echo $foo` | COMMENT |
| LOW | …st-bash/src/spec-tests/bash/cases/func-parsing.test.sh | 1 | ## compare_shells: dash bash mksh | COMMENT |
| LOW | …st-bash/src/spec-tests/bash/cases/func-parsing.test.sh | 41 | ## stdout: 5 0 | COMMENT |
| LOW | …st-bash/src/spec-tests/bash/cases/func-parsing.test.sh | 61 | ## OK dash status: 2 | COMMENT |
| LOW | …ages/just-bash/src/spec-tests/bash/cases/alias.test.sh | 441 | ## OK osh status: 2 | COMMENT |
| LOW | …bash/src/spec-tests/bash/cases/assign-deferred.test.sh | 101 | ## OK bash status: 2 | COMMENT |
| LOW | …just-bash/src/spec-tests/bash/cases/bool-parse.test.sh | 1 | ## oils_failures_allowed: 1 | COMMENT |
| LOW | …st-bash/src/spec-tests/bash/cases/builtin-trap.test.sh | 341 | # All shells spew warnings to stderr, but don't actually exit! Bad! | COMMENT |
| LOW | …ust-bash/src/spec-tests/bash/cases/var-op-test.test.sh | 61 | # | COMMENT |
| LOW | …ust-bash/src/spec-tests/bash/cases/var-op-test.test.sh | 141 | echo empty /"${empty[@]}"/ | COMMENT |
| LOW | …ust-bash/src/spec-tests/bash/cases/var-op-test.test.sh | 221 | COMMENT | |
| LOW | …ust-bash/src/spec-tests/bash/cases/var-op-test.test.sh | 821 | ## N-I dash STDOUT: | COMMENT |
| LOW | …just-bash/src/spec-tests/bash/cases/word-split.test.sh | 401 | argv.py at ${!a[@]} | COMMENT |
| LOW | …just-bash/src/spec-tests/bash/cases/ble-idioms.test.sh | 1 | ## compare_shells: bash zsh mksh ash | COMMENT |
| LOW | …just-bash/src/spec-tests/bash/cases/ble-idioms.test.sh | 61 | 321:321 | COMMENT |
| LOW | …just-bash/src/spec-tests/bash/cases/ble-idioms.test.sh | 461 | COMMENT | |
| LOW | …just-bash/src/spec-tests/bash/cases/shell-bugs.test.sh | 1 | ## compare_shells: bash dash mksh zsh ash | COMMENT |
| LOW | …bash/src/spec-tests/bash/cases/paren-ambiguity.test.sh | 141 | ## STDERR: | COMMENT |
| LOW | …s/just-bash/src/spec-tests/bash/cases/redirect.test.sh | 41 | ## STDOUT: | COMMENT |
| LOW | …s/just-bash/src/spec-tests/bash/cases/redirect.test.sh | 81 | COMMENT | |
| LOW | …s/just-bash/src/spec-tests/bash/cases/redirect.test.sh | 121 | #### : 3>&3 (OSH regression) | COMMENT |
| LOW | …s/just-bash/src/spec-tests/bash/cases/redirect.test.sh | 181 | #### Redirect to empty string | COMMENT |
| LOW | …s/just-bash/src/spec-tests/bash/cases/redirect.test.sh | 441 | COMMENT | |
| LOW | …-bash/src/spec-tests/bash/cases/builtin-printf.test.sh | 1 | ## oils_failures_allowed: 1 | COMMENT |
| LOW | …-bash/src/spec-tests/bash/cases/builtin-printf.test.sh | 41 | # quote 'val' and store it in foo | COMMENT |
| LOW | …-bash/src/spec-tests/bash/cases/builtin-printf.test.sh | 101 | ## STDOUT: | COMMENT |
| LOW | …-bash/src/spec-tests/bash/cases/builtin-printf.test.sh | 441 | # printf: warning: : character(s) following character constant have been ignored | COMMENT |
| LOW | …-bash/src/spec-tests/bash/cases/builtin-printf.test.sh | 461 | # 206 | COMMENT |
| LOW | …-bash/src/spec-tests/bash/cases/builtin-printf.test.sh | 801 | ['a b'] | COMMENT |
| LOW | …-bash/src/spec-tests/bash/cases/builtin-printf.test.sh | 1341 | printf 'three %b\n' '\141' # di | COMMENT |
| LOW | …st-bash/src/spec-tests/bash/cases/builtin-dirs.test.sh | 241 | ## stdout: ~ ~ | COMMENT |
| LOW | …sh/src/spec-tests/bash/cases/known-differences.test.sh | 1 | ## oils_failures_allowed: 0 | COMMENT |
| LOW | …sh/src/spec-tests/bash/cases/known-differences.test.sh | 21 | ## END | COMMENT |
| LOW | …bash/src/spec-tests/bash/cases/sh-options-bash.test.sh | 21 | 1 | COMMENT |
| LOW | …s/just-bash/src/spec-tests/bash/cases/command_.test.sh | 21 | ./0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567 | COMMENT |
| LOW | …s/just-bash/src/spec-tests/bash/cases/command_.test.sh | 181 | status=1 | COMMENT |
| LOW | …/just-bash/src/spec-tests/bash/cases/word-eval.test.sh | 1 | ## compare_shells: dash bash mksh | COMMENT |
| LOW | …es/just-bash/src/spec-tests/bash/cases/sh-func.test.sh | 181 | COMMENT | |
| LOW | …-bash/src/spec-tests/bash/cases/strict-options.test.sh | 1 | ## compare_shells: dash bash-4.4 mksh | COMMENT |
| 172 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | examples/executor-tools/multi-api-agent.ts | 47 | // ── Inline tools ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | examples/executor-tools/multi-api-agent.ts | 139 | // ── Turn 1: agent gathers all three pieces in parallel ────────────────── | COMMENT |
| MEDIUM | examples/executor-tools/multi-api-agent.ts | 172 | // ── Turn 2: bash composes the report from saved JSON ──────────────────── | COMMENT |
| MEDIUM | examples/executor-tools/multi-api-agent.ts | 203 | // ── Turn 3: bash CLI form of the same tools ───────────────────────────── | COMMENT |
| MEDIUM | examples/executor-tools/multi-api-agent.ts | 214 | // ── Diagnostic: which tools were called ───────────────────────────────── | COMMENT |
| MEDIUM | examples/executor-tools/multi-turn-discovery.ts | 91 | // ── Turn 2: Agent calls a discovered query tool ───────────────── | COMMENT |
| MEDIUM | examples/executor-tools/multi-turn-discovery.ts | 108 | // ── Turn 3: Agent filters a list endpoint ─────────────────────── | COMMENT |
| MEDIUM | examples/executor-tools/multi-turn-discovery.ts | 123 | // ── Turn 4: Agent chains tools — group by continent ───────────── | COMMENT |
| MEDIUM | examples/executor-tools/multi-turn-discovery.ts | 145 | // ── Turn 5: Agent writes results to virtual filesystem ────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/ast.ts | 7 | // ─── Expressions ─────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/ast.ts | 148 | // ─── Statements ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/ast.ts | 250 | // ─── Program Structure ───────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/builtins.ts | 166 | // ─── String Functions ─────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/builtins.ts | 512 | // ─── Math Functions ───────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/builtins.ts | 597 | // ─── Unsupported Functions ────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/builtins.ts | 611 | // ─── Printf Formatting ────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/builtins.ts | 1007 | // ─── Built-in Function Registry ───────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/parser2.ts | 84 | // ─── Helper methods ──────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/parser2.ts | 175 | // ─── Program parsing ─────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/parser2.ts | 341 | // ─── Statement parsing ───────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash/src/commands/awk/parser2.ts | 552 | // ─── Expression parsing (precedence climbing) ────────────── | COMMENT |
| MEDIUM | …h/src/commands/js-exec/js-exec.buffer-encoding.test.ts | 5 | // ─── Encode side ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …h/src/commands/js-exec/js-exec.buffer-encoding.test.ts | 89 | // ─── Decode side ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …h/src/commands/js-exec/js-exec.buffer-encoding.test.ts | 184 | // ─── Cross-API ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …h/src/commands/js-exec/js-exec.buffer-encoding.test.ts | 234 | // ─── Unknown encoding ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …h/src/commands/js-exec/js-exec.buffer-encoding.test.ts | 254 | // ─── Aliases ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …h/src/commands/js-exec/js-exec.buffer-encoding.test.ts | 283 | // ─── Node-compat edge cases ────────────────────────────────────── | COMMENT |
| MEDIUM | …ges/just-bash/src/transform/plugins/tee-plugin.test.ts | 417 | // ── Complex scripts ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/node-esm-smoke.test.ts | 53 | // ── 1. Each upstream plugin loads + instantiates in plain Node ESM ───────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/node-esm-smoke.test.ts | 81 | // ── 2. @just-bash/executor's plugin-loader path works for each kind ───────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/node-esm-smoke.test.ts | 167 | // ── 3. Inline tools path doesn't need any plugin at all ───────────────────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/tool-command.ts | 21 | // ── Naming ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/tool-command.ts | 34 | // ── Arg Parsing ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/tool-command.ts | 172 | // ── Help Formatting ───────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/tool-command.ts | 252 | // ── Command Factory ───────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/tool-command.ts | 331 | // ── Grouping Helpers ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/tool-command.test.ts | 17 | // ── camelToKebab ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/tool-command.test.ts | 41 | // ── parseToolCliArgs ──────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/just-bash-executor/src/tool-command.test.ts | 163 | // ── Integration: Bash with tool commands ──────────────────────── | COMMENT |
| MEDIUM | …kages/just-bash-executor/src/executor-examples.test.ts | 15 | // ── Network isolation ────────────────────────────────────────── | COMMENT |
| MEDIUM | …kages/just-bash-executor/src/executor-examples.test.ts | 70 | // ── Custom discovery plugin tests ─────────────────────────────── | COMMENT |
| MEDIUM | …kages/just-bash-executor/src/executor-examples.test.ts | 233 | // ── Tool approval tests ───────────────────────────────────────── | COMMENT |
| MEDIUM | …kages/just-bash-executor/src/executor-examples.test.ts | 368 | // ── GraphQL plugin: offline introspection → tool discovery ────── | COMMENT |
| MEDIUM | …kages/just-bash-executor/src/executor-examples.test.ts | 465 | // ── OpenAPI plugin: static spec → tool discovery ──────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/just-bash/src/readme.test.ts | 127 | function renameDuplicateDeclarations(code: string): string { | CODE |
| LOW | packages/just-bash/src/fatal-execution-error.ts | 11 | export function rethrowFatalExecutionError(error: unknown): void { | CODE |
| LOW | packages/just-bash/src/execution-scope.ts | 460 | export function createCommandExecutionBudget( | CODE |
| LOW | packages/just-bash/src/interpreter/redirections.ts | 40 | async function checkOutputRedirectTarget( | CODE |
| LOW | packages/just-bash/src/interpreter/redirections.ts | 168 | export async function processFdVariableRedirections( | CODE |
| LOW | packages/just-bash/src/interpreter/expansion.ts | 465 | async function expandWordWithBracesAsync( | CODE |
| LOW | packages/just-bash/src/interpreter/builtin-dispatch.ts | 104 | function createRevocableCommandContext( | CODE |
| LOW | …-bash/src/interpreter/defense-aware-command-context.ts | 194 | export function createDefenseAwareCommandContext( | CODE |
| LOW | …ages/just-bash/src/interpreter/assignment-expansion.ts | 23 | export async function expandLocalArrayAssignment( | CODE |
| LOW | …ages/just-bash/src/interpreter/assignment-expansion.ts | 264 | export async function expandScalarAssignmentArg( | CODE |
| LOW | …ust-bash/src/interpreter/simple-command-assignments.ts | 349 | async function processAssociativeArrayAssignment( | CODE |
| LOW | …ust-bash/src/interpreter/simple-command-assignments.ts | 443 | async function processIndexedArrayWithKeysAssignment( | CODE |
| LOW | …ust-bash/src/interpreter/simple-command-assignments.ts | 558 | async function processSimpleArrayAssignment( | CODE |
| LOW | …ust-bash/src/interpreter/simple-command-assignments.ts | 611 | async function processSubscriptAssignment( | CODE |
| LOW | …ages/just-bash/src/interpreter/process-substitution.ts | 397 | export async function releaseProcessSubstitutions( | CODE |
| LOW | packages/just-bash/src/interpreter/arithmetic.ts | 39 | function createArithmeticResolutionContext(): ArithmeticResolutionContext { | CODE |
| LOW | packages/just-bash/src/interpreter/arithmetic.ts | 221 | async function evaluateResolvedArithValue( | CODE |
| LOW | packages/just-bash/src/interpreter/arithmetic.ts | 414 | async function evaluateArithmeticInternal( | CODE |
| LOW | packages/just-bash/src/interpreter/arithmetic.ts | 931 | async function evalConcatPartToStringAsync( | CODE |
| LOW | packages/just-bash/src/interpreter/builtins/set.ts | 278 | function formatOptionsResetCommands(ctx: InterpreterContext): string { | CODE |
| LOW | …t-bash/src/interpreter/builtins/variable-assignment.ts | 226 | export function clearLocalVarStackForScope( | CODE |
| LOW | …bash/src/interpreter/expansion/arith-text-expansion.ts | 16 | export async function expandDollarVarsInArithText( | CODE |
| LOW | …bash/src/interpreter/expansion/arith-text-expansion.ts | 132 | export async function expandSubscriptForAssocArray( | CODE |
| LOW | …t-bash/src/interpreter/expansion/indirect-expansion.ts | 61 | export async function handleIndirectArrayExpansion( | CODE |
| LOW | …t-bash/src/interpreter/expansion/indirect-expansion.ts | 227 | async function handleIndirectArraySlicing( | CODE |
| LOW | …t-bash/src/interpreter/expansion/indirect-expansion.ts | 287 | async function handleIndirectArrayDefaultAlternative( | CODE |
| LOW | …t-bash/src/interpreter/expansion/indirect-expansion.ts | 371 | export async function handleIndirectInAlternative( | CODE |
| LOW | …t-bash/src/interpreter/expansion/indirect-expansion.ts | 464 | export async function handleIndirectionWithInnerAlternative( | CODE |
| LOW | …bash/src/interpreter/expansion/array-word-expansion.ts | 44 | export function handleSimpleArrayExpansion( | CODE |
| LOW | …bash/src/interpreter/expansion/array-word-expansion.ts | 107 | export function handleNamerefArrayExpansion( | CODE |
| LOW | …st-bash/src/interpreter/expansion/pattern-expansion.ts | 18 | export function patternHasCommandSubstitution(pattern: string): boolean { | CODE |
| LOW | …st-bash/src/interpreter/expansion/pattern-expansion.ts | 53 | function findCommandSubstitutionEnd(pattern: string, startIdx: number): number { | CODE |
| LOW | …st-bash/src/interpreter/expansion/pattern-expansion.ts | 104 | async function executeCommandSubstitutionFromString( | CODE |
| LOW | …st-bash/src/interpreter/expansion/pattern-expansion.ts | 264 | function expandVariablesInDoubleQuotedPattern( | CODE |
| LOW | …st-bash/src/interpreter/expansion/pattern-expansion.ts | 328 | export async function expandVariablesInPatternAsync( | CODE |
| LOW | …st-bash/src/interpreter/expansion/pattern-expansion.ts | 458 | async function expandVariablesInDoubleQuotedPatternAsync( | CODE |
| LOW | …-bash/src/interpreter/expansion/word-glob-expansion.ts | 218 | async function handleBraceExpansionResults( | CODE |
| LOW | …-bash/src/interpreter/expansion/word-glob-expansion.ts | 250 | async function handleArrayExpansionCases( | CODE |
| LOW | …-bash/src/interpreter/expansion/word-glob-expansion.ts | 408 | function handleVarNamePrefixExpansion( | CODE |
| LOW | …-bash/src/interpreter/expansion/word-glob-expansion.ts | 458 | async function handlePositionalExpansionCases( | CODE |
| LOW | …-bash/src/interpreter/expansion/word-glob-expansion.ts | 520 | async function handleUnquotedExpansionCases( | CODE |
| LOW | …-bash/src/interpreter/expansion/word-glob-expansion.ts | 639 | function findWordProducingExpansion( | CODE |
| LOW | …-bash/src/interpreter/expansion/word-glob-expansion.ts | 678 | async function expandDoubleQuotedWithWordProducing( | CODE |
| LOW | …st-bash/src/interpreter/expansion/array-pattern-ops.ts | 63 | export async function handleArrayPatternReplacement( | CODE |
| LOW | …st-bash/src/interpreter/expansion/array-pattern-ops.ts | 165 | export async function handleArrayPatternRemoval( | CODE |
| LOW | …ckages/just-bash/src/interpreter/expansion/variable.ts | 34 | function normalizeAssociativeSubscript( | CODE |
| LOW | …-bash/src/interpreter/expansion/pattern-replacement.ts | 7 | export function applyPatternReplacementBounded( | CODE |
| LOW | …ages/just-bash/src/interpreter/expansion/word-split.ts | 111 | async function hasMixedQuotedDefaultValue( | CODE |
| LOW | …ages/just-bash/src/interpreter/expansion/word-split.ts | 483 | async function smartWordSplitWithUnquotedLiterals( | CODE |
| LOW | …ckages/just-bash/src/interpreter/expansion/analysis.ts | 71 | export function isOperationWordEntirelyQuoted( | CODE |
| LOW | …-bash/src/interpreter/expansion/array-prefix-suffix.ts | 193 | export async function handleArrayPatternWithPrefixSuffix( | CODE |
| LOW | …-bash/src/interpreter/expansion/array-prefix-suffix.ts | 388 | export async function handleArrayWithPrefixSuffix( | CODE |
| LOW | packages/just-bash/src/interpreter/expansion/tilde.ts | 58 | export function applyAssignmentTildeExpansion( | CODE |
| LOW | …t-bash/src/interpreter/expansion/unquoted-expansion.ts | 188 | export async function handleUnquotedArrayPatternReplacement( | CODE |
| LOW | …t-bash/src/interpreter/expansion/unquoted-expansion.ts | 371 | export async function handleUnquotedArrayPatternRemoval( | CODE |
| LOW | …t-bash/src/interpreter/expansion/unquoted-expansion.ts | 523 | export async function handleUnquotedPositionalPatternRemoval( | CODE |
| LOW | …t-bash/src/interpreter/expansion/unquoted-expansion.ts | 662 | export async function handleUnquotedPositionalSlicing( | CODE |
| LOW | …t-bash/src/interpreter/expansion/unquoted-expansion.ts | 839 | export async function handleUnquotedSimplePositional( | CODE |
| LOW | …t-bash/src/interpreter/expansion/unquoted-expansion.ts | 943 | export async function handleUnquotedSimpleArray( | CODE |
| LOW | …t-bash/src/interpreter/expansion/unquoted-expansion.ts | 1059 | export function handleUnquotedVarNamePrefix( | CODE |
| 58 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/just-bash/src/interpreter/assoc-array.test.ts | 236 | // Step 0: Check declare -p output | COMMENT |
| LOW⚡ | packages/just-bash/src/interpreter/assoc-array.test.ts | 244 | // Step 1: Single quoted assignment & lookup | COMMENT |
| LOW | packages/just-bash/src/parser/expansion-parser.ts | 645 | // We need to check if this is arithmetic (closes with )) or command sub (closes with ) )) | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 58 | // Step 1: Validate order | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 61 | // Step 2: Check inventory | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 64 | // Step 3: Process payment | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 67 | // Step 4: Confirm order | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 70 | // Step 5: Send notification | COMMENT |
| LOW | packages/just-bash/src/commands/find/matcher.ts | 628 | // For expressions with stat-dependent parts, we need to check if the | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 461 | // Step 1: RLE1 encoding | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 464 | // Step 2: BWT | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 470 | // Step 3: Determine symbols in use | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 504 | // Step 4: MTF | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 510 | // Step 5: RLE2 | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 520 | // Step 6: Build Huffman table(s) | COMMENT |
| LOW⚡ | …sh/src/fs/read-write-fs/read-write-fs.security.test.ts | 1163 | // Step 2: Try to mv the directory (should be blocked by Fix 2) | COMMENT |
| LOW⚡ | …sh/src/fs/read-write-fs/read-write-fs.security.test.ts | 1170 | // Step 3: Even if mv somehow succeeded, writing through the symlink | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/just-bash/src/interpreter/assoc-array.test.ts | 236 | // Step 0: Check declare -p output | COMMENT |
| LOW⚡ | packages/just-bash/src/interpreter/assoc-array.test.ts | 244 | // Step 1: Single quoted assignment & lookup | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 58 | // Step 1: Validate order | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 61 | // Step 2: Check inventory | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 64 | // Step 3: Process payment | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 67 | // Step 4: Confirm order | COMMENT |
| LOW⚡ | …ust-bash/src/agent-examples/debugging-workflow.test.ts | 70 | // Step 5: Send notification | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 461 | // Step 1: RLE1 encoding | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 464 | // Step 2: BWT | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 470 | // Step 3: Determine symbols in use | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 504 | // Step 4: MTF | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 510 | // Step 5: RLE2 | COMMENT |
| LOW⚡ | packages/just-bash/src/commands/tar/bzip2-compress.ts | 520 | // Step 6: Build Huffman table(s) | COMMENT |
| LOW⚡ | …sh/src/fs/read-write-fs/read-write-fs.security.test.ts | 1163 | // Step 2: Try to mv the directory (should be blocked by Fix 2) | COMMENT |
| LOW⚡ | …sh/src/fs/read-write-fs/read-write-fs.security.test.ts | 1170 | // Step 3: Even if mv somehow succeeded, writing through the symlink | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/just-bash/src/agent-examples/python-scripting.test.ts | 421 | API_KEY=your-api-key-here | CODE |
| HIGH | …s/just-bash/src/agent-examples/config-analysis.test.ts | 43 | API_KEY=your-api-key-here | CODE |
| HIGH | …s/just-bash/src/agent-examples/config-analysis.test.ts | 145 | API_KEY=your-api-key-here | CODE |
| HIGH | …s/just-bash/src/agent-examples/config-analysis.test.ts | 206 | your-api-key-here | CODE |
| HIGH | …s/just-bash/src/agent-examples/config-analysis.test.ts | 228 | API_KEY: your-api-key-here | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | examples/custom-command/commands.ts | 94 | * Generate lorem ipsum text | COMMENT |
| LOW⚡ | examples/custom-command/commands.ts | 100 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna | CODE |
| LOW⚡ | examples/custom-command/commands.ts | 100 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna | CODE |
| LOW⚡ | examples/custom-command/main.ts | 51 | // Lorem ipsum | COMMENT |
| LOW⚡ | examples/custom-command/main.ts | 52 | console.log("4. Generate lorem ipsum (2 paragraphs):"); | CODE |
| LOW⚡ | examples/custom-command/main.ts | 57 | console.log("5. Count words in lorem ipsum:"); | CODE |
| LOW | examples/custom-command/README.md | 9 | - **lorem** - Generate lorem ipsum text (`lorem 3` for 3 paragraphs) | CODE |
| LOW | …/just-bash/src/agent-examples/python-scripting.test.ts | 230 | expect(output[0].name).toBe("John Doe"); | CODE |
| LOW | …t-bash/src/agent-examples/refactoring-workflow.test.ts | 66 | expect(formatUserName('John', 'Doe')).toBe('John Doe'); | CODE |
| LOW | …t-bash/src/agent-examples/refactoring-workflow.test.ts | 95 | /project/src/tests/string.test.ts: expect(formatUserName('John', 'Doe')).toBe('John Doe'); | CODE |
| LOW | …t-bash/src/agent-examples/refactoring-workflow.test.ts | 216 | /project/src/tests/string.test.ts: expect(formatUserName('John', 'Doe')).toBe('John Doe'); | CODE |
| LOW | …ust-bash/src/commands/sqlite3/sqlite3.fixtures.test.ts | 195 | "sqlite3 -readonly users.db \"INSERT INTO users (name, email, age) VALUES ('Test', 'test@test.com', 99)\"", | CODE |
| LOW | …ust-bash/src/commands/sqlite3/sqlite3.fixtures.test.ts | 215 | "sqlite3 users.db \"INSERT INTO users (name, email, age) VALUES ('Test', 'test@test.com', 99)\"", | CODE |
| LOW | …ust-bash/src/commands/sqlite3/sqlite3.fixtures.test.ts | 220 | "sqlite3 users.db \"SELECT name FROM users WHERE email = 'test@test.com'\"", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/just-bash/src/readme.test.ts | 515 | "/src/app.ts": "// TODO: implement\nexport const x = 1;", | CODE |
| LOW | …s/just-bash/src/spec-tests/bash/cases/dbracket.test.sh | 133 | # TODO: Add tests for this | COMMENT |
| LOW | …h/src/agent-examples/text-processing-workflows.test.ts | 19 | // TODO: Add error handling | COMMENT |
| LOW | …kages/just-bash/src/agent-examples/code-review.test.ts | 17 | // TODO: Add error handling | COMMENT |
| LOW | …kages/just-bash/src/agent-examples/code-review.test.ts | 22 | "/project/src/user.ts": `// TODO: Add validation | CODE |
| LOW | …kages/just-bash/src/agent-examples/code-review.test.ts | 66 | ).toBe(`/project/src/index.ts:// TODO: Add error handling | CODE |
| LOW | …kages/just-bash/src/agent-examples/code-review.test.ts | 67 | /project/src/user.ts:// TODO: Add validation | CODE |
| LOW | …kages/just-bash/src/agent-examples/code-review.test.ts | 87 | // TODO: Add error handling | COMMENT |
| LOW | …ages/just-bash/src/commands/grep/grep.advanced.test.ts | 448 | "/src/b.js": "// Regular comment\n// TODO: implement\n", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …urity/attacks/exploit-fixtures/python-worker-escape.sh | 10 | except Exception: | CODE |
| LOW⚡ | …urity/attacks/exploit-fixtures/python-worker-escape.sh | 16 | except Exception: | CODE |
| LOW⚡ | …urity/attacks/exploit-fixtures/python-worker-escape.sh | 25 | except Exception: | CODE |
| LOW⚡ | …urity/attacks/exploit-fixtures/python-worker-escape.sh | 31 | except Exception: | CODE |
| LOW⚡ | …es/just-bash/src/commands/python3/python3.http.test.ts | 176 | except Exception as e: | CODE |
| LOW⚡ | …es/just-bash/src/commands/python3/python3.http.test.ts | 194 | except Exception as e: | CODE |
| LOW⚡ | …es/just-bash/src/commands/python3/python3.http.test.ts | 215 | except Exception as e: | CODE |
| LOW⚡ | …ust-bash/src/commands/python3/python3.security.test.ts | 302 | except Exception as e: | CODE |
| LOW | packages/just-bash/src/commands/python3/worker.ts | 1440 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ust-bash/src/security/limits/memory-exhaustion.test.ts | 291 | # Create a moderate sized array | COMMENT |
| MEDIUM | …bash/src/spec-tests/bash/cases/builtin-process.test.sh | 18 | # Create the helper script inline - it uses exec to redirect stdin from here-doc | COMMENT |
| MEDIUM | …kages/just-bash/src/spec-tests/bash/cases/loop.test.sh | 370 | # Create the test data files inline | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …st-bash/src/spec-tests/bash/cases/builtin-dirs.test.sh | 174 | # Can't use the OSH test harness for this because | COMMENT |
| MEDIUM | …s/just-bash/src/spec-tests/bash/cases/comments.test.sh | 3 | # NOTE: The test harness isn't good for this test; it strips lines that start | COMMENT |
| MEDIUM | …ash/src/spec-tests/bash/cases/spec-harness-bug.test.sh | 3 | #### osh-native duplicates stdin - is this a test harness issue? | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …st-bash/src/spec-tests/bash/cases/builtin-kill.test.sh | 118 | # Check if at least the HUP flag is reported. The output format of all shells | COMMENT |
| LOW | …s/just-bash/src/spec-tests/bash/cases/redirect.test.sh | 153 | #### Open file on descriptor 3 and write to it many times | COMMENT |
| LOW | …s/just-bash/src/spec-tests/bash/cases/redirect.test.sh | 167 | #### Open file on descriptor 4 and write to it many times | COMMENT |
| LOW | …ges/just-bash/src/spec-tests/bash/cases/append.test.sh | 11 | #### Append array to array | COMMENT |
| LOW | packages/just-bash/src/commands/python3/worker.ts | 994 | # Set cwd to host mount | COMMENT |