Where agent teams gather. Cross-platform team chat where AI agents are first-class teammates — with cloud or bring-your-own (Claude Code / Codex) brains.
This report summarizes scanner evidence for yetone/cumora, a TypeScript project with 3,964 GitHub stars. SynthScan examined 202,096 lines of code across 655 source files, recording 733 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 7.2 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 342 finding(s).
Are imports declared and package/API names verified? 8 finding(s).
Are wrappers, guards, and repeated structures necessary? 550 finding(s).
Which changes need focused human review? 733 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 733 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/docker/agent-computer-entrypoint.sh | 267 | # ─── Xvfb ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/docker/agent-computer-entrypoint.sh | 291 | # ─── Chromium ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/docker/agent-computer-entrypoint.sh | 316 | # ─── agent loop ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/scheduler.ts | 692 | // ─── author-name cache (Fix #10) ───────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/scheduler.ts | 692 | // ─── author-name cache (Fix #10) ───────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/scheduler.ts | 748 | // ─── steer rate limit (Fix #8) ─────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/scheduler.ts | 748 | // ─── steer rate limit (Fix #8) ─────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/scheduler.ts | 1188 | // ─── poll author wake (real-time vote watching) ────────────────────── | COMMENT |
| MEDIUM | server/src/agents/cli.ts | 1860 | // ─── Anti-monologue gate ────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/cli.ts | 1971 | // ─── FRESHNESS PREFLIGHT ─────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/cli.ts | 2130 | // ─── VERBATIM-DUP GATE ─────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/observability.ts | 362 | // ─── triage economics ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/seen-boundary.ts | 82 | // ─── Compose anchor (turn-start timestamp) ──────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/seen-boundary.ts | 153 | // ─── Hold token (HELD-acknowledgement gate for override flags) ──────────── | COMMENT |
| MEDIUM | server/src/agents/seen-boundary.ts | 275 | // ─── same-turn continuation ──────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/steer.ts | 97 | // ── mid-tool interrupt registry ──────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/steer.ts | 174 | // ── tunable knobs ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/steer.ts | 224 | // ── why this queue is intentionally NOT persisted ────────────────────── | COMMENT |
| MEDIUM | server/src/agents/steer.ts | 255 | // ── push / drain API ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/steer.ts | 417 | // ── test-only inspection (NOT exported via index — module-local) ────── | COMMENT |
| MEDIUM | server/src/agents/steer.ts | 444 | // ── helpers ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/agenda.ts | 513 | // ─── deterministic fallback ───────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/turn-compaction.ts | 233 | // ── shared internal helpers ───────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/turn.ts | 2124 | // ─── In-flight peer work ────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/inproc-client.ts | 357 | // ─── reads (cont.) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/inproc-client.ts | 512 | // ─── identity ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/inproc-client.ts | 522 | // ─── status + presence ──────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/inproc-client.ts | 577 | // ─── observability ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/inproc-client.ts | 751 | // ─── Steering busy heartbeat ────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/inproc-client.ts | 793 | // ─── Thinking claim ───────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/inproc-client.ts | 876 | // ─── Worklog (anti-duplicate-work claims) ──────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/orchestrator.ts | 754 | // ─── cluster-wide FUSE admission control ───────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/orchestrator.ts | 1438 | // ─── Idle chrome-profile PVC garbage collection ────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/orchestrator.ts | 1610 | // ─── Completed/Failed agent-pod garbage collection ────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/orchestrator.ts | 1675 | // ─── cluster fuse-pressure monitor ────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/http-client.ts | 118 | // ─── reads ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/http-client.ts | 177 | // ─── status + presence ──────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/http-client.ts | 227 | // ─── observability ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/server.ts | 163 | // ─── canonical action surface: cumora CLI ────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/server.ts | 189 | // ─── reads ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/server.ts | 387 | // ─── status + presence ────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/server.ts | 421 | // ─── observability ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/server.ts | 720 | // ─── steering busy heartbeat ──────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/server.ts | 740 | // ─── thinking-claim — peer-visible "I'm composing" signal ───────── | COMMENT |
| MEDIUM | server/src/agents/runtime/server.ts | 804 | // ─── worklog — anti-duplicate-work claims ─────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/runtime/server.ts | 871 | // ─── steering dedup: advance per-agent conversation_reads cursor ───── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 401 | // ─── self-update ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 579 | // ─── arg parsing ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 609 | // ─── HTTP helpers ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 1113 | // ─── config ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 1126 | // ─── the `cumora` shim ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 1549 | // ─── pairing ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 1598 | // ─── per-agent runner ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 3413 | // ─── run loop ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 3797 | // ─── self-update + service ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 4533 | // ─── doctor ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/daemon.ts | 4670 | // ─── entry ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/engine.ts | 2892 | // ─── zcode ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/engine.ts | 3379 | // ─── cursor ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | server/src/agents/computer/engine.ts | 3734 | // ─── opencode ──────────────────────────────────────────────────────────── | COMMENT |
| 323 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/src/oauth.ts | 411 | export async function findOrCreateUserByProfile( | CODE |
| LOW | server/src/og.ts | 389 | async function fetchWithValidatedRedirects( | CODE |
| LOW | server/src/orcarouter.ts | 53 | export function orcarouterResponsesCreate( | CODE |
| LOW | server/src/storage-keys.ts | 61 | export function messageAttachmentStorageKey( | CODE |
| LOW | server/src/polls.ts | 393 | export function startPollExpirationSweeper(intervalMs: number): { stop(): void } | null { | CODE |
| LOW | server/src/polls.ts | 413 | export function stopPollExpirationSweeper(): void { | CODE |
| LOW | server/src/storage.ts | 55 | export function messageAttachmentStorageKey(input: { key?: unknown; url?: unknown }): string | null { | CODE |
| LOW | server/src/email.ts | 138 | export async function backfillCompanyAgentAddresses(companyId: string): Promise<number> { | CODE |
| LOW | server/src/email.ts | 516 | export async function findEmailConversationByMessageIds( | CODE |
| LOW | server/src/email.ts | 556 | export async function findUserInCompanyByAuthEmail( | CODE |
| LOW | server/src/email.ts | 827 | export async function findOrCreateEmailConversation(args: { | CODE |
| LOW | server/src/admin.ts | 436 | async function sendWaitlistApprovedEmail(args: { | CODE |
| LOW | server/src/local-attachment-files.ts | 16 | export async function readLocalMessageAttachment( | CODE |
| LOW | server/src/calendar.ts | 92 | async function resolveTargetConversation(event: CalendarEventRow): Promise<string | null> { | CODE |
| LOW | server/src/calendar.ts | 271 | async function resolveReminderRecipients(event: CalendarEventRow): Promise<Array<{ userId: string; email: string | null | CODE |
| LOW | server/src/ws.ts | 185 | export async function resolveWsEventRecipientUserIds( | CODE |
| LOW | server/src/ws.ts | 626 | function enqueueAuthorizedDocFrame( | CODE |
| LOW | server/src/ws.ts | 665 | async function withAuthorizedDocOperation( | CODE |
| LOW | server/src/llm.ts | 107 | function warnProviderUnconfiguredOnce(provider: 'Novita' | 'OrcaRouter', model: string | undefined): void { | CODE |
| LOW | server/src/realtime-outbox.ts | 274 | export function startRealtimeOutboxWorker(): NodeJS.Timeout { | CODE |
| LOW | server/src/workspace-cleanup.ts | 115 | export async function findReferencedStorageKeys(keys: string[], client?: PoolClient): Promise<Set<string>> { | CODE |
| LOW | server/src/workspace-cleanup.ts | 175 | async function defaultDeleteAgentRuntime(agentId: string): Promise<void> { | CODE |
| LOW | server/src/workspace-cleanup.ts | 239 | export async function drainWorkspaceCleanupJobs(options: { | CODE |
| LOW⚡ | server/src/workspace-cleanup.ts | 276 | export function nudgeWorkspaceCleanupWorker(): void { | CODE |
| LOW⚡ | server/src/workspace-cleanup.ts | 280 | export function startWorkspaceCleanupWorker(): NodeJS.Timeout | null { | CODE |
| LOW⚡ | server/src/workspace-cleanup.ts | 289 | export function stopWorkspaceCleanupWorker(): void { | CODE |
| LOW | server/src/tenant.ts | 28 | export async function companyIdForConveneSession(id: string): Promise<string | null> { | CODE |
| LOW | server/src/deploy/recovery.ts | 247 | function deploymentServerContainer(template: JsonObject): JsonObject { | CODE |
| LOW | server/src/deploy/recovery.ts | 252 | export function extractDeploymentSnapshot( | CODE |
| LOW | server/src/deploy/recovery.ts | 297 | export function deploymentReceiptFromObject( | CODE |
| LOW | server/src/deploy/recovery.ts | 471 | export function assertReceiptShapeForRecovery(receipt: DeploymentReceipt): void { | CODE |
| LOW | server/src/deploy/recovery.ts | 475 | export function assertRecoveryStateBinding( | CODE |
| LOW | server/src/deploy/recovery.ts | 624 | export function buildSchemaVerifierScript(): string { | CODE |
| LOW | server/src/deploy/recovery.ts | 756 | export function parseSchemaVerifierOutput(stdout: string, stderr = ''): SchemaVerifierResult { | CODE |
| LOW | server/src/deploy/recovery.ts | 789 | export function assertCompatibleVerifierResult(result: SchemaVerifierResult): asserts result is SchemaVerifierResult & { | CODE |
| LOW | server/src/deploy/recovery.ts | 804 | export function assertDeploymentReceiptMatches( | CODE |
| LOW | server/src/deploy/recovery.ts | 817 | export function assertCandidateReceiptMatches( | CODE |
| LOW | server/src/agents/turn-wake.ts | 48 | export function describeWakeBackgroundBrief( | CODE |
| LOW | server/src/agents/turn-wake.ts | 66 | export function renderBriefedManualWakeContext( | CODE |
| LOW | server/src/agents/membership.ts | 72 | async function insertMembershipSystemMessage(args: { | CODE |
| LOW | server/src/agents/membership.ts | 118 | async function lockConversationForMembership(args: { | CODE |
| LOW | server/src/agents/membership.ts | 283 | async function nextConversationSequenceWithClient( | CODE |
| LOW | server/src/agents/memory-write.ts | 80 | export async function projectIdsForConversations(conversationIds: string[]): Promise<string[]> { | CODE |
| LOW | server/src/agents/scheduler.ts | 407 | export async function resolveDurableDeliveryAgent(args: { | CODE |
| LOW | server/src/agents/scheduler.ts | 1008 | export function shouldDeliverToMutedAgent(args: { | CODE |
| LOW | server/src/agents/scheduler.ts | 1309 | async function resolveCurrentParticipantNames( | CODE |
| LOW | server/src/agents/llm-ledger.ts | 215 | export function readStreamReasoningTokens(ev: { type?: string } & Record<string, unknown>): number { | CODE |
| LOW | server/src/agents/llm-ledger.ts | 907 | export async function getLlmDaemonVersionRollup(args: { sinceDays?: number; companyId?: string | null } = {}): Promise<L | CODE |
| LOW | server/src/agents/routing.ts | 149 | export function buildUnaddressedRouteRequest(args: { | CODE |
| LOW | server/src/agents/cli-result.ts | 37 | export function cliResultHasReplySideEffect(result: unknown): boolean { | CODE |
| LOW | server/src/agents/cli-result.ts | 51 | export function cliResultSideEffectChannelUnreliable(result: unknown): boolean { | CODE |
| LOW | server/src/agents/cli-result.ts | 60 | export function parseCliSideEffectsJsonlDetailed(raw: string): CliSideEffectsParseResult { | CODE |
| LOW | server/src/agents/cli-result.ts | 84 | export function parseCliSideEffectsWriteFailureMarker(raw: string): CliSideEffect[] { | CODE |
| LOW | server/src/agents/cli-result.ts | 101 | export async function writeCliSideEffectsToResultPath(result: CliResult): Promise<void> { | CODE |
| LOW | server/src/agents/routing-claims.ts | 250 | export async function defaultFindCursorLaggingMembers( | CODE |
| LOW | server/src/agents/routing-claims.ts | 311 | export function startRoutingClaimSweeperIfEnabled(): NodeJS.Timeout | null { | CODE |
| LOW | server/src/agents/cli.ts | 190 | function duplicateWorkErrorMessage(existing: WorklogEntry): string { | CODE |
| LOW | server/src/agents/cli.ts | 3266 | function rejectsEmailAttachmentFlags(parsed: ParsedArgs): CliResult | null { | CODE |
| LOW | server/src/agents/cli.ts | 4594 | function cliCalendarVisibilityClause(meIdx: number): string { | CODE |
| LOW | server/src/agents/auto-relay.ts | 36 | export function resolveDeclaredAutoRelayTarget( | CODE |
| 107 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | capacitor.config.ts | 21 | contentInset: 'never', | COMMENT |
| LOW | capacitor.config.ts | 41 | }, | COMMENT |
| LOW | website/index.html | 981 | // unauthenticated and CORS-open so this static site (cumora.ai) can | COMMENT |
| LOW | server/docker/agent-computer-cumora.sh | 1 | #!/bin/sh | COMMENT |
| LOW | server/docker/agent-computer-cumora-web.sh | 1 | #!/bin/sh | COMMENT |
| LOW | server/k8s/cumora-agent-network-policy.yaml | 1 | # Pre-deploy these policies in the namespace selected by | COMMENT |
| LOW | server/k8s/cumora-server.orbstack.yaml | 1 | # cumora-server — OrbStack / local-dev manifest. | COMMENT |
| LOW | server/k8s/cumora-server.orbstack.yaml | 101 | # when server runs on the host, agents reach it via | COMMENT |
| LOW | server/k8s/cumora-server.gke.yaml | 1 | # cumora-server — production GKE manifest. | COMMENT |
| LOW | server/k8s/cumora-server.gke.yaml | 161 | # it does not apply policies or infer URL-specific exceptions. | COMMENT |
| LOW | server/src/personal-workspace.ts | 81 | // Running out used to fall through silently, leaving companyId pointing at no | COMMENT |
| LOW | server/src/email.ts | 1021 | COMMENT | |
| LOW | server/src/admin.ts | 501 | // provider sign-in materialized them while they were waiting). We | COMMENT |
| LOW | server/src/index.ts | 161 | // The same Docker image bakes in the frontend `dist/` next to the server | COMMENT |
| LOW | server/src/index.ts | 301 | // longer referenced by any email_attachments row (DB CASCADE doesn't | COMMENT |
| LOW | server/src/index.ts | 321 | COMMENT | |
| LOW | server/src/index.ts | 421 | process.on('SIGTERM', () => shutdown('SIGTERM')) | COMMENT |
| LOW | server/src/agents/cost.ts | 41 | inputTokens: 0, cachedInputTokens: 0, cacheCreationTokens: 0, outputTokens: 0, | COMMENT |
| LOW | server/src/agents/private_chat.ts | 241 | // START a conversation, and this opening line is the one a human has the | COMMENT |
| LOW | server/src/agents/scheduler.ts | 121 | // calls loadInbox — picking up everything since the agent's last | COMMENT |
| LOW | server/src/agents/scheduler.ts | 321 | return wakeOne(agentId, reason, conversationId, steerPayload, options) | COMMENT |
| LOW | server/src/agents/scheduler.ts | 541 | // Visible acknowledgement: the steer payload won't actually be | COMMENT |
| LOW | server/src/agents/scheduler.ts | 581 | // — and that payload is gone the moment nobody is subscribed. The managed-pod | COMMENT |
| LOW | server/src/agents/scheduler.ts | 601 | return durableWithoutDelivery | COMMENT |
| LOW | server/src/agents/scheduler.ts | 901 | recipients = [...recipients, deliveryAgentId] | COMMENT |
| LOW | server/src/agents/scheduler.ts | 1101 | COMMENT | |
| LOW | server/src/agents/scheduler.ts | 1181 | } | COMMENT |
| LOW | server/src/agents/cli.ts | 321 | # This is also how you SCHEDULE YOURSELF. Set --assignee to your own id | COMMENT |
| LOW | server/src/agents/cli.ts | 1861 | // In multi-party conversations (3+ members), an agent can't post a | COMMENT |
| LOW | server/src/agents/cli.ts | 1881 | // mindedly continuing to monologue. | COMMENT |
| LOW | server/src/agents/cli.ts | 1981 | // strictly Redis-only with explicit fail-open semantics — if Redis is | COMMENT |
| LOW | server/src/agents/cli.ts | 2001 | // | COMMENT |
| LOW | server/src/agents/cli.ts | 2061 | ) | COMMENT |
| LOW | server/src/agents/cli.ts | 2121 | ? `(Your --send-anyway was IGNORED: it only acknowledges a HOLD you have already been shown — passing it pre | COMMENT |
| LOW | server/src/agents/cli.ts | 2321 | } | COMMENT |
| LOW | server/src/agents/cli.ts | 2341 | // post-baseline side-traffic), but verbatim-content-dup is a hard no. | COMMENT |
| LOW | server/src/agents/cli.ts | 2421 | // The row is durable now, so the phone can be told. Fire-and-forget for the | COMMENT |
| LOW | server/src/agents/cli.ts | 2441 | }) | COMMENT |
| LOW | server/src/agents/triage-core.ts | 441 | // HARD loop cap (deterministic, no model): if EVERY unread conversation has run | COMMENT |
| LOW | server/src/agents/triage-core.ts | 461 | // old fixed cap kept getting wrong (a constant < team size killed real | COMMENT |
| LOW | server/src/agents/seen-boundary.ts | 81 | COMMENT | |
| LOW | server/src/agents/seen-boundary.ts | 161 | // token makes the override flag an ACKNOWLEDGEMENT instead of a free pass: | COMMENT |
| LOW | server/src/agents/tools-shared.ts | 141 | cumora doc read <doc_id> # current text body (plain) | COMMENT |
| LOW | server/src/agents/tools-shared.ts | 161 | cumora doc rename <doc_id> "<title>" | COMMENT |
| LOW | server/src/agents/tools-shared.ts | 181 | # opencli browser "$CUMORA_AGENT_ID" click --selector '#submit' | COMMENT |
| LOW | server/src/agents/tools-shared.ts | 201 | # A poll arriving in your inbox is BINARY: either vote, or stay silent. | COMMENT |
| LOW | server/src/agents/tools-shared.ts | 221 | # (e.g. a poll about a meeting time when you have no calendar), or | COMMENT |
| LOW | server/src/agents/tools-shared.ts | 241 | # actually leans toward, however slightly. | COMMENT |
| LOW | server/src/agents/steer.ts | 101 | // call — `yt-dlp` ripping a long video, `ffmpeg` transcoding, an | COMMENT |
| LOW | server/src/agents/steer.ts | 221 | * {@link canDrainSteer} returns false once exceeded. */ | COMMENT |
| LOW | server/src/agents/steer.ts | 241 | // that wasn't actively running a turn anyway. | COMMENT |
| LOW | server/src/agents/steer.ts | 261 | export function pushSteer(agentId: string, item: SteerItem): void { | COMMENT |
| LOW | server/src/agents/agenda.ts | 501 | // everything else (including "no", "false", undefined, 0) as not | COMMENT |
| LOW | server/src/agents/agenda.ts | 521 | // the simplest "you have an unread, nobody else has it" case. | COMMENT |
| LOW | server/src/agents/turn.ts | 621 | ? '[tool call]' | COMMENT |
| LOW | server/src/agents/turn.ts | 1661 | let markInitialInboxReadOnCompletion = false | COMMENT |
| LOW | server/src/agents/turn.ts | 1721 | let failureNoticePosted = false | COMMENT |
| LOW | server/src/agents/turn.ts | 1781 | // (system) messages in seconds. Filtering system messages out of the key | COMMENT |
| LOW | server/src/agents/turn.ts | 2281 | agentId, | COMMENT |
| LOW | server/src/agents/turn.ts | 2341 | }).catch(() => { /* observability best-effort */ }) | COMMENT |
| 103 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | server/src/__tests__/deployment-release-flow.test.ts | 141 | return state.deployment.spec.template.spec.containers.find((container: any) => container.name === 'server') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | server/src/agents/computer/engine.ts | 2919 | // scaffold into each turn prompt (the Cursor/OpenCode contract). | COMMENT |
| MEDIUM | server/src/api/router.ts | 2573 | // 2. Anti-oily guardrails in the main prompt body (matte natural skin, | COMMENT |
| MEDIUM | .github/workflows/deploy.yml | 2 | # The executable orchestration lives in scripts/deploy-release.mjs so the same | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | benchmarks/lib/harness.ts | 142 | // Step 1: create the convo (members fixed) but DON'T post the seed yet. | COMMENT |
| LOW⚡ | benchmarks/lib/harness.ts | 144 | // Step 2: per-scenario setup (kanban: create board/card; werewolf: | COMMENT |
| LOW⚡ | benchmarks/lib/harness.ts | 149 | // Step 3: post the seed + publish fanout. NOW agents wake. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | benchmarks/lib/harness.ts | 142 | // Step 1: create the convo (members fixed) but DON'T post the seed yet. | COMMENT |
| LOW⚡ | benchmarks/lib/harness.ts | 144 | // Step 2: per-scenario setup (kanban: create board/card; werewolf: | COMMENT |
| LOW⚡ | benchmarks/lib/harness.ts | 149 | // Step 3: post the seed + publish fanout. NOW agents wake. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts-gen-tray-icons.py | 26 | CODE | |
| LOW | scripts-gen-tray-icons.py | 29 | CODE | |
| LOW | scripts/gen-skype-sounds.py | 28 | CODE | |
| LOW | scripts/gen-skype-sounds.py | 31 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/src/__tests__/oauth-github-email.test.ts | 54 | const profile = await fetchProfile('github', 'fake-token') | CODE |
| LOW | server/src/__tests__/oauth-github-email.test.ts | 66 | const profile = await fetchProfile('github', 'fake-token') | CODE |
| LOW | server/src/__tests__/oauth-github-email.test.ts | 77 | () => fetchProfile('github', 'fake-token'), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts-gen-tray-icons.py | 46 | CODE | |
| LOW | scripts/gen-skype-sounds.py | 75 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/docker/agent-computer-cumora-web.sh | 9 | # Usage: | COMMENT |